Configuration Management (CM)

Overview:The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system. Supplemental Guidance:Any changes to the hardware, software, and/or firmware components... Read More

Overview:The organization:(a) Identifies [Assignment: organization-defined software programs authorized to execute on the information system];(b) Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on... Read More

Overview:The information system enforces access restrictions and supports auditing of the enforcement actions. Related controls: AU-2, AU-12, AU-6, CM-3, CM-6. Action Items:1) Ensure only qualified personnel can implement changes 2) Ensure systems... Read More

Overview:The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components]. Supplemental Guidance: Related controls:CA-7, CM-4. Action... Read More

Overview:The organization:(a) Employs automated mechanisms [Assignment: organization-defined frequency] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and(b) Takes the following... Read More

Overview:The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system. Supplemental Guidance:Automated mechanisms that help organizations maintain... Read More

Overview:The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system. Supplemental Guidance:This control establishes baseline configurations for information systems and... Read More

Overview:The organization: a. Determines the types of changes to the information system that are configuration-controlled; b. Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with... Read More

Overview:The organization develops, documents, and implements a configuration management plan for the information system that:a. Addresses roles, responsibilities, and configuration management processes and procedures;b. Establishes a process for... Read More

Overview:The organization:a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:1. A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment,... Read More