+CM Configuration Management
---+CM-01 Policy and Procedures
---+CM-02 Baseline Configuration
------+CM-02(02) Automation Support for Accuracy and Currency
------+CM-02(03) Retention of Previous Configurations
------+CM-02(06) Development and Test Environments
------+CM-02(07) Configure Systems and Components for High-risk Areas
---+CM-03 Configuration Change Control
------+CM-03(01) Automated Documentation, Notification, and Prohibition of Changes
------+CM-03(02) Testing, Validation, and Documentation of Changes
------+CM-03(03) Automated Change Implementation
------+CM-03(04) Security and Privacy Representatives
------+CM-03(05) Automated Security Response
------+CM-03(06) Cryptography Management
------+CM-03(07) Review System Changes
------+CM-03(08) Prevent or Restrict Configuration Changes
---+CM-04 Impact Analyses
------+CM-04(01) Separate Test Environments
------+CM-04(02) Verification of Controls
---+CM-05 Access Restrictions for Change
------+CM-05(01) Automated Access Enforcement and Audit Records
------+CM-05(04) Dual Authorization
------+CM-05(05) Privilege Limitation for Production and Operation
------+CM-05(06) Limit Library Privileges
---+CM-06 Configuration Settings
------+CM-06(01) Automated Management, Application, and Verification
------+CM-06(02) Respond to Unauthorized Changes
---+CM-07 Least Functionality
------+CM-07(01) Periodic Review
------+CM-07(02) Prevent Program Execution
------+CM-07(03) Registration Compliance
------+CM-07(04) Unauthorized Software — Deny-by-exception
------+CM-07(05) Authorized Software — Allow-by-exception
------+CM-07(06) Confined Environments with Limited Privileges
------+CM-07(07) Code Execution in Protected Environments
------+CM-07(08) Binary or Machine Executable Code
------+CM-07(09) Prohibiting The Use of Unauthorized Hardware
---+CM-08 System Component Inventory
------+CM-08(01) Updates During Installation and Removal
------+CM-08(02) Automated Maintenance
------+CM-08(03) Automated Unauthorized Component Detection
------+CM-08(04) Accountability Information
------+CM-08(06) Assessed Configurations and Approved Deviations
------+CM-08(07) Centralized Repository
------+CM-08(08) Automated Location Tracking
------+CM-08(09) Assignment of Components to Systems
---+CM-09 Configuration Management Plan
------+CM-09(01) Assignment of Responsibility
---+CM-10 Software Usage Restrictions
------+CM-10(01) Open-source Software
---+CM-11 User-installed Software
------+CM-11(02) Software Installation with Privileged Status
------+CM-11(03) Automated Enforcement and Monitoring
---+CM-12 Information Location
------+CM-12(01) Automated Tools to Support Information Location
---+CM-13 Data Action Mapping
---+CM-14 Signed Components

CM Configuration Management

Configuration Management

1. Pregled

CM-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] configuration management policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the configuration management policy and procedures; and
  3. Review and update the current configuration management:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Configuration management policy and procedures address the controls in the CM family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of configuration management policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission/business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to configuration management policy and procedures include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. a configuration management policy is developed and documented;
    2. the configuration management policy is disseminated to [Assignement: personnel or roles];
    3. configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented;
    4. the configuration management procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses compliance;
      2. the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures;
      1. the current configuration management policy is reviewed and updated [Assignement: frequency];
      2. the current configuration management policy is reviewed and updated following [Assignement: events];
      1. the current configuration management procedures are reviewed and updated [Assignement: frequency];
      2. the current configuration management procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Configuration management policy and procedures security and privacy program policies and procedures assessment or audit findings documentation of security incidents or breaches system security plan privacy plan risk management strategy other relevant artifacts, documents, or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities
CM-02 Baseline Configuration

Control

  1. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
  2. Review and update the baseline configuration of the system:
    1. [Assignement: frequency];
    2. When required due to [Assignement: circumstances] ; and
    3. When system components are installed or upgraded.

