ISO 27001 A.8.9 — Configuration management

What the control says

Configurations, including security configurations, of hardware, software, services and networks shall be established, documented, implemented, monitored and reviewed. That covers laptops, servers, cloud tenants, network devices and applications.

Theme: Technological · New in ISO 27001:2022

Why it matters

Configuration drift is invisible until it is exploited. A documented baseline gives you a reference point: without it, nobody can say whether a setting was always wrong or was changed last Tuesday.

Use the tooling you already pay for. Intune or Jamf baselines for endpoints, Microsoft Secure Score or your cloud provider's posture tooling for the tenant, and a short written baseline for anything managed by hand.

How to implement it

1. List the asset types that need a baseline: laptops, mobile devices, servers, cloud tenants, network equipment, and any key application.
2. Adopt a recognised starting point (CIS Benchmarks, Microsoft security baselines, vendor hardening guides) instead of writing baselines from scratch.
3. Record deliberate deviations with a reason and an approver — auditors accept documented exceptions, not undocumented ones.
4. Deploy the baselines via management tooling so new devices inherit them automatically.
5. Monitor for drift: compliance reports from Intune/Jamf, posture scores, or a periodic manual check for hand-managed kit.
6. Review baselines at least annually and after any significant platform change.

Evidence auditors ask for

• Documented baselines per asset type, with version and approval date
• Deployment evidence — device compliance reports or configuration profiles
• Drift or non-compliance reports plus what was done about the exceptions
• Exception register with reason, approver and review date
• Change records for baseline updates

Common findings

• Baselines documented but never applied — the policy says one thing, the device report says another.
• No coverage of cloud tenant configuration, only endpoints.
• Non-compliant devices visible in reports for months with no corrective action.
• Exceptions granted verbally, with nothing written down.

Related controls

• A.8.1 User endpoint devices
• A.8.8 Management of technical vulnerabilities
• A.8.19 Installation of software on operational systems
• A.8.32 Change management
• A.5.23 Information security for use of cloud services

See the full list of all 93 Annex A controls or start from the Statement of Applicability template.

FAQ