ISO 27001 8.9 Configuration Management

Requirement

"Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed."[1]

Explanation

Create baseline configurations for each type of system component used in your company. Baseline configurations specify how a particular device such as a Windows computer should be configured. This includes documenting the default software to be installed on a system and its security settings. You need to establish baseline configurations for computers servers network devices software (operating systems) and printers. Periodically review and update your baseline configurations to reflect any new operational requirements.

References

  1. ISO/IEC 27001

Need help putting this into practice? See our ISO 27001 compliance services or read our ISO 27001 articles.

See LakeRidge in action.

Talk with our team about your framework, your gaps, and the right plan.

Get a demo

See LakeRidge in action.

Loading the booking calendar…