ISC2 Certified in Cybersecurity (CC)Security OperationsMedium
A government contractor is preparing for an audit of its information systems. The audit requires demonstrating that all production systems consistently adhere to a predefined security baseline, including specific operating system settings, installed software versions, and network configurations. Which security operation directly supports proving this consistent adherence?
- AConfiguration Management
- BAsset Management
- CVulnerability Scanning
- DSecurity Monitoring
Show answer & explanationAnswer & explanation
Correct answer: A. Configuration Management
Configuration management is the process of maintaining consistency of a system's configuration over time, ensuring it adheres to a defined baseline. This is precisely what's needed to prove consistent adherence to security standards for an audit.
Why the other options are wrong
- B. Asset management tracks inventory, but doesn't manage or verify configurations.
- C. Vulnerability scanning identifies weaknesses, not adherence to a configuration baseline.
- D. Security monitoring detects events, it doesn't enforce or prove configuration adherence.
Configuration Management
The process of establishing and maintaining consistency of a system's performance, functional, and physical attributes with its requirements, design, and operational information throughout its life.
- Ensures systems are configured securely and consistently.
- Prevents configuration drift and unauthorized changes.
- Crucial for compliance and auditing.
Memory trick: Consistent Configs Confirm Compliance.