+6.3 Configuration management
---+6.3.1 The relevant entities shall take the appropriate measures to establish, document, implement and …
---+6.3.2 For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in …
---+6.3.3 The relevant entities shall review and, where appropriate, update configurations at planned …

6.3 Configuration management

Mapping to standards and frameworks

ISO standard 27001:2022A.8.9
NIST Cybersecurity Framework v2.0PR.PS-01, ID.IM-01, ID.IM-02, ID.IM-03, ID.IM-04
ETSI Standard EN 319 401 V3.1.1REQ-6.3-08X, REQ-7.7-03, REQ-6.3-09X, REQ-7.7-08X, REQ-7.7-09X, REQ-7.7-10X
CEN/TS 18026:2024OPS-21, PSS-03, PSS-04
BE-CyFun®2023BASIC: PR.IP-4.1
IMPORTANT: ID.AM-3.2, PR.IP-1.1
ESSENTIAL: ID.SC-3.2, PR.DS-1.1, PR.IP-1.2, PR.IP-2.2, DE.CM-7.2
FI-KybermittariASSET-3, ASSET-4, ARCHITECTURE-3, ARCHITECTURE-4
EL- Ministerial decision 1689/2025Ministerial decision 1689/2025: articles 14a, 14b, 14c, 14d, 19h
Cybersecurity Handbook: Part B: 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.12, 2.15
Self-assessment tool: 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.12, 3.13
ENS-Royal Decree 311/2022Article 10, Article 20, Article 21, Article 30
Annex II: [op.exp.2] Security Configuration, [op.exp.3] Security Configuration Management
FR10.B.2-IE/EE
11.B.7-EE
17.2-EE
19.1-EE
19.2-EE
19.3-EE

1. Panoramica

6.3.1 The relevant entities shall take the appropriate measures to establish, document, implement and …

Requirement

The relevant entities shall take the appropriate measures to establish, document, implement and monitor configurations, including security configurations of hardware, software, services and networks.

Guidance

  • Establish documented processes based on best practices and information security standards (52).
  • Maintain and document detailed configuration settings for the following operating procedures (indicative, non-exhaustive list):
    • processing and handling of information,
    • backup,
    • scheduling requirements, including interdependencies with other systems,
    • handling errors or other exceptional conditions,
    • system restart and recovery procedures,
    • cryptographic mechanisms and settings, and
    • audit trail and system log information.
  • Consider the following security-related parameters for the configuration settings (indicative, non-exhaustive list):
    • registry settings,
    • account, file and directory permission settings, and
    • settings for functions, ports, protocols, services and remote connections.
  • Employ automated mechanisms to centrally manage, apply and verify configuration settings for software and hardware, including mobile devices and the entity’s connected vehicles.
    • Where appropriate, implement a configuration management database to catalogue and classify all configuration items (CIs), including their security attributes (e.g. patch level, firewall rules and encryption status)
  • Ensure that all network, software and system configurations adhere to established security and operational standards for functions, ports, protocols and services.
  • Monitor and control changes to the configuration settings in accordance with the entity’s policy on the security of network and information systems and topic-specific policies and procedures.
  • Identify software not authorised to run on the information systems.
  • Where appropriate, regularly review and update software configurations.
  • Where appropriate, identify software programs authorised to run on the information system.
  • Employ a deny-all, permit-by-exception policy to allow authorised software to run.
  • Set up procedures for network service usage to restrict access to necessary services or applications only.
  • Manage a secure baseline configuration for development and test environments separately from the operational baseline configuration, where appropriate.
  • Identify, document and approve any deviations from established configuration settings based on defined exceptions on operational requirements.

Examples of evidence

  • System configuration process, based on good practices and standards, in place and maintained.
  • System configuration tables containing configurations of hardware, software, services and networks.
  • Documented secure baseline configuration containing at least (indicative, non-exhaustive list):
    • essential capabilities of operation;
    • restricted use of functions;
    • security by default;
    • ports, protocols and/or services allowed.
  • Documented and approved exceptions to the configuration baseline containing the alternative measures in place to ensure the confidentiality, availability and integrity of the CI.
  • Documented secure baseline configuration for development and test environments.
6.3.2 For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in …

Requirement

For the purpose of point 6.3.1., the relevant entities shall: (a) lay down and ensure security in configurations for their hardware, software, services and networks; (b) lay down and implement processes and tools to enforce the laid down secure configurations for hardware, software, services and networks, for newly installed systems as well as for systems in operation over their lifetime.

Guidance

  • Consider hardening guides/best practices and general cybersecurity principles (e.g. least functionality and least privilege) as a basis for deriving the defined security configurations.
  • Establish, document and maintain configuration settings respecting the access control policy.
  • Where applicable, test the configuration before implementation.
  • Employ security safeguards to detect and respond to unauthorised changes to defined configuration settings.
  • Establish a configuration management plan containing:
    • roles, responsibilities and configuration management processes and procedures;
    • a process for identifying CIs throughout the system development life cycle; and
    • a process for managing the configuration of the CIs throughout their life cycle.
  • Protect the configuration management plan from unauthorised disclosure and modification.
  • Implement enhanced controls, including regular vulnerability scanning, strict configuration hardening, isolation where feasible and continuous monitoring to compensate for products which lack official updates after the end of supplier support.

Examples of evidence

  • Configuration management plan.
  • Comparison of the configuration plan with the access control lists.
  • Mechanisms, for example logical and physical access controls, encryption and audit logs in place.
  • Documented and approved exceptions to the configuration baseline containing the alternative measures in place to ensure the confidentiality, availability and integrity of the CI.
6.3.3 The relevant entities shall review and, where appropriate, update configurations at planned …

Requirement

The relevant entities shall review and, where appropriate, update configurations at planned intervals or when significant incidents or significant changes to operations or risks occur.

Guidance

  • Review and, where appropriate update (53) configurations at least monthly to ensure that patches have been applied, that the backup has been executed according to the plan and that monitoring is in place to identify and alert to fatal server/device/disk errors without delay.
  • Regularly produce, keep and review change logs regarding the security configuration of information systems.
  • Review and update the configurations after major changes (e.g. software updates) and past incidents.
  • Where feasible, obtain baseline configuration files for key systems and devices to compare against current configurations.

Examples of evidence

  • Up-to-date configuration management plan, review comments and/or change logs.
  • Documented results of the review activities.
  • Configuration snapshots taken before and after changes or at regular intervals to verify that reviews are conducted and documented.
  • Audit logs from systems and devices that track configuration changes and reviews.
  • Alerts from monitoring systems that notify administrators of unexpected configurations or changes or deviations from the baseline in critical systems.
  • Audit trails and compliance records from internal and external audits.
  • Minutes from team meetings where configuration reviews and changes are discussed and documented.
  • Records of notifications or reminders sent to relevant employees about upcoming configuration reviews.
  • Records from the configuration management tools to ensure they are kept up to date with accurate configuration information.
  • Incident response records that confirm whether the entity takes into account incidents related the configurations.

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is related to 6.3. Configuration management