[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-9":3},{"item":4,"lessons":16,"controls":42,"related":69},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-9","Annex A 8.9","ISO\u002FIEC 27001:2022 Annex A 8.9: Configuration management",6,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects configurations, including security configurations, of hardware, software, services and networks to be established, documented, implemented, monitored and reviewed. The aim is to make sure hardware, software, services and networks work correctly with the required security settings and are not altered by unauthorised or incorrect changes.\n\n**In practice.** Good practice means defining secure baseline configurations for each type of system, often based on vendor guidance or recognised benchmarks, and applying them through templates or automation. Changes follow change management, and systems are checked for drift from the baseline. Auditors expect documented baselines, records of configuration changes and evidence of compliance checks.\n\n**Common gaps.** Typical gaps are baselines only for servers, not for cloud services or network devices, and default settings left in place on new systems. Configuration of SaaS administration settings is often overlooked entirely.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38],{"slug":19,"title":20,"published_at":21},"default-credentials-expose-220-million-traveler-records-in-apis-database-leak","Default Credentials Expose 220 Million Traveler Records in APIS Database Leak","2026-09-08T08:20:36.011+00:00",{"slug":23,"title":24,"published_at":25},"trojanized-haproxy-builds-used-to-hide-north-korean-backdoor","Trojanized HAProxy Builds Used to Hide North Korean Backdoor","2026-09-04T16:20:41.753+00:00",{"slug":27,"title":28,"published_at":29},"brazil-sisvisa-health-database-left-79gb-of-sensitive-records-publicly-exposed","Brazil SISVISA Health Database Left 79GB of Sensitive Records Publicly Exposed","2026-08-05T12:21:52.305+00:00",{"slug":31,"title":32,"published_at":33},"anthropics-ai-escapes-sandbox-due-to-misconfigured-test-environment","Anthropic's AI Escapes Sandbox Due to Misconfigured Test Environment","2026-07-31T02:20:45.599+00:00",{"slug":35,"title":36,"published_at":37},"orange-romania-fined-100k-after-app-misconfigurations-expose-customer-data","Orange Romania Fined €100K After App Misconfigurations Expose Customer Data","2026-07-28T14:21:44.114+00:00",{"slug":39,"title":40,"published_at":41},"bootrom-exploit-bypasses-apple-secure-boot-on-millions-of-iphones","BootROM Exploit Bypasses Apple Secure Boot on Millions of iPhones","2026-06-22T12:21:27.603+00:00",[43,48,52,57,61,65],{"slug":44,"name":45,"problem":46,"stories":47},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",3,{"slug":49,"name":50,"problem":51,"stories":47},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":53,"name":54,"problem":55,"stories":56},"breach-attack-simulation","Breach and attack simulation","You only find out whether your security tools stop an attack when a real attacker tries.",1,{"slug":58,"name":59,"problem":60,"stories":56},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":62,"name":63,"problem":64,"stories":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":66,"name":67,"problem":68,"stories":56},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[70,76,81,85,90,94,99,103],{"family":71,"item":72,"code":73,"title":74,"together":75},"cis","4","Control 4","Secure Configuration of Enterprise Assets and Software",5,{"family":77,"item":78,"code":79,"title":79,"together":80},"itil","overview","ITIL",4,{"family":71,"item":82,"code":83,"title":84,"together":80},"12","Control 12","Network Infrastructure Management",{"family":86,"item":87,"code":88,"title":89,"together":80},"nist-800-53","cm-6","CM-6","Configuration Settings",{"family":86,"item":91,"code":92,"title":93,"together":80},"sc-7","SC-7","Boundary Protection",{"family":95,"item":96,"code":97,"title":98,"together":47},"gdpr","32","Article 32","Security of processing",{"family":86,"item":100,"code":101,"title":102,"together":47},"ac-3","AC-3","Access Enforcement",{"family":71,"item":104,"code":105,"title":106,"together":47},"6","Control 6","Access Control Management"]