CCI-001744

Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.

Implementation Guidance

The organization being inspected/assessed implements security responses, as defined in CM-3 (5), CCI 1743, automatically if baseline configurations are changed in an unauthorized manner. The information system must maintain an audit trail of automatic security responses to unauthorized changes in baseline configurations.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail to ensure the organization being inspected/assessed implements security responses, as defined in CM-3 (5), CCI 1743, automatically if baseline configurations are changed in an unauthorized manner.

Compelling Evidence

1.) Audit trail of security responses

The controls below (if any) were marked by NIST as being related to CCI-001744.