Lexim011/Compliance huggingface dataset:
CCI-000303 (policy): Maintain available configuration of the system using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-2 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2) NIST: NIST SP 800-53A (v1): CM-2 (2).1
CCI-003911 (policy): Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the baseline configuration of the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (2)
CCI-000304 (policy): Retain organization-defined number of previous versions of baseline configurations of the system to support rollback.
References: NIST: NIST SP 800-53 (v3): CM-2 (3) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (3) NIST: NIST SP 800-53A (v1): CM-2 (3).1
CCI-001736 (policy): Defines the number of previous versions of the baseline configuration of the system required to support rollback.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (3) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (3)
CCI-000311 (policy): Maintain a baseline configuration for system development environments that is managed separately from the operational baseline configuration.
References: NIST: NIST SP 800-53 (v3): CM-2 (6) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (6) NIST: NIST SP 800-53A (v1): CM-2 (6).1
CCI-000312 (policy): Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration.
References: NIST: NIST SP 800-53 (v3): CM-2 (6) NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (6) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (6) NIST: NIST SP 800-53A (v1): CM-2 (6).1
CCI-001737 (policy): Defines the systems or system components that are to have organization-defined configurations applied when located in areas of significant risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (a)
CCI-001738 (policy): Defines the configurations to be implemented on systems and system components when they are located in areas of significant risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (a)
CCI-001739 (policy): Issue organization-defined systems or system components with organization-defined configurations to individuals traveling to locations the organization deems to be of significant risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (a)
CCI-001815 (policy): Defines the controls to be applied to devices when individuals return from areas of significant risk.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (b)
CCI-001816 (policy): Apply organization-defined controls to the systems or components when the individuals return from travel.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-2 (7) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-2 (7) (b)
CCI-000313 (policy): Determine and document the types of changes to the system that are configuration-controlled.
References: NIST: NIST SP 800-53 (v3): CM-3 a NIST: NIST SP 800-53 Revision 4 (v4): CM-3 a NIST: NIST SP 800-53 Revision 5 (v5): CM-3 a NIST: NIST SP 800-53A (v1): CM-3.1 (i)
CCI-000314 (policy): Approve or disapprove configuration-controlled changes to the system, with explicit consideration for security impact analyses.
References: NIST: NIST SP 800-53 (v3): CM-3 b NIST: NIST SP 800-53 Revision 4 (v4): CM-3 b NIST: NIST SP 800-53 Revision 5 (v5): CM-3 b NIST: NIST SP 800-53A (v1): CM-3.1 (ii)
CCI-001740 (policy): Review proposed configuration-controlled changes to the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 b NIST: NIST SP 800-53 Revision 5 (v5): CM-3 b
CCI-003912 (policy): Approve or disapprove configuration-controlled changes to the system, with explicit consideration for privacy impact analyses.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 b
CCI-001741 (policy): Document configuration change decisions associated with the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 c NIST: NIST SP 800-53 Revision 5 (v5): CM-3 c
CCI-001819 (policy): Implement approved configuration-controlled changes to the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 d NIST: NIST SP 800-53 Revision 5 (v5): CM-3 d
CCI-002056 (policy): Defines the time period the records of configuration-controlled changes are to be retained.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 e NIST: NIST SP 800-53 Revision 5 (v5): CM-3 d
CCI-000316 (policy): Retain records of configuration-controlled changes to the system for an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): CM-3 d NIST: NIST SP 800-53 Revision 4 (v4): CM-3 e NIST: NIST SP 800-53 Revision 5 (v5): CM-3 e NIST: NIST SP 800-53A (v1): CM-3.1 (iv)
CCI-000318 (policy): Monitor and review activities associated with configuration-controlled changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-3 e NIST: NIST SP 800-53 Revision 4 (v4): CM-3 f NIST: NIST SP 800-53 Revision 5 (v5): CM-3 f NIST: NIST SP 800-53A (v1): CM-3.1 (v)
CCI-000319 (policy): Coordinate and provides oversight for configuration change control activities through an organization-defined configuration change control element that convenes at the organization-defined frequency, and/or for any organization-defined configuration change conditions.
References: NIST: NIST SP 800-53 (v3): CM-3 f NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g NIST: NIST SP 800-53A (v1): CM-3.1 (vii)
CCI-000320 (policy): Defines the frequency with which to convene the configuration change control element.
