Navigate

CM-6 (1)

CM-6 (1): Automated Central Management / Application / Verification

The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [Assignment: organization-defined information system components].

Supplemental

None

CIA Levels
Confidentiality	unknown
Integrity	moderate
Availability	unknown

Overlays
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-6 (1).

Control	Description
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: CA-7a.: Establishment of [Assignment: organization-defined metrics] to be monitored; CA-7b.: Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring; CA-7c.: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; CA-7d.: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; CA-7e.: Correlation and analysis of security-related information generated by assessments and monitoring; CA-7f.: Response actions to address results of the analysis of security-related information; and CA-7g.: Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

Control

Description

CA-7

The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

CA-7a.: Establishment of [Assignment: organization-defined metrics] to be monitored;

CA-7b.: Establishment of [Assignment: organization-defined frequencies] for monitoring and [Assignment: organization-defined frequencies] for assessments supporting such monitoring;

CA-7c.: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

CA-7d.: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

CA-7e.: Correlation and analysis of security-related information generated by assessments and monitoring;

CA-7f.: Response actions to address results of the analysis of security-related information; and

CA-7g.: Reporting the security status of organization and the information system to [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency].

CM-4

The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

Enhancements

The controls below (if any) add on to the requirements of CM-6 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-6 (1).

CCI	Definition
CCI-000370	The organization employs automated mechanisms to centrally manage configuration settings for organization-defined information system components.
CCI-000371	The organization employs automated mechanisms to centrally apply configuration settings for organization-defined information system components.
CCI-000372	The organization employs automated mechanisms to centrally verify configuration settings for organization-defined information system components.
CCI-002059	The organization defines the information system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.