ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(2) > Discussion

CM-2(2) Automation Support for Accuracy and Currency - Discussion
Family: Configuration Management (CM) > CM-2 Baseline Configuration

Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools, hardware, software, firmware inventory tools, and network management tools. Automated tools can be used at the organization level, mission and business process level, or system level on workstations, servers, notebook computers, network components, or mobile devices. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of [CM-8(2)](#cm-8.2) for organizations that combine system component inventory and baseline configuration activities.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(2)

CM-2(2) Baseline Configuration | Automation Support for Accuracy and Currency
Family: Configuration Management (CM) > CM-2 Baseline Configuration

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(3) > Discussion

CM-2(3) Retention of Previous Configurations - Discussion
Family: Configuration Management (CM) > CM-2 Baseline Configuration

Retaining previous versions of baseline configurations to support rollback include hardware, software, firmware, configuration files, configuration records, and associated documentation.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(3)

CM-2(3) Baseline Configuration | Retention of Previous Configurations
Family: Configuration Management (CM) > CM-2 Baseline Configuration

Retain [Assignment: organization-defined number] of previous versions of baseline configurations of the system to support rollback.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(6) > Discussion

CM-2(6) Development and Test Environments - Discussion
Family: Configuration Management (CM) > CM-2 Baseline Configuration

Establishing separate baseline configurations for development, testing, and operational environments protects systems from unplanned or unexpected events related to development and testing activities. Separate baseline configurations allow organizations to apply the configuration management that is most appropriate for each type of configuration. For example, the management of operational configurations typically emphasizes the need for stability, while the management of development or test configurations requires greater flexibility. Configurations in the test environment mirror configurations in the operational environment to the extent practicable so that the results of the testing are representative of the proposed changes to the operational systems. Separate baseline configurations do not necessarily require separate physical environments.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(6)

CM-2(6) Baseline Configuration | Development and Test Environments
Family: Configuration Management (CM) > CM-2 Baseline Configuration

Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(7) > Discussion

CM-2(7) Configure Systems and Components for High-risk Areas - Discussion
Family: Configuration Management (CM) > CM-2 Baseline Configuration

When it is known that systems or system components will be in high-risk areas external to the organization, additional controls may be implemented to counter the increased threat in such areas. For example, organizations can take actions for notebook computers used by individuals departing on and returning from travel. Actions include determining the locations that are of concern, defining the required configurations for the components, ensuring that components are configured as intended before travel is initiated, and applying controls to the components after travel is completed. Specially configured notebook computers include computers with sanitized hard drives, limited applications, and more stringent configuration settings. Controls applied to mobile devices upon return from travel include examining the mobile device for signs of physical tampering and purging and reimaging disk drives. Protecting information that resides on mobile devices is addressed in the [MP](#mp) (Media Protection) family.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-2 > CM-2(7)

CM-2(7) Baseline Configuration | Configure Systems and Components for High-risk Areas
Family: Configuration Management (CM) > CM-2 Baseline Configuration

(a) Issue [Assignment: organization-defined systems or system components] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and
(b) Apply the following controls to the systems or components when the individuals return from travel: [Assignment: organization-defined controls].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3

CM-3 Configuration Change Control
Family: Configuration Management (CM)

a. Determine and document the types of changes to the system that are configuration-controlled;
b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
c. Document configuration change decisions associated with the system;
d. Implement approved configuration-controlled changes to the system;
e. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period];
f. Monitor and review activities associated with configuration-controlled changes to the system; and
g. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection; one or more: [Assignment: organization-defined frequency] ; when [Assignment: organization-defined configuration change conditions] ].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > Discussion

CM-3 Configuration Change Control - Discussion
Family: Configuration Management (CM)

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(1)

CM-3(1) Configuration Change Control | Automated Documentation, Notification, and Prohibition of Changes
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Use [Assignment: organization-defined automated mechanisms] to:
(a) Document proposed changes to the system;
(b) Notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval;
(c) Highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period];
(d) Prohibit changes to the system until designated approvals are received;
(e) Document all changes to the system; and
(f) Notify [Assignment: organization-defined personnel] when approved changes to the system are completed.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(2) > Discussion

CM-3(2) Testing, Validation, and Documentation of Changes - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Changes to systems include modifications to hardware, software, or firmware components and configuration settings defined in [CM-6](#cm-6) . Organizations ensure that testing does not interfere with system operations that support organizational mission and business functions. Individuals or groups conducting tests understand security and privacy policies and procedures, system security and privacy policies and procedures, and the health, safety, and environmental risks associated with specific facilities or processes. Operational systems may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(2)

