Controlled configuration changes prevent unauthorized or unsafe modifications.
Require authorized requests, impact assessment, testing, approval, implementation records, and post-change validation.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| CIS-V8 | CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 04 – Secure Configuration of Enterprise Assets and Software: 4.1 – Establish and Maintain a Secure Configuration Process |
CIS
Best Practice
|
vv8 | View → |
| COBIT2019 | COBIT COBIT is an enterprise governance and management f... Clause: 4.3 – Build, Acquire and Implement (BAI) > BAI10 – Managed Configuration > BAI10.04 – Produce status and configuration reports. 4.3 – Build, Acquire and Implement (BAI) > BAI06 – Managed IT Changes > BAI06.01 – Evaluate, prioritize and authorize change requests. |
COBIT
Governance Framework
|
v2019 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 32(1) – Security of processing; Article 32(1)(d) – Testing, assessing and evaluating security measures |
EU
Regulation
|
vCurrent | View → |
| HIPAA | Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement... Clause: § 164.308(a)(2) Standard: Risk analysis |
US
Law
|
vCurrent | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.9-3.3 – Change life cycle |
India
Guideline
|
vLatest | View → |
| ISO22301 | ISO/IEC 22301 ISO 22301 specifies requirements for a Business Co... Clause: 6.1.2 – Addressing risks and opportunities; 8.1 – Operational planning and control |
ISO
Standard
|
v2019 | View → |
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 6.1.2 – Information security risk assessment |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.16 – RISK ASSESSMENT; RA-3 – RISK ASSESSMENT |
NIST
Control Catalog
|
vRev. 5 | View → |
| PCI-DSS | PCI DSS PCI DSS is an industry security standard maintaine... Clause: 2.2.1 – Configuration standards are developed,; 2.2.6 – System security parameters are configured to |
PCI
Standard
|
v4 | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 2) Preventing execution of unauthorised software – 2.4 Defined exception framework, approval and periodic review |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures |
India
Regulation
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC3.2 – Risk Assessment – COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action. |
AICPA
Audit Framework
|
vLatest | View → |