Purpose
Configuration determines how systems actually behave. A secure design can be undermined by exposed services, default credentials, excessive permission, unsafe protocols, missing logging, or drift.
Core practices
- Approved secure baselines
- Automated provisioning and policy where practical
- Documented exceptions and ownership
- Drift detection and reconciliation
- Change control and rollback
- Inventory of versions, settings, and dependencies
- Periodic validation against risk and operating need
Configuration versus patching
Patching changes software to address defects. Configuration management governs settings and state. Both matter, and either can create or reduce exposure.
Evidence
Strong programs can show what should be configured, what is actually configured, who changed it, why the change occurred, and whether the result was verified.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: