ISO 27001 Annex A 8.9 Configuration Management

Home / ISO 27001 Annex A Controls / ISO 27001 Annex A 8.9 Configuration Management

ISO 27001 Configuration Management

The focus for this ISO 27001 Annex A Control is having standard, secure, configurations for software and hardware. As one of the ISO 27001 controls this is about having configurations in place and managing them.

You will learn what ISO 27001 Annex A 8.9 is, how to simply and easily implement it for ISO 27001 certification and I will show you some common gotchas so you can avoid them.

What is ISO 27001 Annex A 8.9 Configuration Management?

ISO 27001 Annex A 8.9 Configuration Management is an ISO 27001 control that looks to make sure you have configured software and hardware, documented it and are monitoring and reviewing it.

ISO 27001 Annex A 8.9 Purpose

The purpose of Annex A 8.9 Configuration Management is to ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorised or incorrect changes.

ISO 27001 Annex A 8.9 Definition

The ISO 27001 standard defines Annex A 8.9 as:

Configurations, including security configurations, of hardware, software, services and networks should be established, documented, implemented, monitored and reviewed.

ISO 27001:2022 Annex A 8.9 Configuration Management

DO IT YOURSELF ISO27001

Stop Spanking £10,000’s on Consultants and Platforms

ISO 27001 Toolkit Business Edition

ISO 27001 Annex A 8.9 Implementation Guide

Document Configuration Management

My advice when starting out with configuration management is document before you implement, if you can. Work out what your secure configurations should be based on vendor advice, industry best practice and your own needs. It may that you can’t as you already have an environment in place and you are trying to retro fit, but if you can do it first, do it first.

We know when we purchase hardware and software that it just comes with the standard default set up. Clearly it has to be this way as they cannot account for every use case. This can include default passwords and things should be locked down and closed being left open.

To document it, if you can, get your hand on vendor or industry templates for the thing you are trying to secure. Sure, the actual configuration set up itself can be enough, but for belts and braces documenting it in templates allows a couple of other things to happen. It enables the change management cycle which includes the processes and steps for authorisation. With documentation you can show previous states and evidence that changes to configuration were effectively managed.

What to document

What kind of things can you consider in your templates and documentation? Well here are few of the common ones. Clearly access management and the use of admin accounts will be documented. You are going to remove or disable services that you do not need and document those. Clocks are going to be synchronised and the mechanism for that recorded. The requirement to remove default user names and passwords. You are also going to tie back to licensing to make sure you have licenses for the things you are configuring.

Configuration Changes

For changes you will follow your change management process. In that you will have records of configuration changes that show owners, what the change was, when it was changed, the version of the configuration or template and where needed the relation to other assets.

Configuration Monitoring and Review

Once that configuration is in place you are going to monitor those configurations and review them. Depending on how big and complex you are you may benefit from deploying tools. If you find that the configurations do not match your templates and requirements then you follow your corrective action and risk management processes.

ISO 27001 Templates

ISO 27001 templates have the advantage of being a massive boost that can save time and money so before we get into the implementation guide we consider these pre written templates that will sky rocket your implementation. This ISO 27001 Toolkit has been specifically designed so you can DIY your ISO 27001 certification, build your ISMS in a week and be ISO 27001 certification ready in 30 days.

How to pass an audit ISO 27001 Annex A 8.9

Time needed: 2 hours

How to comply with ISO 27001 Annex A 8.9

  1. Have effective asset management and know what assets you have

    Have an asset management process that includes an asset register.

  2. Document your configuration standards

    Using templates and industry best practice you will document your configuration standards for each asset type.

  3. Configure your assets appropriately before use

    Using the configuration standards that you have developed and approved you will configure your assets appropriately before you deploy them.

  4. Monitor your configurations

    For all asset types you will monitor the configurations to ensure they continue to meet the standards that you have set.

  5. Review your configurations

    On a periodic basis you will review your asset configurations to ensure they are in line with the standards that you have set.

  6. Take actions where configurations do not match the templates and standards you have set

    If you identify that assets are not configured in line with the configuration standards you will take action and follow appropriate internal processes such as risk management and change control to rectify.

  7. Implement controls proportionate to the risk posed

    The controls that you implement and the configuration standards you choose are based on your risk assessment and proportionate to that risk and your business needs.

  8. Keep records

    For audit purposes you will keep records. Examples of the records to keep include changes, updates, monitoring, review and audits.

  9. Test the controls that you have to make sure they are working

    Perform internal audits that include the testing of the controls to ensure that they are working.

