Assessment Objective
Determine if:
- CM-06(02) [Assignment: actions] are taken in response to unauthorized changes to [Assignment: configuration settings].
Assessment Methods
Examine
- System security plan
- privacy plan
- configuration management policy
- procedures addressing configuration settings for the system
- configuration management plan
- system design documentation
- system configuration settings and associated documentation
- alerts/notifications of unauthorized changes to system configuration settings
- system component inventory
- documented responses to unauthorized changes to system configuration settings
- change control records
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with security configuration management responsibilities
- organizational personnel with security and privacy responsibilities
- system/network administrators
Test
- Organizational process for responding to unauthorized changes to system configuration settings
- mechanisms supporting and/or implementing actions in response to unauthorized changes
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | CM-06(02) [H] Respond to Unauthorized Changes |