References: NIST: NIST SP 800-53 (v3): CM-3 f NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g NIST: NIST SP 800-53A (v1): CM-3.1 (vi)
CCI-000321 (policy): Defines configuration change conditions that prompt the configuration change control element to convene.
References: NIST: NIST SP 800-53 (v3): CM-3 f NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g NIST: NIST SP 800-53A (v1): CM-3.1 (vi)
CCI-001586 (policy): Defines the configuration change control element responsible for coordinating and providing oversight for configuration change control activities.
References: NIST: NIST SP 800-53 (v3): CM-3 f NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (4) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 g NIST: NIST SP 800-53 Revision 5 (v5): CM-3 g NIST: NIST SP 800-53A (v1): CM-3.1 (vi)
CCI-000322 (policy): Use organization-defined automated mechanisms to document proposed changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-3 (1) (a) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (a) NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii)
CCI-003913 (policy): Defines the automated mechanisms for documenting proposed changes to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (a)
CCI-000323 (policy): Use organization-defined automated mechanisms to notify organization-defined approval authorities of proposed changes to the system and request change approval.
References: NIST: NIST SP 800-53 (v3): CM-3 (1) (b) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (b) NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii)
CCI-001742 (policy): Defines the approval authorities to be notified when proposed changes to the system are received.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (b)
CCI-003914 (policy): Defines the automated mechanisms for notifying approval authorities of proposed changes to the system and request change proposal.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (b)
CCI-000324 (policy): Use organization-defined automated mechanisms to highlight proposed changes to the system that have not been approved or disapproved by an organization-defined time period.
References: NIST: NIST SP 800-53 (v3): CM-3 (1) (c) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (c) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (c) NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii)
CCI-001498 (policy): Defines a time period after which proposed changes to the system that have not been approved or disapproved are highlighted.
References: NIST: NIST SP 800-53 (v3): CM-3 (1) (c) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (c) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (c) NIST: NIST SP 800-53A (v1): CM-3 (1).1 (i)
CCI-003915 (policy): Defines the automated mechanisms for highlighting proposed changes to the system that have not been approved or disapproved within an organization-defined time period.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (c)
CCI-000325 (policy): Use organization-defined automated mechanisms to prohibit changes to the system until designated approvals are received.
References: NIST: NIST SP 800-53 (v3): CM-3 (1) (d) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (d) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (d) NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii)
CCI-003916 (policy): Defines the automated mechanisms for prohibiting changes to the system until designated approvals are received.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (d)
CCI-000326 (policy): Use organization-defined automated mechanisms to document all changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-3 (1) (e) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (e) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (e) NIST: NIST SP 800-53A (v1): CM-3 (1).1 (ii)
CCI-003917 (policy): Defines the automated mechanisms for documenting all changes to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (e)
CCI-002057 (policy): Defines the personnel to be notified when approved changes to the system are completed.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (f) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (f)
CCI-002058 (policy): Employ automated mechanisms to notify organization-defined personnel when approved changes to the system are completed.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (1) (f) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (f)
CCI-003918 (policy): Defines the automated mechanisms for notifying organization-defined personnel when approved changes to the system are completed.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (1) (f)
CCI-000327 (policy): Tests changes to the system before finalizing the implementation of the changes.
References: NIST: NIST SP 800-53 (v3): CM-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (2) NIST: NIST SP 800-53A (v1): CM-3 (2).1
CCI-000328 (policy): Validate changes to the system before finalizing the implementation of the changes.
References: NIST: NIST SP 800-53 (v3): CM-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (2) NIST: NIST SP 800-53A (v1): CM-3 (2).1
CCI-000329 (policy): Document changes to the system before finalizing the implementation of the changes.
References: NIST: NIST SP 800-53 (v3): CM-3 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (2) NIST: NIST SP 800-53A (v1): CM-3 (2).1
CCI-000330 (policy): Implement changes to the current system baseline using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-3 (3) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3) NIST: NIST SP 800-53A (v1): CM-3 (3).1
CCI-000331 (policy): Deploy the updated system baseline across the installed base using organization-defined automated mechanism.
