A.8.9 Technological
Configuration management
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
The implementation guidance for this control is published in
ISO/IEC 27002:2022
and is not reproduced here. The structured attributes and the cross-walk
rationales below are derived facts and our own AI-authored analysis.
Mapped NIST 800-53 r5 controls (11)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CM-2mostlycovers — Both controls establish and maintain secure baseline configurations for systems and components throughout their lifecycle.
- CM-3mostlycovers — Both require formal change control processes and logging for all configuration modifications to hardware, software, and services.
- CM-6mostlycovers — Both mandate defining, applying, and periodically reviewing standardized secure configuration settings across organizational assets.
- CM-7partialaligns with — Both emphasize disabling or restricting unnecessary functions, services, and privileged accounts to reduce attack surface.
- CM-8partialaligns with — Both require maintaining accurate records of system components and their configuration relationships for accountability.
Aligned NIST CSF 2.0 outcomes (10)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- PR.PS-01fullcovers — The ISO control's mandate to define, enforce, record, and monitor secure configuration baselines for hardware, software, services, and networks directly implements the CSF outcome of establishing and applying configuration management practices.
- PR.PS-02mostlyaligns with — By requiring periodic review and update of standard templates when new threats, vulnerabilities, or software/hardware versions appear, the control ensures software is maintained and replaced in line with risk.
- PR.PS-03mostlyaligns with — The control's requirement to maintain and enforce secure hardware configurations throughout the asset lifecycle aligns with the CSF outcome of managing hardware commensurate with risk.
- ID.AM-08partialaligns with — Requiring configuration records, change logs, and owner information for every asset supports the CSF outcome of managing systems, hardware, software, services, and data throughout their life cycles.
- ID.RA-07partialaligns with — The control's requirement that configuration changes follow a formal change-management process and that deviations are assessed and corrected addresses the CSF outcome of managing changes and exceptions for risk impact.
Related OWASP ASVS 5.0 requirements (13)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V13.2.1mostlyaligns with — The ISO control's requirement to enforce secure baseline configurations on backend components and services directly supports the ASVS mandate that non-standard session mechanisms between backend elements must still be protected by documented, controlled communication settings.
- V13.2.2mostlyaligns with — Requiring recorded, monitored configurations for all backend services and APIs mirrors the ASVS expectation that every inter-component link (middleware, data stores, OS services) follows an approved, non-default security posture.
- V13.2.3mostlyaligns with — Mandating immediate replacement of vendor default credentials and restriction of privileged identities implements the same objective as the ASVS rule that service-to-service authentication must never rely on factory or default credentials.
- V13.2.4partialaligns with — Defining and maintaining allow-listed external resources within configuration templates aligns with the ASVS requirement to restrict outbound connections to only pre-approved destinations.
- V13.2.5partialaligns with — The ISO practice of restricting server-initiated requests to an approved allow-list of targets corresponds to the ASVS control that web or application servers must be configured with explicit outbound resource restrictions.
- V13.4.2partialaligns with — Periodic monitoring and automatic enforcement of secure configurations helps ensure debug modes and unnecessary services remain disabled in production, satisfying the intent of the ASVS requirement to disable debug features.
- V15.2.3partialaligns with — By disabling or restricting unnecessary functions and services through standard secure templates, the ISO control achieves the same goal as the ASVS rule that production environments must contain only required functionality.
Related weaknesses / CWE (108)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
CWE-1051←P →MCWE-11←P →MCWE-1112←P →PCWE-1125←P →MCWE-1188→MCWE-1190←P →MCWE-12←P →MCWE-1221←P →MCWE-1222←P →PCWE-1231←P →PCWE-1233←PCWE-1234←P →PCWE-1242←PCWE-1253←P →MCWE-1269←F →MCWE-1272→PCWE-1282←P →PCWE-1283←PCWE-1295→MCWE-1304←P →PCWE-1314←P →PCWE-1328←PCWE-1329←PCWE-1342←P →PCWE-1391←P →MCWE-1392→MCWE-1393→MCWE-1394→MCWE-15←F →MCWE-250→MCWE-258→MCWE-260→MCWE-276→MCWE-278←P →PCWE-282←PCWE-284→MCWE-344←P →MCWE-379→PCWE-427→PCWE-433→MCWE-453←P →MCWE-455←P →PCWE-471←P →PCWE-489→MCWE-520→MCWE-525←P →PCWE-529→PCWE-555←P →MCWE-6←P →MCWE-605←P →MCWE-65←PCWE-664←PCWE-665→MCWE-671←PCWE-69←P →PCWE-694←PCWE-732→MCWE-771←P
Why these map — AI rationale (under review)
- CWE-1051mostlyprevents — Configuration management directly addresses hard-coded network resource identifiers by enforcing externalized, version-controlled settings.
