Skip to content

Purpose of ISO 27001:2022 Annex A 8.9

Configurations, either as an individual config file or a collection of configurations linked together, determine how hardware, software, and networks are managed.

As an example, a firewall’s configuration file will contain the baseline attributes that the device utilises to manage the traffic entering and leaving an organisation’s network, such as block lists, port forwarding, virtual LANs and VPN information.

Configuration management forms an essential part of any organisation’s asset management strategy. Configurations are crucial for making sure that a network runs as it should, and for protecting devices from unapproved changes or inappropriate alterations by maintenance personnel and/or vendors.

Ownership of Annex A 8.9

Configuration management is an administrative duty dedicated to sustaining and observing asset-related data and info present on various devices and applications. Therefore, ownership should be in the hands of the Head of IT or the equivalent.




ISMS.online gives you an 81% Headstart from the moment you log on

ISO 27001 made easy

We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.




Guidance on ISO 27001:2022 Annex A 8.9 Compliance

Organisations need to craft and enact configuration management policies for both new and existing systems and hardware. Internal controls should encompass key elements such as security configurations, hardware with configuration files, and any applicable software or systems.

ISO 27001:2022 Annex A 8.9 requires organisations to contemplate all pertinent roles and duties when establishing a configuration policy, including assigning ownership of configurations on a device-by-device or application-by-application basis.

Guidance on Standard Templates

Organisations should strive to use standardised templates to secure all hardware, software and systems whenever practical. These templates should:

  • Attempt to use freely available vendor-specific and open source instructions to optimally configure hardware and software assets.
  • Ensure that the device, application or system abides by the minimum security requirements.
  • Co-operate with the company’s larger information security activities, including all applicable ISO regulations.
  • Take into account the special business needs of the organisation – particularly with respect to security settings – as well as the possibility of applying or managing a template at any given time.
  • At regular intervals, review the system and hardware updates, and any current security threats, to ensure optimal performance.



climbing

Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.




Guidance on Security Controls

Security is of utmost importance when applying configuration templates or changing existing ones in accordance with the guidance mentioned above.

When contemplating templates to be implemented across the company, organisations should strive to reduce potential information security hazards by:

  • Restrain the amount of personnel with administrative authority to the least quantity possible.
  • Deactivate any identities not being used or not needed.
  • Track access to maintenance programs, utilities and internal settings carefully.
  • Ensure clocks are coordinated to record configuration accurately and aid any future probes.
  • Straight away switch any default passwords or safety settings provided with any device, service or program.
  • Implement a preset log-off period for any devices, systems, or applications that have been inactive for a predetermined time frame.
  • Ensure compliance with ISO 27001:2022 Annex A 5.32 to guarantee that all licensing requirements have been fulfilled.

Guidance on Managing and Monitoring Configurations

The organisation is obliged to retain and record configurations, along with a history of any changes or new setups, in line with the ISO 27001:2022 Annex A 8.32 Change Management process.

Logs should include information that details:

  • Who holds the asset.
  • Record the time of the latest configuration change.
  • This version of the configuration template that is in effect.
  • Explain any data pertinent to the asset’s association with configurations on other gadgets/systems.

Organisations should employ a broad spectrum of methods to keep tabs on the functioning of configuration files across their network, such as:

  • Automation.
  • Specialised configuration maintenance programs are available for use. These programs enable efficient and effective management of settings.
  • Remote support tools that automatically populate configuration data for each device.
  • Enterprise device and software management utilities are created to observe large quantities of configuration data simultaneously.
  • The BUDR software provides automated backups of configurations to a secure place, and can remotely or on-site restore templates to malfunctioning or compromised devices.

Organisations should employ specialised software to monitor any changes to a device’s configuration, taking swift action to either approve or revert the transformation to its initial status.

Accompanying Annex A Controls

  • ISO 27001:2022 Annex A 5.32
  • ISO 27001:2022 Annex A 8.32



[case_study_slider ids=”88859,101932,92016″ autoplay=”true” autoplay_speed=”5000″]


Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.9 is not present in ISO 27001:2013, as it is a new addition in the 2022 revision.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

