Navigate

CM-8 (6)

CM-8 (6): Assessed Configurations / Approved Deviations

The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.

Supplemental

This control enhancement focuses on configuration settings established by organizations for information system components, the specific components that have been assessed to determine compliance with the required configuration settings, and any approved deviations from established configuration settings.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
NC3

Related Controls

The controls below (if any) were marked by NIST as being related to CM-8 (6).

Control	Description
CM-2	The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.
CM-6	The organization: CM-6a.: Establishes and documents configuration settings for information technology products employed within the information system using [Assignment: organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; CM-6b.: Implements the configuration settings; CM-6c.: Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and CM-6d.: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.

Control

Description

CM-2

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

CM-6

The organization:

CM-6a.: Establishes and documents configuration settings for information technology products employed within the information system using [Assignment: organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements;

CM-6b.: Implements the configuration settings;

CM-6c.: Identifies, documents, and approves any deviations from established configuration settings for [Assignment: organization-defined information system components] based on [Assignment: organization-defined operational requirements]; and

CM-6d.: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.

Enhancements

The controls below (if any) add on to the requirements of CM-8 (6).

Control	Description
No controls

Related CCIs

The CCIs below are tied to CM-8 (6).

CCI	Definition
CCI-000420	The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.