system configuration setting

A tunable parameter within the hardware, software, or firmware components of an information system that governs the system's security, privacy posture, or functional behavior. Such parameters are those that can be changed in the hardware, software, or firmware components of a system and affect its security and privacy posture or functionality; they include registry settings, account and file permission settings, and settings for functions, protocols, ports, services, and remote connections. Organizations employ these settings on commercial IT products — including mainframe computers, workstations, portable and mobile devices, and network components — as part of a holistic, defense-in-depth risk management strategy. In practice, the field uses the concept through control CM-6 of NIST SP 800-53, which requires organizations to establish and document configuration settings that reflect the most restrictive mode consistent with operational requirements, implement them, document approved deviations, and monitor and control changes to them in accordance with organizational policies.

Advisory only. A term this product ships is defined by an authority document, not by a search result.