FFIEC IT Examination Handbook IS-II.C.10(a): II.C.10(a) Configuration Management (Information Security)

Management controls the configurations of systems, applications and other technology through policies and procedures that set minimally acceptable baselines, updates baselines and confirms security settings when systems change, tracks, verifies and reports configuration items, monitors for unauthorised changes and misconfigurations and may use automated tools to track and correct them.