ISO 27001:2022 Organisational Controls
Annex A Control Type ISO/IEC 27001:2022 Annex A Identifier ISO/IEC 27001:2013 Annex A Identifier Annex A Name
Organisational Controls Annex A 5.1 Annex A 5.1.1
Annex A 5.1.2
Policies for Information Security
Organisational Controls Annex A 5.2 Annex A 6.1.1 Information Security Roles and Responsibilities
Organisational Controls Annex A 5.3 Annex A 6.1.2 Segregation of Duties
Organisational Controls Annex A 5.4 Annex A 7.2.1 Management Responsibilities
Organisational Controls Annex A 5.5 Annex A 6.1.3 Contact With Authorities
Organisational Controls Annex A 5.6 Annex A 6.1.4 Contact With Special Interest Groups
Organisational Controls Annex A 5.7 NEW Threat Intelligence
Organisational Controls Annex A 5.8 Annex A 6.1.5
Annex A 14.1.1
Information Security in Project Management
Organisational Controls Annex A 5.9 Annex A 8.1.1
Annex A 8.1.2
Inventory of Information and Other Associated Assets
Organisational Controls Annex A 5.10 Annex A 8.1.3
Annex A 8.2.3
Acceptable Use of Information and Other Associated Assets
Organisational Controls Annex A 5.11 Annex A 8.1.4 Return of Assets
Organisational Controls Annex A 5.12 Annex A 8.2.1 Classification of Information
Organisational Controls Annex A 5.13 Annex A 8.2.2 Labelling of Information
Organisational Controls Annex A 5.14 Annex A 13.2.1
Annex A 13.2.2
Annex A 13.2.3
Information Transfer
Organisational Controls Annex A 5.15 Annex A 9.1.1
Annex A 9.1.2
Access Control
Organisational Controls Annex A 5.16 Annex A 9.2.1 Identity Management
Organisational Controls Annex A 5.17 Annex A 9.2.4
Annex A 9.3.1
Annex A 9.4.3
Authentication Information
Organisational Controls Annex A 5.18 Annex A 9.2.2
Annex A 9.2.5
Annex A 9.2.6
Access Rights
Organisational Controls Annex A 5.19 Annex A 15.1.1 Information Security in Supplier Relationships
Organisational Controls Annex A 5.20 Annex A 15.1.2 Addressing Information Security Within Supplier Agreements
Organisational Controls Annex A 5.21 Annex A 15.1.3 Managing Information Security in the ICT Supply Chain
Organisational Controls Annex A 5.22 Annex A 15.2.1
Annex A 15.2.2
Monitoring, Review and Change Management of Supplier Services
Organisational Controls Annex A 5.23 NEW Information Security for Use of Cloud Services
Organisational Controls Annex A 5.24 Annex A 16.1.1 Information Security Incident Management Planning and Preparation
Organisational Controls Annex A 5.25 Annex A 16.1.4 Assessment and Decision on Information Security Events
Organisational Controls Annex A 5.26 Annex A 16.1.5 Response to Information Security Incidents
Organisational Controls Annex A 5.27 Annex A 16.1.6 Learning From Information Security Incidents
Organisational Controls Annex A 5.28 Annex A 16.1.7 Collection of Evidence
Organisational Controls Annex A 5.29 Annex A 17.1.1
Annex A 17.1.2
Annex A 17.1.3
Information Security During Disruption
Organisational Controls Annex A 5.30 NEW ICT Readiness for Business Continuity
Organisational Controls Annex A 5.31 Annex A 18.1.1
Annex A 18.1.5
Legal, Statutory, Regulatory and Contractual Requirements
Organisational Controls Annex A 5.32 Annex A 18.1.2 Intellectual Property Rights
Organisational Controls Annex A 5.33 Annex A 18.1.3 Protection of Records
Organisational Controls Annex A 5.34 Annex A 18.1.4 Privacy and Protection of PII
Organisational Controls Annex A 5.35 Annex A 18.2.1 Independent Review of Information Security
Organisational Controls Annex A 5.36 Annex A 18.2.2
Annex A 18.2.3
Compliance With Policies, Rules and Standards for Information Security
Organisational Controls Annex A 5.37 Annex A 12.1.1 Documented Operating Procedures
ISO 27001:2022 People Controls
Annex A Control Type ISO/IEC 27001:2022 Annex A Identifier ISO/IEC 27001:2013 Annex A Identifier Annex A Name
People Controls Annex A 6.1 Annex A 7.1.1 Screening
People Controls Annex A 6.2 Annex A 7.1.2 Terms and Conditions of Employment
People Controls Annex A 6.3 Annex A 7.2.2 Information Security Awareness, Education and Training
People Controls Annex A 6.4 Annex A 7.2.3 Disciplinary Process
People Controls Annex A 6.5 Annex A 7.3.1 Responsibilities After Termination or Change of Employment
People Controls Annex A 6.6 Annex A 13.2.4 Confidentiality or Non-Disclosure Agreements
People Controls Annex A 6.7 Annex A 6.2.2 Remote Working
People Controls Annex A 6.8 Annex A 16.1.2
Annex A 16.1.3
Information Security Event Reporting
ISO 27001:2022 Physical Controls
Annex A Control Type ISO/IEC 27001:2022 Annex A Identifier ISO/IEC 27001:2013 Annex A Identifier Annex A Name
Physical Controls Annex A 7.1 Annex A 11.1.1 Physical Security Perimeters
Physical Controls Annex A 7.2 Annex A 11.1.2
Annex A 11.1.6
Physical Entry
