03.04 Configuration Management

Statement

• a. Develop and maintain under configuration control, a current baseline configuration of the system.

• b. Review and update the baseline configuration of the system {{ insert: param, A.03.04.01.ODP.01 }} and when system components are installed or modified.

Guidance

Baseline configurations for the system and system components include aspects of connectivity, operation, and communications. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for the system or configuration items within the system. Baseline configurations serve as a basis for future builds, releases, or changes to the system and include information about system components, operational procedures, network topology, and the placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as the system changes over time. Baseline configurations of the system reflect the current enterprise architecture.

Assessment objective

a current baseline configuration of the system is developed.

Assessment objective

a current baseline configuration of the system is maintained under configuration control.

Assessment objective

the baseline configuration of the system is updated {{ insert: param, A.03.04.01.ODP.01 }}.

Assessment objective

the baseline configuration of the system is reviewed when system components are installed or modified.

Assessment objective

the baseline configuration of the system is updated when system components are installed or modified.

Assessment objective

the baseline configuration of the system is reviewed {{ insert: param, A.03.04.01.ODP.01 }}.

Assessment method

• configuration management policy and procedures procedures for the baseline system configuration configuration management plan enterprise architecture system design documentation system architecture system configuration settings system component inventory change control records system security plan other relevant documents or records

Assessment method

• personnel with configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing baseline configurations mechanisms for supporting configuration control of the baseline configuration

Statement

• a. Establish, document, and implement the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements: {{ insert: param, A.03.04.02.ODP.01 }} .

• b. Identify, document, and approve any deviations from established configuration settings.

Guidance

Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system and that affect the security posture or functionality of the system. Security-related configuration settings can be defined for systems (e.g., servers, workstations), input and output devices (e.g., scanners, copiers, printers), network components (e.g., firewalls, routers, gateways, voice and data switches, wireless access points, network appliances, sensors), operating systems, middleware, and applications. Security parameters are those parameters that impact the security state of the system, including the parameters required to satisfy other security requirements. Security parameters include registry settings; account, file, and directory permission settings (i.e., privileges); and settings for functions, ports, protocols, and remote connections. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for the system. The established settings become part of the system’s configuration baseline. Common secure configurations (also referred to as security configuration checklists, lockdown and hardening guides, security reference guides, and security technical implementation guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for specific information technology platforms/products and instructions for configuring those system components to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, consortia, academia, industry, federal agencies, and other organizations in the public and private sectors.

Assessment objective

the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: {{ insert: param, A.03.04.02.ODP.01 }}.

Assessment objective

any deviations from established configuration settings are identified and documented.

Assessment objective

any deviations from established configuration settings are approved.

Assessment objective

the following configuration settings for the system are implemented: {{ insert: param, A.03.04.02.ODP.01 }}.

Assessment method

• configuration management policy and procedures procedures for system configuration settings configuration management plan system design documentation system configuration settings common secure configuration checklists system component inventory evidence supporting approved deviations from established configuration settings change control records system data processing and retention permissions system audit records system security plan other relevant documents or records

Assessment method

• personnel with security configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing configuration settings mechanisms that implement, monitor, or control system configuration settings mechanisms that identify or document deviations from established configuration settings

Statement

• a. Define the types of changes to the system that are configuration-controlled.

• b. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit consideration for security impacts.

• c. Implement and document approved configuration-controlled changes to the system.

• d. Monitor and review activities associated with configuration-controlled changes to the system.

Guidance

Configuration change control refers to tracking, reviewing, approving or disapproving, and logging changes to the system. Specifically, it involves the systematic proposal, justification, implementation, testing, review, and disposition of changes to the system, including system upgrades and modifications. Configuration change control includes changes to baseline configurations for system components (e.g., operating systems, applications, firewalls, routers, mobile devices) and configuration items of the system, changes to configuration settings, unscheduled and unauthorized changes, and changes to remediate vulnerabilities. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.04.04) 03.04.04.

Assessment objective

the types of changes to the system that are configuration-controlled are defined.

Assessment objective

proposed configuration-controlled changes to the system are reviewed with explicit consideration for security impacts.

Assessment objective

proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security impacts.

Assessment objective

activities associated with configuration-controlled changes to the system are monitored.

Assessment objective

activities associated with configuration-controlled changes to the system are reviewed.

Assessment objective

approved configuration-controlled changes to the system are implemented.

Assessment objective

approved configuration-controlled changes to the system are documented.

Assessment method

• configuration management policy and procedures procedures for system configuration change control configuration management plan system architecture configuration settings change control records system audit records change control audit and review reports agenda, minutes, and documentation from configuration change control oversight meetings system security plan other relevant documents or records

Assessment method

• personnel with configuration change control responsibilities personnel with information security responsibilities members of change control board or similar system administrators

Assessment method

• processes for configuration change control mechanisms that implement configuration change control

Statement

• a. Analyze changes to the system to determine potential security impacts prior to change implementation.

• b. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.

