CM-3(1)
CM-3(1): Automated Documentation, Notification, and Prohibition of Changes
Use [mechanisms used to automate configuration change control are defined;] to:
- (a): Document proposed changes to the system;
- (b): Notify [approval authorities to be notified of and request approval for proposed changes to the system are defined;] of proposed changes to the system and request change approval;
- (c): Highlight proposed changes to the system that have not been approved or disapproved within [the time period after which to highlight changes that have not been approved or disapproved is defined;];
- (d): Prohibit changes to the system until designated approvals are received;
- (e): Document all changes to the system; and
- (f): Notify [personnel to be notified when approved changes are complete is/are defined;] when approved changes to the system are completed.
Supplemental
None.
| CIA Levels | |
|---|---|
| Confidentiality | unknown |
| Integrity | high |
| Availability | unknown |
| Overlays |
|---|
| DAF Baseline, Privacy (high) |
| CSF Categories |
|---|
| None |