1. Document Control

• Document Title: System Configuration Management Procedure

• Document Identifier: PRC-IT-003

• Version Number: v1.0

• Approval Date: <23 June 2025>

• Effective Date: <23 June 2025>

• Review Date: <23 June 2026>

• Document Owner: <IT Infrastructure Manager>

• Approved By: <Chief Information Security Officer>

2. Purpose

The purpose of this procedure is to define the processes used by to implement, monitor, and maintain secure configurations across all IT systems. Proper configuration management ensures the integrity, availability, and confidentiality of systems and data by reducing the risk of misconfigurations, unauthorized changes, and system vulnerabilities.

This document aligns with SOC 2 Trust Criteria CC8.1 (Change Management) and CC8.2 (Configuration and Change Monitoring), and ISO/IEC 27001:2022 Controls A.8.8 (Configuration management), A.5.23 (Information security for use of cloud services), and A.5.28 (Secure development lifecycle).

3. Scope

This procedure applies to:

• All production and staging systems, servers, containers, network devices, and cloud resources

• All environments where company data is stored, processed, or transmitted

• Internal, hosted, and third-party managed infrastructure components

The procedure governs system configuration from initial provisioning through lifecycle updates and decommissioning.

4. Procedure Overview

4.1 Baseline Configuration

1. Establish Baselines

   • All systems must be deployed using approved configuration baselines documented in a Configuration Standards Library.

   • Baselines must cover OS settings, firewall rules, user permissions, logging, encryption, and service configurations.

2. Baseline Approval

   • Baselines are reviewed and approved by IT Security and documented with version control.

4.2 Configuration Implementation

1. Automated Provisioning

   • Infrastructure as Code (IaC) tools (e.g., Terraform, Ansible, Puppet) must be used where applicable.

   • Configuration scripts are version-controlled and subject to peer review before deployment.

2. Manual Systems

   • If automation is not feasible, manual configurations must follow a documented checklist and be validated by a second engineer.

4.3 Change Control

1. Change Authorization

   • Any configuration change must be submitted through the Change Management Process (see PRC-IT-004) and approved before implementation.

2. Testing and Rollback

   • All changes must be tested in a staging environment.

   • Rollback plans are required for all critical changes.

3. Documentation

   • Change details, including before/after configuration states, must be logged and linked to the associated ticket.

4.4 Monitoring and Drift Detection

1. Configuration Monitoring Tools

   • Use of configuration management and compliance tools (e.g., Chef InSpec, AWS Config, Azure Policy) to detect unauthorized changes.

2. Drift Alerts

   • Real-time alerts are triggered if system configurations deviate from baseline.

3. Monthly Review

   • System owners review drift reports and remediation logs monthly.

5. Roles and Responsibilities

6. Safeguards and Controls

7. Compliance and Exceptions

All configurations are subject to periodic audits by the Security and Compliance Team. Exceptions to this procedure must be formally documented with business justification and compensating controls, and approved by the IT Infrastructure Manager and CISO.

8. Related Policies/Documents

• POL-ALL-001: Information Security Policy

• POL-ALL-004: Change Management Policy

• POL-ALL-003: Access Control Policy

• PRC-IT-004: Change Request and Approval Procedure

• SOC 2 Trust Criteria: CC8.1, CC8.2

• ISO/IEC 27001:2022 Controls: A.8.8, A.5.23, A.5.28

9. Review and Maintenance

This procedure will be reviewed annually or following any significant change in technology, architecture, or compliance requirements. The IT Infrastructure Manager and CISO are responsible for ensuring that configurations remain current and security-aligned. All revisions must be tracked through the change control process.