Navigate

CCI-000314

CCI-000314 Definition

Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed approves or disapproves configuration controlled changes to the information system with explicit consideration for security impact analysis. The organization must maintain an audit trail of approval/disapproval of configuration controlled changes. This action will be implemented by the CCB as defined in CM-3, CCI 1586.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of the approval/disapproval of configuration controlled changes to ensure a security impact analysis was conducted.

Compelling Evidence

1.) Signed and dated configuration management policies

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000314.

Control	Description
CM-3	The organization: a: Determines the types of changes to the information system that are configuration-controlled; b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; c: Documents configuration change decisions associated with the information system; d: Implements approved configuration-controlled changes to the information system; e: Retains records of configuration-controlled changes to the information system for [organization-defined time period]; f: Audits and reviews activities associated with configuration-controlled changes to the information system; and g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].

Control

Description

CM-3

The organization:

a: Determines the types of changes to the information system that are configuration-controlled;

b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

c: Documents configuration change decisions associated with the information system;

d: Implements approved configuration-controlled changes to the information system;

e: Retains records of configuration-controlled changes to the information system for [organization-defined time period];

f: Audits and reviews activities associated with configuration-controlled changes to the information system; and

g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].