- CWE-11mostlyprevents — Configuration management directly requires disabling debug builds and removing diagnostic information from production releases.
- CWE-1125mostlyprevents — Configuration management directly limits unnecessary services, ports and features that enlarge the attack surface.
- CWE-1188mostlyprevents — Mandating secure baseline templates and immediate replacement of vendor defaults directly stops systems from being deployed with insecure factory settings that attackers can exploit.
- CWE-1190mostlyprevents — Configuration management enforces secure boot ordering and DMA enablement timing.
- CWE-12mostlyprevents — Configuration management directly requires proper configuration of error handling to avoid information disclosure.
- CWE-1221mostlyprevents — Configuration management enforces secure default values and parameter settings for hardware registers and IP modules.
- CWE-1253mostlyprevents — Configuration management can enforce correct fuse settings and prevent unauthorized changes that would leave the system in an insecure state.
- CWE-1269mostlyprevents — Configuration management directly prevents release of non-release builds by enforcing approved, documented configurations.
- CWE-1295mostlyprevents — Configuration management can disable debug flags, providing partial mitigation without covering the control's broader scope.
- CWE-1391mostlyprevents — Enforces secure baseline configurations that should remove default credentials, yet does not guarantee credential strength.
- CWE-1392mostlyprevents — The requirement to replace vendor default authentication information immediately after installation directly counters the use of default credentials that attackers commonly target.
- CWE-1393mostlyprevents — Configuration management processes typically enforce changing defaults during hardening.
- CWE-1394mostlyprevents — Enforces secure configuration baselines that should replace default keys.
- CWE-15mostlyprevents — Configuration management directly prevents external tampering with system settings.
- CWE-250mostlyprevents — The control explicitly calls for minimizing privileged identities and disabling unnecessary accounts, thereby reducing the number of processes that run with unnecessary privileges.
- CWE-258mostlyprevents — Configuration management processes would normally detect and correct insecure empty-password settings.
- CWE-260mostlyprevents — Configuration management processes can enforce removal of secrets from config files, but the control is broader.
- CWE-276mostlyprevents — Standard templates that restrict access to utility programs and host parameter settings prevent the assignment of overly permissive default permissions on critical resources.
- CWE-284mostlyprevents — Enforcing recorded, monitored, and deviation-corrected configurations limits an attacker’s ability to exploit improper access control by keeping systems in a known secure state.
- CWE-344mostlyprevents — Configuration management prevents use of hard-coded or invariant values by enforcing environment-specific settings.
- CWE-433mostlyprevents — Configuration management ensures correct server settings for content types but is broader than this specific weakness.
- CWE-453mostlyprevents — Configuration management enforces secure default values and prevents insecure initialization.
- CWE-489mostlyprevents — Configuration management can disable or remove debug features through hardened baselines.
- CWE-520mostlyprevents — Configuration management can enforce secure impersonation settings, but eliminating the weakness does not materially advance broader configuration governance.
- CWE-555mostlyprevents — Enforces secure configuration management, reducing the risk of plaintext secrets being stored in application config files.
- CWE-6mostlyprevents — Configuration management ensures session-ID length settings are correctly defined and maintained.
- CWE-605mostlyprevents — Configuration management can enforce and audit port-binding settings across systems.
- CWE-665mostlyprevents — Configuration management can enforce secure defaults and initialization settings but is not the primary control for code-level initialization.
- CWE-732mostlyprevents — By defining and enforcing secure permission settings in configuration templates, the control reduces the likelihood that critical resources receive incorrect permission assignments.
- CWE-1112partialmitigates — Configuration management records execution parameters, but does not guarantee completeness of documentation.
- CWE-1222partialmitigates — Configuration management can enforce fine-grained lock settings but does not guarantee hardware register granularity.
- CWE-1231partialmitigates — Configuration management can define and enforce lock-bit settings, but does not prevent runtime modification of the bit itself.
- CWE-1234partialmitigates — Configuration management can enforce secure debug settings, yet hardware-level lock bypass may still occur outside its scope.
- CWE-1272partialmitigates — Configuration management can embed secure-state-transition settings, yet does not guarantee data clearing.
- CWE-1282partialmitigates — Configuration management enforces immutable firmware and write-once settings, directly preventing unauthorized reprogramming of assumed-immutable data.
- CWE-1304partialprevents — Configuration management directly requires preserving and verifying hardware configuration state across power events.
- CWE-1314partialprevents — Configuration management enforces write-protection and integrity checks on parametric/sensor calibration data.
- CWE-1342partialmitigates — Configuration management can enforce CPU microcode versions and disable vulnerable speculative features.
