A default policy is the preset behavior a system uses when no administrator has explicitly chosen another setting. In managed environments, this often appears as Not Configured: the policy exists, but it has not been set to allow or block a feature. That distinction matters because “unset” does not always mean “disabled.”
In cyber security, default policies can shape the real security baseline for endpoints, cloud services, and identity systems. Attackers often benefit when organizations assume a default is safe, while defenders must watch for vendor changes that move features into a default-on state. A backup, sync, or remote access feature enabled by default can alter data exposure, compliance posture, and recovery behavior. Good administration means reviewing inherited settings, not just the policies that were manually changed.