Guidance

Organizational personnel with security responsibilities conduct impact analyses that include reviewing system security plans, policies, and procedures to understand security requirements; reviewing system design documentation and operational procedures to understand how system changes might affect the security state of the system; reviewing the impacts of system changes on supply chain partners with stakeholders; and determining how potential changes to a system create new risks and the ability to mitigate those risks. Impact analyses also include risk assessments to understand the impacts of changes and determine whether additional security requirements are needed. Changes to the system may affect the safeguards and countermeasures previously implemented. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.04.03)03.04.03. Not all changes to the system are configuration controlled.

Assessment objective

the security requirements for the system continue to be satisfied after the system changes have been implemented.

Assessment objective

changes to the system are analyzed to determine potential security impacts prior to change implementation.

Assessment method

• configuration management policy and procedures procedures for security impact analyses for system changes configuration management plan security impact analysis documentation system design documentation analysis tools and outputs change control records system audit records system security plan other relevant documents or records

Assessment method

• personnel with security impact analysis responsibilities personnel with information security responsibilities members of change control board system developers system administrators

Assessment method

• processes for security impact analyses

Statement

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Guidance

Changes to the hardware, software, or firmware components of the system or the operational procedures related to the system can have potentially significant effects on the security of the system. Therefore, organizations permit only qualified and authorized individuals to access the system for the purpose of initiating changes. Access restrictions include physical and logical access controls, software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into the system), and change windows (i.e., changes occur only during specified times).

Assessment objective

physical access restrictions associated with changes to the system are defined and documented.

Assessment objective

physical access restrictions associated with changes to the system are approved.

Assessment objective

physical access restrictions associated with changes to the system are enforced.

Assessment objective

logical access restrictions associated with changes to the system are defined and documented.

Assessment objective

logical access restrictions associated with changes to the system are approved.

Assessment objective

logical access restrictions associated with changes to the system are enforced.

Assessment method

• configuration management policy and procedures procedures for access restrictions for system changes configuration management plan system design documentation system architecture system configuration settings logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records

Assessment method

• personnel with logical access control responsibilities personnel with physical access control responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing access restrictions for system changes mechanisms for supporting, implementing, or enforcing access restrictions associated with system changes

Statement

• a. Configure the system to provide only mission-essential capabilities.

• b. Prohibit or restrict use of the following functions, ports, protocols, connections, and services: {{ insert: param, A.03.04.06.ODP.01 }} .

• c. Review the system {{ insert: param, A.03.04.06.ODP.06 }} to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.

• d. Disable or remove functions, ports, protocols, connections, and services that are unnecessary or nonsecure.

Guidance

Systems can provide a variety of functions and services. Some functions and services that are routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. It may be convenient to provide multiple services from single system components. However, doing so increases risk over limiting the services provided by any one component. Where feasible, organizations limit functionality to a single function per component. Organizations review the functions and services provided by the system or system components to determine which functions and services are candidates for elimination. Organizations disable unused or unnecessary physical and logical ports and protocols to prevent the unauthorized connection of devices, the transfer of information, and tunneling. Organizations can employ network scanning tools, intrusion detection and prevention systems, and endpoint protection systems (e.g., firewalls and host-based intrusion detection systems) to identify and prevent the use of prohibited functions, ports, protocols, system connections, and services. Bluetooth, File Transfer Protocol (FTP), and peer-to-peer networking are examples of the types of protocols that organizations consider eliminating, restricting, or disabling.

Assessment objective

the use of the following functions is prohibited or restricted: {{ insert: param, A.03.04.06.ODP.01 }}.

Assessment objective

the use of the following ports is prohibited or restricted: {{ insert: param, A.03.04.06.ODP.02 }}.

Assessment objective

the use of the following protocols is prohibited or restricted: {{ insert: param, A.03.04.06.ODP.03 }}.

Assessment objective

the use of the following connections is prohibited or restricted: {{ insert: param, A.03.04.06.ODP.04 }}.

Assessment objective

the use of the following services is prohibited or restricted: {{ insert: param, A.03.04.06.ODP.05 }}.

Assessment objective

the system is reviewed {{ insert: param, A.03.04.06.ODP.06 }} to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.

Assessment objective

unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.

Assessment objective

the system is configured to provide only mission-essential capabilities.

Assessment method

• configuration management policy and procedures procedures for least functionality in the system configuration management plan system design documentation system configuration settings system component inventory common secure configuration checklists documented reviews of functions, ports, protocols, and services change control records system audit records system security plan other relevant documents or records

Assessment method

• personnel with configuration management responsibilities personnel with responsibilities for reviewing functions, ports, protocols, and services personnel with information security responsibilities system developers system administrators

Assessment method

• processes for prohibiting or restricting functions, ports, protocols, and services processes for reviewing or disabling functions, ports, protocols, and services mechanisms for implementing the review and disabling of functions, ports, protocols, and services mechanisms for implementing restrictions on or the prohibition of functions, ports, protocols, and services

Statement

• a. Identify software programs authorized to execute on the system.

• b. Implement a deny-all, allow-by-exception policy for the execution of authorized software programs on the system.

