system configuration setting
163589·updated Sep 1, 2026A modifiable parameter — residing in the hardware, software, or firmware of an information system — whose value affects the security posture, privacy posture, or operational behavior of that system. Configuration settings are "the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system," and the qualifier *system* situates that parameter at the level of the whole system rather than a sub-component or application in isolation. Covered products range from mainframe computers and servers to mobile devices and applications; concrete examples include registry settings, account and file permissions, and settings for protocols, ports, services, and remote connections. In practice, organizations establish and document these settings to reflect the most restrictive mode consistent with operational requirements, deriving system-specific values from organization-wide baselines that then become part of the system's configuration baseline.
Source
system configurationthe sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A tunable parameter within the hardware, software, or firmware components of an information system that governs the system's security, privacy posture, or functional behavior. Such parameters are those that can be changed in the hardware, software, or firmware components of a system and affect its security and privacy posture or functionality; they include registry settings, account and file permission settings, and settings for functions, protocols, ports, services, and remote connections. Organizations employ these settings on commercial IT products — including mainframe computers, workstations, portable and mobile devices, and network components — as part of a holistic, defense-in-depth risk management strategy. In practice, the field uses the concept through control CM-6 of NIST SP 800-53, which requires organizations to establish and document configuration settings that reflect the most restrictive mode consistent with operational requirements, implement them, document approved deviations, and monitor and control changes to them in accordance with organizational policies.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- system configuration settings
- possessive
- system configuration setting's
- pluralpossessive
- system configuration settings'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A modifiable parameter — residing in the hardware, software, or firmware of an information system — whose value affects the security posture, privacy posture, or operational behavior of that system. Configuration settings are "the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system," and the qualifier *system* situates that parameter at the level of the whole system rather than a sub-component or application in isolation. Covered products range from mainframe computers and servers to mobile devices and applications; concrete examples include registry settings, account and file permissions, and settings for protocols, ports, services, and remote connections. In practice, organizations establish and document these settings to reflect the most restrictive mode consistent with operational requirements, deriving system-specific values from organization-wide baselines that then become part of the system's configuration baseline.DR-088 backfill from the noun definition column