system configuration setting

A modifiable parameter — residing in the hardware, software, or firmware of an information system — whose value affects the security posture, privacy posture, or operational behavior of that system. Configuration settings are "the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system," and the qualifier *system* situates that parameter at the level of the whole system rather than a sub-component or application in isolation. Covered products range from mainframe computers and servers to mobile devices and applications; concrete examples include registry settings, account and file permissions, and settings for protocols, ports, services, and remote connections. In practice, organizations establish and document these settings to reflect the most restrictive mode consistent with operational requirements, deriving system-specific values from organization-wide baselines that then become part of the system's configuration baseline.