Which of the following is the MAIN reason for using configuration management?

The main reason for using configuration management is to establish and maintain consistency in the performance and functional attributes of information systems. From a security perspective, this translates directly to providing consistency in security controls. By defining, documenting, and maintaining a secure baseline configuration, organizations ensure that all systems are hardened to a known, approved standard. This consistency is crucial for preventing security vulnerabilities that arise from unauthorized or ad-hoc changes, and it provides a reliable foundation for auditing, monitoring, and maintaining the organization's overall security posture.

1. National Institute of Standards and Technology (NIST) Special Publication 800-128

Guide for Security-Focused Configuration Management of Information Systems. Section 2

"Introduction

" states

"An organization establishes and maintains a secure configuration of its information systems through the implementation of a robust configuration management and control process... The focus of this publication is on the implementation of the security controls that are used to manage and control the configuration of an information system..." This directly links the purpose of configuration management to the consistent implementation of security controls.

2. National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5

Security and Privacy Controls for Information Systems and Organizations. The introduction to the Configuration Management (CM) control family states

"Configuration management and control are critical to establishing and maintaining the security of organizational systems." Control CM-2

"Baseline Configuration

" emphasizes the need to "develop

document

and maintain... a current baseline configuration of the system

" which is the foundation for consistency.

3. Carnegie Mellon University

Software Engineering Institute (SEI)

CMMI for Development

Version 1.3. CM Process Area

Specific Goal 1 (SG 1)

"Establish Baselines

" states

"Baselines of identified work products are established and maintained." The purpose is to provide a stable

consistent point of reference for development and management

which in a security context

applies to the system's security controls. (CMMI-DEV

V1.3

November 2010

p. 279).