What is Configuration Management?
Configuration Management is the process by which an organisation records the technical settings, software versions, firmware and dependencies of its systems throughout their lifecycle, fixes them in an approved baseline configuration, changes them in a controlled way and periodically checks them for drift. The aim is visibility, control and reproducibility: at any moment you know what is running, how it is configured and how to return it to the last known good state after a failure or an attack. In IT environments this covers servers, workstations and network equipment; in OT environments it also covers PLC programs, SCADA projects, HMI screens and the parameters of field devices.
🧠 Why does Configuration Management matter?
Default settings of devices and software are designed for ease of use, not for security. On top of that, configurations change unnoticed: a technician opens a port during a breakdown, a supplier adjusts a parameter, or an engineer downloads an older program version. Without configuration management nobody sees that difference until something goes wrong.
| Benefit | Explanation |
|---|---|
| Visibility into configurations | Who is running what, where, with which settings and which version? |
| Reproducibility | Identical configurations during recovery, migration, replacement or testing |
| Change control | Together with Change Management: no uncontrolled modifications |
| Security | Detection of unauthorised or insecure configuration changes |
| Fast impact analysis | When a new vulnerability is published, you see at once which systems run an affected version |
| Audit support | Demonstrable compliance with BIO, IEC 62443, ISO 27001 and the Dutch Cybersecurity Act |
🧱 What counts as a configuration item?
A configuration item (CI) is any component you need to manage so that a service or process runs reliably. ITIL 4 calls the related practice service configuration management. A CI can be:
- Hardware - for example a PLC, Router, switch, server or Engineering Station
- Software and Firmware - versions, patch level and licences
- Settings and parameters - user roles, policies, control parameters, alarm limits
- Network configuration - VLANs, firewall rules, IP addresses and routing
- Documentation - drawings, I/O lists, functional specifications
- Location, owner and dependencies - which system relies on which other system
Each CI has a unique identity, an owner, a recorded status and a documented relationship with other CIs.
Not every asset is a CI. An Asset Inventory and Asset Management are about what you own and what it costs; configuration management is about how it is configured and how those settings change. The data comes together in a configuration management system, often with a CMDB at its core.
🔧 How does Configuration Management work in practice?
The classic configuration management standard SAE EIA-649C (2019) and the guideline ISO 10007:2017 describe the same five functions. NIST SP 800-128 (2011, updated in 2019) translates them into security-focused configuration management in four phases: planning, identifying and implementing configurations, controlling configuration changes, and monitoring.
| Function | What you do | Typical output |
|---|---|---|
| Planning and management | Define policy, roles, tooling and a configuration control board (CCB) | Configuration management plan |
| Identification | Name and uniquely number CIs and record a baseline | Approved baseline per system type |
| Change control | Request changes, assess impact, test, approve | Updated baseline after each approved change |
| Status accounting | Track which version runs where and what changed | Current configuration history |
| Verification and audit | Compare the actual configuration with the baseline | Deviation report and corrective actions |
A practical approach in five steps:
- Map your assets - start with a complete inventory; without a list there is no baseline.
- Define baselines - use CIS Benchmarks or vendor guidance for Hardening and record the approved settings for each system type.
- Put everything under version control - configuration files, scripts and PLC projects, recording who changed what, when and why.
- Link to change management - no change without a ticket; after approval the baseline is updated.
- Check automatically for drift - compare scheduled backups with the baseline, for example daily for servers and weekly or after every maintenance job for PLCs.
🏭 Why is configuration management even more important in OT?
In operational technology (OT) a configuration error affects the physical process directly. Typical OT characteristics add to this:
- Many devices run on Embedded firmware without automatic Logging of changes.
- A modified PLC configuration can affect production, quality or safety.
- OT Assets often last twenty years or more and are poorly documented.
- Recovery after a failure is often manual, using whatever backup happens to be on a laptop.
Stuxnet showed why this matters: the malware modified the code in Siemens S7 PLCs and hid that change from the engineering software. Only an independent comparison with a known good version makes such manipulation visible.
| OT element | Configuration aspect |
|---|---|
| SCADA system | IP addresses, logging parameters, user roles, tag database |
| PLC program | Version control of ladder logic, function blocks and hardware configuration |
| Network switches | QoS settings, VLAN configuration, redundancy mode |
| Remote I/O modules | Signal mapping, sample rate, diagnostic options |
| Safety systems | SIS parameters and logic, under IEC 61511 management of change |
Specialised tools such as octoplant from AUVESY-MDT (the merger of versiondog and MDT AutoSave) and Rockwell FactoryTalk AssetCentre periodically upload the projects from PLCs, robots and drives and compare them with the previous version. An unrecorded change is then reported automatically.
