What it covers. NIST guidance on managing configurations with security in mind. It covers planning, identifying and implementing secure baseline configurations, controlling changes and monitoring systems for deviation from baselines. It builds on the configuration management controls of SP 800-53 and applies to any type of system.
In practice. Applying it well means defining secure baselines for each system type, often from recognised benchmarks, applying them consistently through automation and controlling changes with security impact analysis. Systems are monitored for drift and deviations are corrected or approved. Evidence includes baselines, change records and compliance scan results.
Common gaps. Typical gaps are baselines that exist only for some platforms, manual changes outside change control and no detection of configuration drift. Baselines also tend to go out of date when platforms change. Changes made during incidents are often not documented afterwards.