Which term best describes the process by which an organization's information systems components are kept in a controlled state that meets security and compliance requirements?

Which term best describes the process by which an organization's information systems components are kept in a controlled state that meets security and compliance requirements?

• A. Change Control
• B. Change Management
• C. Configuration Management
• D. Backups

Answer: (C)

Keeping IT components in a controlled, auditable state that aligns with security and compliance baselines is what configuration management aims to achieve. It involves identifying and documenting each configuration item, establishing standard baselines, and tracking changes to prevent drift so systems stay consistent and secure. This includes maintaining a configuration management database, enforcing approved configurations, and ensuring that any changes are recorded and reversible if needed. These practices provide evidence of the current state and the history of modifications, which supports audits and regulatory requirements by showing that controls are actually in place across the environment. Change management or change control describe how changes are proposed, reviewed, and approved, but they don’t automatically ensure the ongoing, unified state of all components. Backups focus on recovering data, not maintaining the live configuration state. So, configuration management best captures the idea of keeping system components in a controlled state that meets security and compliance requirements.

Keeping IT components in a controlled, auditable state that aligns with security and compliance baselines is what configuration management aims to achieve. It involves identifying and documenting each configuration item, establishing standard baselines, and tracking changes to prevent drift so systems stay consistent and secure. This includes maintaining a configuration management database, enforcing approved configurations, and ensuring that any changes are recorded and reversible if needed. These practices provide evidence of the current state and the history of modifications, which supports audits and regulatory requirements by showing that controls are actually in place across the environment. Change management or change control describe how changes are proposed, reviewed, and approved, but they don’t automatically ensure the ongoing, unified state of all components. Backups focus on recovering data, not maintaining the live configuration state. So, configuration management best captures the idea of keeping system components in a controlled state that meets security and compliance requirements.