Discussion

Baseline configurations for systems and system components include connectivity, operational, and communications aspects of systems. Baseline configurations are documented, formally reviewed, and agreed-upon specifications for systems or configuration items within those systems. Baseline configurations serve as a basis for future builds, releases, or changes to systems and include security and privacy control implementations, operational procedures, information about system components, network topology, and logical placement of components in the system architecture. Maintaining baseline configurations requires creating new baselines as organizational systems change over time. Baseline configurations of systems reflect the current enterprise architecture.

Assessment Objective

    1. a current baseline configuration of the system is developed and documented;
    2. a current baseline configuration of the system is maintained under configuration control;
    1. the baseline configuration of the system is reviewed and updated [Assignement: frequency];
    2. the baseline configuration of the system is reviewed and updated when required due to [Assignement: circumstances];
    3. the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.

Assessment Method

Examine

Configuration management policy procedures addressing the baseline configuration of the system configuration management plan enterprise architecture documentation system design documentation system security plan privacy plan system architecture and configuration documentation system configuration settings and associated documentation system component inventory change control records other relevant documents or records

Interview

Organizational personnel with configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
CM-03 Configuration Change Control

Control

  1. Determine and document the types of changes to the system that are configuration-controlled;
  2. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
  3. Document configuration change decisions associated with the system;
  4. Implement approved configuration-controlled changes to the system;
  5. Retain records of configuration-controlled changes to the system for [Assignement: time period];
  6. Monitor and review activities associated with configuration-controlled changes to the system; and
  7. Coordinate and provide oversight for configuration change control activities through [Assignement: configuration change control element] that convenes [Selection(one-or-more): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Discussion

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).

Assessment Objective

  1. the types of changes to the system that are configuration-controlled are determined and documented;
    1. proposed configuration-controlled changes to the system are reviewed;
    2. proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;
  3. configuration change decisions associated with the system are documented;
  4. approved configuration-controlled changes to the system are implemented;
  5. records of configuration-controlled changes to the system are retained for [Assignement: time period];
    1. activities associated with configuration-controlled changes to the system are monitored;
    2. activities associated with configuration-controlled changes to the system are reviewed;
    1. configuration change control activities are coordinated and overseen by [Assignement: configuration change control element];
    2. the configuration control element convenes [Selection(one-or-more): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan system architecture and configuration documentation change control records system audit records change control audit and review reports agenda/minutes/documentation from configuration change control oversight meetings system security plan privacy plan privacy impact assessments system of records notices other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar
CM-04 Impact Analyses

Control

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

Discussion

Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.

Assessment Objective

  1. changes to the system are analyzed to determine potential security impacts prior to change implementation;
  2. changes to the system are analyzed to determine potential privacy impacts prior to change implementation.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation, system design documentation analysis tools and associated outputs change control records system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security impact analyses organizational personnel with responsibility for conducting privacy impact analyses organizational personnel with information security and privacy responsibilities system developer system/network administrators members of change control board or similar
CM-05 Access Restrictions for Change

Control

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Discussion

Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).

Assessment Objective

  1. physical access restrictions associated with changes to the system are defined and documented;
  2. physical access restrictions associated with changes to the system are approved;
  3. physical access restrictions associated with changes to the system are enforced;
  4. logical access restrictions associated with changes to the system are defined and documented;
  5. logical access restrictions associated with changes to the system are approved;
  6. logical access restrictions associated with changes to the system are enforced.

Assessment Method

Examine

Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation logical access approvals physical access approvals access credentials change control records system audit records system security plan other relevant documents or records

Interview

Organizational personnel with logical access control responsibilities organizational personnel with physical access control responsibilities organizational personnel with information security responsibilities system/network administrators
CM-06 Configuration Settings

Control

  1. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignement: common secure configurations];
  2. Implement the configuration settings;
  3. Identify, document, and approve any deviations from established configuration settings for [Assignement: system components] based on [Assignement: operational requirements] ; and
  4. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

Discussion

Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system. Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors. Implementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB](#98498928-3ca3-44b3-8b1e-f48685373087) and security technical implementation guides (STIGs), which affect the implementation of [CM-6](#cm-6) and other controls such as [AC-19](#ac-19) and [CM-7](#cm-7) . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.

