NIST SP 800-53 (controls) 5.1.1+u4
| Ref | Title | Text | |
|---|---|---|---|
| CM-01 | Policy and Procedures | a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] configuration management policy that: (a) Address | |
| CM-02 | Baseline Configuration | a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. [Assignment: frequency]; 2. When required due to [Assignme | |
| CM-02(01) in CM-2 |
Reviews and Updates withdrawn | ||
| CM-02(02) in CM-2 |
Automation Support for Accuracy and Currency | Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: automated mechanisms]. | |
| CM-02(03) in CM-2 |
Retention of Previous Configurations | Retain [Assignment: number] of previous versions of baseline configurations of the system to support rollback. | |
| CM-02(04) in CM-2 |
Unauthorized Software withdrawn | ||
| CM-02(05) in CM-2 |
Authorized Software withdrawn | ||
| CM-02(06) in CM-2 |
Development and Test Environments | Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration. | |
| CM-02(07) in CM-2 |
Configure Systems and Components for High-risk Areas | (a) Issue [Assignment: systems or system components] with [Assignment: configurations] to individuals traveling to locations that the organization deems to be of significant risk; and (b) Apply the following controls to the systems or compo | |
| CM-03 | Configuration Change Control | a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for securit | |
| CM-03(01) in CM-3 |
Automated Documentation, Notification, and Prohibition of Changes | Use [Assignment: automated mechanisms] to: (a) Document proposed changes to the system; (b) Notify [Assignment: approval authorities] of proposed changes to the system and request change approval; (c) Highlight proposed changes to the syste | |
| CM-03(02) in CM-3 |
Testing, Validation, and Documentation of Changes | Test, validate, and document changes to the system before finalizing the implementation of the changes. | |
| CM-03(03) in CM-3 |
Automated Change Implementation | Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: automated mechanisms]. | |
| CM-03(04) in CM-3 |
Security and Privacy Representatives | Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: configuration change control element]. | |
| CM-03(05) in CM-3 |
Automated Security Response | Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: security responses]. | |
| CM-03(06) in CM-3 |
Cryptography Management | Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: controls]. | |
| CM-03(07) in CM-3 |
Review System Changes | Review changes to the system [Assignment: frequency] or when [Assignment: circumstances] to determine whether unauthorized changes have occurred. | |
| CM-03(08) in CM-3 |
Prevent or Restrict Configuration Changes | Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: circumstances]. | |
| CM-04 | Impact Analyses | Analyze changes to the system to determine potential security and privacy impacts prior to change implementation. | |
| CM-04(01) in CM-4 |
Separate Test Environments | Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice. | |
| CM-04(02) in CM-4 |
Verification of Controls | After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system. | |
| CM-05 | Access Restrictions for Change | Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system. | |
| CM-05(01) in CM-5 |
Automated Access Enforcement and Audit Records | (a) Enforce access restrictions using [Assignment: automated mechanisms] ; and (b) Automatically generate audit records of the enforcement actions. | |
| CM-05(02) in CM-5 |
Review System Changes withdrawn | ||
| CM-05(03) in CM-5 |
Signed Components withdrawn | ||
| CM-05(04) in CM-5 |
Dual Authorization | Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information]. | |
| CM-05(05) in CM-5 |
Privilege Limitation for Production and Operation | (a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges [Assignment: organization-defined frequency]. | |
| CM-05(06) in CM-5 |
Limit Library Privileges | Limit privileges to change software resident within software libraries. | |
| CM-05(07) in CM-5 |
Automatic Implementation of Security Safeguards withdrawn | ||
| CM-06 | Configuration Settings | a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: common secure configurations]; b. Implement the co | |
| CM-06(01) in CM-6 |
Automated Management, Application, and Verification | Manage, apply, and verify configuration settings for [Assignment: system components] using [Assignment: organization-defined automated mechanisms]. | |
| CM-06(02) in CM-6 |
Respond to Unauthorized Changes | Take the following actions in response to unauthorized changes to [Assignment: configuration settings]: [Assignment: actions]. | |
| CM-06(03) in CM-6 |
Unauthorized Change Detection withdrawn | ||
| CM-06(04) in CM-6 |
Conformance Demonstration withdrawn | ||
| CM-07 | Least Functionality | a. Configure the system to provide only [Assignment: mission-essential capabilities] ; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined prohibited | |
| CM-07(01) in CM-7 |
Periodic Review | (a) Review the system [Assignment: frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove [Assignment: organization-defined functions, ports, protocols, software, a | |
| CM-07(02) in CM-7 |
