Navigate

SR-11(2)

SR-11(2): Configuration Control for Component Service and Repair

Maintain configuration control over the following system components awaiting service or repair and serviced or repaired components awaiting return to service: [system components requiring configuration control are defined;].

Supplemental

None.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
DAF Baseline

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to SR-11(2).

Control	Description
CM-3	a: Determine and document the types of changes to the system that are configuration-controlled; b: Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c: Document configuration change decisions associated with the system; d: Implement approved configuration-controlled changes to the system; e: Retain records of configuration-controlled changes to the system for [the time period to retain records of configuration-controlled changes is defined;]; f: Monitor and review activities associated with configuration-controlled changes to the system; and g: Coordinate and provide oversight for configuration change control activities through [the configuration change control element responsible for coordinating and overseeing change control activities is defined;] that convenes [one or more of "{{ insert: param, cm-03_odp.04 }} "/"when {{ insert: param, cm-03_odp.05 }} "].
MA-2	a: Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements; b: Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location; c: Require that [personnel or roles required to explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance or repairs is/are defined;] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement; d: Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [information to be removed from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement is defined;]; e: Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and f: Include the following information in organizational maintenance records: [information to be included in organizational maintenance records is defined;].
MA-4	a: Approve and monitor nonlocal maintenance and diagnostic activities; b: Allow the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the system; c: Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions; d: Maintain records for nonlocal maintenance and diagnostic activities; and e: Terminate session and network connections when nonlocal maintenance is completed.
SA-10	Require the developer of the system, system component, or system service to: a: Perform configuration management during system, component, or service [one or more of "design"/"development"/"implementation"/"operation"/"disposal"]; b: Document, manage, and control the integrity of changes to [configuration items under configuration management are defined;]; c: Implement only organization-approved changes to the system, component, or service; d: Document approved changes to the system, component, or service and the potential security and privacy impacts of such changes; and e: Track security flaws and flaw resolution within the system, component, or service and report findings to [personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined;].

Enhancements

The controls below (if any) add on to the requirements of SR-11(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to SR-11(2).

CCI	Definition
CCI-005139	Maintain configuration control over the following system components awaiting service or repair.
CCI-005140	Maintain configuration control over serviced or repaired components awaiting return to service.
CCI-005141	Defines the system components awaiting service or repair.