Navigate

CM-4 (1)

CM-4 (1): Separate Test Environments

The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.

Supplemental

Separate test environment in this context means an environment that is physically or logically isolated and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment, and information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not used, organizations determine the strength of mechanism required when implementing logical separation (e.g., separation achieved through virtual machines).

CIA Levels
Confidentiality	unknown
Integrity	moderate
Availability	unknown

Overlays
Privacy (High), Privacy (Mod)

Related Controls

The controls below (if any) were marked by NIST as being related to CM-4 (1).

Control	Description
SA-11	The organization requires the developer of the information system, system component, or information system service to: SA-11a.: Create and implement a security assessment plan; SA-11b.: Perform [Selection (one or more): unit; integration; system; regression] testing/evaluation at [Assignment: organization-defined depth and coverage]; SA-11c.: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation; SA-11d.: Implement a verifiable flaw remediation process; and SA-11e.: Correct flaws identified during security testing/evaluation.
SC-3	The information system isolates security functions from nonsecurity functions.
SC-7	The information system: SC-7a.: Monitors and controls communications at the external boundary of the system and at key internal boundaries within the system; SC-7b.: Implements subnetworks for publicly accessible system components that are [Selection: physically; logically] separated from internal organizational networks; and SC-7c.: Connects to external networks or information systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security architecture.

Enhancements

The controls below (if any) add on to the requirements of CM-4 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-4 (1).

CCI	Definition
CCI-001817	The organization, when analyzing changes to the information system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
CCI-001818	The organization analyzes changes to the information system in a separate test environment before installation in an operational environment.