6.3.3 The relevant entities shall review and, where appropriate, update configurations at planned …

Requirement

The relevant entities shall review and, where appropriate, update configurations at planned intervals or when significant incidents or significant changes to operations or risks occur.

Guidance

• Review and, where appropriate update (53) configurations at least monthly to ensure that patches have been applied, that the backup has been executed according to the plan and that monitoring is in place to identify and alert to fatal server/device/disk errors without delay.
• Regularly produce, keep and review change logs regarding the security configuration of information systems.
• Review and update the configurations after major changes (e.g. software updates) and past incidents.
• Where feasible, obtain baseline configuration files for key systems and devices to compare against current configurations.

Examples of evidence

• Up-to-date configuration management plan, review comments and/or change logs.
• Documented results of the review activities.
• Configuration snapshots taken before and after changes or at regular intervals to verify that reviews are conducted and documented.
• Audit logs from systems and devices that track configuration changes and reviews.
• Alerts from monitoring systems that notify administrators of unexpected configurations or changes or deviations from the baseline in critical systems.
• Audit trails and compliance records from internal and external audits.
• Minutes from team meetings where configuration reviews and changes are discussed and documented.
• Records of notifications or reminders sent to relevant employees about upcoming configuration reviews.
• Records from the configuration management tools to ensure they are kept up to date with accurate configuration information.
• Incident response records that confirm whether the entity takes into account incidents related the configurations.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

3. Свързани регулации

Свързани задачи

• ENISA -