References: NIST: NIST SP 800-53 (v3): CM-3 (3) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (3) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3) NIST: NIST SP 800-53A (v1): CM-3 (3).1
CCI-003919 (policy): Defines the automated mechanisms to implement changes to the current system baseline.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3)
CCI-003920 (policy): Defines the automated mechanisms to deploy the updated baselines across the installed base.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (3)
CCI-000332 (policy): Require an organization-defined security representative to be a member of the organization-defined configuration change control element.
References: NIST: NIST SP 800-53 (v3): CM-3 (4) NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (4) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4) NIST: NIST SP 800-53A (v1): CM-3 (3).1
CCI-003921 (policy): Require an organization-defined privacy representative to be a member of the organization-defined configuration change control element.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4)
CCI-003922 (policy): Defines the security representatives required to be members of the configuration change control element.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4)
CCI-003923 (policy): Defines the privacy representatives required to be members of the configuration change control element.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4)
CCI-003924 (policy): Defines the configuration change control element required for security and privacy representatives.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (4)
CCI-001743 (policy): Defines the security responses to be automatically implemented if baseline configurations are changed in an unauthorized manner.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (5)
CCI-001744 (technical): Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (5) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (5)
CCI-001745 (policy): Defines the controls that are to be provided by the cryptographic mechanisms are under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (6) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (6)
CCI-001746 (policy): Ensure that cryptographic mechanisms used to provide organization-defined control are under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-3 (6) NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (6)
CCI-003925 (policy): Review changes to the system on an organization-defined frequency or when there are organization-defined circumstances to determine whether unauthorized changes have occurred.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (7)
CCI-003926 (policy): Defines the frequency for reviewing changes to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (7)
CCI-003927 (policy): Defines the circumstances for determining whether unauthorized changes to the system have occurred.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (7)
CCI-003928 (technical): Prevent or restrict changes to the configuration of the system under organization-defined circumstances.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (8)
CCI-003929 (technical): Defines the circumstances for preventing or restricting changes to the configuration of the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-3 (8)
CCI-000333 (policy): Analyze changes to the system to determine potential security impacts prior to change implementation.
References: NIST: NIST SP 800-53 (v3): CM-4 NIST: NIST SP 800-53 Revision 4 (v4): CM-4 NIST: NIST SP 800-53 Revision 5 (v5): CM-4 NIST: NIST SP 800-53A (v1): CM-4.1
CCI-003930 (policy): Analyze changes to the system to determine potential privacy impacts prior to change implementation.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-4
CCI-001817 (policy): When analyzing changes to the system, looks for privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (1)
CCI-001818 (policy): Analyze changes to the system in a separate test environment before installation in an operational environment.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (1)
CCI-003931 (policy): When analyzing changes to the system, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (1)
CCI-000335 (policy): After system changes, verify that the impacted controls are implemented correctly, meeting the security requirements for the system.
References: NIST: NIST SP 800-53 (v3): CM-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) NIST: NIST SP 800-53A (v1): CM-4 (2).1
CCI-000336 (policy): After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system.
References: NIST: NIST SP 800-53 (v3): CM-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) NIST: NIST SP 800-53A (v1): CM-4 (2).1
CCI-000337 (policy): After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system.
References: NIST: NIST SP 800-53 (v3): CM-4 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-4 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2) NIST: NIST SP 800-53A (v1): CM-4 (2).1
CCI-003932 (policy): After system changes, verify that the impacted controls are implemented correctly, meeting the privacy requirements for the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2)
CCI-003933 (policy): After system changes, verify that the impacted controls are operating as intended, meeting the privacy requirements for the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2)
CCI-003934 (policy): After system changes, verify that the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-4 (2)
CCI-000340 (policy): Approve physical access restrictions associated with changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53 Revision 5 (v5): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000341 (policy): Enforce physical access restrictions associated with changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53 Revision 5 (v5): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000344 (policy): Approve logical access restrictions associated with changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53 Revision 5 (v5): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-000345 (policy): Enforce logical access restrictions associated with changes to the system.
