Configuration Management

Overview:Define, document, approve, and enforce physical and logical access restrictions associated with changes to the information system. Action Items:3.4.5[a]Determine if: physical access restrictions associated with changes to the system are... Read More

Overview:Establish and maintain baseline configurations and inventories of organizational information systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles. Action Items:3.4.1[a... Read More

Overview:Apply deny-by-exception (blacklist) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software. Action Items:3.4.8[a]Determine if: a policy... Read More

Overview:Track, review, approve/disapprove, and audit changes to information systems. Action Items:3.4.3[a]Determine if: changes to the system are tracked. 3.4.3[b]Determine if: changes to the system are reviewed. 3.4.3[c]Determine if: changes to the... Read More

Overview:Restrict, disable, and prevent the use of nonessential programs, functions, ports, protocols, and services. Action Items:3.4.7[a]Determine if: essential programs are defined. 3.4.7[b]Determine if: the use of nonessential programs is defined.... Read More

Overview:Employ the principle of least functionality by configuring the information system to provide only essential capabilities. Action Items:3.4.6[a]Determine if: essential system capabilities are defined based on the principle of least... Read More

Overview:Establish and enforce security configuration settings for information technology products employed in organizational information systems. Action Items:3.4.2[a]Determine if: security configuration settings for information technology products... Read More

Overview:Analyze the security impact of changes prior to implementation. Action Items:3.4.4[a]Determine if: the security impact of changes to the system is analyzed prior to implementation. POTENTIAL ASSESSMENT METHODS AND OBJECTS 1Examine:... Read More

Overview:Control and monitor user-installed software. Action Items:3.4.9[a]Determine if: a policy for controlling the installation of software by users is established. 3.4.9[b]Determine if: installation of software by users is controlled based on the... Read More