Overview
Drift occurs when actual configuration deviates from the baseline. Detecting drift early prevents misconfigurations, outages, and compliance failures.
Baseline Requirements
- Define approved configuration baselines
- Version baselines and store centrally
- Map baselines to standards (CIS, NIST, SOC 2)
- Document expected configuration values
- Review baselines regularly
Monitoring Requirements
- Enable continuous or scheduled configuration monitoring
- Monitor identity, network, storage, compute, and cloud resources
- Integrate monitoring with CI/CD pipelines
- Track configuration changes over time
- Ensure monitoring covers all baseline rules
Drift Detection Requirements
- Detect unauthorized or accidental configuration changes
- Record drift history for audits
- Detect drift in infrastructure-as-code and live resources
- Enable event-driven drift detection for critical resources
- Integrate drift detection with SIEM or ticketing systems
Alerting Requirements
- Send alerts for drift events
- Define severity levels for alerts
- Route alerts to appropriate teams
- Include remediation guidance in alerts
- Track alert resolution times
Remediation Requirements
- Define remediation workflows
- Assign remediation responsibilities
- Enable automated remediation where possible
- Verify remediation restores baseline alignment
- Document remediation actions for audits
Evidence Collection Requirements
- Store drift history and change logs
- Collect configuration snapshots
- Generate compliance reports
- Retain evidence according to policy
- Map evidence to compliance frameworks
Conceptual Diagram
Baseline → Monitoring → Drift Detection → Alerting → Remediation → Evidence Collection
Frequently Asked Questions
What is configuration drift detection?
Configuration drift detection identifies when actual configuration deviates from the approved baseline.
What should be included in a drift detection checklist?
A drift detection checklist should include baselines, monitoring, drift detection, alerting, remediation, and evidence collection.