+CM-03 [M] Configuration Change Control
---+CM-03(02) [M] Testing, Validation, and Documentation of Changes
---+CM-03(04) [M] Security and Privacy Representatives

CM-03 [M] Configuration Change Control

Control

  1. Determine and document the types of changes to the system that are configuration-controlled;
  2. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
  3. Document configuration change decisions associated with the system;
  4. Implement approved configuration-controlled changes to the system;
  5. Retain records of configuration-controlled changes to the system for [Assignement: time period];
  6. Monitor and review activities associated with configuration-controlled changes to the system; and
  7. Coordinate and provide oversight for configuration change control activities through [Assignement: configuration change control element] that convenes [Selection(one-or-more): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Discussion

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).

Assessment Objective

  1. the types of changes to the system that are configuration-controlled are determined and documented;
    1. proposed configuration-controlled changes to the system are reviewed;
    2. proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;
  3. configuration change decisions associated with the system are documented;
  4. approved configuration-controlled changes to the system are implemented;
  5. records of configuration-controlled changes to the system are retained for [Assignement: time period];
    1. activities associated with configuration-controlled changes to the system are monitored;
    2. activities associated with configuration-controlled changes to the system are reviewed;
    1. configuration change control activities are coordinated and overseen by [Assignement: configuration change control element];
    2. the configuration control element convenes [Selection(one-or-more): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system architecture and configuration documentation change control records system audit records change control audit and review reports agenda/minutes/documentation from configuration change control oversight meetings system security plan privacy plan privacy impact assessments system of records notices other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar

1. Panoramica

CM-03(02) [M] Testing, Validation, and Documentation of Changes

Control

Test, validate, and document changes to the system before finalizing the implementation of the changes.

Discussion

Changes to systems include modifications to hardware, software, or firmware components and configuration settings defined in [CM-6](#cm-6) . Organizations ensure that testing does not interfere with system operations that support organizational mission and business functions. Individuals or groups conducting tests understand security and privacy policies and procedures, system security and privacy policies and procedures, and the health, safety, and environmental risks associated with specific facilities or processes. Operational systems may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls.

Assessment Objective

  1. changes to the system are tested before finalizing the implementation of the changes;
  2. changes to the system are validated before finalizing the implementation of the changes;
  3. changes to the system are documented before finalizing the implementation of the changes.

Assessment Method

Examine

Configuration management policy configuration management plan procedures addressing system configuration change control system design documentation system architecture and configuration documentation system configuration settings and associated documentation test records validation records change control records system audit records system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar
CM-03(04) [M] Security and Privacy Representatives

Control

Require [Assignement: organization-defined security and privacy representatives] to be members of the [Assignement: configuration change control element].

Discussion

Information security and privacy representatives include system security officers, senior agency information security officers, senior agency officials for privacy, or system privacy officers. Representation by personnel with information security and privacy expertise is important because changes to system configurations can have unintended side effects, some of which may be security- or privacy-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security and privacy posture of systems. The configuration change control element referred to in the second organization-defined parameter reflects the change control elements defined by organizations in [CM-3g](#cm-3_smt.g).

Assessment Objective

  1. [Assignement: security representatives] are required to be members of the [Assignement: configuration change control element];
  2. [Assignement: privacy representatives] are required to be members of the [Assignement: configuration change control element].

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities members of change control board or similar

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by CM-03 [M] Configuration Change Control – Assessment Procedure
is blocked by Change Management Program
is blocked by Configuration Change Control