Assessment Objective

  1. configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [Assignement: common secure configurations];
  2. the configuration settings documented in CM-06a are implemented;
    1. any deviations from established configuration settings for [Assignement: system components] are identified and documented based on [Assignement: operational requirements];
    2. any deviations from established configuration settings for [Assignement: system components] are approved;
    1. changes to the configuration settings are monitored in accordance with organizational policies and procedures;
    2. changes to the configuration settings are controlled in accordance with organizational policies and procedures.

Assessment Method

Examine

Configuration management policy procedures addressing configuration settings for the system configuration management plan system design documentation system configuration settings and associated documentation common secure configuration checklists system component inventory evidence supporting approved deviations from established configuration settings change control records system data processing and retention permissions system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with security configuration management responsibilities organizational personnel with privacy configuration management responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
CM-07 Least Functionality

Control

  1. Configure the system to provide only [Assignement: mission-essential capabilities] ; and
  2. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignement: organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].

Discussion

Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).

Assessment Objective

  1. the system is configured to provide only [Assignement: mission-essential capabilities];
    1. the use of [Assignement: functions] is prohibited or restricted;
    2. the use of [Assignement: ports] is prohibited or restricted;
    3. the use of [Assignement: protocols] is prohibited or restricted;
    4. the use of [Assignement: software] is prohibited or restricted;
    5. the use of [Assignement: services] is prohibited or restricted.

Assessment Method

Examine

Configuration management policy procedures addressing least functionality in the system configuration management plan system design documentation system configuration settings and associated documentation system component inventory common secure configuration checklists system security plan other relevant documents or records

Interview

Organizational personnel with security configuration management responsibilities organizational personnel with information security responsibilities system/network administrators system developers
CM-08 System Component Inventory

Control

  1. Develop and document an inventory of system components that:
    1. Accurately reflects the system;
    2. Includes all components within the system;
    3. Does not include duplicate accounting of components or components assigned to any other system;
    4. Is at the level of granularity deemed necessary for tracking and reporting; and
    5. Includes the following information to achieve system component accountability: [Assignement: information] ; and
  2. Review and update the system component inventory [Assignement: frequency].

Discussion

System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location. Preventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of [CM-8(7)](#cm-8.7) can help to eliminate duplicate accounting of components.

Assessment Objective

    1. an inventory of system components that accurately reflects the system is developed and documented;
    2. an inventory of system components that includes all components within the system is developed and documented;
    3. an inventory of system components that does not include duplicate accounting of components or components assigned to any other system is developed and documented;
    4. an inventory of system components that is at the level of granularity deemed necessary for tracking and reporting is developed and documented;
    5. an inventory of system components that includes [Assignement: information] is developed and documented;
  2. the system component inventory is reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Configuration management policy procedures addressing system component inventory configuration management plan system security plan system design documentation system component inventory inventory reviews and update records system security plan other relevant documents or records

Interview

Organizational personnel with component inventory management responsibilities organizational personnel with information security responsibilities system/network administrators
CM-09 Configuration Management Plan

Control

Develop, document, and implement a configuration management plan for the system that:
  1. Addresses roles, responsibilities, and configuration management processes and procedures;
  2. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;
  3. Defines the configuration items for the system and places the configuration items under configuration management;
  4. Is reviewed and approved by [Assignement: personnel or roles] ; and
  5. Protects the configuration management plan from unauthorized disclosure and modification.

