The organization: a. Develops, documents, and disseminates to {{ insert: param, cm-1_prm_1 }}: 1. A configuration management policy that addresses purpose, scope, roles, responsibilities, man...

The organization develops, documents, and maintains under configuration control, a current baseline configuration of the information system.

The organization reviews and updates the baseline configuration of the information system: (a) {{ insert: param, cm-2.1_prm_1 }}; (b) When required due to {{ insert: param, cm-2.1_prm_2 }}; and...

The organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.

The organization retains {{ insert: param, cm-2.3_prm_1 }} to support rollback.

The organization maintains a baseline configuration for information system development and test environments that is managed separately from the operational baseline configuration.

The organization: (a) Issues {{ insert: param, cm-2.7_prm_1 }} with {{ insert: param, cm-2.7_prm_2 }} to individuals traveling to locations that the organization deems to be of significant risk; ...

The organization: a. Determines the types of changes to the information system that are configuration-controlled; b. Reviews proposed configuration-controlled changes to the information system ...

The organization employs automated mechanisms to: (a) Document proposed changes to the information system; (b) Notify {{ insert: param, cm-3.1_prm_1 }} of proposed changes to the information sy...

The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.

The organization employs automated mechanisms to implement changes to the current information system baseline and deploys the updated baseline across the installed base.

The organization requires an information security representative to be a member of the {{ insert: param, cm-3.4_prm_1 }}.

The information system implements {{ insert: param, cm-3.5_prm_1 }} automatically if baseline configurations are changed in an unauthorized manner.

The organization ensures that cryptographic mechanisms used to provide {{ insert: param, cm-3.6_prm_1 }} are under configuration management.

The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.

The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses...

The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired out...

The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.

The information system enforces access restrictions and supports auditing of the enforcement actions.

The organization reviews information system changes {{ insert: param, cm-5.2_prm_1 }} and {{ insert: param, cm-5.2_prm_2 }} to determine whether unauthorized changes have occurred.

The information system prevents the installation of {{ insert: param, cm-5.3_prm_1 }} without verification that the component has been digitally signed using a certificate that is recognized and ap...

The organization enforces dual authorization for implementing changes to {{ insert: param, cm-5.4_prm_1 }}.

The organization: (a) Limits privileges to change information system components and system-related information within a production or operational environment; and (b) Reviews and reevaluates pr...

The organization limits privileges to change software resident within software libraries.

The organization: a. Establishes and documents configuration settings for information technology products employed within the information system using {{ insert: param, cm-6_prm_1 }} that reflect...

The organization employs automated mechanisms to centrally manage, apply, and verify configuration settings for {{ insert: param, cm-6.1_prm_1 }}.

The organization employs {{ insert: param, cm-6.2_prm_1 }} to respond to unauthorized changes to {{ insert: param, cm-6.2_prm_2 }}.

The organization: a. Configures the information system to provide only essential capabilities; and b. Prohibits or restricts the use of the following functions, ports, protocols, and/or service...

The organization: (a) Reviews the information system {{ insert: param, cm-7.1_prm_1 }} to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and (b) Disables {{ in...

The information system prevents program execution in accordance with {{ insert: param, cm-7.2_prm_1 }}.

The organization ensures compliance with {{ insert: param, cm-7.3_prm_1 }}.

The organization: (a) Identifies {{ insert: param, cm-7.4_prm_1 }}; (b) Employs an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the informa...

The organization: (a) Identifies {{ insert: param, cm-7.5_prm_1 }}; (b) Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information ...

The organization: a. Develops and documents an inventory of information system components that: 1. Accurately reflects the current information system; 2. Includes all components within th...

The organization updates the inventory of information system components as an integral part of component installations, removals, and information system updates.

The organization employs automated mechanisms to help maintain an up-to-date, complete, accurate, and readily available inventory of information system components.

The organization: (a) Employs automated mechanisms {{ insert: param, cm-8.3_prm_1 }} to detect the presence of unauthorized hardware, software, and firmware components within the information syst...

The organization includes in the information system component inventory information, a means for identifying by {{ insert: param, cm-8.4_prm_1 }}, individuals responsible/accountable for administer...

The organization verifies that all components within the authorization boundary of the information system are not duplicated in other information system component inventories.

The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.

The organization provides a centralized repository for the inventory of information system components.

The organization employs automated mechanisms to support tracking of information system components by geographic location.

The organization: (a) Assigns {{ insert: param, cm-8.9_prm_1 }} to an information system; and (b) Receives an acknowledgement from the information system owner of this assignment.

The organization develops, documents, and implements a configuration management plan for the information system that: a. Addresses roles, responsibilities, and configuration management processes ...

The organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in information system development.

The organization: a. Uses software and associated documentation in accordance with contract agreements and copyright laws; b. Tracks the use of software and associated documentation protected b...

The organization establishes the following restrictions on the use of open source software: {{ insert: param, cm-10.1_prm_1 }}.

The organization: a. Establishes {{ insert: param, cm-11_prm_1 }} governing the installation of software by users; b. Enforces software installation policies through {{ insert: param, cm-11_prm...

The information system alerts {{ insert: param, cm-11.1_prm_1 }} when the unauthorized installation of software is detected.

The information system prohibits user installation of software without explicit privileged status.