+CM-03 Configuration Change Control
---+CM-03(01) Automated Documentation, Notification, and Prohibition of Changes
---+CM-03(02) Testing, Validation, and Documentation of Changes
---+CM-03(03) Automated Change Implementation
---+CM-03(04) Security and Privacy Representatives
---+CM-03(05) Automated Security Response
---+CM-03(06) Cryptography Management
---+CM-03(07) Review System Changes
---+CM-03(08) Prevent or Restrict Configuration Changes

CM-03 Configuration Change Control

Control

  1. Determine and document the types of changes to the system that are configuration-controlled;
  2. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
  3. Document configuration change decisions associated with the system;
  4. Implement approved configuration-controlled changes to the system;
  5. Retain records of configuration-controlled changes to the system for [Assignement: time period];
  6. Monitor and review activities associated with configuration-controlled changes to the system; and
  7. Coordinate and provide oversight for configuration change control activities through [Assignement: configuration change control element] that convenes [Selection(one-or-more): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Discussion

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).

Assessment Objective

  1. the types of changes to the system that are configuration-controlled are determined and documented;
    1. proposed configuration-controlled changes to the system are reviewed;
    2. proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;
  3. configuration change decisions associated with the system are documented;
  4. approved configuration-controlled changes to the system are implemented;
  5. records of configuration-controlled changes to the system are retained for [Assignement: time period];
    1. activities associated with configuration-controlled changes to the system are monitored;
    2. activities associated with configuration-controlled changes to the system are reviewed;
    1. configuration change control activities are coordinated and overseen by [Assignement: configuration change control element];
    2. the configuration control element convenes [Selection(one-or-more): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system architecture and configuration documentation change control records system audit records change control audit and review reports agenda/minutes/documentation from configuration change control oversight meetings system security plan privacy plan privacy impact assessments system of records notices other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar

1. Ħarsa ġenerali

CM-03(01) Automated Documentation, Notification, and Prohibition of Changes

Control

Use [Assignement: automated mechanisms] to:
  1. Document proposed changes to the system;
  2. Notify [Assignement: approval authorities] of proposed changes to the system and request change approval;
  3. Highlight proposed changes to the system that have not been approved or disapproved within [Assignement: time period];
  4. Prohibit changes to the system until designated approvals are received;
  5. Document all changes to the system; and
  6. Notify [Assignement: personnel] when approved changes to the system are completed.

Discussion

None.

Assessment Objective

  1. [Assignement: automated mechanisms] are used to document proposed changes to the system;
  2. [Assignement: automated mechanisms] are used to notify [Assignement: approval authorities] of proposed changes to the system and request change approval;
  3. [Assignement: automated mechanisms] are used to highlight proposed changes to the system that have not been approved or disapproved within [Assignement: time period];
  4. [Assignement: automated mechanisms] are used to prohibit changes to the system until designated approvals are received;
  5. [Assignement: automated mechanisms] are used to document all changes to the system;
  6. [Assignement: automated mechanisms] are used to notify [Assignement: personnel] when approved changes to the system are completed.

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system design documentation system architecture and configuration documentation automated configuration control mechanisms system configuration settings and associated documentation change control records system audit records change approval requests change approvals system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar
CM-03(02) Testing, Validation, and Documentation of Changes

Control

Test, validate, and document changes to the system before finalizing the implementation of the changes.

Discussion

Changes to systems include modifications to hardware, software, or firmware components and configuration settings defined in [CM-6](#cm-6) . Organizations ensure that testing does not interfere with system operations that support organizational mission and business functions. Individuals or groups conducting tests understand security and privacy policies and procedures, system security and privacy policies and procedures, and the health, safety, and environmental risks associated with specific facilities or processes. Operational systems may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls.

Assessment Objective

  1. changes to the system are tested before finalizing the implementation of the changes;
  2. changes to the system are validated before finalizing the implementation of the changes;
  3. changes to the system are documented before finalizing the implementation of the changes.

Assessment Method

Examine

Configuration management policy configuration management plan procedures addressing system configuration change control system design documentation system architecture and configuration documentation system configuration settings and associated documentation test records validation records change control records system audit records system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar
CM-03(03) Automated Change Implementation

Control

Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignement: automated mechanisms].

Discussion

Automated tools can improve the accuracy, consistency, and availability of configuration baseline information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.

Assessment Objective

  1. changes to the current system baseline are implemented using [Assignement: automated mechanisms];
  2. the updated baseline is deployed across the installed base using [Assignement: automated mechanisms].

Assessment Method

Examine

Configuration management policy configuration management plan procedures addressing system configuration change control system design documentation system architecture and configuration documentation automated configuration control mechanisms change control records system component inventory system audit records system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar
CM-03(04) Security and Privacy Representatives

Control

Require [Assignement: organization-defined security and privacy representatives] to be members of the [Assignement: configuration change control element].

Discussion

Information security and privacy representatives include system security officers, senior agency information security officers, senior agency officials for privacy, or system privacy officers. Representation by personnel with information security and privacy expertise is important because changes to system configurations can have unintended side effects, some of which may be security- or privacy-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security and privacy posture of systems. The configuration change control element referred to in the second organization-defined parameter reflects the change control elements defined by organizations in [CM-3g](#cm-3_smt.g).

Assessment Objective

  1. [Assignement: security representatives] are required to be members of the [Assignement: configuration change control element];
  2. [Assignement: privacy representatives] are required to be members of the [Assignement: configuration change control element].

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities members of change control board or similar
CM-03(05) Automated Security Response

Control

Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignement: security responses].

Discussion

Automated security responses include halting selected system functions, halting system processing, and issuing alerts or notifications to organizational personnel when there is an unauthorized modification of a configuration item.

Assessment Objective

[Assignement: security responses] are automatically implemented if baseline configurations are changed in an unauthorized manner.

Assessment Method

Examine

System security plan configuration management policy procedures addressing system configuration change control configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation alerts/notifications of unauthorized baseline configuration changes system audit records other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar
CM-03(06) Cryptography Management

Control

Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignement: controls].

Discussion

The controls referenced in the control enhancement refer to security and privacy controls from the control catalog. Regardless of the cryptographic mechanisms employed, processes and procedures are in place to manage those mechanisms. For example, if system components use certificates for identification and authentication, a process is implemented to address the expiration of those certificates.

Assessment Objective

cryptographic mechanisms used to provide [Assignement: controls] are under configuration management.

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security responsibilities system/network administrators system developers members of change control board or similar
CM-03(07) Review System Changes

Control

Review changes to the system [Assignement: frequency] or when [Assignement: circumstances] to determine whether unauthorized changes have occurred.

Discussion

Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.

Assessment Objective

changes to the system are reviewed [Assignement: frequency] or when [Assignement: circumstances] to determine whether unauthorized changes have occurred.

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan change control records system architecture and configuration documentation system configuration settings and associated documentation system audit records system component inventory system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with security responsibilities system/network administrators members of change control board or similar
CM-03(08) Prevent or Restrict Configuration Changes

Control

Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignement: circumstances].

Discussion

System configuration changes can adversely affect critical system security and privacy functionality. Change restrictions can be enforced through automated mechanisms.

Assessment Objective

changes to the configuration of the system are prevented or restricted under [Assignement: circumstances].

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan change control records system architecture and configuration documentation system configuration settings and associated documentation system component inventory system audit records system security plan other relevant documents or records

Interview

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by CM-03 Configuration Change Control – Assessment Procedure
is blocked by Change Management Program
is blocked by Configuration Change Control