CFG-02.4: Development & Test Environment Configurations
Mechanisms exist to manage baseline configurations for development and test environments separately from operational baseline configurations to minimize the risk of unintentional changes.
Control Question: Does the organization manage baseline configurations for development and test environments separately from operational baseline configurations to minimize the risk of unintentional changes?
General (14)
| Framework | Mapping Values |
|---|---|
| CSA CCM 4 | AIS-02 IVS-05 |
| ISO 27002 2022 | 8.25 |
| MPA Content Security Program 5.1 | TS-2.5 |
| NIST 800-53 R4 | CM-2(6) |
| NIST 800-53 R5 (source) | CM-2(6) |
| NIST 800-53 R5 (NOC) (source) | CM-2(6) |
| NIST 800-161 R1 | CM-2(6) |
| NIST 800-161 R1 Level 2 | CM-2(6) |
| NIST 800-161 R1 Level 3 | CM-2(6) |
| NIST 800-218 | PO.5 PO.5.2 |
| PCI DSS 4.0.1 (source) | 6.5.6 |
| PCI DSS 4.0.1 SAQ D Merchant (source) | 6.5.6 |
| PCI DSS 4.0.1 SAQ D Service Provider (source) | 6.5.6 |
| Shared Assessments SIG 2025 | I.1.1 |
US (4)
| Framework | Mapping Values |
|---|---|
| US DHS CISA SSDAF | 1 |
| US EO 14028 | 4e(i) |
| US HIPAA HICP Small Practice | 6.S.A |
| US - CA CCPA 2025 | 7123(c)(5)(B) |
EMEA (1)
| Framework | Mapping Values |
|---|---|
| EMEA Israel CDMO 1.0 | 10.1 10.2 |
APAC (2)
| Framework | Mapping Values |
|---|---|
| APAC New Zealand NZISM 3.6 | 18.1.10.C.01 18.1.10.C.02 18.1.10.C.03 18.1.10.C.04 |
| APAC Singapore MAS TRM 2021 | 5.7.3 |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to manage baseline configurations for development and test environments separately from operational baseline configurations to minimize the risk of unintentional changes.
Level 1 — Performed Informally
Configuration Management (CFG) efforts are ad hoc and inconsistent. CMM Level 1 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Standardized across the organization. o Consistently aligned with industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides).
- IT personnel use an informal process to design, build and maintain secure configurations for test, development, staging and production environments.
- Secure configurations are not:
Level 2 — Planned & Tracked
Configuration Management (CFG) efforts are requirements-driven and governed at a local/regional level, but are not consistent across the organization. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Configuration management is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
- IT/cybersecurity personnel identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for configuration management.
- Technologies are configured to protect data with the strength and integrity commensurate with the classification or sensitivity of the information and mostly conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides), including cryptographic protections for sensitive/regulated data.
- Special baseline configurations are created for higher-risk environments or for systems, applications and services that store, process or transmit sensitive/regulated data.
- Apart from workstation and server operating system baselines, configuration management is decentralized.
- Cybersecurity personnel use a structured process to design, build and maintain secure configurations for test, development, staging and production environments.
- Deviations to baseline configurations are required to have a risk assessment and the business process owner acceptance of the risk(s) associated with the deviation.
- Unauthorized configuration changes are investigated to determine if the unauthorized configuration is malicious in nature.
- Logical Access Control (LAC) is enforced to prohibit non-administrative users from being able to install unauthorized software.
Level 3 — Well Defined
Configuration Management (CFG) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- The configuration management function is formally assigned with defined roles and responsibilities.
- An IT infrastructure team, or similar function, ensures that statutory, regulatory and contractual cybersecurity and data privacy obligations are addressed to ensure secure configurations are designed, built and maintained.
- Configuration management is centralized for all operating systems, applications, servers and other configurable technologies.
- Technologies are configured to protect data with the strength and integrity commensurate with the classification or sensitivity of the information and conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides), including test, development, staging and production environments.
- Configurations conform to industry-recognized standards for hardening (e.g., DISA STIGs, CIS Benchmarks or OEM security guides) for test, development, staging and production environments.
- Deviations to baseline configurations are required to have a risk assessment and business process owner approval of the risk(s) associated with the deviation.
- Special baseline configurations are created for higher-risk environments or for systems, applications and services that store, process or transmit sensitive/regulated data.
- An IT Asset Management (ITAM) function, or similar function, ensures compliance with requirements for asset management.
- Logical Access Control (LAC) is used to limit the ability of non-administrators from making configuration changes to systems, applications and services, including the of installation of unauthorized software.
- A Security Incident Event Manager (SIEM), or similar automated tool, monitors for unauthorized activities, accounts, connections, devices and software.
- Unauthorized configuration changes are responded to in accordance with an Incident Response Plan (IRP) to determine if the unauthorized configuration is malicious in nature.
Level 4 — Quantitatively Controlled
Configuration Management (CFG) efforts are metrics driven and provide sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
- Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
- Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
- Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
- Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
- Both business and technical stakeholders are involved in reviewing and approving proposed changes.
Level 5 — Continuously Improving
Configuration Management (CFG) efforts are “world-class” capabilities that leverage predictive analysis (e.g., machine learning, AI, etc.). In addition to CMM Level 4 criteria, CMM Level 5 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Stakeholders make time-sensitive decisions to support operational efficiency, which may include automated remediation actions.
- Based on predictive analysis, process improvements are implemented according to “continuous improvement” practices that affect process changes.
Assessment Objectives
- CFG-02.4_A01 a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained.
- CFG-02.4_A02 a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.