Discussion

Configuration management activities occur throughout the system development life cycle. As such, there are developmental configuration management activities (e.g., the control of code and software libraries) and operational configuration management activities (e.g., control of installed components and how the components are configured). Configuration management plans satisfy the requirements in configuration management policies while being tailored to individual systems. Configuration management plans define processes and procedures for how configuration management is used to support system development life cycle activities. Configuration management plans are generated during the development and acquisition stage of the system development life cycle. The plans describe how to advance changes through change management processes; update configuration settings and baselines; maintain component inventories; control development, test, and operational environments; and develop, release, and update key documents. Organizations can employ templates to help ensure the consistent and timely development and implementation of configuration management plans. Templates can represent a configuration management plan for the organization with subsets of the plan implemented on a system by system basis. Configuration management approval processes include the designation of key stakeholders responsible for reviewing and approving proposed changes to systems, and personnel who conduct security and privacy impact analyses prior to the implementation of changes to the systems. Configuration items are the system components, such as the hardware, software, firmware, and documentation to be configuration-managed. As systems continue through the system development life cycle, new configuration items may be identified, and some existing configuration items may no longer need to be under configuration control.

Assessment Objective

  1. a configuration management plan for the system is developed and documented;
  2. a configuration management plan for the system is implemented;
    1. the configuration management plan addresses roles;
    2. the configuration management plan addresses responsibilities;
    3. the configuration management plan addresses configuration management processes and procedures;
    1. the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle;
    2. the configuration management plan establishes a process for managing the configuration of the configuration items;
    1. the configuration management plan defines the configuration items for the system;
    2. the configuration management plan places the configuration items under configuration management;
  6. the configuration management plan is reviewed and approved by [Assignement: personnel or roles];
    1. the configuration management plan is protected from unauthorized disclosure;
    2. the configuration management plan is protected from unauthorized modification.

Assessment Method

Examine

Configuration management policy procedures addressing configuration management planning configuration management plan system design documentation system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibilities for developing the configuration management plan organizational personnel with responsibilities for implementing and managing processes defined in the configuration management plan organizational personnel with responsibilities for protecting the configuration management plan organizational personnel with information security and privacy responsibilities system/network administrators
CM-10 Software Usage Restrictions

Control

  1. Use software and associated documentation in accordance with contract agreements and copyright laws;
  2. Track the use of software and associated documentation protected by quantity licenses to control copying and distribution; and
  3. Control and document the use of peer-to-peer file sharing technology to ensure that this capability is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Discussion

Software license tracking can be accomplished by manual or automated methods, depending on organizational needs. Examples of contract agreements include software license agreements and non-disclosure agreements.

Assessment Objective

  1. software and associated documentation are used in accordance with contract agreements and copyright laws;
  2. the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution;
  3. the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Assessment Method

Examine

Configuration management policy software usage restrictions software contract agreements and copyright laws site license documentation list of software usage restrictions software license tracking reports configuration management plan system security plan system security plan other relevant documents or records

Interview

Organizational personnel operating, using, and/or maintaining the system organizational personnel with software license management responsibilities organizational personnel with information security responsibilities system/network administrators
CM-11 User-installed Software

Control

  1. Establish [Assignement: policies] governing the installation of software by users;
  2. Enforce software installation policies through the following methods: [Assignement: methods] ; and
  3. Monitor policy compliance [Assignement: frequency].

Discussion

If provided the necessary privileges, users can install software in organizational systems. To maintain control over the software installed, organizations identify permitted and prohibited actions regarding software installation. Permitted software installations include updates and security patches to existing software and downloading new applications from organization-approved "app stores." Prohibited software installations include software with unknown or suspect pedigrees or software that organizations consider potentially malicious. Policies selected for governing user-installed software are organization-developed or provided by some external entity. Policy enforcement methods can include procedural methods and automated methods.

Assessment Objective

  1. [Assignement: policies] governing the installation of software by users are established;
  2. software installation policies are enforced through [Assignement: methods];
  3. compliance with [Assignement: policies] is monitored [Assignement: frequency].

Assessment Method

Examine

Configuration management policy procedures addressing user-installed software configuration management plan system security plan system design documentation system configuration settings and associated documentation list of rules governing user installed software system monitoring records system audit records continuous monitoring strategy system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for governing user-installed software organizational personnel operating, using, and/or maintaining the system organizational personnel monitoring compliance with user-installed software policy organizational personnel with information security responsibilities system/network administrators
CM-12 Information Location

Control

  1. Identify and document the location of [Assignement: information] and the specific system components on which the information is processed and stored;
  2. Identify and document the users who have access to the system and system components where the information is processed and stored; and
  3. Document changes to the location (i.e., system or system components) where the information is processed and stored.

