Security configuration management and policy compliance tools provide a top-down baseline of the IT environment in relation to an organization’s defined security configuration policies. An organization can define its “gold-standard” environment — the desired state of system configurations and access rights — or it can use a predefined set of best-practice system security configuration templates (such as the Microsoft Security guide, the SANS Institute, the Center for Internet Security, the National Institute of Standards and Technology or the National Security Agency) or vendor-defined templates for regulatory compliance.
Source: Gartner
