Navigate

CM-6(1)

CM-6(1): Automated Central Management / Application / Verification

The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for [organization-defined information system components].

Supplemental

CIA Levels
Confidentiality	unknown
Integrity	high
Availability	unknown

Overlays
None

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to CM-6(1).

Control	Description
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

Control

Description

CA-7

The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes:

a: Establishment of [organization-defined metrics] to be monitored;

b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring;

c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy;

d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy;

e: Correlation and analysis of security-related information generated by assessments and monitoring;

f: Response actions to address results of the analysis of security-related information; and

g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].

CM-4

The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

Enhancements

The controls below (if any) add on to the requirements of CM-6(1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-6(1).

CCI	Definition
CCI-000370	Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-000371	Apply configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-000372	Verify configuration settings for organization-defined system components using organization-defined automated mechanisms.
CCI-002059	Defines the system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.