{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Secure Configuration & Change Management","Vulnerability & Patch Management"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-800-30-threat-event"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-poor-baseline-drift","description":"Without documented, enforced baseline configurations and change control, systems drift into insecure states, contain unauthorized changes, or expose unnecessary network services, expanding attack surface.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"config-poor-baseline-drift","taxonomies":["iso-27005-vulnerability","nist-800-30-threat-event"],"treatment":"mitigate"},"id":"risk:config-poor-baseline-drift","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aconfig-poor-baseline-drift","sourceIds":["coso-ic","iso-27001","nist-800-53","nist-csf-2","nydfs-500","pci-dss","soc1","soc2","sox"],"sourceUrl":null,"title":"Poor configuration management and insecure baseline drift","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:43f1567b5887d1fa8d9380a632faafe3d4edf31d1160d3b278bdd6e23944dc3c","properties":{"rationale":"Gating changes through authorization and impact analysis prevents unauthorized changes that cause drift, though baseline monitoring is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:539d6269f1b8d523fe4babe83874b06eea8bd7b7f12e4aceead61cb24f28f376","properties":{"rationale":"Establishing enforced baselines and monitoring/remediating deviations is the direct defense against insecure configuration drift.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-01-8f911a32.json","sourceId":"uc:UC-CONFIG-01","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5d7c53dd765de59eb885dc1564cb02030584dd492b2532162044aa39a892b971","properties":{"rationale":"Integrity monitoring detects unauthorized changes and deviations from the trusted baseline.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-06-3863b890.json","sourceId":"uc:UC-VULN-06","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:610a50fbfce562d7abb329df448ae492410a9a88750151ea34b93e955dfdf08a","properties":{"rationale":"Requiring authorized, documented changes reduces the unauthorized changes that drive drift, though baseline monitoring is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-16-7a8d6d65.json","sourceId":"uc:UC-ACCESS-16","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6bd27af7de8c37306c757455fc856aa1a73c98fc45fc7ff859d7b45306ca6dab","properties":{"rationale":"Scans surface deviations from secure baselines (missing patches, insecure settings), flagging drift for remediation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-01-ec9a46fe.json","sourceId":"uc:UC-VULN-01","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a03a6c886e769fac0436dc1b51e316365b4763858182610cc4965151db1907f1","properties":{"rationale":"A documented CM plan defining how configuration items are identified and managed is the foundation enabling baseline control, but not the operative drift defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a147b69e4978a218885cf9aae5692339be7b34b9176dd725e6ff7b3d90e7b7e2","properties":{"rationale":"Restricting who can alter production and separating environments reduces ad-hoc unauthorized production changes that cause drift.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-03-3a08a2b1.json","sourceId":"uc:UC-CONFIG-03","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:eb92db02e2d2b5c8b8a77851e0e697fbeef61b8d8aa4d5a9b293e65885d627fc","properties":{"rationale":"Non-persistent provisioning and periodic refresh from known-good trusted sources revert configuration drift and unauthorized changes.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-vuln-09-01891801.json","sourceId":"uc:UC-VULN-09","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"}],"schemaVersion":1}