FFIEC IT Examination Handbook AIO-VI.B.2: VI.B.2 Configuration Management (Architecture, Infrastructure, and Operations)

What does AIO-VI.B.2 require?

Management maintains policies, standards and procedures for configuration management, defines and implements appropriate configuration settings, the parameters in hardware, software and firmware that affect security and functionality, controls the initialising, changing and monitoring of configurations through the life cycle, and ensures that systems and software have configuration management capabilities including audit log settings and that the configuration management is enforced.