References: NIST: NIST SP 800-53 (v3): CM-5 NIST: NIST SP 800-53 Revision 4 (v4): CM-5 NIST: NIST SP 800-53 Revision 5 (v5): CM-5 NIST: NIST SP 800-53A (v1): CM-5.1
CCI-003935 (policy): Define and document physical access restrictions associated with changes to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-5
CCI-003936 (policy): Define and document logical access restrictions associated with changes to the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-5
CCI-001813 (technical): Enforce access restrictions using organization-defined mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (1) (a)
CCI-003937 (technical): Defines the automated mechanisms to enforce access restrictions.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (1) (a)
CCI-003938 (technical): Automatically generate audit records of the enforcement actions.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (1) (b)
CCI-000353 (policy): Defines system components requiring enforcement of a dual authorization for system changes.
References: NIST: NIST SP 800-53 (v3): CM-5 (4) NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4) NIST: NIST SP 800-53A (v1): CM-5 (4).1 (i)
CCI-000354 (policy, technical): Enforce dual authorization for implementing changes to organization-defined system components.
References: NIST: NIST SP 800-53 (v3): CM-5 (4) NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4) NIST: NIST SP 800-53A (v1): CM-5 (4).1 (ii)
CCI-001751 (policy): Defines system-level information requiring enforcement of a dual authorization for system changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4)
CCI-001752 (policy, technical): Enforce dual authorization for implementing changes to organization-defined system-level information.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (4) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (4)
CCI-001753 (policy): Limit privileges to change system components within a production or operational environment.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (a)
CCI-001754 (policy): Limit privileges to change system-related information within a production or operational environment.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (a)
CCI-003939 (policy): Defines the frequency with which to review and reevaluate system privileges.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (b)
CCI-003940 (policy): Review and reevaluate system privileges per an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (5) (b)
CCI-001499 (technical): Limit privileges to change software resident within software libraries.
References: NIST: NIST SP 800-53 (v3): CM-5 (6) NIST: NIST SP 800-53 Revision 4 (v4): CM-5 (6) NIST: NIST SP 800-53 Revision 5 (v5): CM-5 (6) NIST: NIST SP 800-53A (v1): CM-5 (6).1
CCI-003941 (policy, technical): Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using organization-defined common secure configurations.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 a
CCI-003942 (policy, technical): Defines the common secure configurations for establishing and documenting configuration settings within the system, that reflect the most restrictive mode consistent with operational requirements.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 a
CCI-000366 (policy, technical): Implement the security configuration settings.
References: NIST: NIST SP 800-53 (v3): CM-6 b NIST: NIST SP 800-53 Revision 4 (v4): CM-6 b NIST: NIST SP 800-53 Revision 5 (v5): CM-6 b NIST: NIST SP 800-53A (v1): CM-6.1 (iv)
CCI-000367 (policy): Identify any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.
References: NIST: NIST SP 800-53 (v3): CM-6 c NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c NIST: NIST SP 800-53A (v1): CM-6.1 (v)
CCI-000368 (policy): Document any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.
References: NIST: NIST SP 800-53 (v3): CM-6 c NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c NIST: NIST SP 800-53A (v1): CM-6.1 (v)
CCI-000369 (policy): Approve any deviations from the established configuration settings for organization-defined system components based on organization-defined operational requirements.
References: NIST: NIST SP 800-53 (v3): CM-6 c NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c NIST: NIST SP 800-53A (v1): CM-6.1 (v)
CCI-001755 (policy): Defines the system components for which any deviation from the established configuration settings are to be identified, documented, and approved.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c
CCI-001756 (policy): Defines the operational requirements on which the configuration settings for the organization-defined system components are to be based.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-6 c NIST: NIST SP 800-53 Revision 5 (v5): CM-6 c
CCI-003943 (policy, technical): Monitor changes to the configuration settings in accordance with organizational policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d
CCI-003944 (policy, technical): Monitor changes to the configuration settings in accordance with organizational procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d
CCI-003945 (policy, technical): Control changes to the configuration settings in accordance with organizational policies.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d
CCI-003946 (policy, technical): Control changes to the configuration settings in accordance with organizational procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 d
CCI-000370 (policy): Manage configuration settings for organization-defined system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) NIST: NIST SP 800-53A (v1): CM-6 (1).1
CCI-000371 (policy): Apply configuration settings for organization-defined system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) NIST: NIST SP 800-53A (v1): CM-6 (1).1
CCI-000372 (policy): Verify configuration settings for organization-defined system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-6 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1) NIST: NIST SP 800-53A (v1): CM-6 (1).1
CCI-002059 (policy): Defines the system components for which the organization will employ automated mechanisms to centrally manage, apply, and verify configuration settings.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1)
CCI-003947 (policy): Defines the automated mechanisms for managing, applying, and verifying configuration settings.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (1)
CCI-001757 (policy): Defines the actions to employ when responding to unauthorized changes to the organization-defined configuration settings.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (2)
CCI-001758 (policy): Defines the configuration settings for which to employ organization-defined actions in response to unauthorized changes.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (2)
CCI-001759 (policy): Take organization-defined actions in response to unauthorized changes to organization-defined configuration settings.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-6 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-6 (2)
CCI-000381 (technical): Configure the system to provide only organization-defined mission essential capabilities.
