1. Document Control

• Document Title: Configuration Baseline Management Procedure

• Document Identifier: PRC-IT-011

• Version Number: v1.0

• Approval Date: <24 June 2025>

• Effective Date: <24 June 2025>

• Review Date: <24 June 2026>

• Document Owner: <Director of IT Infrastructure>

• Approved By: <Change Advisory Board (CAB)>

2. Purpose

The purpose of this procedure is to establish a formal process for defining, maintaining, reviewing, and enforcing secure configuration baselines for 's IT systems and services. Configuration baselines ensure consistency, reduce attack surfaces, and support operational reliability across the organization.

This document supports compliance with SOC 2 Trust Criteria CC8.1 (change control) and CC8.2 (change authorization and documentation), and is aligned with ISO/IEC 27001:2022 Control A.8.9, which mandates secure and documented configuration management practices for production systems.

3. Scope

This procedure applies to all production systems, cloud environments, endpoints, network devices, servers, applications, databases, and middleware managed by or on behalf of . This includes all infrastructure components deployed across on-premises, hybrid, and cloud platforms.

All IT teams, DevOps, cloud architects, and infrastructure administrators are required to adhere to this procedure. Third-party managed systems must also meet configuration baseline requirements as per contract terms.

4. Policy Statement

shall establish and enforce secure configuration baselines across all technology assets to:

1. Define approved baseline configurations for systems based on industry standards (e.g., CIS Benchmarks, NIST).

2. Document, version, and store all baseline configurations in a central repository.

3. Automatically validate configurations during deployment using Infrastructure-as-Code (IaC) and CI/CD tools.

4. Periodically audit configurations against approved baselines and correct any drifts.

5. Require formal change control for all updates to baseline configurations.

6. Include configuration checks in vulnerability scans and compliance monitoring platforms.

7. Maintain rollback procedures and logs of all configuration changes.

5. Safeguards