Assessment Objective
Determine if:
- CM-06a. configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [Assignment: common secure configurations];
- CM-06b. the configuration settings documented in CM-06a are implemented;
- CM-06c.
- CM-06c.[01] any deviations from established configuration settings for [Assignment: system components] are identified and documented based on [Assignment: operational requirements];
- CM-06c.[02] any deviations from established configuration settings for [Assignment: system components] are approved;
- CM-06d.
- CM-06d.[01] changes to the configuration settings are monitored in accordance with organizational policies and procedures;
- CM-06d.[02] changes to the configuration settings are controlled in accordance with organizational policies and procedures.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing configuration settings for the system
- configuration management plan
- system design documentation
- system configuration settings and associated documentation
- common secure configuration checklists
- system component inventory
- evidence supporting approved deviations from established configuration settings
- change control records
- system data processing and retention permissions
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with security configuration management responsibilities
- organizational personnel with privacy configuration management responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Test
- Organizational processes for managing configuration settings
- mechanisms that implement, monitor, and/or control system configuration settings
- mechanisms that identify and/or document deviations from established configuration settings
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | CM-06 [M] Configuration Settings |