References: NIST: NIST SP 800-53 (v3): CM-7 NIST: NIST SP 800-53 Revision 4 (v4): CM-7 a NIST: NIST SP 800-53 Revision 5 (v5): CM-7 a NIST: NIST SP 800-53A (v1): CM-7.1 (ii)
CCI-003948 (policy, technical): Defines the mission essential capabilities for configuring the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 a
CCI-000380 (policy): Defines prohibited or restricted functions, system ports, protocols, software and/or services for the system.
References: NIST: NIST SP 800-53 (v3): CM-7 NIST: NIST SP 800-53 Revision 4 (v4): CM-7 b NIST: NIST SP 800-53 Revision 5 (v5): CM-7 b NIST: NIST SP 800-53A (v1): CM-7.1 (i)
CCI-000382 (technical): Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
References: NIST: NIST SP 800-53 (v3): CM-7 NIST: NIST SP 800-53 Revision 4 (v4): CM-7 b NIST: NIST SP 800-53 Revision 5 (v5): CM-7 b NIST: NIST SP 800-53A (v1): CM-7.1 (iii)
CCI-000384 (policy): Review the system per organization-defined frequency to identify unnecessary and nonsecure functions, ports, protocols, software, and services.
References: NIST: NIST SP 800-53 (v3): CM-7 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (a) NIST: NIST SP 800-53A (v1): CM-7 (1).1 (i)
CCI-001760 (policy): Defines the frequency of system reviews to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (a)
CCI-001761 (policy): Defines the functions, ports, protocols, software, and services within the information system that are to be disabled or removed when deemed unnecessary and/or nonsecure.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (b)
CCI-001762 (technical): Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (1) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (1) (b)
CCI-001592 (policy): Defines the rules authorizing the terms and conditions of software program usage on the system.
References: NIST: NIST SP 800-53 (v3): CM-7 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (2) NIST: NIST SP 800-53A (v1): CM-7 (2).1 (i)
CCI-001763 (policy): Defines the policies regarding software program usage and restrictions.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (2)
CCI-001764 (technical): Prevent program execution in accordance with organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions; rules authorizing the terms and conditions of software program usage.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (2)
CCI-000387 (policy): Defines registration requirements for functions, ports, protocols, and services.
References: NIST: NIST SP 800-53 (v3): CM-7 (3) NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (3) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (3) NIST: NIST SP 800-53A (v1): CM- 7(3).1 (i)
CCI-000388 (policy): Ensure compliance with organization-defined registration requirements for functions, ports, protocols, and services.
