Configuration Management
What is Configuration Management?
A process for systematically managing, organizing, and controlling changes to system configurations to maintain integrity and traceability.
Terms that appear alongside configuration management
Each of these is named in at least one of the same controls as configuration management. The number is how many controls name both.
- baseline 29 shared controls
- change control 19 shared controls
- integrity 16 shared controls
- nist 15 shared controls
- policy 15 shared controls
- vulnerability 14 shared controls
- audit 13 shared controls
- remediation 13 shared controls
Frameworks that govern configuration management
What the standards actually require on configuration management
Requirements naming configuration management across 6 standards, quoted from the control text.
Establish the SecCM policy and procedures that address purpose, scope, roles, responsibilities, and compliance.
SP800-128-POLICY · Configuration Management Policy and Procedures →Requires a configuration management policy with supporting procedures to be developed, approved, disseminated to defined personnel, owned by a named official, and reviewed and updated on a defined frequency and after defined events.
NIST800-CM-1 · Policy and procedures for configuration management →Licensees must maintain configuration management for critical digital assets throughout their lifecycle.
RG5.71-C.6 · Configuration Management →Develop, document, implement configuration management plan addressing roles, processes, items under CM, identification scheme.
CM-9 · Configuration Management Plan →Manage and control system elements and configurations over the life cycle, preserving security-relevant configuration integrity.
SP800-160-TM-CONFIG · Configuration Management Process →Requires the developer or supplier to manage configuration of what they deliver, and to prove it.
161R1-SA-10 · Developer Configuration Management →Questions people ask about configuration management
What is Configuration Management?
Why is Configuration Management important for compliance?
Which compliance frameworks address Configuration Management?
Where can I learn more about Configuration Management?
See how Configuration Management applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.