Discussion

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see [FIPS 199](#628d22a1-6a11-4784-bc59-5cd9497b5445) ). The location of the information and system components is also a factor in the architecture and design of the system (see [SA-4](#sa-4), [SA-8](#sa-8), [SA-17](#sa-17)).

Assessment Objective

    1. the location of [Assignement: information] is identified and documented;
    2. the specific system components on which [Assignement: information] is processed are identified and documented;
    3. the specific system components on which [Assignement: information] is stored are identified and documented;
    1. the users who have access to the system and system components where [Assignement: information] is processed are identified and documented;
    2. the users who have access to the system and system components where [Assignement: information] is stored are identified and documented;
    1. changes to the location (i.e., system or system components) where [Assignement: information] is processed are documented;
    2. changes to the location (i.e., system or system components) where [Assignement: information] is stored are documented.

Assessment Method

Examine

Configuration management policy procedures addressing identification and documentation of information location configuration management plan system design documentation system architecture documentation PII inventory documentation data mapping documentation audit records list of users with system and system component access change control records system component inventory system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibilities for managing information location and user access to information organizational personnel with responsibilities for operating, using, and/or maintaining the system organizational personnel with information security and privacy responsibilities system/network administrators system developers
CM-13 Data Action Mapping

Control

Develop and document a map of system data actions.

Discussion

Data actions are system operations that process personally identifiable information. The processing of such information encompasses the full information life cycle, which includes collection, generation, transformation, use, disclosure, retention, and disposal. A map of system data actions includes discrete data actions, elements of personally identifiable information being processed in the data actions, system components involved in the data actions, and the owners or operators of the system components. Understanding what personally identifiable information is being processed (e.g., the sensitivity of the personally identifiable information), how personally identifiable information is being processed (e.g., if the data action is visible to the individual or is processed in another part of the system), and by whom (e.g., individuals may have different privacy perceptions based on the entity that is processing the personally identifiable information) provides a number of contextual factors that are important to assessing the degree of privacy risk created by the system. Data maps can be illustrated in different ways, and the level of detail may vary based on the mission and business needs of the organization. The data map may be an overlay of any system design artifact that the organization is using. The development of this map may necessitate coordination between the privacy and security programs regarding the covered data actions and the components that are identified as part of the system.

Assessment Objective

a map of system data actions is developed and documented.

Assessment Method

Examine

Configuration management policy procedures for identification and documentation of information location procedures for mapping data actions configuration management plan system security plan privacy plan system design documentation PII inventory documentation data mapping documentation change control records system component inventory other relevant documents or records

Interview

Organizational personnel with responsibilities for managing information location organizational personnel responsible for data action mapping organizational personnel with information security and privacy responsibilities system/network administrators system developers
CM-14 Signed Components

Control

Prevent the installation of [Assignement: organization-defined software and firmware components] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Discussion

Software and firmware components prevented from installation unless signed with recognized and approved certificates include software and firmware version updates, patches, service packs, device drivers, and basic input/output system updates. Organizations can identify applicable software and firmware components by type, by specific items, or a combination of both. Digital signatures and organizational verification of such signatures is a method of code authentication.

Assessment Objective

  1. the installation of [Assignement: software components] is prevented unless it is verified that the software has been digitally signed using a certificate recognized and approved by the organization;
  2. the installation of [Assignement: firmware components] is prevented unless it is verified that the firmware has been digitally signed using a certificate recognized and approved by the organization.

Assessment Method

Examine

Configuration management policy procedures addressing digitally signed certificates for software and firmware components configuration management plan system security plan system design documentation change control records system component inventory system security plan other relevant documents or records

Interview

Organizational personnel with responsibilities for verifying digitally signed certificates for software and firmware component installation organizational personnel with information security responsibilities system/network administrators system developers

1.1 Sklici

1.2 Ugotovljene zahteve

1.3 Povezani predpisi

2. Ugotovljene zahteve

Zahteve

3. Povezani predpisi

Predpisi