Configuration-management operations must be restricted to administrative roles

Control Statement: System operations that permit changing the configuration of the instance must be granted only to roles designated as administrative.

Description: A subset of Creatio’s system operations permits modification of the instance itself rather than the data within it. This control requires that these be granted only to roles explicitly designated as administrative in the role inventory required by CSB-ROLE-001.

The operations in scope include those permitting a user to:

• manage configuration elements
• manage system settings
• manage workplace and section setup
• manage the user list, user licences, or portal users

Operation names are localised and vary between versions. Identify operations by the capability they confer.

Rationale: Configuration-management operations change how the instance behaves for everyone, and their effects persist beyond the session in which they were made. Managing system settings reaches the settings that several controls in this benchmark depend on, including the authentication settings in the AUTH category — so a user holding it can weaken the instance’s password policy or session handling without holding any authentication-specific permission. Managing configuration elements permits the introduction of code and schema changes into a production instance outside any deployment process, which defeats change control regardless of how rigorous that process is elsewhere.

Audit Procedure:

1. Obtain the list of roles designated administrative in the role inventory.
2. Open System Designer → Users and administration → Operation permissions.
3. Identify the operations conferring configuration-management capability, using the capability list above.
4. For each, review the roles granted permission to execute it.
5. Record as non-compliant every grant to a role not designated administrative.

Remediation:

1. For each non-compliant grant, determine whether the role requires the capability.
2. Where it does and the role is genuinely administrative, record that designation in the role inventory.
3. Where it does not, revoke the grant.
4. Where a non-administrative role requires a narrow capability the operation confers broadly, meet the need another way rather than granting the operation.

Default Value: Creatio ships configuration-management operations granted to its administrative roles. Whether the roles an organisation subsequently designates as administrative match those defaults is not something Creatio verifies or reports.