Frameworks / ISO 27001:2022 / 8.9 ISO 27001:2022
Technological controls – ISO 27001:2022
ISO 27001:2022 8.9: Configuration management The organization is to set, record, apply, watch and review how its hardware, software, services and networks are configured, security settings included. Purpose (stated in ISO/IEC 27002:2022): ensures systems and networks work correctly with required security settings and are not changed without approval or by mistake. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 8.9.
Maintained by Gerard Blokdyk · Verified against the published standard 18 August 2026 · Control text last updated 25 September 2026 What else in your programme already covers this This control maps to 145 controls across 31 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
CIS-10.5 Enable Anti-Exploitation Features CIS-12.1 Ensure Network Infrastructure is Up-to-Date CIS-12.3 Securely Manage Network Infrastructure CIS-13.5 Manage Access Control for Remote Assets CIS-14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure CIS-2.2 Ensure Authorized Software is Currently Supported CIS-2.3 Address Unauthorized Software CIS-4.1 Establish and Maintain a Secure Configuration Process CIS-4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure CIS-4.6 Securely Manage Enterprise Assets and Software CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS-4.9 Configure Trusted DNS Servers on Enterprise Assets CIS-7.3 Perform Automated Operating System Patch Management CIS-9.1 Ensure Use of Only Fully Supported Browsers and Email Clients CIS-9.4 Restrict Unnecessary or Unauthorized Browser and Email Client Extensions AC-6 Least Privilege CM-2 Baseline Configuration CM-2(7) Configure Systems and Components for High-Risk Areas CM-6 Configuration Settings CM-7 Least Functionality CM-7(1) Periodic Review CM-7(5) Authorized Software Allow-by-Exception CM-8(3) Automated Unauthorized Component Detection CM-9 Configuration Management Plan SA-10 Developer Configuration Management SA-22 Unsupported System Components (SA-22) SA-9(2) Identification of Functions, Ports, Protocols, and Services SI-7 Software, Firmware, and Information Integrity AC-6 Least Privilege CM-2 Baseline Configuration CM-2(7) Configure Systems and Components for High-Risk Areas CM-6 Configuration Settings CM-7 Least Functionality CM-7(1) Periodic Review CM-7(5) Authorized Software Allow-by-Exception CM-8(3) Automated Unauthorized Component Detection CM-9 Configuration Management Plan SA-10 Developer Configuration Management SA-22 Unsupported System Components (SA-22) SA-9(2) Identification of Functions, Ports, Protocols, and Services SI-7 Software, Firmware, and Information Integrity 1.2.1 1.2.1 Ruleset configuration standards for NSCs 1.2.5 1.2.5 Allowed services, protocols and ports justified 1.2.6 1.2.6 Security features for insecure services in use 1.2.7 1.2.7 Six-monthly review of NSC configurations 1.2.8 1.2.8 NSC configuration files secured and consistent 1.5.1 1.5.1 Security controls on dual-connected devices 12.6.1 12.6.1 Formal security awareness program 2.2.1 2.2.1 System configuration standards maintained 2.2.2 2.2.2 Vendor default accounts managed 2.2.4 2.2.4 Only necessary functionality enabled 2.2.5 2.2.5 Insecure services, protocols or daemons secured 2.2.6 2.2.6 System security parameters configured against misuse 2.3.1 2.3.1 Wireless vendor defaults changed or confirmed secure ASBv3-NS-7 Simplify network security configuration ASBv3-NS-8 Detect and disable insecure services and protocols ASBv3-PV-1 Define and establish secure configurations ASBv3-PV-3 Define and establish secure configurations for compute resources ASBv3-PV-4 Audit and enforce secure configurations for compute resources PV-2 Audit and enforce secure configurations SOC2-CC5.1 CC5.1 Selecting control activities that mitigate risk (COSO principle 10) SOC2-CC5.2 CC5.2 General controls over technology (COSO principle 11) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure SOC2-PI1.2 PI1.2 Controls over system inputs SOC2-PI1.5 PI1.5 Controls over stored inputs, work in process and outputs C5-AM-03 Commissioning of Hardware C5-DEV-03 Policies for changes to information systems C5-OPS-16 Logging and Monitoring - Configuration C5-OPS-23 Managing Vulnerabilities, Malfunctions and Errors - System Hardening C5-PSS-11 Images for Virtual Machines and Containers ASD37-04 User application hardening (Essential) ASD37-09 OS generic exploit mitigation (Excellent) ASD37-10 Server application hardening (Very Good) ASD37-11 Operating system hardening (Very Good) ANSSI-HYG-12 Change Default Authentication Elements on Equipment and Services ANSSI-HYG-14 Apply a Minimum Security Level Across the Whole Estate ANSSI-HYG-16 Use a Centralised Management Tool to Standardise Security Policies BAI10.02 BAI10.02 Establish and maintain a configuration repository and baseline BAI10.03 BAI10.03 Maintain and control configuration items BAI10.05 BAI10.05 Verify and review integrity of the configuration repository NIST-CSF-ID.AM-08 Systems, hardware, software, services, and data are managed throughout their life cycles NIST-CSF-PR.PS-01 Configuration management practices are established and applied NIST-CSF-PR.PS-02 Software is maintained, replaced, and removed commensurate with risk E8-MACRO-ML1 Configure Microsoft Office Macro Settings (ML1) E8-UAH-ML2 User Application Hardening - Maturity Level 2 8.32 Change management 8.9 Configuration management 6.9 Operations security 6.9.5 Control of operational software 3.14.4e Refresh Systems and Components from a Trusted Baseline 3.4.2e Automated Detection and Remediation of Unauthorized Software CE-SC.1 Remove or Disable Unused Software CE-SC.2 Change Default Passwords on Devices and Software AUCDR-IS-2 Secure the network and systems within the data environment A.4 Resources for AI systems Art.21.2.g Basic cyber hygiene practices and cybersecurity training Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in Technological controls – ISO 27001:2022 You are reading one control. How much of ISO 27001:2022 have you already done? ISO 27001:2022 8.9 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27001:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27001:2022 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 170 were rejected on the NIST SP 800-53 Rev 5 pair alone.
Query this from an agent The graph holds this control, the 145 it maps to, and the evidence behind each claim, over MCP and REST.