CM-03(05) Automated Security Response
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Automated Security Response
Control
Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: security responses].
Discussion
Automated security responses include halting selected system functions, halting system processing, and issuing alerts or notifications to organizational personnel when there is an unauthorized modification of a configuration item.
Parameters
cm-03.05_odp: security responses
Assessment objective
CM-03(05) [Assignment: security responses] are automatically implemented if baseline configurations are changed in an unauthorized manner.
STIG rules that implement this control 9
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-651020 CAT II Ubuntu 22.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100130 CAT II Ubuntu 24.04 LTS must notify designated personnel if baseline configurations are changed in an unauthorized manner. The file integrity tool must notify the system administrator (SA) when changes to the baseline configuration or anomalies in the operation of any security functions are discovered.
Microsoft Windows Server 2022 V2R11
- WN22-00-000220 CAT II Windows Server 2022 system files must be monitored for unauthorized changes.
Microsoft Windows Server 2025 V1R4
- WN25-00-000220 CAT II Windows Server 2025 system files must be monitored for unauthorized changes.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200520 CAT II RHEL 10 must have the "s-nail" package installed.
- RHEL-10-200633 CAT II RHEL 10 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-215095 CAT II RHEL 9 must have the s-nail package installed.
- RHEL-09-651010 CAT II RHEL 9 must have the AIDE package installed.
- RHEL-09-651015 CAT II RHEL 9 must routinely check the baseline configuration for unauthorized changes and notify the system administrator when anomalies in the operation of any security functions are discovered.