ISO 27001 A.8.9 - Configuration Management

Requirement

“Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed.”

Plain-language meaning

The organization should define what secure and acceptable configuration looks like, apply it, monitor whether systems stay aligned to it, and review exceptions. If approved configuration is not defined, unauthorized changes and insecure defaults are hard to detect.

Configuration management is not only asset inventory. It includes hardening baselines, secure settings, exception handling, drift monitoring, alert resolution, and risk-based justification where a standard cannot be followed.

Why this matters

Misconfigurations are a major cause of breaches and outages. Weak settings, exposed services, insecure certificates, disabled logging, excessive permissions, open ports, default accounts, or inconsistent hardening can create avoidable risk.

A known baseline makes deviation visible. Without it, the organization cannot reliably distinguish approved change, accidental drift, and malicious alteration.

Implementation guidance

1. Establish configuration baselines

Baselines should cover relevant:

• servers;
• endpoints;
• network devices;
• cloud services;
• databases;
• applications;
• security tools;
• identity platforms;
• logging and monitoring components.

External baselines from vendors, manufacturers, or security bodies can help, but they usually require local tailoring.

2. Document local deviations

Some recommended settings may not be practical because of business, compatibility, supplier, or operational needs. Deviations should be supported by business case and risk assessment.

3. Implement and enforce configurations

Automation is usually lower risk for consistency, but it can create operational impact if applied blindly. Use automation where practical and focus attention on edge cases, exceptions, and critical systems.

4. Monitor configuration drift

Compare systems against approved baselines regularly or continuously. Drift may indicate malicious change, accidental change, unauthorized troubleshooting, or well-intentioned but uncontrolled modification.

5. Link alerts to incident and change management

Configuration alerts should have owners, escalation, resolution, and linkage to change/incident processes. Too many unmanaged alerts become background noise and stop being useful.

Audit guidance

Auditors should verify:

• configuration standards/baselines;
• scope of systems covered by each baseline;
• configuration implementation evidence;
• exception/deviation records with risk justification;
• compensating controls for deviations;
• configuration validation records;
• monitoring frequency and rationale;
• alert escalation and resolution records;
• linkage to change and incident management.

For exceptions, ask what risk is created by not applying the baseline and what compensating control reduces that risk.

Evidence examples

Strong evidence

• Baselines exist for major technology types.
• Systems are mapped to applicable baselines.
• Compliance is checked regularly or continuously.
• Exceptions include risk rationale and compensating controls.
• Drift alerts are investigated and closed.
• Baselines are reviewed when threats, standards, or platforms change.

Weak evidence

• Vendor baseline is referenced but not tailored.
• Only some systems are checked without rationale.
• Exceptions exist informally.
• Configuration alerts are ignored due to volume.
• Baselines are documented but not implemented.
• No evidence links configuration changes to change control.

Common failures

Exam traps

Related controls and concepts

• A.8 Technological Controls MOC
• A.8.8 Management of Technical Vulnerabilities
• Monitoring activities
• A.5.37 Documented Operating Procedures
• A.5.36 Compliance with Policies, Rules and Standards for Information Security
• Risk Assessment
• Statement of Applicability
• Configuration Baseline Register
• Configuration Exception and Risk Acceptance Record
• Configuration Compliance Review Checklist
• Configuration Drift Alert Review Record
• A.8.9 Audit Evidence Pack
• A.8.9 Audit Checklist

KB-ready summary

• Establish secure configuration baselines.
• Map systems to applicable baselines.
• Implement and monitor baseline compliance.
• Justify and review exceptions.
• Resolve configuration drift through change or incident processes.

Templates and checklists

• Configuration Baseline Register
• Configuration Exception and Risk Acceptance Record
• Configuration Compliance Review Checklist
• Configuration Drift Alert Review Record
• A.8.9 Audit Checklist