Device configuration
Configuration compliance is a scan against an authoritative inventory, and the denominator is the hard part.
What the published 2016 guidance says
Configuration compliance is a scan against an authoritative inventory, and the denominator is the hard part. The construct counts devices configured to policy against the total, by type: registered devices, devices found but not registered, a platform or version, or mobile devices. The target is 100 percent. Evidence is the device inventory, the software inventory and the scan result. It is scanned every three days and reported immediately. Network management owns and collects it, and the technology lead is the client. The action is to disconnect, patch or revise the baseline.
What it means in practice
Configuration compliance is a scan against an authoritative inventory. The denominator is the hard part: registered devices, unregistered devices, a platform or version, mobile. State it. The action is as important as the percentage: disconnect, patch, or revise the baseline.
Status of this record. For B.28, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the device inventory and the configuration scan. Count compliant devices against the defined denominator. Report by device class. Record the action for each non-compliant device and the baseline review.
Evidence an assessor asks for
- Configuration managementAuthoritative device and software inventories
- Vulnerability managementConfiguration scan results every three days
- Configuration managementRecords of the disconnect, patch or guideline-revision action taken
The question an assessor will ask
An assessor will ask for authoritative device and software inventories. The test for B.28 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Unregistered devices found by scanning but excluded from the denominator
- Non-compliant hosts reported with no action recorded
Before the next review
Before the next review, test this against one live record: unregistered devices found by scanning but excluded from the denominator.
What to check when the revision publishes
When DIS 27004 is published, compare the B.28 Device configuration record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.