Configuration baseline and drift check
None of the held texts sets a fixed period on this consumer; every row below reads no period set by the text. Paste one job that feeds this consumer, for example config_drift_check, weekly, and the register reads its period against the clocks below, names the gap in hours, and carries the question for its owner.
Matched on the job name or the consumer column by these words: config drift, drift, baseline check, hardening check, config compliance, configuration check, drift check.
The clock each rule sets
| Regime | Clock | Clause |
|---|---|---|
| ISO 27001 | no clock | ISO 27001 8.9 Configuration management |
| no clock | ISO 27001 8.32 Change management | |
| SP 800-53 | no clock | SP 800-53 CA-7 Continuous monitoringa defined frequency |
Questions this page answers
How often does ISO/IEC 27001:2022 require configuration baseline and drift check?
The held text of ISO 27001 8.9 (Configuration management) sets no fixed period: no period set by the text. The held text of ISO 27001 8.32 (Change management) sets no fixed period: no period set by the text. Establish, document, implement, monitor and review secure configurations for hardware, software, services and networks. Put changes to facilities and systems through change management procedures.
How often does NIST SP 800-53 Rev 5 require configuration baseline and drift check?
The held text of SP 800-53 CA-7 (Continuous monitoring) sets no fixed period: a defined frequency. Requires a system-level continuous monitoring strategy aligned to the organizational one, defining the metrics monitored, the frequencies for monitoring and for assessing control effectiveness, ongoing control assessment, correlation and analysis of the results, response actions, and reporting of security and privacy posture to defined personnel.
What does the register ask the owner of a configuration baseline and drift check job?
Who approves a drift the check finds, and is the approval recorded against the change?
The clauses in full
Establish, document, implement, monitor and review secure configurations for hardware, software, services and networks.
Guidance beside it, ISO 27002 8.9: Requires configurations of hardware, software, services and networks, including their security configurations, to be established, documented, implemented, monitored and reviewed. Supporting material frames this as a standing process that keeps systems configured securely and consistently.
What an assessor asks to see: baseline_configurations; change_control_records; configuration_audit_reports; secure_hardening_guidelines. Where it usually falls short: outdated baselines
Put changes to facilities and systems through change management procedures.
Guidance beside it, ISO 27002 8.32: Requires change management procedures to govern changes made to information systems and to the facilities that process information. Older source material adds that changes should be controlled by formal, documented and enforced procedures, with risk assessed as part of the process.
What an assessor asks to see: change_requests; change_approvals; implementation_testing; post_implementation_reviews. Where it usually falls short: missing formal approval
Requires a system-level continuous monitoring strategy aligned to the organizational one, defining the metrics monitored, the frequencies for monitoring and for assessing control effectiveness, ongoing control assessment, correlation and analysis of the results, response actions, and reporting of security and privacy posture to defined personnel.
What an assessor asks to see: Documented continuous monitoring strategy with metrics and frequencies; Evidence of ongoing control assessments performed at the stated cadence; Correlation and analysis output showing findings drawn from monitoring data; Posture reports issued to the defined personnel and the actions they triggered. Where it usually falls short: Monitoring reduced to vulnerability scanning, with most controls never reassessed
Requirement text quoted from the standards themselves, published at compliance.theartofservice.com, the same publisher as this register, read against the held text of each standard: our statement of each clause, not the instrument verbatim. Run this job through the register