Navigate

CM-3(7)

CM-3(7): Review System Changes

Review changes to the system [the frequency at which changes are to be reviewed is defined;] or when [the circumstances under which changes are to be reviewed are defined;] to determine whether unauthorized changes have occurred.

Supplemental

Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.

CIA Levels
Confidentiality	unknown
Integrity	low
Availability	unknown

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-3(7).

Control	Description
AU-6	a: Review and analyze system audit records [frequency at which system audit records are reviewed and analyzed is defined;] for indications of [inappropriate or unusual activity is defined;] and the potential impact of the inappropriate or unusual activity; b: Report findings to [personnel or roles to receive findings from reviews and analyses of system records is/are defined;] ; and c: Adjust the level of audit record review, analysis, and reporting within the system when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.
AU-7	Provide and implement an audit record reduction and report generation capability that: a: Supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and b: Does not alter the original content or time ordering of audit records.
CM-3	a: Determine and document the types of changes to the system that are configuration-controlled; b: Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c: Document configuration change decisions associated with the system; d: Implement approved configuration-controlled changes to the system; e: Retain records of configuration-controlled changes to the system for [the time period to retain records of configuration-controlled changes is defined;]; f: Monitor and review activities associated with configuration-controlled changes to the system; and g: Coordinate and provide oversight for configuration change control activities through [the configuration change control element responsible for coordinating and overseeing change control activities is defined;] that convenes [one or more of "{{ insert: param, cm-03_odp.04 }} "/"when {{ insert: param, cm-03_odp.05 }} "].

Enhancements

The controls below (if any) add on to the requirements of CM-3(7).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-3(7).

CCI	Definition
CCI-003925	Review changes to the system on an organization-defined frequency or when there are organization-defined circumstances to determine whether unauthorized changes have occurred.
CCI-003926	Defines the frequency for reviewing changes to the system.
CCI-003927	Defines the circumstances for determining whether unauthorized changes to the system have occurred.