Top 3 Mistakes People Make for ISO 27001 Annex A 8.9

The top 3 mistakes people make for ISO 27001 Annex A 8.9 are

1. Leaving configuration defaults in place

Leaving systems and hardware default configurations, especially user names and passwords, is the biggest mistake that we see.

2. You never check your configurations

Configuration management is not a one and done. Often we see that the actual configurations do not match the templates and standards that are documented. There are many reasons why this can happen. Do not assume you have configured and it works before the audit happens, check it. You may be surprised.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 8.9 FAQ

What is ISO 27001 Annex A 8.9?

What is ISO 27001 Annex A 8.9 is an ISO 27001 control that requires an organisation to fully manage configurations of hardware, software, services and networks.

Who is responsible for ISO 27001 Annex A 8.9?

Responsibility for ISO 27001 Annex A 8.9 lies with the IT department.

Who is accountable for ISO 27001 Annex A 8.9?

Accountability for ISO 27001 Annex A 8.9 lies with senior management and leadership.

Who owns ISO 27001 Annex A 8.9?

Ownership of ISO 27001 Annex A 8.9 lies with the head of IT.

What is the ISO 27001 Annex A 8.9 Guidance on Security Controls?

The guidance on security controls from ISO 27001 Annex A 8.9 includes:
Restrict who has administrative accounts
Restrict the number of administrative accounts
Ensure that segregation of duty is implemented for those with administrative accounts
Disable any accounts or identities that are not used or required
Disable any services or features that are not used or required
Implement appropriate logging and monitoring
Implement clock synchronisation
Change default passwords and settings immediately before use and / or connecting to a network
Ensure auto account lock out and log outs are in place

What is the ISO 27001 Annex A 8.9 Guidance on Standard Templates?

The guidance on standard templates from ISO 27001 Annex A 8.9 includes:
Utilise templates and follow guidance from vendors
Where possible utilise industry best practice for templates such as the High Table ISO 27001 Templates
Subscribe to vendor, industry and specialist forums and communications

What is the ISO 27001 Annex A 8.9 Guidance on Managing and Monitoring Configurations?

The guidance on Managing and Monitoring Configurations from ISO 27001 Annex A 8.9 includes:
Implement a configuration management process
Ensure that configurations are tested before they are put live
Keep records and version control of configurations
Regularly review configurations and document the review
Consider the use of software and tools for the deployment and monitoring of configurations

What other ISO 27001 controls are relevant to ISO 27001 Annex A 8.9?

The following 27001 controls are relevant to ISO 27001 Annex A 8.9:
ISO 27001 Annex A 5.32 Intellectual Property Rights

Is ISO 27001 Annex A 8.9 a new control?

Yes, ISO 27001 Annex A 8.9 is a new control. It was introduced in the 2022 update to the standard.

What are some common tools and technologies used for configuration management?

Example of common tools used for configuration management include:
Configuration management databases (CMDBs)
Configuration management software (CMS)
Version control systems
Deployment automation tools

What are the challenges of implementing and maintaining configuration management?

The challenges of implementing configuration are directly proportionate to the number of devices and complexity of your setup. The more you have, the harder it is to manage.

What is ISO 27001 configuration management?

ISO 27001 configuration management is the process of establishing, documenting, implementing, monitoring, and reviewing the configurations of hardware, software, services, and networks. This includes security configurations.

What are the benefits of implementing ISO 27001 configuration management?

The benefits of implementing ISO 27001 configuration management include:
Reduced risk of a data breach
Reduced risk of unauthorised access
Reduced risk of information security incidents.
Compliance with laws and regulations for data and information security
Reduction in IT management and maintenance costs

What is the difference between ISO 27001 configuration management and change management?

Change management is about managing changes. Configuration management is about the setup of devices, software, services and networks. To implement configuration management will rely on change management to manage the changes to configurations.

How hard it is to implement ISO 27001 configuration management?

ISO 27001 configuration management can be difficult to implement. The smaller you are the easier it will be. The larger and more complex you are, the harder it will be.

How much will it cost to implement ISO 27001 configuration management?

