a. Develop, document, and disseminate to {{ insert: param, cm-1_prm_1 }}: 1. {{ insert: param, cm-01_odp.03 }} configuration management policy that: (a) Addresses purpose, scope, roles,...

a. Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b. Review and update the baseline configuration of the system: 1. {{ inse...

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using {{ insert: param, cm-02.02_odp }}.

Retain {{ insert: param, cm-02.03_odp }} of previous versions of baseline configurations of the system to support rollback.

Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.

(a) Issue {{ insert: param, cm-02.07_odp.01 }} with {{ insert: param, cm-02.07_odp.02 }} to individuals traveling to locations that the organization deems to be of significant risk; and (b) App...

a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such ...

Use {{ insert: param, cm-03.01_odp.01 }} to: (a) Document proposed changes to the system; (b) Notify {{ insert: param, cm-03.01_odp.02 }} of proposed changes to the system and request change ap...

Test, validate, and document changes to the system before finalizing the implementation of the changes.

Implement changes to the current system baseline and deploy the updated baseline across the installed base using {{ insert: param, cm-03.03_odp }}.

Require {{ insert: param, cm-3.4_prm_1 }} to be members of the {{ insert: param, cm-03.04_odp.03 }}.

Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: {{ insert: param, cm-03.05_odp }}.

Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: {{ insert: param, cm-03.06_odp }}.

Review changes to the system {{ insert: param, cm-03.07_odp.01 }} or when {{ insert: param, cm-03.07_odp.02 }} to determine whether unauthorized changes have occurred.

Prevent or restrict changes to the configuration of the system under the following circumstances: {{ insert: param, cm-03.08_odp }}.

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility,...

After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requireme...

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

(a) Enforce access restrictions using {{ insert: param, cm-05.01_odp }} ; and (b) Automatically generate audit records of the enforcement actions.

Enforce dual authorization for implementing changes to {{ insert: param, cm-5.4_prm_1 }}.

(a) Limit privileges to change system components and system-related information within a production or operational environment; and (b) Review and reevaluate privileges {{ insert: param, cm-5.5...

Limit privileges to change software resident within software libraries.

a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using {{ insert: param, ...

Manage, apply, and verify configuration settings for {{ insert: param, cm-06.01_odp.01 }} using {{ insert: param, cm-6.1_prm_2 }}.

Take the following actions in response to unauthorized changes to {{ insert: param, cm-06.02_odp.02 }}: {{ insert: param, cm-06.02_odp.01 }}.

a. Configure the system to provide only {{ insert: param, cm-07_odp.01 }} ; and b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: {{ inser...

(a) Review the system {{ insert: param, cm-07.01_odp.01 }} to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and (b) Disable or remove {{ insert: par...

Prevent program execution in accordance with {{ insert: param, cm-07.02_odp.01 }}.

Ensure compliance with {{ insert: param, cm-07.03_odp }}.

(a) Identify {{ insert: param, cm-07.04_odp.01 }}; (b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and (c) Review ...

(a) Identify {{ insert: param, cm-07.05_odp.01 }}; (b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and (c) Review and u...

Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: {{ insert: param, cm-07.06_odp }}.

Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of {{ insert: param, cm-07.07_odp }} when such code is:...

(a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and (b) Allow exceptions only for compelling mission ...

(a) Identify {{ insert: param, cm-07.09_odp.01 }}; (b) Prohibit the use or connection of unauthorized hardware components; (c) Review and update the list of authorized hardware components {{ ...

a. Develop and document an inventory of system components that: 1. Accurately reflects the system; 2. Includes all components within the system; 3. Does not include duplicate accounti...

Update the inventory of system components as part of component installations, removals, and system updates.

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using {{ insert: param, cm-8.2_prm_1 }}.

(a) Detect the presence of unauthorized hardware, software, and firmware components within the system using {{ insert: param, cm-8.3_prm_1 }} {{ insert: param, cm-08.03_odp.04 }} ; and (b) Take...

Include in the system component inventory information, a means for identifying by {{ insert: param, cm-08.04_odp }} , individuals responsible and accountable for administering those components.

Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.

Provide a centralized repository for the inventory of system components.

Support the tracking of system components by geographic location using {{ insert: param, cm-08.08_odp }}.

(a) Assign system components to a system; and (b) Receive an acknowledgement from {{ insert: param, cm-08.09_odp }} of this assignment.

Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes...

Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.

a. Use software and associated documentation in accordance with contract agreements and copyright laws; b. Track the use of software and associated documentation protected by quantity licenses ...

Establish the following restrictions on the use of open-source software: {{ insert: param, cm-10.01_odp }}.

a. Establish {{ insert: param, cm-11_odp.01 }} governing the installation of software by users; b. Enforce software installation policies through the following methods: {{ insert: param, cm-11_...

Allow user installation of software only with explicit privileged status.

Enforce and monitor compliance with software installation policies using {{ insert: param, cm-11.3_prm_1 }}.

a. Identify and document the location of {{ insert: param, cm-12_odp }} and the specific system components on which the information is processed and stored; b. Identify and document the users w...

Use automated tools to identify {{ insert: param, cm-12.01_odp.01 }} on {{ insert: param, cm-12.01_odp.02 }} to ensure controls are in place to protect organizational information and individual pri...

Develop and document a map of system data actions.

Prevent the installation of {{ insert: param, cm-14_prm_1 }} without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.