ISO 27001 Configuration Management

The focus for this ISO 27001 Annex A Control is having standard, secure, configurations for software and hardware. As one of the ISO 27001 controls this is about having configurations in place and managing them.

You will learn what ISO 27001 Annex A 8.9 is, how to simply and easily implement it for ISO 27001 certification and I will show you some common gotchas so you can avoid them.

What is ISO 27001 Annex A 8.9 Configuration Management?

ISO 27001 Annex A 8.9 Configuration Management is an ISO 27001 control that looks to make sure you have configured software and hardware, documented it and are monitoring and reviewing it.

ISO 27001 Annex A 8.9 Purpose

The purpose of Annex A 8.9 Configuration Management is to ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorised or incorrect changes.

ISO 27001 Annex A 8.9 Definition

The ISO 27001 standard defines Annex A 8.9 as:

Configurations, including security configurations, of hardware, software, services and networks should be established, documented, implemented, monitored and reviewed.

ISO 27001:2022 Annex A 8.9 Configuration Management

DO IT YOURSELF ISO27001

STOP SPANKING £10,000s

ISO 27001 Annex A 8.9 Implementation Guide

Document Configuration Management

My advice when starting out with configuration management is document before you implement, if you can. Work out what your secure configurations should be based on vendor advice, industry best practice and your own needs. It may that you can’t as you already have an environment in place and you are trying to retro fit, but if you can do it first, do it first.

We know when we purchase hardware and software that it just comes with the standard default set up. Clearly it has to be this way as they cannot account for every use case. This can include default passwords and things should be locked down and closed being left open.

To document it, if you can, get your hand on vendor or industry templates for the thing you are trying to secure. Sure, the actual configuration set up itself can be enough, but for belts and braces documenting it in templates allows a couple of other things to happen. It enables the change management cycle which includes the processes and steps for authorisation. With documentation you can show previous states and evidence that changes to configuration were effectively managed.

What to document

What kind of things can you consider in your templates and documentation? Well here are few of the common ones. Clearly access management and the use of admin accounts will be documented. You are going to remove or disable services that you do not need and document those. Clocks are going to be synchronised and the mechanism for that recorded. The requirement to remove default user names and passwords. You are also going to tie back to licensing to make sure you have licenses for the things you are configuring.

Configuration Changes

For changes you will follow your change management process. In that you will have records of configuration changes that show owners, what the change was, when it was changed, the version of the configuration or template and where needed the relation to other assets.

Configuration Monitoring and Review

Once that configuration is in place you are going to monitor those configurations and review them. Depending on how big and complex you are you may benefit from deploying tools. If you find that the configurations do not match your templates and requirements then you follow your corrective action and risk management processes.

ISO 27001 Templates

ISO 27001 templates have the advantage of being a massive boost that can save time and money so before we get into the implementation guide we consider these pre written templates that will sky rocket your implementation. This ISO 27001 Toolkit has been specifically designed so you can DIY your ISO 27001 certification, build your ISMS in a week and be ISO 27001 certification ready in 30 days.

How to pass an audit ISO 27001 Annex A 8.9

Time needed: 2 hours

How to comply with ISO 27001 Annex A 8.9

  1. Have effective asset management and know what assets you have

    Have an asset management process that includes an asset register.

  2. Document your configuration standards

    Using templates and industry best practice you will document your configuration standards for each asset type.

  3. Configure your assets appropriately before use

    Using the configuration standards that you have developed and approved you will configure your assets appropriately before you deploy them.

  4. Monitor your configurations

    For all asset types you will monitor the configurations to ensure they continue to meet the standards that you have set.

  5. Review your configurations

    On a periodic basis you will review your asset configurations to ensure they are in line with the standards that you have set.

  6. Take actions where configurations do not match the templates and standards you have set

    If you identify that assets are not configured in line with the configuration standards you will take action and follow appropriate internal processes such as risk management and change control to rectify.

  7. Implement controls proportionate to the risk posed

    The controls that you implement and the configuration standards you choose are based on your risk assessment and proportionate to that risk and your business needs.

  8. Keep records

    For audit purposes you will keep records. Examples of the records to keep include changes, updates, monitoring, review and audits.

  9. Test the controls that you have to make sure they are working

    Perform internal audits that include the testing of the controls to ensure that they are working.

Top 3 Mistakes People Make for ISO 27001 Annex A 8.9

The top 3 mistakes people make for ISO 27001 Annex A 8.9 are

1. Leaving configuration defaults in place

Leaving systems and hardware default configurations, especially user names and passwords, is the biggest mistake that we see.

