Direct answer
A drift review compares current effective state with a documented expected baseline, then investigates differences with the responsible owner. Treat a mismatch as a question to validate, not automatic proof of compromise.
Choose the reference baseline
Record the relevant asset, approved configuration version, owner and observation date. A firewall rule for a production gateway should be compared with its own intended policy, not a generic workstation setting.
Reference: NIST SP 800-137: Information Security Continuous Monitoring.
Identify and classify differences
A new inbound rule, changed public DNS record or additional privileged role can be intentional or accidental. Record the actual effective value and the relevant change reference. An inventory report may be stale, so verify the source and time.
- Identify business owner and change authority.
- Distinguish expected changes, unknown state and confirmed deviations.
- Record affected assets and network paths.
Investigate with owners
Ask whether the change was approved, why it is needed and whether related controls remain effective. If a public service appears unexpectedly, verify ownership and authorization before active testing. Escalate suspicious changes through the organization's incident process.
Reference: NIST SP 800-61 Rev. 3: Incident Response.
Restore or update the baseline
Apply an approved correction or document the legitimate change and update the baseline. Retest the effective state and critical workflow, then schedule follow-up monitoring. Retain the prior observation and decision for auditability.
Assessment limits
A baseline comparison can miss unmonitored assets and unauthorized changes outside the observed controls. It is not a complete compromise assessment.
Frequently asked questions
Is every configuration difference a security incident?
No. Changes can be authorized. Validate the effective state, approval and business purpose.
Does a baseline match prove a system is safe?
No. It only shows selected settings match the reference at the time measured.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.