Assessment Objective
Determine if:
- CM-06(01)[01] configuration settings for [Assignment: system components] are managed using [Assignment: automated mechanisms];
- CM-06(01)[02] configuration settings for [Assignment: system components] are applied using [Assignment: automated mechanisms];
- CM-06(01)[03] configuration settings for [Assignment: system components] are verified using [Assignment: automated mechanisms].
Assessment Methods
Examine
- Configuration management policy
- procedures addressing configuration settings for the system
- configuration management plan
- system design documentation
- system configuration settings and associated documentation
- system component inventory
- common secure configuration checklists
- change control records
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with security configuration management responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Organizational processes for managing configuration settings
- automated mechanisms implemented to manage, apply, and verify system configuration settings
Powiązane zgłoszenia
| Typ powiązania | Zgłoszenie |
|---|---|
| blocks | CM-06(01) Automated Management, Application, and Verification |