The costs will vary depending on the approach you take but they will be significant. Commons costs include:
The cost of IT staff
The cost of outsourcing
The cost of tools

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Controls and Attribute Values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
PreventiveAvailabilityProtectSecure ConfigurationProtection
Integrity
Confidentiality

ISO 27001:2022 requirements

Organisational Controls - A5

ISO 27001 Annex A 5.1 Policies for information security

ISO 27001 Annex A 5.2 Information Security Roles and Responsibilities

ISO 27001 Annex A 5.3 Segregation of duties

ISO 27001 Annex A 5.4 Management responsibilities

ISO 27001 Annex A 5.5 Contact with authorities

ISO 27001 Annex A 5.6 Contact with special interest groups

ISO 27001 Annex A 5.7 Threat intelligence – new

ISO 27001 Annex A 5.8 Information security in project management

ISO 27001 Annex A 5.9 Inventory of information and other associated assets – change

ISO 27001 Annex A 5.10 Acceptable use of information and other associated assets – change

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.11 Return of assets

ISO 27001 Annex A 5.13 Labelling of information

ISO 27001 Annex A 5.14 Information transfer

ISO 27001 Annex A 5.15 Access control

ISO 27001 Annex A 5.16 Identity management

ISO 27001 Annex A 5.17 Authentication information – new

ISO 27001 Annex A 5.18 Access rights – change

ISO 27001 Annex A 5.19 Information security in supplier relationships

ISO 27001 Annex A 5.20 Addressing information security within supplier agreements

ISO 27001 Annex A 5.21 Managing information security in the ICT supply chain – new

ISO 27001 Annex A 5.22 Monitoring, review and change management of supplier services – change

ISO 27001 Annex A 5.23 Information security for use of cloud services – new

ISO 27001 Annex A 5.24 Information security incident management planning and preparation – change

ISO 27001 Annex A 5.25 Assessment and decision on information security events 

ISO 27001 Annex A 5.26 Response to information security incidents

ISO 27001 Annex A 5.27 Learning from information security incidents

ISO 27001 Annex A 5.28 Collection of evidence

ISO 27001 Annex A 5.29 Information security during disruption – change

ISO 27001 Annex A 5.31 Identification of legal, statutory, regulatory and contractual requirements

ISO 27001 Annex A 5.32 Intellectual property rights

ISO 27001 Annex A 5.33 Protection of records

ISO 27001 Annex A 5.34 Privacy and protection of PII

ISO 27001 Annex A 5.35 Independent review of information security

ISO 27001 Annex A 5.36 Compliance with policies and standards for information security

ISO 27001 Annex A 5.37 Documented operating procedures 

Technology Controls - A8

ISO 27001 Annex A 8.1 User Endpoint Devices

ISO 27001 Annex A 8.2 Privileged Access Rights

ISO 27001 Annex A 8.3 Information Access Restriction

ISO 27001 Annex A 8.4 Access To Source Code

ISO 27001 Annex A 8.5 Secure Authentication

ISO 27001 Annex A 8.6 Capacity Management

ISO 27001 Annex A 8.7 Protection Against Malware

ISO 27001 Annex A 8.8 Management of Technical Vulnerabilities

ISO 27001 Annex A 8.9 Configuration Management 

ISO 27001 Annex A 8.10 Information Deletion

ISO 27001 Annex A 8.11 Data Masking

ISO 27001 Annex A 8.12 Data Leakage Prevention

ISO 27001 Annex A 8.13 Information Backup

ISO 27001 Annex A 8.14 Redundancy of Information Processing Facilities

ISO 27001 Annex A 8.15 Logging

ISO 27001 Annex A 8.16 Monitoring Activities

ISO 27001 Annex A 8.17 Clock Synchronisation

ISO 27001 Annex A 8.18 Use of Privileged Utility Programs

ISO 27001 Annex A 8.19 Installation of Software on Operational Systems

ISO 27001 Annex A 8.20 Network Security

ISO 27001 Annex A 8.21 Security of Network Services

ISO 27001 Annex A 8.22 Segregation of Networks

ISO 27001 Annex A 8.23 Web Filtering

ISO 27001 Annex A 8.24 Use of CryptographyISO27001 Annex A 8.25 Secure Development Life Cycle

ISO 27001 Annex A 8.26 Application Security Requirements

ISO 27001 Annex A 8.27 Secure Systems Architecture and Engineering Principles

ISO 27001 Annex A 8.28 Secure Coding

ISO 27001 Annex A 8.29 Security Testing in Development and Acceptance

ISO 27001 Annex A 8.30 Outsourced Development

ISO 27001 Annex A 8.31 Separation of Development, Test and Production Environments

ISO 27001 Annex A 8.32 Change Management

ISO 27001 Annex A 8.33 Test Information

ISO 27001 Annex A 8.34 Protection of information systems during audit testing