+CM-05 [H] Access Restrictions for Change
---+CM-05(01) [H] Automated Access Enforcement and Audit Records

CM-05 [H] Access Restrictions for Change

Control

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Discussion

Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).

Assessment Objective

  1. physical access restrictions associated with changes to the system are defined and documented;
  2. physical access restrictions associated with changes to the system are approved;
  3. physical access restrictions associated with changes to the system are enforced;
  4. logical access restrictions associated with changes to the system are defined and documented;
  5. logical access restrictions associated with changes to the system are approved;
  6. logical access restrictions associated with changes to the system are enforced.

Assessment Method

Examine

Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records

Interview

Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators

1. Oversigt

CM-05(01) [H] Automated Access Enforcement and Audit Records

Control

  1. Enforce access restrictions using [Assignement: automated mechanisms] ; and
  2. Automatically generate audit records of the enforcement actions.

Discussion

Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes.

Assessment Objective

  1. access restrictions for change are enforced using [Assignement: automated mechanisms];
  2. audit records of enforcement actions are automatically generated.

Assessment Method

Examine

Configuration management policy procedures addressing access restrictions for changes to the system system design documentation system architecture and configuration documentation system configuration settings and associated documentation change control records system audit records system security plan other relevant documents or records

Interview

Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by CM-05 [H] Access Restrictions for Change – Assessment Procedure
is blocked by Access Restriction For Change