Configuration management

Plain-language summary

New in 2022: setting secure, documented configurations for hardware, software, cloud services and networks, applying them consistently, keeping them under change control and checking regularly that nothing has drifted — so systems stay as hardened as you intended.

What the clause is really asking

Many incidents come from settings rather than software flaws: a default password left on a router, a cloud storage area made public, an admin interface exposed to the internet, logging switched off. The control asks you to define standard configurations, including security settings, for the types of asset you run — laptops, servers, firewalls, switches, cloud tenants, key applications — usually starting from recognised hardening guidance such as CIS Benchmarks or vendor security baselines. Configurations are documented, applied through templates or management tools, changed only through change management, monitored for drift, and reviewed periodically as threats and versions change. The guidance expects a configuration record for each asset, with an owner and the date of the last change. The common misunderstanding is that a well-run MSP means this is covered. It may be, but you still need to see the baseline, agree it fits your risk, and get evidence that it is applied. For cloud platforms such as Microsoft 365, the vendor's security score dashboard is a useful starting point, not proof of compliance on its own.

What auditors look for

Auditors ask for the configuration baselines for each asset type and who approved them. They then compare a sample of real assets against the baseline — a laptop's settings in the management console, a firewall's rule set and admin settings, the cloud tenant's security configuration — and ask how deviations are detected and corrected. They pick a recent configuration change and trace it through change management. They look for default passwords, unused services and admin interfaces open to the internet. The hard question: how do you know that the configuration on your firewall today is the one you approved?

Typical evidence

Configuration management procedure; approved baseline configurations or hardening standards per asset type; references to the hardening guidance used and recorded deviations; configuration records per asset with owner and date of last change; configuration compliance or drift reports from management tools; cloud tenant posture or security score reports; change records for configuration changes; baseline review records.

How to comply — recommendations

Pick your asset types — Windows laptops, servers, firewall, switches, the Microsoft 365 or Google tenant, the ERP — and for each adopt a published baseline such as a CIS Benchmark or the vendor's security baseline, recording where you deviate and why. Apply baselines through tools rather than by hand: Intune or Group Policy profiles for endpoints, configuration templates for network devices, policy settings in the cloud tenant. Back up every network device configuration and compare it monthly with the previous version. Review the cloud tenant's security score monthly and treat new recommendations as proposed changes. Route every configuration change through change management. Review baselines annually or when a major version changes.

Common nonconformities

No defined secure baseline for servers, endpoints or network devices; default passwords or settings left on devices; configuration changes made outside change management; no means of detecting configuration drift; cloud tenant security settings never reviewed; MSP-managed baselines never seen or approved by the organisation; network device configurations not backed up.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.