References: NIST: NIST SP 800-53 (v3): CM-7 (3) NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (3) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (3) NIST: NIST SP 800-53A (v1): CM-7 (3).1 (ii)
CCI-001765 (policy): Defines the software programs not authorized to execute on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (a)
CCI-001766 (policy): Identify the organization-defined software programs not authorized to execute on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (a)
CCI-001767 (technical): Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (b)
CCI-001768 (policy): Defines the frequency on which the list of unauthorized software programs will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (c)
CCI-001770 (policy): Review and update the list of unauthorized software programs per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (4) (c) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (4) (c)
CCI-001772 (policy): Defines the software programs authorized to execute on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (a)
CCI-001773 (policy): Identify the organization-defined software programs authorized to execute on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (a)
CCI-001774 (technical): Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (b)
CCI-001775 (policy): Defines the frequency on which the list of authorized software programs will be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (c)
CCI-001777 (policy): Review and update the list of authorized software programs per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-7 (5) (c) NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (5) (c)
CCI-003949 (policy): Require that organization-defined user-installed software in a confined physical or virtual machine environment with limited privileges.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (6)
CCI-003950 (policy): Defines the user-installed software required for executing in a confined physical or virtual machine environment with limited privileges.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (6)
CCI-003951 (policy, technical): Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is obtained from sources with limited or no warranty.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (a)
CCI-003952 (policy, technical): Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is obtained from sources with limited or no warranty.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (a)
CCI-003953 (policy, technical): Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of organization-defined personnel or roles when such code is without the provision of source code.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (b)
CCI-003954 (policy, technical): Defines the personnel or roles who allow execution of binary or machine-executable code only in confined physical or virtual machine environments when such code is without the provision of source code.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (7) (b)
CCI-003955 (policy, technical): Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (8) (a)
CCI-003956 (policy, technical): Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (8) (b)
CCI-003957 (policy, technical): Identify organization-defined hardware components authorized for system use.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (a)
CCI-003958 (policy, technical): Defines the hardware components to be identified for authorized system use.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (a)
CCI-003959 (policy, technical): Prohibit the use or connection of unauthorized hardware components.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (b)
CCI-003960 (policy, technical): Review and update the list of authorized hardware components on an organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (c)
CCI-003961 (policy, technical): Defines the frequency the hardware components are reviewed and updated.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-7 (9) (c)
CCI-000398 (policy): Defines information deemed necessary to achieve effective system component accountability.
References: NIST: NIST SP 800-53 (v3): CM-8 d NIST: NIST SP 800-53 Revision 4 (v4): CM-8 a 4 NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 5 NIST: NIST SP 800-53A (v1): CM-8.1 (i)
CCI-003962 (policy): Develop and document an inventory of system components that accurately reflects the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 1
CCI-003963 (policy): Develop and document an inventory of system components that includes all components within the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 2
CCI-003964 (policy): Develop and document an inventory of system components that does not include duplicate accounting of components or components assigned to any other system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 3
CCI-003965 (policy): Develop and document an inventory of system components that is at the level of granularity deemed necessary for tracking.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 4
CCI-003966 (policy): Develop and document an inventory of system components that is at the level of granularity deemed necessary for reporting.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 4
CCI-003967 (policy): Develop and document an inventory of system components that includes organization-defined information deemed necessary to achieve effective system component accountability.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 a 5
CCI-001779 (policy): Defines the frequency on which the system component inventory is to be reviewed and updated.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b NIST: NIST SP 800-53 Revision 5 (v5): CM-8 b
CCI-001780 (policy): Review and update the system component inventory per organization-defined frequency.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 b NIST: NIST SP 800-53 Revision 5 (v5): CM-8 b
CCI-000408 (policy): Update the inventory of system components as part of component installations.
References: NIST: NIST SP 800-53 (v3): CM-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (1) NIST: NIST SP 800-53A (v1): CM-8 (1).1
CCI-000409 (policy): Update the inventory of system components as part of component removals.
References: NIST: NIST SP 800-53 (v3): CM-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (1) NIST: NIST SP 800-53A (v1): CM-8 (1).1
CCI-000410 (policy): Update the inventory of system components as part of system updates.
References: NIST: NIST SP 800-53 (v3): CM-8 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (1) NIST: NIST SP 800-53A (v1): CM-8 (1).1
CCI-000411 (policy): Maintain the currency of the inventory of system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-8 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) NIST: NIST SP 800-53A (v1): CM-8 (2).1
CCI-000412 (policy): Maintain the completeness of the inventory of system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-8 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) NIST: NIST SP 800-53A (v1): CM-8 (2).1
CCI-000413 (policy): Maintain the accuracy of the inventory of system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-8 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) NIST: NIST SP 800-53A (v1): CM-8 (2).1
CCI-000414 (policy): Maintain the availability of the inventory of system components using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 (v3): CM-8 (2) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (2) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2) NIST: NIST SP 800-53A (v1): CM-8 (2).1
CCI-003968 (policy): Defines the automated mechanisms for maintaining the currency, completeness, accuracy, and availability of the inventory of the system components.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (2)
CCI-000415 (policy): Defines the frequency of employing automated mechanisms to detect the presence of unauthorized hardware, software, and firmware components within the system.
