<?xml version="1.0"?>

<rss version="2.0">


<channel>
<title>Home - All Categories - FedRAMP  - Configuration Management &amp;#40;CM&amp;#41;  </title>
<link>http://www.compliancewiki.org/category/fedramp/configuration-management-cm/12/</link>
<description>This RSS Feed contains Articles of Category in the knowledge base. You can click on the title to view its content. Powered by PHPKB (https://www.phpkb.com)</description>
<item>
										<guid>http://www.compliancewiki.org/article/updates-during-installations-and-removals-cm-8-1-659.html</guid>
										<title>Updates During Installations and Removals CM-8&#40;1&#41;</title>
										<link>http://www.compliancewiki.org/article/updates-during-installations-and-removals-cm-8-1-659.html</link>
										<description><![CDATA[Overview:The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates. Action Items:1) Update the inventory of system components for information...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/limit-production-and-operational-privileges-cm-5-5-651.html</guid>
										<title>Limit Production and Operational Privileges CM-5&#40;5&#41;</title>
										<link>http://www.compliancewiki.org/article/limit-production-and-operational-privileges-cm-5-5-651.html</link>
										<description><![CDATA[Overview:The organization:(a) Limits privileges to change information system components and system-related information within a production or operational environment; and(b) Reviews and reevaluates privileges [Assignment: organization-defined...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/configuration-management-plan-cm-9-662.html</guid>
										<title>Configuration Management Plan CM-9</title>
										<link>http://www.compliancewiki.org/article/configuration-management-plan-cm-9-662.html</link>
										<description><![CDATA[Overview:The organization develops, documents, and implements a configuration management plan for the information system that:a. Addresses roles, responsibilities, and configuration management processes and procedures;b. Establishes a process for...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/automation-support-for-accuracy-and-currency-cm-2-2-643.html</guid>
										<title>Automation Support for Accuracy and Currency CM-2&#40;2&#41;</title>
										<link>http://www.compliancewiki.org/article/automation-support-for-accuracy-and-currency-cm-2-2-643.html</link>
										<description><![CDATA[Overview:The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system. Supplemental Guidance:Automated mechanisms that help organizations maintain...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/configure-systems-components-or-devices-for-high-risk-areas-cm-2-7-645.html</guid>
										<title>Configure Systems, Components, or Devices for High-Risk Areas CM-2&#40;7&#41;</title>
										<link>http://www.compliancewiki.org/article/configure-systems-components-or-devices-for-high-risk-areas-cm-2-7-645.html</link>
										<description><![CDATA[Overview:The organization:(a) Issues [Assignment: organization-defined information systems, system components, or devices] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/configuration-change-control-cm-3-646.html</guid>
										<title>Configuration Change Control CM-3</title>
										<link>http://www.compliancewiki.org/article/configuration-change-control-cm-3-646.html</link>
										<description><![CDATA[Overview:The organization: a. Determines the types of changes to the information system that are configuration-controlled; b. Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/prevent-program-execution-cm-7-2-656.html</guid>
										<title>Prevent Program Execution CM-7&#40;2&#41;</title>
										<link>http://www.compliancewiki.org/article/prevent-program-execution-cm-7-2-656.html</link>
										<description><![CDATA[Overview:The information system prevents program execution in accordance with [Selection (one or more): [Assignment: organization-defined policies regarding software program usage and restrictions]; rules authorizing the terms and conditions of...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/software-usage-restrictions-cm-10-663.html</guid>
										<title>Software Usage Restrictions CM-10</title>
										<link>http://www.compliancewiki.org/article/software-usage-restrictions-cm-10-663.html</link>
										<description><![CDATA[Overview:The organization:a. Uses software and associated documentation in accordance with contract agreements and copyright laws;b. Tracks the use of software and associated documentation protected by quantity licenses to control copying and...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/configuration-settings-cm-6-652.html</guid>
										<title>Configuration Settings CM-6</title>
										<link>http://www.compliancewiki.org/article/configuration-settings-cm-6-652.html</link>
										<description><![CDATA[Overview:The organization:a. Establishes and documents configuration settings for information technology products employed within the information system using [Assignment: organization-defined security configuration checklists] that reflect the most...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/configuration-management-policy-and-procedures-cm-1-640.html</guid>
										<title>Configuration Management Policy and Procedures CM-1</title>
										<link>http://www.compliancewiki.org/article/configuration-management-policy-and-procedures-cm-1-640.html</link>
										<description><![CDATA[Overview:The organization:a. Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:1. A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment,...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/open-source-software-cm-10-1-664.html</guid>
										<title>Open Source Software CM-10&#40;1&#41;</title>
										<link>http://www.compliancewiki.org/article/open-source-software-cm-10-1-664.html</link>
										<description><![CDATA[Overview:The organization establishes the following restrictions on the use of open source software: [Assignment: organization-defined restrictions]. Supplemental Guidance:Open source software refers to software that is available in source code form....]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/periodic-review-cm-7-1-655.html</guid>
										<title>Periodic Review CM-7&#40;1&#41;</title>
										<link>http://www.compliancewiki.org/article/periodic-review-cm-7-1-655.html</link>
										<description><![CDATA[Overview:The organization:(a) Reviews the information system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and(b) Disables [Assignment: organization-defined functions,...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/information-system-component-inventory-cm-8-658.html</guid>
										<title>Information System Component Inventory CM-8</title>
										<link>http://www.compliancewiki.org/article/information-system-component-inventory-cm-8-658.html</link>
