What it asks for. This control expects configurations, including security configurations, of hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. The aim is to make sure hardware, software, services and networks work correctly with the required security settings and are not altered by unauthorised or incorrect changes.
In practice. Good practice means defining secure baseline configurations for each type of system, often based on vendor guidance or recognised benchmarks, and applying them through templates or automation. Changes follow change management, and systems are checked for drift from the baseline. Auditors expect documented baselines, records of configuration changes and evidence of compliance checks.
Common gaps. Typical gaps are baselines only for servers, not for cloud services or network devices, and default settings left in place on new systems. Configuration of SaaS administration settings is often overlooked entirely.