CCI-001754

Limit privileges to change system-related information within a production or operational environment.

Implementation Guidance

Determine if: - privileges to change system components within a production or operational environment are limited. - privileges to change system-related information within a production or operational environment are limited.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing access restrictions for changes to the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; user privilege reviews; user privilege recertifications; system component inventory; change control records; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for managing access restrictions to change; mechanisms supporting and/or implementing access restrictions for change].

The controls below (if any) were marked by NIST as being related to CCI-001754.