Control A.8.9Configuration management
Configurations, including security configurations, of hardware, software, services and networks must be established, documented, implemented, monitored and reviewed.
New in the 2022 edition and arguably the control with the widest reach, because misconfiguration causes more incidents than unpatched software does.
Five verbs: configurations must be established as defined baselines, documented so they are knowable, implemented consistently, monitored so drift is visible, and reviewed as requirements change.
The monitoring step is what distinguishes this from a build standard. Systems drift — through incident response, through troubleshooting, through changes made under pressure — and a baseline nobody checks describes the estate as it was built rather than as it runs.
Cloud services are where this control does the most work and where the surface is largest: storage permissions, network rules, identity configuration and logging settings are all configuration, they change from a console in seconds, and the defaults are frequently not what the organisation would choose.
How to put this in place
Systems left on default or hand-tuned settings are inconsistent and often insecure. Your ISMS needs defined secure settings and a way to notice when systems depart from them.
- Choose the system types in scope, including cloud services.
- Write a secure baseline for each, starting from a published benchmark.
- Apply it through automation or build images where you can.
- Detect drift and correct it, recording approved departures.
- Change the baseline only through your change process, and review it on a schedule.
Evidence an auditor usually looks for: the baselines, compliance reports against them, and drift alerts with the fixes.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists approved baseline configurations among the documents auditors commonly expect for this control.