+CM-05 Access Restrictions for Change
---+CM-05(01) Automated Access Enforcement and Audit Records
---+CM-05(04) Dual Authorization
---+CM-05(05) Privilege Limitation for Production and Operation
---+CM-05(06) Limit Library Privileges

CM-05 Access Restrictions for Change

Control

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Discussion

Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).

Assessment Objective

physical access restrictions associated with changes to the system are defined and documented;
physical access restrictions associated with changes to the system are approved;
physical access restrictions associated with changes to the system are enforced;
logical access restrictions associated with changes to the system are defined and documented;
logical access restrictions associated with changes to the system are approved;
logical access restrictions associated with changes to the system are enforced.

Assessment Method

Examine

Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records

Interview

Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators

1. Overview

Summary	Standard
CM-05(01) Automated Access Enforcement and Audit Records	Control Enforce access restrictions using [Assignement: automated mechanisms] ; and Automatically generate audit records of the enforcement actions. Discussion Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes. Assessment Objective access restrictions for change are enforced using [Assignement: automated mechanisms]; audit records of enforcement actions are automatically generated. Assessment Method Examine Configuration management policy procedures addressing access restrictions for changes to the system system design documentation system architecture and configuration documentation system configuration settings and associated documentation change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators
CM-05(04) Dual Authorization	Control Enforce dual authorization for implementing changes to [Assignement: organization-defined system components and system-level information]. Discussion Organizations employ dual authorization to help ensure that any changes to selected system components and information cannot occur unless two qualified individuals approve and implement such changes. The two individuals possess the skills and expertise to determine if the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures. Assessment Objective dual authorization for implementing changes to [Assignement: system components] is enforced; dual authorization for implementing changes to [Assignement: system-level information] is enforced. Assessment Method Examine Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation change control records system audit records system component inventory system information types information system security plan other relevant documents or records Interview Organizational personnel with dual authorization enforcement responsibilities for implementing system changes organizational personnel with information security responsibilities system/network administrators
CM-05(05) Privilege Limitation for Production and Operation	Control Limit privileges to change system components and system-related information within a production or operational environment; and Review and reevaluate privileges [Assignement: organization-defined frequency]. Discussion In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures. Assessment Objective privileges to change system components within a production or operational environment are limited; privileges to change system-related information within a production or operational environment are limited; privileges are reviewed [Assignement: frequency]; privileges are reevaluated [Assignement: frequency]. Assessment Method Examine Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation user privilege reviews user privilege recertifications system component inventory change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities system/network administrators
CM-05(06) Limit Library Privileges	Control Limit privileges to change software resident within software libraries. Discussion Software libraries include privileged programs. Assessment Objective privileges to change software resident within software libraries are limited. Assessment Method Examine Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system component inventory change control records system audit records system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities system/network administrators

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements
Source	Requirement

3. Related Regulations

Regulations
Source	Regulation

Linked Issues

Issuelinks
Linktype	Issue
is blocked by	CM-05 Access Restrictions for Change – Assessment Procedure
is blocked by	Access Restriction For Change

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.