3.4.2—Configuration Management - Basic
>Control Description
>Discussion
Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture or functionality of the system. Information technology products for which security-related configuration settings can be defined include mainframe computers, servers, workstations, input and output devices (e.g., scanners, copiers, and printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications. Security parameters are those parameters impacting the security state of systems including the parameters required to satisfy other security requirements.
Security parameters include: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the systems configuration baseline.
Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations including information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors. [SP 800-70] and [SP 800-128] provide guidance on security configuration settings.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern security configuration settings for IT products?
- •What is the source for security configuration benchmarks (CIS, DISA)?
- •How often are security settings reviewed and updated?
- •Who approves security configuration standards?
- •What procedures address configuration deviations or exceptions?
Technical Implementation:
- •How do you implement and enforce security configuration settings?
- •What tools apply security hardening baselines (GPO, MDM, SCCM)?
- •What automated scanning assesses security configuration compliance?
- •How do you remediate systems not meeting security settings?
- •What mechanisms prevent unauthorized configuration changes?
Evidence & Documentation:
- •Can you provide security configuration benchmarks applied?
- •What scan results show security configuration compliance?
- •Can you demonstrate hardening settings implementation?
- •What evidence shows security configurations are enforced?
- •What audit findings track security setting deviations?
Ask AI
Configure your API key to use AI features.