Physical Controls Annex A 7.3 Annex A 11.1.3 Securing Offices, Rooms and Facilities
Physical Controls Annex A 7.4 NEW Physical Security Monitoring
Physical Controls Annex A 7.5 Annex A 11.1.4 Protecting Against Physical and Environmental Threats
Physical Controls Annex A 7.6 Annex A 11.1.5 Working In Secure Areas
Physical Controls Annex A 7.7 Annex A 11.2.9 Clear Desk and Clear Screen
Physical Controls Annex A 7.8 Annex A 11.2.1 Equipment Siting and Protection
Physical Controls Annex A 7.9 Annex A 11.2.6 Security of Assets Off-Premises
Physical Controls Annex A 7.10 Annex A 8.3.1
Annex A 8.3.2
Annex A 8.3.3
Annex A 11.2.5
Storage Media
Physical Controls Annex A 7.11 Annex A 11.2.2 Supporting Utilities
Physical Controls Annex A 7.12 Annex A 11.2.3 Cabling Security
Physical Controls Annex A 7.13 Annex A 11.2.4 Equipment Maintenance
Physical Controls Annex A 7.14 Annex A 11.2.7 Secure Disposal or Re-Use of Equipment
ISO 27001:2022 Technological Controls
Annex A Control Type ISO/IEC 27001:2022 Annex A Identifier ISO/IEC 27001:2013 Annex A Identifier Annex A Name
Technological Controls Annex A 8.1 Annex A 6.2.1
Annex A 11.2.8
User Endpoint Devices
Technological Controls Annex A 8.2 Annex A 9.2.3 Privileged Access Rights
Technological Controls Annex A 8.3 Annex A 9.4.1 Information Access Restriction
Technological Controls Annex A 8.4 Annex A 9.4.5 Access to Source Code
Technological Controls Annex A 8.5 Annex A 9.4.2 Secure Authentication
Technological Controls Annex A 8.6 Annex A 12.1.3 Capacity Management
Technological Controls Annex A 8.7 Annex A 12.2.1 Protection Against Malware
Technological Controls Annex A 8.8 Annex A 12.6.1
Annex A 18.2.3
Management of Technical Vulnerabilities
Technological Controls Annex A 8.9 NEW Configuration Management
Technological Controls Annex A 8.10 NEW Information Deletion
Technological Controls Annex A 8.11 NEW Data Masking
Technological Controls Annex A 8.12 NEW Data Leakage Prevention
Technological Controls Annex A 8.13 Annex A 12.3.1 Information Backup
Technological Controls Annex A 8.14 Annex A 17.2.1 Redundancy of Information Processing Facilities
Technological Controls Annex A 8.15 Annex A 12.4.1
Annex A 12.4.2
Annex A 12.4.3
Logging
Technological Controls Annex A 8.16 NEW Monitoring Activities
Technological Controls Annex A 8.17 Annex A 12.4.4 Clock Synchronization
Technological Controls Annex A 8.18 Annex A 9.4.4 Use of Privileged Utility ProgramsAccess Rights
Technological Controls Annex A 8.19 Annex A 12.5.1
Annex A 12.6.2
Installation of Software on Operational Systems
Technological Controls Annex A 8.20 Annex A 13.1.1 Networks Security
Technological Controls Annex A 8.21 Annex A 13.1.2 Security of Network Services
Technological Controls Annex A 8.22 Annex A 13.1.3 Segregation of Networks
Technological Controls Annex A 8.23 NEW Web filtering
Technological Controls Annex A 8.24 Annex A 10.1.1
Annex A 10.1.2
Use of Cryptography
Technological Controls Annex A 8.25 Annex A 14.2.1 Secure Development Life Cycle
Technological Controls Annex A 8.26 Annex A 14.1.2
Annex A 14.1.3
Application Security Requirements
Technological Controls Annex A 8.27 Annex A 14.2.5 Secure System Architecture and Engineering PrinciplesLearning From Information Security Incidents
Technological Controls Annex A 8.28 NEW Secure Coding
Technological Controls Annex A 8.29 Annex A 14.2.8
Annex A 14.2.9
Security Testing in Development and Acceptance
Technological Controls Annex A 8.30 Annex A 14.2.7 Outsourced Development
Technological Controls Annex A 8.31 Annex A 12.1.4
Annex A 14.2.6
Separation of Development, Test and Production Environments
Technological Controls Annex A 8.32 Annex A 12.1.2
Annex A 14.2.2
Annex A 14.2.3
Annex A 14.2.4
Change Management
Technological Controls Annex A 8.33 Annex A 14.3.1 Test Information
Technological Controls Annex A 8.34 Annex A 12.7.1 Protection of Information Systems During Audit Testing

How ISMS.online Help

ISMS.Online provides a comprehensive approach to ISO 27001 implementation. It offers a full-service package, ensuring that the whole process is handled quickly and efficiently. It provides all the necessary tools, resources and guidance to enable organisations to implement the standard with confidence.

This web-based system permits you to demonstrate that your Information Security Management System (ISMS) meets the accepted standards, with well-considered processes, procedures and checklists.

Contact us now to arrange a demonstration.


Sam Peters

Sam is Chief Product Officer at ISMS.online and leads the development on all product features and functionality. Sam is an expert in many areas of compliance and works with clients on any bespoke or large-scale projects.

ISO 27001:2022 Annex A Controls

Organisational Controls