Navigate

CM-3

CM-3: Configuration Change Control

The organization:

CM-3a.: Determines the types of changes to the information system that are configuration-controlled;

CM-3b.: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

CM-3c.: Documents configuration change decisions associated with the information system;

CM-3d.: Implements approved configuration-controlled changes to the information system;

CM-3e.: Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period];

CM-3f.: Audits and reviews activities associated with configuration-controlled changes to the information system; and

CM-3g.: Coordinates and provides oversight for configuration change control activities through [Assignment: organization-defined configuration change control element (e.g., committee, board)] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].

Supplemental

Configuration change controls for organizational information systems involve the systematic proposal, justification, implementation, testing, review, and disposition of changes to the systems, including system upgrades and modifications. Configuration change control includes changes to baseline configurations for components and configuration items of information systems, changes to configuration settings for information technology products (e.g., operating systems, applications, firewalls, routers, and mobile devices), unscheduled/unauthorized changes, and changes to remediate vulnerabilities. Typical processes for managing configuration changes to information systems include, for example, Configuration Control Boards that approve proposed changes to systems. For new development information systems or systems undergoing major upgrades, organizations consider including representatives from development organizations on the Configuration Control Boards. Auditing of changes includes activities before and after changes are made to organizational information systems and the auditing activities required to implement such changes.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-3.

Control	Description
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: CA-7a.: Establishment of [Assignment: organization-defined metrics] to be monitored; CA-7b.: Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring; CA-7c.: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; CA-7d.: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; CA-7e.: Correlation and analysis of security-related information generated by assessments and monitoring; CA-7f.: Response actions to address results of the analysis of security-related information; and CA-7g.: Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].
CM-2	The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
CM-5	The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
CM-6	The organization: CM-6a.: Establishes and documents configuration settings for information technology products employed within the information system using [Assignment: organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; CM-6b.: Implements the configuration settings; CM-6c.: Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and CM-6d.: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
CM-9	The organization develops, documents, and implements a configuration management plan for the information system that: CM-9a.: Addresses roles, responsibilities, and configuration management processes and procedures; CM-9b.: Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; CM-9c.: Defines the configuration items for the information system and places the configuration items under configuration management; and CM-9d.: Protects the configuration management plan from unauthorized disclosure and modification.
SA-10	The organization requires the developer of the information system, system component, or information system service to: SA-10a.: Perform configuration management during system, component, or service [Selection (one or more): design; development; implementation; operation]; SA-10b.: Document, manage, and control the integrity of changes to [Assignment: organization-defined configuration items under configuration management]; SA-10c.: Implement only organization-approved changes to the system, component, or service; SA-10d.: Document approved changes to the system, component, or service and the potential security impacts of such changes; and SA-10e.: Track security flaws and flaw resolution within the system, component, or service and report findings to [Assignment: organization-defined personnel].
SI-2	The organization: SI-2a.: Identifies, reports, and corrects information system flaws; SI-2b.: Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; SI-2c.: Installs security-relevant software and firmware updates within [Assignment: organization-defined time period] of the release of the updates; and SI-2d.: Incorporates flaw remediation into the organizational configuration management process.
SI-12	The organization handles and retains information within the information system and information output from the system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements.

Enhancements

The controls below (if any) add on to the requirements of CM-3.

Control	Description
CM-3 (1)	The organization employs automated mechanisms to: CM-3 (1)(a): Document proposed changes to the information system; CM-3 (1)(b): Notify [Assignment: organized-defined approval authorities] of proposed changes to the information system and request change approval; CM-3 (1)(c): Highlight proposed changes to the information system that have not been approved or disapproved by [Assignment: organization-defined time period]; CM-3 (1)(d): Prohibit changes to the information system until designated approvals are received; CM-3 (1)(e): Document all changes to the information system; and CM-3 (1)(f): Notify [Assignment: organization-defined personnel] when approved changes to the information system are completed.
CM-3 (2)	The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.
CM-3 (3)	The organization employs automated mechanisms to implement changes to the current information system baseline and deploys the updated baseline across the installed base.
CM-3 (4)	The organization requires an information security representative to be a member of the [Assignment: organization-defined configuration change control element].
CM-3 (5)	The information system implements [Assignment: organization-defined security responses] automatically if baseline configurations are changed in an unauthorized manner.
CM-3 (6)	The organization ensures that cryptographic mechanisms used to provide [Assignment: organization-defined security safeguards] are under configuration management.

Related CCIs

The CCIs below are tied to CM-3.

CCI	Definition
CCI-000313	The organization determines the types of changes to the information system that are configuration controlled.
CCI-000314	The organization approves or disapproves configuration-controlled changes to the information system, with explicit consideration for security impact analysis.
CCI-000316	The organization retains records of configuration-controlled changes to the information system for an organization-defined time period.
CCI-000318	The organization audits and reviews activities associated with configuration-controlled changes to the system.
CCI-000319	The organization coordinates and provides oversight for configuration change control activities through an organization-defined configuration change control element (e.g., committee, board) that convenes at the organization-defined frequency and/or for any organization-defined configuration change conditions.
CCI-000320	The organization defines the frequency with which to convene the configuration change control element.
CCI-000321	The organization defines configuration change conditions that prompt the configuration change control element to convene.
CCI-001586	The organization defines the configuration change control element (e.g., committee, board) responsible for coordinating and providing oversight for configuration change control activities.
CCI-001740	The organization reviews proposed configuration-controlled changes to the information system.
CCI-001741	The organization documents configuration change decisions associated with the information system.
CCI-001819	The organization implements approved configuration-controlled changes to the information system.
CCI-002056	The organization defines the time period the records of configuration-controlled changes are to be retained.