- CWE-278partialprevents — Configuration management can define secure default permissions and prevent insecure inheritance during deployment or copy operations.
- CWE-379partialmitigates — Configuration management can enforce secure default permissions on temporary directories.
- CWE-427partialprevents — Configuration management can enforce approved search-path settings but does not inherently prevent the weakness.
- CWE-455partialmitigates — Configuration management ensures secure initialization settings and failure handling, directly mitigating non-exit on failed init.
- CWE-471partialmitigates — Configuration management ensures that values declared immutable remain under controlled change processes.
- CWE-525partialprevents — Configuration management can mandate secure browser cache settings across the estate.
- CWE-529partialprevents — Configuration management can enforce ACL file permissions but does not address the weakness directly.
- CWE-69partialmitigates — Secure baseline configurations can disable or restrict ADS features on Windows systems, reducing exposure without eliminating the underlying coding weakness.
- CWE-1233nonemitigates — Configuration management enforces lock-bit settings and prevents unauthorized hardware register changes.
- CWE-1242nonenone — Configuration management enforces documented, approved configurations, limiting undocumented hardware or firmware features.
- CWE-1283nonemitigates — Configuration management enforces integrity of boot-time registers and measurement data.
- CWE-1310nonenone — Configuration management ensures secure baseline configurations but does not mandate patching capability for immutable ROM.
- CWE-1313nonemitigates — Configuration management can mandate secure hardware settings that prevent activation of test/debug logic.
- CWE-1326nonenone — Configuration management can enforce secure boot settings but does not address the absence of an immutable hardware root.
- CWE-1328nonenone — Configuration management can enforce immutable or version-locked firmware images, limiting rollback risk.
- CWE-1329nonenone — Configuration management can track and flag unsupported components, yet does not address the underlying inability to update them.
- CWE-183nonenone — Configuration management can enforce validated input rules, yet does not directly address the design flaw of permissive lists.
- CWE-281nonenone — Configuration baselines can embed permission settings, indirectly reducing the chance of incorrect preservation.
- CWE-282nonemitigates — Configuration management includes maintaining correct ownership of system components and files.
- CWE-378nonemitigates — Configuration management can enforce secure defaults for temporary file permissions.
- CWE-547nonenone — Configuration management can externalize constants but does not directly address coding practice.
- CWE-61nonenone — Configuration management can enforce safe file-permission baselines that limit symlink abuse, but does not address the code flaw itself.
- CWE-65nonenone — Configuration management can enforce secure file-system settings that reduce the risk of unauthorized hard-link operations.
- CWE-664nonenone — Configuration management enforces lifecycle rules for resource creation, use and disposal.
- CWE-671nonenone — Configuration management provides the means for administrators to tailor security settings and harden the product.
- CWE-694nonenone — Configuration management ensures unique identifiers are assigned and maintained across resources.
- CWE-708nonemitigates — Configuration baselines may specify ownership, but the control is broader and does not target ownership assignment errors.
- CWE-771nonenone — Configuration management can enforce proper tracking of allocated resources and their references.
- CWE-772nonenone — Configuration baselines can enforce resource limits or timeouts, indirectly reducing exposure to leaks.
- CWE-798nonenone — Requiring the change of default authentication credentials as part of the secure configuration template eliminates the use of hard-coded or factory passwords that are widely known.
Mitigated MITRE ATT&CK techniques (8)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1543mostlyprevents — Requiring documented, change-controlled configurations for system services and processes limits an adversary’s ability to create or modify persistent system-level processes without detection.
- T1569mostlyprevents — Templates that disable or tightly control system services and utilities constrain adversaries from leveraging service execution as a stealthy or persistent execution mechanism.
- T1053partialmitigates — Configuration baselines that restrict or disable unnecessary scheduled-task or cron capabilities reduce the attack surface for adversaries seeking to establish execution via scheduled jobs.
- T1059partialprevents — Enforcing minimal, hardened command interpreters and scripting environments limits the execution avenues available to adversaries who rely on interactive shells or scripting languages.
- T1078partialmitigates — Standard templates that minimize privileged identities and disable unused accounts shrink the pool of valid accounts an adversary can abuse for initial access or lateral movement.
- T1218partialmitigates — Baseline configurations that disable or restrict unnecessary binaries and system utilities reduce opportunities for adversaries to proxy malicious code through living-off-the-land binaries.
- T1548partialmitigates — Secure-configuration standards that restrict powerful utilities and privileged access rights hinder abuse of elevation-control mechanisms such as sudo caching or setuid binaries.
- T1552partialmitigates — Enforcing secure configuration templates that immediately replace vendor defaults and disable unnecessary accounts directly reduces the availability of unsecured credentials that adversaries can harvest from files, registries, or default accounts.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.