CM-3 (1)
CM-3 (1): Automated Document / Notification / Prohibition Of Changes
The organization employs automated mechanisms to:
- CM-3 (1)(a): Document proposed changes to the information system;
- CM-3 (1)(b): Notify [Assignment: organized-defined approval authorities] of proposed changes to the information system and request change approval;
- CM-3 (1)(c): Highlight proposed changes to the information system that have not been approved or disapproved by [Assignment: organization-defined time period];
- CM-3 (1)(d): Prohibit changes to the information system until designated approvals are received;
- CM-3 (1)(e): Document all changes to the information system; and
- CM-3 (1)(f): Notify [Assignment: organization-defined personnel] when approved changes to the information system are completed.
Supplemental
None
| CIA Levels | |
|---|---|
| Confidentiality | unknown |
| Integrity | high |
| Availability | unknown |
| Overlays |
|---|
| None |