CM-3(1)
CM-3(1): Automated Document / Notification / Prohibition of Changes
The organization employs automated mechanisms to:
- (a): Document proposed changes to the information system;
- (b): Notify [organized-defined approval authorities] of proposed changes to the information system and request change approval;
- (c): Highlight proposed changes to the information system that have not been approved or disapproved by [organization-defined time period];
- (d): Prohibit changes to the information system until designated approvals are received;
- (e): Document all changes to the information system; and
- (f): Notify [organization-defined personnel] when approved changes to the information system are completed.
Supplemental
| CIA Levels | |
|---|---|
| Confidentiality | unknown |
| Integrity | high |
| Availability | unknown |
| Overlays |
|---|
| None |
| CSF Categories |
|---|
| None |