2. You never check your configurations

Configuration management is not a one and done. Often we see that the actual configurations do not match the templates and standards that are documented. There are many reasons why this can happen. Do not assume you have configured and it works before the audit happens, check it. You may be surprised.

3. Your document and version control is wrong

Keeping your document version control up to date, making sure that version numbers match where used, having a review evidenced in the last 12 months, having documents that have no comments in are all good practices.

ISO 27001 Annex A 8.9 FAQ

What is ISO 27001 Annex A 8.9?

What is ISO 27001 Annex A 8.9 is an ISO 27001 control that requires an organisation to fully manage configurations of hardware, software, services and networks.

Who is responsible for ISO 27001 Annex A 8.9?

Responsibility for ISO 27001 Annex A 8.9 lies with the IT department.

Who is accountable for ISO 27001 Annex A 8.9?

Accountability for ISO 27001 Annex A 8.9 lies with senior management and leadership.

Who owns ISO 27001 Annex A 8.9?

Ownership of ISO 27001 Annex A 8.9 lies with the head of IT.

What is the ISO 27001 Annex A 8.9 Guidance on Security Controls?

The guidance on security controls from ISO 27001 Annex A 8.9 includes:
Restrict who has administrative accounts
Restrict the number of administrative accounts
Ensure that segregation of duty is implemented for those with administrative accounts
Disable any accounts or identities that are not used or required
Disable any services or features that are not used or required
Implement appropriate logging and monitoring
Implement clock synchronisation
Change default passwords and settings immediately before use and / or connecting to a network
Ensure auto account lock out and log outs are in place

What is the ISO 27001 Annex A 8.9 Guidance on Standard Templates?

The guidance on standard templates from ISO 27001 Annex A 8.9 includes:
Utilise templates and follow guidance from vendors
Where possible utilise industry best practice for templates such as the High Table ISO 27001 Templates
Subscribe to vendor, industry and specialist forums and communications

What is the ISO 27001 Annex A 8.9 Guidance on Managing and Monitoring Configurations?

The guidance on Managing and Monitoring Configurations from ISO 27001 Annex A 8.9 includes:
Implement a configuration management process
Ensure that configurations are tested before they are put live
Keep records and version control of configurations
Regularly review configurations and document the review
Consider the use of software and tools for the deployment and monitoring of configurations

What other ISO 27001 controls are relevant to ISO 27001 Annex A 8.9?

The following 27001 controls are relevant to ISO 27001 Annex A 8.9:
ISO 27001 Annex A 5.32 Intellectual Property Rights

Is ISO 27001 Annex A 8.9 a new control?

Yes, ISO 27001 Annex A 8.9 is a new control. It was introduced in the 2022 update to the standard.

What are some common tools and technologies used for configuration management?

Example of common tools used for configuration management include:
Configuration management databases (CMDBs)
Configuration management software (CMS)
Version control systems
Deployment automation tools

What are the challenges of implementing and maintaining configuration management?

The challenges of implementing configuration are directly proportionate to the number of devices and complexity of your setup. The more you have, the harder it is to manage.

What is ISO 27001 configuration management?

ISO 27001 configuration management is the process of establishing, documenting, implementing, monitoring, and reviewing the configurations of hardware, software, services, and networks. This includes security configurations.

What are the benefits of implementing ISO 27001 configuration management?

The benefits of implementing ISO 27001 configuration management include:
Reduced risk of a data breach
Reduced risk of unauthorised access
Reduced risk of information security incidents.
Compliance with laws and regulations for data and information security
Reduction in IT management and maintenance costs

What is the difference between ISO 27001 configuration management and change management?

Change management is about managing changes. Configuration management is about the setup of devices, software, services and networks. To implement configuration management will rely on change management to manage the changes to configurations.

How hard it is to implement ISO 27001 configuration management?

ISO 27001 configuration management can be difficult to implement. The smaller you are the easier it will be. The larger and more complex you are, the harder it will be.

How much will it cost to implement ISO 27001 configuration management?

The costs will vary depending on the approach you take but they will be significant. Commons costs include:
The cost of IT staff
The cost of outsourcing
The cost of tools

Get the Help of the ISO 27001 Ninja

Book your FREE 30 Minute ISO 27001 Strategy Call and let me show you how you can do it 30x cheaper and 10x faster that you ever thought possible.

Controls and Attribute Values

Control typeInformation
security properties
Cybersecurity
concepts
Operational
capabilities
Security domains
PreventiveAvailabilityProtectSecure ConfigurationProtection
Integrity
Confidentiality