Configuration Management (CM)

Overview:The organization reviews and updates the baseline configuration of the information system:(a) [Assignment: organization-defined frequency];(b) When required due to [Assignment organization-defined circumstances]; and(c) As an integral part... Read More

Overview:The organization analyzes changes to the information system to determine potential security impacts prior to change implementation. Supplemental Guidance:Organizational personnel with information security responsibilities (e.g., Information... Read More

Overview:The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by... Read More

Overview:The organization:a. Uses software and associated documentation in accordance with contract agreements and copyright laws;b. Tracks the use of software and associated documentation protected by quantity licenses to control copying and... Read More

Overview:The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates. Action Items:1) Update the inventory of system components for information... Read More

Overview:The organization:a. Establishes [Assignment: organization-defined policies] governing the installation of software by users;b. Enforces software installation policies through [Assignment: organization-defined methods]; andc. Monitors policy... Read More