Navigate

CM-4(2)

CM-4(2): Verification of Security Functions

The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security requirements for the system.

Supplemental

Implementation is this context refers to installing changed code in the operational information system.

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-4(2).

Control	Description
SA-11	The organization requires the developer of the information system, system component, or information system service to: a: Create and implement a security assessment plan; b: Perform [one or more of unit/integration/system/regression] testing/evaluation at [organization-defined depth and coverage]; c: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation; d: Implement a verifiable flaw remediation process; and e: Correct flaws identified during security testing/evaluation.

Control

Description

SA-11

The organization requires the developer of the information system, system component, or information system service to:

a: Create and implement a security assessment plan;

b: Perform [one or more of unit/integration/system/regression] testing/evaluation at [organization-defined depth and coverage];

c: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation;

d: Implement a verifiable flaw remediation process; and

e: Correct flaws identified during security testing/evaluation.

Enhancements

The controls below (if any) add on to the requirements of CM-4(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-4(2).

CCI	Definition
CCI-000335	After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system.
CCI-000336	After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.
CCI-000337	After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system.