Every quarter, vulnerability scans find the same insecure configuration setting on newly built servers, and the operations team corrects each server by hand. What should the information security manager recommend?

A finding that recurs on every new build points to a systemic cause, and the effective treatment addresses that cause rather than its instances. Here the build image or configuration baseline used to deploy servers contains the insecure setting, so each new server inherits it. Correcting the baseline, placing it under change control and verifying builds against it prevents the problem from reappearing and frees the operations team from repetitive manual work. Scanning more often shortens the window of exposure but leaves every new server deployed insecurely and keeps the manual workload. Adding staff to fix servers faster increases cost while preserving the defect in the process. Recording the setting as an accepted risk misuses acceptance: the risk is easily removable at its source, and nobody with authority has decided the exposure is tolerable. Exam caveat: root-cause analysis is a recurring CISM theme, and recurring findings almost always indicate a process or baseline problem rather than an individual system problem. Operational check: confirm the corrected baseline is version-controlled, that newly built servers are scanned at deployment, and that the recurring finding disappears from the next scan cycle.