Skip to main content
Cyber Risk Council
Category: Vulnerability & Exposure Management

Configuration Management

Also known as: CM, Configuration Management (CM)
Simply put

Configuration management is a process for keeping computer systems, servers, and software in a desired, consistent state throughout their life. It establishes and maintains consistency in how a product performs and functions, and it provides structured methods for controlling changes to those systems over time.

Formal definition

Configuration management (CM) is a systems engineering and management process for establishing and maintaining the consistency of a product's performance, functional, and physical attributes throughout its lifecycle. It applies defined methodologies, systems, and procedures to control the elements of the change process and to maintain systems in a known, desired state. In practice, CM overlaps with change, release, and asset management disciplines; its effectiveness depends on documented baselines, controlled change procedures, and consistent enforcement across the environment.

Why it matters

Configuration management underpins the reliability and security of an organization's technology environment by ensuring systems remain in a known, desired, and consistent state throughout their lifecycle. When configurations drift from established baselines through undocumented changes, environments become unpredictable, harder to troubleshoot, and more difficult to secure. A well-run configuration management process gives an organization confidence that it understands how its systems are supposed to perform, function, and be assembled, and that changes to those systems follow controlled procedures rather than ad hoc adjustments.

From a security leadership perspective, configuration management is closely tied to governance and risk rather than being a purely technical concern. Consistent, documented baselines make it possible to detect deviations, enforce standards, and demonstrate that changes are managed deliberately. Because its effectiveness depends on documented baselines, controlled change procedures, and consistent enforcement across the environment, weaknesses in any of these areas can leave gaps that raise operational and security risk. Configuration management overlaps with change, release, and asset management disciplines, so its value is often realized in combination with those adjacent practices rather than in isolation.

A common expert-level correction is that configuration management is a management and systems engineering process, not simply the act of installing tools. Automation and tooling can support it, but the discipline itself is defined by methodology, systems, and procedures for controlling the elements of the change process. Treating it as a checkbox or a one-time setup, rather than an ongoing lifecycle process, is a frequent mistake that undermines the consistency the practice is meant to deliver.

Who it's relevant to

Security and Technology Leaders
Virtual and fractional security leaders often assess and guide configuration management as part of broader governance and risk oversight. Because it advises and directs rather than assumes operational ownership, leadership typically focuses on ensuring documented baselines, controlled change procedures, and consistent enforcement exist, while accountability for maintaining systems generally remains with the client organization and its operational teams.
IT Operations and Systems Engineering Teams
The teams responsible for maintaining computer systems, servers, and software rely on configuration management to keep those assets in a desired, consistent state. They apply the defined methodologies, systems, and procedures that control the elements of the change process and carry out the hands-on work of maintaining and enforcing baselines across the environment.
Change and Release Management Functions
Because configuration management overlaps with change, release, and asset management disciplines, functions responsible for controlling changes depend on it to ensure modifications are made against a known baseline and follow structured, controlled procedures rather than ad hoc adjustments.
Governance, Risk, and Compliance Stakeholders
Stakeholders concerned with governance and risk benefit from configuration management because documented baselines and controlled change procedures provide evidence that systems are maintained deliberately and consistently. The value they realize depends on organizational maturity and the consistency with which the process is enforced.

Inside CM

Configuration Baseline
A documented, approved reference state for a system, application, or device that defines its intended settings. Baselines give a virtual CISO a benchmark against which drift and unauthorized changes can be measured, though establishing them depends on the client organization providing accurate asset and system information.
Configuration Items (CIs)
The individual hardware, software, network, and system components tracked under configuration management. Defining what qualifies as a CI and maintaining an accurate inventory is typically a responsibility of the client's operational teams; a vCISO advises on scope and governance rather than performing the inventory work directly.
Change Control and Approval
The governance process by which proposed configuration changes are reviewed, approved, and documented. A virtual CISO often helps design or improve this process at a policy and governance level, but the execution of changes generally remains an operational task outside the typical vCISO scope unless explicitly contracted.
Configuration Drift Detection
The identification of deviations between the current state and the approved baseline. Detection typically relies on tooling administered by operational staff; a vCISO may advise on requirements and interpret findings in a risk context rather than administer the tools.
Secure Configuration Standards
Hardening guidelines that define secure settings for systems, often mapped to frameworks such as NIST CSF or ISO 27001 or supporting readiness for SOC 2, PCI DSS, or similar. These frameworks describe control objectives; configuration management practices can support compliance readiness but do not by themselves guarantee certification.
Documentation and Audit Trail
Records of configuration states, changes, and approvals that support accountability and evidence for audits. While a vCISO may advise on what documentation is needed, legal and organizational accountability for maintaining accurate records typically remains with the client and its officers.