										<description><![CDATA[Overview:The organization:a. Develops and documents an inventory of information system components that:1. Accurately reflects the current information system;2. Includes all components within the authorization boundary of the information system;3. Is...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/security-impact-analysis-cm-4-647.html</guid>
										<title>Security Impact Analysis CM-4</title>
										<link>http://www.compliancewiki.org/article/security-impact-analysis-cm-4-647.html</link>
										<description><![CDATA[Overview:The organization analyzes changes to the information system to determine potential security impacts prior to change implementation. Supplemental Guidance:Organizational personnel with information security responsibilities (e.g., Information...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/automated-unauthorized-component-detection-cm-8-3-660.html</guid>
										<title>Automated Unauthorized Component Detection CM-8&#40;3&#41;</title>
										<link>http://www.compliancewiki.org/article/automated-unauthorized-component-detection-cm-8-3-660.html</link>
										<description><![CDATA[Overview:The organization:(a) Employs automated mechanisms [Assignment: organization-defined frequency] to detect the presence of unauthorized hardware, software, and firmware components within the information system; and(b) Takes the following...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/baseline-configuration-cm-2-641.html</guid>
										<title>Baseline Configuration CM-2</title>
										<link>http://www.compliancewiki.org/article/baseline-configuration-cm-2-641.html</link>
										<description><![CDATA[Overview:The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system. Supplemental Guidance:This control establishes baseline configurations for information systems and...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/access-restrictions-for-change-cm-5-648.html</guid>
										<title>Access Restrictions for Change CM-5</title>
										<link>http://www.compliancewiki.org/article/access-restrictions-for-change-cm-5-648.html</link>
										<description><![CDATA[Overview:The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system. Supplemental Guidance:Any changes to the hardware, software, and/or firmware components...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/signed-components-cm-5-3-650.html</guid>
										<title>Signed Components CM-5&#40;3&#41;</title>
										<link>http://www.compliancewiki.org/article/signed-components-cm-5-3-650.html</link>
										<description><![CDATA[Overview:The information system prevents the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/automated-access-enforcement-and-auditing-cm-5-1-649.html</guid>
										<title>Automated Access, Enforcement and Auditing CM-5&#40;1&#41;</title>
										<link>http://www.compliancewiki.org/article/automated-access-enforcement-and-auditing-cm-5-1-649.html</link>
										<description><![CDATA[Overview:The information system enforces access restrictions and supports auditing of the enforcement actions. Related controls: AU-2, AU-12, AU-6, CM-3, CM-6. Action Items:1) Ensure only qualified personnel can implement changes 2) Ensure systems...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/least-functionality-cm-7-654.html</guid>
										<title>Least Functionality CM-7</title>
										<link>http://www.compliancewiki.org/article/least-functionality-cm-7-654.html</link>
										<description><![CDATA[Overview:The organization:a. Configures the information system to provide only essential capabilities; andb. Prohibits or restricts the use of the following functions, ports, protocols, and/or services: [Assignment: organization-defined prohibited or...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/reviews-and-updates-cm-2-1-642.html</guid>
										<title>Reviews and Updates CM-2&#40;1&#41;</title>
										<link>http://www.compliancewiki.org/article/reviews-and-updates-cm-2-1-642.html</link>
										<description><![CDATA[Overview:The organization reviews and updates the baseline configuration of the information system:(a) [Assignment: organization-defined frequency];(b) When required due to [Assignment organization-defined circumstances]; and(c) As an integral part...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/automated-general-management-and-application-and-verification-cm-6-1-653.html</guid>
										<title>Automated General Management and Application and Verification CM-6&#40;1&#41;</title>
										<link>http://www.compliancewiki.org/article/automated-general-management-and-application-and-verification-cm-6-1-653.html</link>
										<description><![CDATA[Overview:The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components]. Supplemental Guidance: Related controls:CA-7, CM-4. Action...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/retention-of-previous-configurations-cm-2-3-644.html</guid>
										<title>Retention of Previous Configurations CM-2&#40;3&#41;</title>
										<link>http://www.compliancewiki.org/article/retention-of-previous-configurations-cm-2-3-644.html</link>
										<description><![CDATA[Overview:The organization retains [Assignment: organization-defined previous versions of baseline configurations of the information system] to support rollback. Supplemental Guidance:Retaining previous versions of baseline configurations to support...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/no-duplicate-accounting-of-components-cm-8-5-661.html</guid>
										<title>No Duplicate Accounting of Components CM-8&#40;5&#41;</title>
										<link>http://www.compliancewiki.org/article/no-duplicate-accounting-of-components-cm-8-5-661.html</link>
										<description><![CDATA[Overview:The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system inventories. Supplemental Guidance:This control enhancement addresses the potential...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/authorized-software-and-whitelisting-cm-7-5-657.html</guid>
										<title>Authorized Software and Whitelisting CM-7&#40;5&#41;</title>
										<link>http://www.compliancewiki.org/article/authorized-software-and-whitelisting-cm-7-5-657.html</link>
										<description><![CDATA[Overview:The organization:(a) Identifies [Assignment: organization-defined software programs authorized to execute on the information system];(b) Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on...]]></description>

									</item>
<item>
										<guid>http://www.compliancewiki.org/article/user-installed-software-cm-11-665.html</guid>
										<title>User-Installed Software CM-11</title>
										<link>http://www.compliancewiki.org/article/user-installed-software-cm-11-665.html</link>
										<description><![CDATA[Overview:The organization:a. Establishes [Assignment: organization-defined policies] governing the installation of software by users;b. Enforces software installation policies through [Assignment: organization-defined methods]; andc. Monitors policy...]]></description>

									</item>

</channel>

</rss>