• c. Review and update the list of authorized software programs {{ insert: param, A.03.04.08.ODP.01 }}.

Guidance

If provided with the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved “app stores.” The policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods. Authorized software programs can be limited to specific versions or come from specific sources. To facilitate a comprehensive authorized software process and increase the strength of protection against attacks that bypass application-level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries.

Assessment objective

software programs authorized to execute on the system are identified.

Assessment objective

a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.

Assessment objective

the list of authorized software programs is reviewed and updated {{ insert: param, A.03.04.08.ODP.01 }}.

Assessment method

• configuration management policy and procedures procedures for least functionality in the system configuration management plan system design documentation system configuration settings list of software programs authorized to execute on the system system component inventory records associated with the review and update of the list of authorized software programs common secure configuration checklists change control records system audit records system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for identifying software authorized to execute on the system personnel with information security responsibilities system administrators

Assessment method

• processes for identifying, reviewing, and updating programs authorized to execute on the system processes for implementing authorized software policy mechanisms for supporting or implementing authorized software policy

Statement

• a. Develop and document an inventory of system components.

• b. Review and update the system component inventory {{ insert: param, A.03.04.10.ODP.01 }}.

• c. Update the system component inventory as part of installations, removals, and system updates.

Guidance

System components are discrete, identifiable assets (i.e., hardware, software, and firmware elements) that compose a system. Organizations may implement centralized system component inventories that include components from all systems. In such situations, organizations ensure that the inventories include the system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, software license information, hardware inventory specifications, and — for networked components — the machine names and network addresses for all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include component type, physical location, date of receipt, manufacturer, cost, model, serial number, and supplier information.

Assessment objective

an inventory of system components is developed and documented.

Assessment objective

the system component inventory is reviewed {{ insert: param, A.03.04.10.ODP.01 }}.

Assessment objective

the system component inventory is updated {{ insert: param, A.03.04.10.ODP.01 }}.

Assessment objective

the system component inventory is updated as part of component installations.

Assessment objective

the system component inventory is updated as part of component removals.

Assessment objective

the system component inventory is updated as part of system updates.

Assessment method

• configuration management policy and procedures procedures for system component inventory configuration management plan system design documentation system component inventory inventory reviews and update records component installation records change control records component removal records system change records system security plan other relevant documents or records

Assessment method

• personnel with component inventory management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing the system component inventory mechanisms for supporting or implementing the system component inventory processes for updating the system component inventory mechanisms for supporting or implementing the system component inventory updates

Statement

• a. Identify and document the location of CUI and the system components on which the information is processed and stored.

• b. Document changes to the system or system component location where CUI is processed and stored.

Guidance

Information location addresses the need to understand the specific system components where CUI is being processed and stored and the users who have access to CUI so that appropriate protection mechanisms can be provided, including information flow controls, access controls, and information management.

Assessment objective

the location of CUI is identified and documented.

Assessment objective

the system components on which CUI is processed are identified and documented.

Assessment objective

the system components on which CUI is stored are identified and documented.

Assessment objective

changes to the system or system component location where CUI is processed are documented.

Assessment objective

changes to the system or system component location where CUI is stored are documented.

Assessment method

• configuration management policy and procedures configuration management plan procedures for identification and documentation of information location system audit records architecture documentation system design documentation list of users with system and system component access change control records system component inventory system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing information location and user access personnel with responsibilities for operating, using, or maintaining the system personnel with information security responsibilities system developers system administrators

Assessment method

• processes governing information location mechanisms for enforcing policies and methods for governing information location

Statement

• a. Issue systems or system components with the following configurations to individuals traveling to high-risk locations: {{ insert: param, A.03.04.12.ODP.01 }}.

• b. Apply the following security requirements to the systems or components when the individuals return from travel: {{ insert: param, A.03.04.12.ODP.02 }}.

Guidance

When it is known that a system or a system component will be in a high-risk area, additional security requirements may be needed to counter the increased threat. Organizations can implement protective measures on the systems or system components used by individuals departing on and returning from travel. Actions include determining whether the locations are of concern, defining the required configurations for the components, ensuring that the components are configured as intended before travel is initiated, and taking additional actions after travel is completed. For example, systems going into high-risk areas can be configured with sanitized hard drives, limited applications, and more stringent configuration settings. Actions applied to mobile devices upon return from travel include examining the device for signs of physical tampering and purging and reimaging the device storage.

Assessment objective

systems or system components with the following configurations are issued to individuals traveling to high-risk locations: {{ insert: param, A.03.04.12.ODP.01 }}.

Assessment objective

the following security requirements are applied to the system or system components when the individuals return from travel: {{ insert: param, A.03.04.12.ODP.02 }}.

Assessment method

• configuration management policy and procedures configuration management plan procedures for the baseline configuration of the system procedures for system component installations and upgrades system component inventory system component installations or upgrades and associated records records of system baseline configuration reviews and updates system configuration settings system architecture change control records system security plan other relevant documents or records

Assessment method

• personnel with configuration management responsibilities personnel with information security responsibilities system administrators

Assessment method

• processes for managing baseline configurations