Prevent Program Execution | Prevent program execution in accordance with [Selection (one or more): {{ insert: param, cm-07.02_odp.02 }} ; rules authorizing the terms and conditions of software program usage]. | |
| CM-07(03) in CM-7 |
Registration Compliance | Ensure compliance with [Assignment: registration requirements]. | |
| CM-07(04) in CM-7 |
Unauthorized Software — Deny-by-exception | (a) Identify [Assignment: software programs]; (b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and (c) Review and update the list of unauthorized software programs | |
| CM-07(05) in CM-7 |
Authorized Software — Allow-by-exception | (a) Identify [Assignment: software programs]; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and (c) Review and update the list of authorized software programs [Assign | |
| CM-07(06) in CM-7 |
Confined Environments with Limited Privileges | Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: user-installed software]. | |
| CM-07(07) in CM-7 |
Code Execution in Protected Environments | Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: personnel or roles] when such code is: (a) Obtained from sources with limited or n | |
| CM-07(08) in CM-7 |
Binary or Machine Executable Code | (a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and (b) Allow exceptions only for compelling mission or operational requirements and with the approv | |
| CM-07(09) in CM-7 |
Prohibiting The Use of Unauthorized Hardware | (a) Identify [Assignment: hardware components]; (b) Prohibit the use or connection of unauthorized hardware components; (c) Review and update the list of authorized hardware components [Assignment: frequency]. | |
| CM-08 | System Component Inventory | a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounting of components or components assigned to any other syst | |
| CM-08(01) in CM-8 |
Updates During Installation and Removal | Update the inventory of system components as part of component installations, removals, and system updates. | |
| CM-08(02) in CM-8 |
Automated Maintenance | Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined automated mechanisms]. | |
| CM-08(03) in CM-8 |
Automated Unauthorized Component Detection | (a) Detect the presence of unauthorized hardware, software, and firmware components within the system using [Assignment: organization-defined automated mechanisms] [Assignment: frequency] ; and (b) Take the following actions when unauthoriz | |
| CM-08(04) in CM-8 |
Accountability Information | Include in the system component inventory information, a means for identifying by [Selection (one or more): name; position; role] , individuals responsible and accountable for administering those components. | |
| CM-08(05) in CM-8 |
No Duplicate Accounting of Components withdrawn | ||
| CM-08(06) in CM-8 |
Assessed Configurations and Approved Deviations | Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory. | |
| CM-08(07) in CM-8 |
Centralized Repository | Provide a centralized repository for the inventory of system components. | |
| CM-08(08) in CM-8 |
Automated Location Tracking | Support the tracking of system components by geographic location using [Assignment: automated mechanisms]. | |
| CM-08(09) in CM-8 |
Assignment of Components to Systems | (a) Assign system components to a system; and (b) Receive an acknowledgement from [Assignment: personnel or roles] of this assignment. | |
| CM-09 | Configuration Management Plan | Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a process for identifying configuration items | |
| CM-09(01) in CM-9 |
Assignment of Responsibility | Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development. | |
| CM-10 | Software Usage Restrictions | a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and c. Con | |
| CM-10(01) in CM-10 |
Open-source Software | Establish the following restrictions on the use of open-source software: [Assignment: restrictions]. | |
| CM-11 | User-installed Software | a. Establish [Assignment: policies] governing the installation of software by users; b. Enforce software installation policies through the following methods: [Assignment: methods] ; and c. Monitor policy compliance [Assignment: frequency]. | |
| CM-11(01) in CM-11 |
Alerts for Unauthorized Installations withdrawn | ||
| CM-11(02) in CM-11 |
Software Installation with Privileged Status | Allow user installation of software only with explicit privileged status. | |
| CM-11(03) in CM-11 |
Automated Enforcement and Monitoring | Enforce and monitor compliance with software installation policies using [Assignment: organization-defined automated mechanisms]. | |
| CM-12 | Information Location | a. Identify and document the location of [Assignment: information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access to the system and system components w | |
| CM-12(01) in CM-12 |
Automated Tools to Support Information Location | Use automated tools to identify [Assignment: information by information type] on [Assignment: system components] to ensure controls are in place to protect organizational information and individual privacy. | |
| CM-13 | Data Action Mapping | Develop and document a map of system data actions. | |
| CM-14 | Signed Components | Prevent the installation of [Assignment: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization. |
66 of 1193.