Navigate

CM-5 (2)

CM-5 (2): Review System Changes

The organization reviews information system changes [Assignment: organization-defined frequency] and [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.

Supplemental

Indications that warrant review of information system changes and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process.

CIA Levels
Confidentiality	unknown
Integrity	moderate
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-5 (2).

Control	Description
AU-6	The organization: AU-6a.: Reviews and analyzes information system audit records [Assignment: organization-defined frequency] for indications of [Assignment: organization-defined inappropriate or unusual activity]; and AU-6b.: Reports findings to [Assignment: organization-defined personnel or roles].
AU-7	The information system provides an audit reduction and report generation capability that: AU-7a.: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and AU-7b.: Does not alter the original content or time ordering of audit records.
CM-3	The organization: CM-3a.: Determines the types of changes to the information system that are configuration-controlled; CM-3b.: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; CM-3c.: Documents configuration change decisions associated with the information system; CM-3d.: Implements approved configuration-controlled changes to the information system; CM-3e.: Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period]; CM-3f.: Audits and reviews activities associated with configuration-controlled changes to the information system; and CM-3g.: Coordinates and provides oversight for configuration change control activities through [Assignment: organization-defined configuration change control element (e.g., committee, board)] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; [Assignment: organization-defined configuration change conditions]].
CM-5	The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
PE-6	The organization: PE-6a.: Monitors physical access to the facility where the information system resides to detect and respond to physical security incidents; PE-6b.: Reviews physical access logs [Assignment: organization-defined frequency] and upon occurrence of [Assignment: organization-defined events or potential indications of events]; and PE-6c.: Coordinates results of reviews and investigations with the organizational incident response capability.
PE-8	The organization: PE-8a.: Maintains visitor access records to the facility where the information system resides for [Assignment: organization-defined time period]; and PE-8b.: Reviews visitor access records [Assignment: organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of CM-5 (2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-5 (2).

CCI	Definition
CCI-000348	The organization defines a frequency with which to conduct reviews of information system changes.
CCI-000349	The organization reviews information system changes per organization-defined frequency to determine whether unauthorized changes have occurred.
CCI-000350	The organization reviews information system changes upon organization-defined circumstances to determine whether unauthorized changes have occurred.
CCI-001826	The organization defines the circumstances upon which the organization reviews the information system changes to determine whether unauthorized changes have occurred.