References: NIST: NIST SP 800-53 (v3): CM-8 (3) (a) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (a) NIST: NIST SP 800-53A (v1): CM-8 (3).1 (i)
CCI-000416 (policy): Detect the presence of unauthorized hardware, software, and firmware components within the system using organization-defined automated mechanisms, on an organization-defined frequency.
References: NIST: NIST SP 800-53 (v3): CM-8 (3) (a) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (a) NIST: NIST SP 800-53A (v1): CM-8 (3).1 (ii)
CCI-003969 (policy): Defines the automated mechanisms for detecting the presence of unauthorized hardware, software, and firmware components within the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (a)
CCI-001783 (policy): Defines the personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (b)
CCI-001784 (policy): When unauthorized hardware, software, and firmware components are detected within the system, take action to disable network access by such components; isolate the components, and/or notify organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (3) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (3) (b)
CCI-000418 (policy): Include in the system component inventory information, a means for identifying by name, position, and/or role, individuals responsible and accountable for administering those components.
References: NIST: NIST SP 800-53 (v3): CM-8 (4) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (4) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (4) NIST: NIST SP 800-53A (v1): CM-8 (4).1
CCI-000420 (policy): Include assessed component configurations and any approved deviations to current deployed configurations in the system component inventory.
References: NIST: NIST SP 800-53 (v3): CM-8 (6) NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (6) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (6) NIST: NIST SP 800-53A (v1): CM-8 (6).1
CCI-001785 (policy): Provide a centralized repository for the inventory of system components.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (7) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (7)
CCI-001786 (policy): Support the tracking of system components by geographic location using organization-defined automated mechanisms.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (8) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (8)
CCI-003970 (policy): Defines the automated mechanisms for supporting the tracking of system components by geographic location.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (8)
CCI-001788 (policy): Assign system components to a system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (9) (a) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (9) (a)
CCI-001789 (policy): Receive an acknowledgement from organization-defined personnel or roles of the acquired system components to a system.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-8 (9) (b) NIST: NIST SP 800-53 Revision 5 (v5): CM-8 (9) (b)
CCI-000423 (policy): Implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures.
References: NIST: NIST SP 800-53 (v3): CM-9 a NIST: NIST SP 800-53 Revision 4 (v4): CM-9 a NIST: NIST SP 800-53 Revision 5 (v5): CM-9 a NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-003971 (policy): Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 a
CCI-003972 (policy): Develop and document a configuration management plan for the system that addresses roles, responsibilities, and configuration management procedures.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 a
CCI-001792 (policy): Implement a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b
CCI-001795 (policy): Implement a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 b NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b
CCI-003973 (policy): Develop and document a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b
CCI-003974 (policy): Develop and document a configuration management plan for the system that establishes a process for managing the configuration of the configuration items.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 b
CCI-000426 (policy): Implement a configuration management plan for the system that defines the configuration items for the system.
References: NIST: NIST SP 800-53 (v3): CM-9 b NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c NIST: NIST SP 800-53A (v1): CM-9.1 (i)
CCI-001798 (policy): Implement a configuration management plan for the system that places the configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 c NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c
CCI-003975 (policy): Develop and document a configuration management plan for the system that defines the configuration items for the system.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c
CCI-003976 (policy): Develop and document a configuration management plan for the system that places the configuration items under configuration management.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 c
CCI-003977 (policy): Develop and document a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 d
CCI-003978 (policy): Defines the personnel or roles for those who review and approve the configuration management plan.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 d
CCI-003979 (policy): Implement a configuration management plan for the system that is reviewed and approved by organization-defined personnel or roles.
References: NIST: NIST SP 800-53 Revision 5 (v5): CM-9 d
CCI-001799 (policy): Develop and document a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 d NIST: NIST SP 800-53 Revision 5 (v5): CM-9 e
CCI-001801 (policy): Implement a configuration management plan for the system that protects the configuration management plan from unauthorized disclosure and modification.
References: NIST: NIST SP 800-53 Revision 4 (v4): CM-9 d NIST: NIST SP 800-53 Revision 5 (v5): CM-9 e
CCI-000436 (policy): Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
References: NIST: NIST SP 800-53 (v3): CM-9 (1) NIST: NIST SP 800-53 Revision 4 (v4): CM-9 (1) NIST: NIST SP 800-53 Revision 5 (v5): CM-9 (1) NIST: NIST SP 800-53A (v1): CM-9 (1).1