Table of Contents
ISO 27001 Configuration Management
ISO 27001 Annex A 8.9 Configuration Management is an ISO 27001 control that looks to make sure you have configured software and hardware, documented it and are monitoring and reviewing it.
The focus for this ISO 27001 Annex A Control is having standard, secure, configurations for software and hardware. As one of the ISO 27001 controls this is about having configurations in place and managing them.
Purpose
The purpose of Annex A 8.9 Configuration Management is to ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorised or incorrect changes.
Definition
The ISO 27001 standard defines Annex A 8.9 as:
Configurations, including security configurations, of hardware, software, services and networks should be established, documented, implemented, monitored and reviewed.
ISO 27001:2022 Annex A 8.9 Configuration Management
Watch the Tutorial
In the video ISO 27001 Configuration Management Explained – ISO27001:2022 Annex A 8.9 I show you how to implement it and how to pass the audit.
Implementation Guide
Document Configuration Management
My advice when starting out with configuration management is document before you implement, if you can. Work out what your secure configurations should be based on vendor advice, industry best practice and your own needs. It may that you can’t as you already have an environment in place and you are trying to retro fit, but if you can do it first, do it first.
We know when we purchase hardware and software that it just comes with the standard default set up. Clearly it has to be this way as they cannot account for every use case. This can include default passwords and things should be locked down and closed being left open.
To document it, if you can, get your hand on vendor or industry templates for the thing you are trying to secure. Sure, the actual configuration set up itself can be enough, but for belts and braces documenting it in templates allows a couple of other things to happen. It enables the change management cycle which includes the processes and steps for authorisation. With documentation you can show previous states and evidence that changes to configuration were effectively managed.
What to document
What kind of things can you consider in your templates and documentation? Well here are few of the common ones. Clearly access management and the use of admin accounts will be documented. You are going to remove or disable services that you do not need and document those. Clocks are going to be synchronised and the mechanism for that recorded. The requirement to remove default user names and passwords. You are also going to tie back to licensing to make sure you have licenses for the things you are configuring.
Configuration Changes
For changes you will follow your change management process. In that you will have records of configuration changes that show owners, what the change was, when it was changed, the version of the configuration or template and where needed the relation to other assets.
Configuration Monitoring and Review
Once that configuration is in place you are going to monitor those configurations and review them. Depending on how big and complex you are you may benefit from deploying tools. If you find that the configurations do not match your templates and requirements then you follow your corrective action and risk management processes.
How to pass the audit
Time needed: 2 hours
How to comply with ISO 27001 Annex A 8.9
- Have effective asset management and know what assets you have
Have an asset management process that includes an asset register.
- Document your configuration standards
Using templates and industry best practice you will document your configuration standards for each asset type.
- Configure your assets appropriately before use
Using the configuration standards that you have developed and approved you will configure your assets appropriately before you deploy them.
- Monitor your configurations
For all asset types you will monitor the configurations to ensure they continue to meet the standards that you have set.
- Review your configurations
On a periodic basis you will review your asset configurations to ensure they are in line with the standards that you have set.
- Take actions where configurations do not match the templates and standards you have set
If you identify that assets are not configured in line with the configuration standards you will take action and follow appropriate internal processes such as risk management and change control to rectify.
- Implement controls proportionate to the risk posed
The controls that you implement and the configuration standards you choose are based on your risk assessment and proportionate to that risk and your business needs.
- Keep records
For audit purposes you will keep records. Examples of the records to keep include changes, updates, monitoring, review and audits.
- Test the controls that you have to make sure they are working
Perform internal audits that include the testing of the controls to ensure that they are working.
Top 3 Mistakes People Make
The top 3 mistakes people make for ISO 27001 Annex A 8.9 are
1. Leaving configuration defaults in place
Leaving systems and hardware default configurations, especially user names and passwords, is the biggest mistake that we see.
2. You never check your configurations
Configuration management is not a one and done. Often we see that the actual configurations do not match the templates and standards that are documented. There are many reasons why this can happen. Do not assume you have configured and it works before the audit happens, check it. You may be surprised.
3. Your document and version control is wrong
Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.
ISO 27001 Annex A 8.9 FAQ
What is ISO 27001 Annex A 8.9 is an ISO 27001 control that requires an organisation to fully manage configurations of hardware, software, services and networks.
Responsibility for ISO 27001 Annex A 8.9 lies with the IT department.
Accountability for ISO 27001 Annex A 8.9 lies with senior management and leadership.
Ownership of ISO 27001 Annex A 8.9 lies with the head of IT.
The guidance on security controls from ISO 27001 Annex A 8.9 includes:
Restrict who has administrative accounts
Restrict the number of administrative accounts
Ensure that segregation of duty is implemented for those with administrative accounts
Disable any accounts or identities that are not used or required
Disable any services or features that are not used or required
Implement appropriate logging and monitoring
Implement clock synchronisation
Change default passwords and settings immediately before use and / or connecting to a network
Ensure auto account lock out and log outs are in place
The guidance on standard templates from ISO 27001 Annex A 8.9 includes:
Utilise templates and follow guidance from vendors
Where possible utilise industry best practice for templates such as the High Table ISO 27001 Templates
Subscribe to vendor, industry and specialist forums and communications
The guidance on Managing and Monitoring Configurations from ISO 27001 Annex A 8.9 includes:
Implement a configuration management process
Ensure that configurations are tested before they are put live
Keep records and version control of configurations
Regularly review configurations and document the review
Consider the use of software and tools for the deployment and monitoring of configurations
The following 27001 controls are relevant to ISO 27001 Annex A 8.9:
ISO 27001 Annex A 5.32 Intellectual Property Rights
Yes, ISO 27001 Annex A 8.9 is a new control. It was introduced in the 2022 update to the standard.
Example of common tools used for configuration management include:
Configuration management databases (CMDBs)
Configuration management software (CMS)
Version control systems
Deployment automation tools
The challenges of implementing configuration are directly proportionate to the number of devices and complexity of your setup. The more you have, the harder it is to manage.
ISO 27001 configuration management is the process of establishing, documenting, implementing, monitoring, and reviewing the configurations of hardware, software, services, and networks. This includes security configurations.
The benefits of implementing ISO 27001 configuration management include:
Reduced risk of a data breach
Reduced risk of unauthorised access
Reduced risk of information security incidents.
Compliance with laws and regulations for data and information security
Reduction in IT management and maintenance costs
Change management is about managing changes. Configuration management is about the setup of devices, software, services and networks. To implement configuration management will rely on change management to manage the changes to configurations.
ISO 27001 configuration management can be difficult to implement. The smaller you are the easier it will be. The larger and more complex you are, the harder it will be.
The costs will vary depending on the approach you take but they will be significant. Commons costs include:
The cost of IT staff
The cost of outsourcing
The cost of tools
Related ISO 27001 Controls
ISO 27001 Monitoring, Measurement, Analysis, Evaluation: Clause 9.1
ISO 27001 Change Management: Annex A 8.32
Further Reading
ISO 27001 Risk Treatment – Tutorial
ISO 27001 Change Management Policy Template
Get the Help of the ISO 27001 Ninja
Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.
Controls and Attribute Values
| Control type | Information security properties | Cybersecurity concepts | Operational capabilities | Security domains |
|---|---|---|---|---|
| Preventive | Availability | Protect | Secure Configuration | Protection |
| Integrity | ||||
| Confidentiality |
