TR-C Domain 3: Implementation and Configuration
TR-C Domain 3, Implementation and Configuration, tests whether you can move an approved design into a controlled production state. Expect questions on secure configuration baselines, change management, environment separation, secrets handling, least privilege, peer review, testing, rollback, and implementation evidence. The exam distinguishes “configured” from “validated”: a setting is not a control until it is applied, tested, and monitored.
Core rules
- Define a configuration baseline for each component and record deviations as exceptions with owners and expiry dates.
- Separate development, test, and production. Promote changes through a pipeline or documented approval path rather than editing production directly.
- Keep secrets out of code, scripts, and tickets. Use a secrets manager and rotate credentials after exposure.
- Apply least privilege to service accounts, deployment identities, and administrators. Avoid shared accounts and standing high privilege.
- Require peer review, pre-change testing, a rollback plan, and post-change validation. Retain the approval, test result, and validation evidence.
Worked example
A team deploys a new logging agent to production servers. The baseline specifies TLS to the collector, a local buffer, and restricted agent permissions. The change is defined in infrastructure-as-code, peer-reviewed, and tested in staging against a sample server. A change ticket links the approval, test output, and rollback command. Production is rolled out in waves; after each wave, the team validates that logs arrive, checks CPU impact, and confirms the buffer works during a collector outage. The implementation record includes the validated configuration hash and the date of the next review.
Traps
Hard-coded credentials and undocumented manual console changes are common failures. Do not test in production first. Do not assume a tool’s policy enforces itself; verify endpoint state. Do not close a change without validation evidence. Do not let emergency changes bypass retrospective review, and do not leave configuration drift undetected between releases.