Domain: Information
Question:
A financial services company is migrating sensitive banking and identity workloads into AWS and is trying to tighten up both fraud operations and cloud security. One problem keeps coming up in its cloud-hosted fraud detection platform: configuration drift. Storage settings, IAM policies, fraud model thresholds, and security group rules keep changing over time, and not always in a controlled way. The result is inconsistent access controls, exposed fraud telemetry, and unapproved changes to detection logic that could weaken fraud defenses or even let an attacker influence scoring outcomes. Using the NIST 800-53 control mapping you have, especially the Configuration Management and Risk Assessment families (CM-2, CM-3, CM-6, SI-7, and RA-5), what should the fraud engineering or cyber-risk team put in place to lock in configuration baselines, control and track changes to fraud detection logic, and protect the integrity of fraud data and model pipelines over time?

Expected points in a correct answer:
States that managing configuration drift requires baselines to be established and continuously updated as changes occur in the environment.
Recommends taking an inventory of all currently deployed infrastructure as the first step toward establishing configuration baselines.
Recommends using AWS Config as a tool for conducting the infrastructure inventory required to establish configuration baselines.
Recommends using AWS IAM Access Analyzer as a tool for conducting the infrastructure inventory required to establish configuration baselines.
States that CM-2 (Baseline Configuration) requires baselines to represent hardened platform configurations that define the approved secure state all systems must maintain.
Recommends identifying out-of-scope permissions during the baseline establishment process to eliminate excessive access that persists regardless of default configurations.
States that systems, users, and service accounts must be granted the lowest amount of access possible regardless of what default configurations allow.
States that CM-6 (Configuration Settings) requires applying standardized secure defaults across all environments to reduce the risk of inconsistent access controls.
States that applying CM-6 ensures initial system configurations integrate security controls at the point of deployment rather than retroactively.
States that CM-3 (Configuration Change Control) requires organizations to implement change processes that include formal approval, documentation, and validation for all configuration modifications to ensure accountability and traceability.
Recommends that mature programs conduct weekly change management meetings in which stakeholders are informed about and can provide input on changes affecting their assets and tooling.
States that change management meetings are sessions in which changes are formally documented and rollback and backout procedures are established.
States that configuration baselines must be updated following change management sessions in accordance with both CM-2 and CM-3.
States that verifying baseline integrity requires confirming that a system's current state matches the expected state defined in the established baseline.
States that AWS Config can verify configurations against established baselines through the use of Config snapshots.
States that AWS KMS can be used to verify the integrity of CloudFormation templates as part of baseline integrity verification.
States that SI-7 (Software, Firmware, and Information Integrity) mechanisms must detect unauthorized or unexpected modifications to critical assets.
Recommends using Amazon Security Hub and AWS GuardDuty in combination to ingest and generate alerts for potentially out-of-scope changes in support of SI-7 integrity monitoring.
Recommends combining Security Hub and GuardDuty outputs with CloudTrail logs to verify that all assets are deploying configurations in the expected manner.
States that RA-5 (Vulnerability Monitoring) requires continuous scanning of the environment for misconfigurations and vulnerabilities that could be exploited.
Recommends performing vulnerability assessments and scanning while updating systems frequently to maintain a continued security posture.
Recommends AWS Inspector as a tool that satisfies RA-5 by providing both infrastructure vulnerability coverage and code-level vulnerability detection.
States that AWS Inspector enables a shift-left vulnerability detection methodology by identifying vulnerabilities earlier in the development and deployment lifecycle.
Recommends using automated tools (such as AWS Config) to detect when deployed infrastructure deviates from CM-2 baselines
Recommends maintaining a formal exception management process for approved deviations from CM-2 baselines that includes documented justification and defined expiration dates.
Recommends integrating Infrastructure as Code templates with CM-2 baseline definitions to enable repeatable and auditable configuration deployments across environments.
Recommends maintaining a configuration management database or equivalent asset register to support baseline tracking and CM-3 change management operations.
Recommends establishing a formal change advisory board as the designated governance body responsible for approving configuration changes in accordance with CM-3.
Recommends defining rollback and backout procedure success criteria before implementing changes to ensure recoverability can be verified if a change must be reversed.
Recommends mapping RA-5 vulnerability findings to the CM-3 change management process to ensure identified vulnerabilities are remediated through formal and trackable change control.
Recommends establishing a vulnerability remediation SLA that defines time-to-patch requirements based on the severity rating of each RA-5 finding.
Recommends extending SI-7 integrity monitoring scope to include configuration files, IAM policies, and network configurations in addition to system and firmware files.
Recommends conducting periodic reviews of established CM-2 baselines to ensure they remain aligned with evolving security requirements and organizational change.
Recommends using AWS Config Rules to automate continuous compliance checks against CM-2 baseline definitions without requiring manual configuration comparisons.
States that organizations should perform vulnerability assessments and scanning while also updating systems frequently to ensure continued security posture.