Configuration management is the discipline of establishing and maintaining known, approved settings for systems across their entire lifecycle. It tracks hardware, software versions, and configuration parameters against a defined baseline, then watches for drift when something changes without authorization.
Security configuration management narrows that focus to hardening: systems are built to a standard such as CIS Benchmarks or DISA STIGs, weak settings get flagged, and a configuration management database (CMDB) keeps the inventory that vulnerability scanning, incident response, and compliance reporting all lean on. The value shows up the moment something breaks. If you cannot say what normal looked like, you cannot prove what changed. Misconfiguration, not some exotic exploit, remains one of the most common ways sensitive cloud data ends up exposed, which is why continuous baselines and drift detection earn their keep.
How is configuration management tested on the CISSP?
Configuration management appears mainly in Domain 7: Security Operations and connects to Security Architecture. Understand baseline creation, drift detection, hardening guides, and the tight link to change management. CIS publishes hardening guidance through its CIS Benchmarks.
Related terms: Change Management, Vulnerability Assessment