In CyMetric, we apply cybersecurity controls to each information system according to the compliance objectives and security risk assessment you set for that system. Each time a new system is added with a compliance objective, a new set of controls is created. This set of controls applied to an information system is called a control instance. But for the most part, the controls are the same and are configured by you to act in the same manner. For instance, a control for logon attempts may require that the account be locked or inaccessible for some period of time after some number of failed logon attempts.If the configuration of this control is the same across all systems – for instance locking the account after three failed attempts, then there would only be one configuration for this control. But it may be appropriate to have two different configurations. While the primary configuration of this control may call for the account to be locked until unlocked by an authorized user, there could be information that is not that sensitive and is stored in a separate system which would not need this level of protection or where the level would be seen as too intrusive. In those situations the organization just may want to dissuade or prevent a robot from brute forcing its way into that system by locking the account for 15 minutes and then automatically unlocking it. If this is what the organization wants, then it would create a second configuration of the control and apply it to the systems that only need that level of protection. So, to summarize, "instances" are how many times each control, no matter how it is configured, exists in the CyMetric system for your organization and the "configuration" count lets you know how many different ways that particular control is configured.