BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CM-06 Configuration Settings

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged CM Low baselineModerate baselineHigh baseline

Title

Configuration Settings

Control

a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: common secure configurations];
b. Implement the configuration settings;
c. Identify, document, and approve any deviations from established configuration settings for [Assignment: system components] based on [Assignment: operational requirements] ; and
d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

Discussion

Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.

Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors.

Implementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB](#98498928-3ca3-44b3-8b1e-f48685373087) and security technical implementation guides (STIGs), which affect the implementation of [CM-6](#cm-6) and other controls such as [AC-19](#ac-19) and [CM-7](#cm-7) . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.

Parameters

cm-06_odp.01: common secure configurations
cm-06_odp.02: system components
cm-06_odp.03: operational requirements

Related controls

ac-19, ac-3, au-2, au-6, ca-9, cm-11, cm-2, cm-3, cm-5, cm-7, cp-10, cp-7, cp-9, ia-3, ia-5, pl-8, pl-9, ra-5, sa-4, sa-5, sa-8, sa-9, sc-18, sc-28, sc-43, si-2, si-4, si-6

STIG rules that implement this control 514

Apple iOS/iPadOS 26 V1R3

Apple iOS/iPadOS 27 V1R1

Apple macOS 15 (Sequoia) V1R8

Apple macOS 26 (Tahoe) V1R4

Application Security and Development V6R5

Canonical Ubuntu 22.04 LTS V2R10

Canonical Ubuntu 24.04 LTS V1R7

Cisco IOS XE Router NDM Y26M04

Google Android 16 COBO Y26M10

Google Android 17 COBO Y26M06

Google Chrome Current Windows V2R11

Microsoft Windows 11 V2R11

Microsoft Windows Server 2022 V2R11

Microsoft Windows Server 2025 V1R4

Red Hat Enterprise Linux 9 V2R10

Samsung Android 16 COBO Y26M10