Control A.8.9Configuration management
What it means in practice
Configurations, including security configurations, of hardware, software, services and networks must be established, documented, implemented, monitored and reviewed.
New in the 2022 edition and arguably the control with the widest reach, because misconfiguration causes more incidents than unpatched software does.
Five verbs: configurations must be established as defined baselines, documented so they are knowable, implemented consistently, monitored so drift is visible, and reviewed as requirements change.
The monitoring step is what distinguishes this from a build standard. Systems drift — through incident response, through troubleshooting, through changes made under pressure — and a baseline nobody checks describes the estate as it was built rather than as it runs.
Cloud services are where this control does the most work and where the surface is largest: storage permissions, network rules, identity configuration and logging settings are all configuration, they change from a console in seconds, and the defaults are frequently not what the organisation would choose.
How to put this in place
Systems left on default or hand-tuned settings are inconsistent and often insecure. Your ISMS needs defined secure settings and a way to notice when systems depart from them.
- Choose the system types in scope, including cloud services.
- Write a secure baseline for each, starting from a published benchmark.
- Apply it through automation or build images where you can.
- Detect drift and correct it, recording approved departures.
- Change the baseline only through your change process, and review it on a schedule.
Evidence an auditor usually looks for: the baselines, compliance reports against them, and drift alerts with the fixes.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists approved baseline configurations among the documents auditors commonly expect for this control. - Excel
Vulnerability Scanner Configuration Review Checklist
in Vulnerability & Exposure ManagementIts Framework References list this control. Supported by: Areas 2, 6 and 9. - Excel
Generative AI Deployment Configuration Checklist
in Generative AI SecurityIts Framework References list this control. Supported by: The whole checklist: the configuration of the AI service is defined, recorded, checked and reviewed.