Current configurations of devices, data systems and networks are documented and a log is maintained of configuration changes.
Changes to configurations must be controlled and go through the change management procedure. Only authorized personnel are allowed to make changes to the configurations.
Configuration information may include e.g.:
Organization must be able to monitor that devices, data systems and networks are maintained in accordance with the defined configurations (including security features) both during the implementation phase and throughout their entire life cycle.
For this, the organization has defined standard templates for secure configurations of devices, data systems and networks. When specifying standard templates, the following are taken into account:
Standard templates should be checked regularly and updated when significant new threats or vulnerabilities need to be responded to or new software or hardware versions are released.
The following points should be taken into account when defining standard templates:
Configurations should be monitored with comprehensive system management tools (e.g. maintenance utilities, remote support, enterprise management tools, backup and recovery software) and reviewed regularly to assess settings, password strengths, and operations performed. Actual configurations can be compared to defined target models. Any discrepancies must be dealt with either automatically or by manual processing.
Any unauthorized changes must be corrected and cause investigated and reported.