Configuration management is a process that establishes and maintains the consistency and integrity of the IT systems and applications throughout their lifecycle. Configuration management involves identifying, documenting, controlling, and auditing the configuration items, such as hardware, software, data, or services, that comprise the IT systems and applications. Configuration management also involves establishing and enforcing the configuration baselines, which are the approved and authorized states of the configuration items. Implementing configuration management will best help ensure that systems comply with an established baseline before deployment, as it will enable the enterprise to verify that the systems meet the specified requirements, standards, and policies, and to detect and correct any deviations or discrepancies. The other options are not as effective as configuration management, as they involve different aspects or outcomes of the IT systems and applications:
Vulnerability scanning is a process that identifies and analyzes the weaknesses or gaps in the IT systems and applications that could be exploited by threats. Vulnerability scanning helps to assessthe security and compliance of the systems, but it does not ensure that the systems comply with an established baseline before deployment, as it may not cover all the aspects or components of the systems, or may not reflect the latest changes or updates of the systems.
Continuous monitoring and alerting is a process that tracks and reports the performance and status of the IT systems and applications on an ongoing basis. Continuous monitoring and alerting helps to identify and respond to any issues or incidents that affect the availability, integrity, or confidentiality of the systems, but it does not ensure that the systems comply with an established baseline before deployment, as it may not prevent or detect the unauthorized or unintended changes or modifications of the systems, or may not provide sufficient information or evidence to verify the compliance of the systems.
Access controls and active logging are processes that restrict and record the access and activities of the users or entities on the IT systems and applications. Access controls and active logging help to protect and audit the IT systems and applications, but they do not ensure that the systems comply with an established baseline before deployment, as they may not address the configuration or quality issues of the systems, or may not be consistent or comprehensive across the systems. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 4, Section 4.2.1.1, pp. 156-157.
