PCI DSS 2.2.1: Develop and Implement Configuration Standards
Configuration standards are the foundation of a secure payment environment. PCI DSS 2.2.1 requires you to develop, implement, and maintain standards across all system components to prevent misconfigurations that expose cardholder data. Without standardized configurations, inconsistent security postures create compliance gaps and increase breach risk.
What this means
This control mandates that your organization establish and enforce configuration standards as documented policies for every system component in your cardholder data environment (CDE). These standards must define secure baseline configurations, specify which services and protocols are permitted, and ensure consistent application across all systems. Configuration standards are living documents that require regular review and updates as your environment evolves, new threats emerge, or systems are added or modified.
How to comply
- 1.Document baseline secure configuration standards for each system type (servers, network devices, databases, applications) in your CDE
- 2.Define which services, protocols, and ports are necessary and permitted; disable all others by default
- 3.Establish change control processes to ensure configurations align with standards before deployment
- 4.Implement automated configuration management tools to enforce and monitor compliance with standards
- 5.Schedule quarterly reviews of configuration standards to address new threats, system updates, and environmental changes
- 6.Train technical staff on configuration standards and the rationale behind each requirement
- 7.Maintain an inventory mapping each system to its applicable configuration standard
- 8.Document exceptions to standards with business justification and compensating controls where applicable
Evidence auditors look for
- Written configuration standards document approved by management with version control and dates
- Configuration baselines for each system type (hardening guides, security benchmarks)
- Evidence of automated enforcement (scripts, policy files, configuration management system logs)
- Change control tickets showing configuration changes validated against standards before implementation
- Audit logs from configuration management tools demonstrating compliance monitoring
- Documented quarterly review meetings with updated configuration standards and sign-off
- System inventory with configuration standard assignments per system
- Exception logs with business justifications and compensating controls documented
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates configuration standard mapping to your systems and continuously monitors for drift, flagging misconfigurations in real-time so you maintain 2.2.1 compliance without manual tracking across your entire CDE.
See how GRCWatch handles this control automatically
Start free trial