🛠 Which tools and techniques do you use?
| Tool / method | Use |
|---|---|
| CMDB (Configuration Management Database) | Central registration of CIs and their relationships |
| Version Control (e.g. Git) | Software configurations, PLC programs and scripts |
| Automated baseline checks | Detection of drift from the approved configuration |
| Backups and snapshots | Periodic storage of current configurations as a restore point |
| Policies and procedures | Lifecycle, change and incident management |
🔐 Which standards and laws require configuration management?
Configuration Management supports Security by making misconfigurations visible, contributing to Security by Design and providing the foundation for Patch Management and Vulnerability Management. It cannot detect a Zero-day, but when a vulnerability is published you can see immediately which systems run an affected version.
- ISO 27002:2022 - control 8.9 Configuration management was newly added in the 2022 edition: configurations, including security configurations of hardware, software, services and networks, must be established, documented, implemented, monitored and reviewed.
- BIO - BIO2, adopted on 23 September 2025, follows ISO 27002:2022 and therefore includes this control.
- IEC 62443-3-3 - system requirement SR 7.6 (network and security configuration settings) and SR 7.8 (control system component inventory).
- NIST SP 800-53 - the CM family, including CM-2 (baseline configuration), CM-3 (configuration change control), CM-6 (configuration settings), CM-7 (least functionality) and CM-8 (system component inventory); NIST SP 800-82 Rev. 3 applies this to OT.
- NIS2 and the Dutch Cybersecurity Act - the duty of care requires security in the acquisition, development and maintenance of systems. For cloud, data centre, DNS and managed (security) service providers, among others, Implementing Regulation (EU) 2024/2690 makes this concrete with a dedicated section on configuration management (annex, section 6.3), including review at planned intervals and after significant incidents or changes.
❓ Frequently asked questions
What is the difference between Configuration Management and Change Management?
Configuration Management records how systems are configured and keeps the approved baseline up to date. Change Management is the process that decides whether and how a change is made. Together they ensure that every approved change also ends up in the configuration records.
What is a configuration baseline?
A configuration baseline is a formally approved snapshot of the settings, software versions and firmware of a system. Configuration Management uses that baseline as the reference to detect drift and to restore systems to a known good state after a failure.
Is a CMDB the same as Configuration Management?
No, a CMDB is a database that stores configuration items and their relationships, whereas Configuration Management is the whole process of identifying, changing, recording and verifying. A CMDB without a supporting process quickly becomes outdated and loses its value.
How often should you check OT configurations for drift?
No standard prescribes a fixed frequency; a common rule of thumb is an automated comparison at least weekly and always after maintenance or a failure. For critical installations, comparing PLC projects daily with the last approved version is advisable, so an unrecorded change is noticed within a day.
Can Git be used for PLC programs?
Git works well for text-based configurations and scripts, but many PLC engineering environments store projects in binary formats that Git cannot compare meaningfully. That is why industrial companies often use specialised version control tools for PLCs that make differences in logic and hardware configuration readable.
Is Configuration Management mandatory under the Dutch Cybersecurity Act?
The Dutch Cybersecurity Act (Cyberbeveiligingswet) does not mention configuration management literally, but its duty of care requires appropriate measures for security in the acquisition, development and maintenance of systems. In practice, demonstrable configuration management, for example according to ISO 27002 control 8.9 or IEC 62443, is the usual way to meet that requirement.
📌 In summary
Configuration Management records how each configuration item is set up, maintains an approved baseline and checks whether reality still matches it. In OT this is especially important because installations last a long time, changes affect the physical process and unrecorded modifications would otherwise go unnoticed. Standards such as ISO 27002:2022, IEC 62443-3-3 and NIST SP 800-53 make it a standard security control, and it is indispensable for recovery after an incident.
Configuration Management gives you control over the technology: without an approved baseline, reliable service delivery, security or recovery from failures is barely possible, particularly in OT environments.