Common questions

Answers to the questions practitioners most commonly ask about CM.

Does a virtual CISO handle the hands-on configuration management work, like actually hardening servers and administering tools?
Typically no. A virtual CISO advises on and directs configuration management as part of a broader governance and risk program, defining policy, recommending baselines, and setting expectations for how configurations should be controlled and reviewed. The hands-on execution, such as applying hardening settings, administering tools, or maintaining a configuration management database, generally falls to internal IT and security operations staff or a contracted managed service provider. If operational configuration work is expected, it should be explicitly written into the engagement scope, since it is often out of scope for a standard vCISO arrangement.
Isn't configuration management primarily a technical IT task rather than something a security leadership function cares about?
It is a common mistake to treat configuration management as purely technical. While the implementation is technical, the discipline sits at the intersection of governance, risk, and change management. A virtual CISO is generally concerned with whether configuration baselines exist, whether they align with business risk tolerance, whether changes are controlled and documented, and whether drift is detected and addressed. In that sense it is a business risk and governance concern as much as a technical one, and framing it only as an IT chore tends to leave accountability and oversight gaps.
How would a virtual CISO help us get started with configuration management if we have little in place today?
In many engagements a virtual CISO begins by assessing the current state, what assets exist, whether any baselines or standards are documented, and how changes are currently made. From there they typically help prioritize based on risk, recommend an approach for establishing secure baselines, and define policy and process for controlling changes. The value and pace of this work depend heavily on organizational maturity, access to stakeholders, and internal cooperation, since the vCISO directs and advises but relies on client teams to implement.
How does configuration management relate to the frameworks we may be assessed against, such as NIST CSF or ISO 27001?
Configuration management is addressed within several common frameworks and standards, which generally expect organizations to establish and maintain secure baseline configurations and to control changes to them. A virtual CISO can help map your configuration management practices to the relevant expectations and support readiness for an assessment or certification. It is important to distinguish supporting readiness from asserting certification, the vCISO helps prepare and align practices, but formal certification or attestation is determined by an independent auditor or certifying body, not by the engagement itself.
Who is accountable for configuration decisions once a virtual CISO is advising us?
Responsibility for advising on and directing configuration management may rest with the virtual CISO, but legal and organizational accountability for security decisions usually remains with the client organization and its officers. The vCISO recommends baselines, policies, and controls, and may direct how work is prioritized, but the organization retains ownership of the decisions and their consequences unless a contract specifies otherwise. Clarifying this division of responsibility and accountability early helps avoid confusion during audits, incidents, or change reviews.
How do we keep configurations from drifting over time once baselines are set?
Preventing drift typically involves defining approved baselines, controlling changes through a documented process, and periodically reviewing configurations against those baselines to detect deviations. A virtual CISO can help establish the policy and cadence for this review and recommend how detected drift should be triaged and remediated. The ongoing detection and correction work is generally carried out by operational teams or tooling, so sustained effectiveness depends on client resources, defined ownership, and consistent execution rather than on the vCISO's involvement alone.

Common misconceptions

A virtual CISO will personally manage and administer configuration management tooling and apply system changes.
In most engagements a vCISO provides strategy, governance, and oversight for configuration management rather than performing hands-on tool administration or change execution. Those operational tasks generally fall outside typical vCISO scope unless a contract explicitly includes them.
Configuration management is purely a technical, IT-operations activity with no governance dimension.
Configuration management is both an operational discipline and a governance concern. A vCISO treats it as a risk and governance function, defining policy, baselines, and change control expectations, while recognizing that the technical implementation depends on operational teams and organizational maturity.
Strong configuration management guarantees compliance or certification against standards such as ISO 27001, SOC 2, or PCI DSS.
Configuration management can support readiness for these frameworks, but it does not by itself assure compliance or certification. Certification depends on formal assessment, broader controls, and client cooperation, and a vCISO engagement supports readiness rather than asserting certified status.

Best practices

Establish and document approved configuration baselines for critical systems so drift and unauthorized changes can be measured against a defined reference state.
Maintain an accurate inventory of configuration items, clarifying which teams own the inventory work versus where the vCISO provides governance and scope guidance.
Define change control and approval processes as governance requirements, keeping clear separation between the vCISO's advisory role and the operational execution of changes.
Map secure configuration standards to relevant frameworks such as NIST CSF or ISO 27001 to support compliance readiness, without overstating them as guarantees of certification.
Retain documentation and audit trails of configuration states and approved changes, while recognizing that accountability for maintaining these records typically remains with the client organization.
Scope configuration management responsibilities explicitly in the engagement agreement so both parties understand what is included, what is out of scope, and where value depends on client cooperation and organizational maturity.