Configuration and Change Management
Key Takeaways
Subdomain 5.4 names configuration and change management under asset protection.
A documented configuration is the reference that changes are checked against.
Unplanned configuration changes are a security risk even when they are well meant.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 5.4, checked 2026-10-22.
Configuration Management
Subdomain 5.4, Understand asset protection, names configuration and change management. A documented configuration records how a system is supposed to be set up. Any later change should be compared with that record, so that unplanned differences are visible.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.4, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Why Undocumented Changes Matter
A setting changed to make a problem go away can open an exposure no one reviewed. In a scenario, prefer the answer that compares the change with the documented configuration and routes it through change management, rather than the answer that applies it directly.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.4: Asset lifecycle management (e.g., End Of Life (EOL) software and devices)
- 5.4: Configuration and change management
Common Traps
A common trap is making an undocumented change to fix an outage. Record the change against the documented configuration and route it through change management.
An administrator changes a server setting to fix an outage, without recording it. What does subdomain 5.4 point to as the gap?
Configuration and change management was not followed
The exam fee was too high for the candidate to afford when registering for the exam in this cycle
The subdomain 2.2 redundancy was too strong, so the server had no working backup to fall back on
Physical access was too limited to the server room, so no staff member could reach the console
A configuration answer should refer to the documented configuration as the reference for any change, so that the difference between the record and the system is visible.
Sections you finish are checked off in the contents.