CM-3(2) Configuration Change Control | Testing, Validation, and Documentation of Changes
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Test, validate, and document changes to the system before finalizing the implementation of the changes.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(3) > Discussion

CM-3(3) Automated Change Implementation - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Automated tools can improve the accuracy, consistency, and availability of configuration baseline information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(3)

CM-3(3) Configuration Change Control | Automated Change Implementation
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(4) > Discussion

CM-3(4) Security and Privacy Representatives - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Information security and privacy representatives include system security officers, senior agency information security officers, senior agency officials for privacy, or system privacy officers. Representation by personnel with information security and privacy expertise is important because changes to system configurations can have unintended side effects, some of which may be security- or privacy-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security and privacy posture of systems. The configuration change control element referred to in the second organization-defined parameter reflects the change control elements defined by organizations in [CM-3g](#cm-3_smt.g).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(4)

CM-3(4) Configuration Change Control | Security and Privacy Representatives
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Require [Assignment: organization-defined organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(5) > Discussion

CM-3(5) Automated Security Response - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Automated security responses include halting selected system functions, halting system processing, and issuing alerts or notifications to organizational personnel when there is an unauthorized modification of a configuration item.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(5)

CM-3(5) Configuration Change Control | Automated Security Response
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: organization-defined security responses].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(6) > Discussion

CM-3(6) Cryptography Management - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

The controls referenced in the control enhancement refer to security and privacy controls from the control catalog. Regardless of the cryptographic mechanisms employed, processes and procedures are in place to manage those mechanisms. For example, if system components use certificates for identification and authentication, a process is implemented to address the expiration of those certificates.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(6)

CM-3(6) Configuration Change Control | Cryptography Management
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(7) > Discussion

CM-3(7) Review System Changes - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(7)

CM-3(7) Configuration Change Control | Review System Changes
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Review changes to the system [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(8) > Discussion

CM-3(8) Prevent or Restrict Configuration Changes - Discussion
Family: Configuration Management (CM) > CM-3 Configuration Change Control

System configuration changes can adversely affect critical system security and privacy functionality. Change restrictions can be enforced through automated mechanisms.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-3 > CM-3(8)

CM-3(8) Configuration Change Control | Prevent or Restrict Configuration Changes
Family: Configuration Management (CM) > CM-3 Configuration Change Control

Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: organization-defined circumstances].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-4

CM-4 Impact Analyses
Family: Configuration Management (CM)

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-4 > Discussion

CM-4 Impact Analyses - Discussion
Family: Configuration Management (CM)

Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-4 > CM-4(1) > Discussion

CM-4(1) Separate Test Environments - Discussion
Family: Configuration Management (CM) > CM-4 Impact Analyses

A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-4 > CM-4(1)

CM-4(1) Impact Analyses | Separate Test Environments
Family: Configuration Management (CM) > CM-4 Impact Analyses

Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-4 > CM-4(2) > Discussion

CM-4(2) Verification of Controls - Discussion
Family: Configuration Management (CM) > CM-4 Impact Analyses

Implementation in this context refers to installing changed code in the operational system that may have an impact on security or privacy controls.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-4 > CM-4(2)

CM-4(2) Impact Analyses | Verification of Controls
Family: Configuration Management (CM) > CM-4 Impact Analyses

After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5

CM-5 Access Restrictions for Change
Family: Configuration Management (CM)

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > Discussion

CM-5 Access Restrictions for Change - Discussion
Family: Configuration Management (CM)

Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals' privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(1) > Discussion

CM-5(1) Automated Access Enforcement and Audit Records - Discussion
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(1)

CM-5(1) Access Restrictions for Change | Automated Access Enforcement and Audit Records
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

(a) Enforce access restrictions using [Assignment: organization-defined automated mechanisms] ; and
(b) Automatically generate audit records of the enforcement actions.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(4) > Discussion

CM-5(4) Dual Authorization - Discussion
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

Organizations employ dual authorization to help ensure that any changes to selected system components and information cannot occur unless two qualified individuals approve and implement such changes. The two individuals possess the skills and expertise to determine if the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes. Dual authorization may also be known as two-person control. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(4)

CM-5(4) Access Restrictions for Change | Dual Authorization
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

Enforce dual authorization for implementing changes to [Assignment: organization-defined organization-defined system components and system-level information].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(5) > Discussion

CM-5(5) Privilege Limitation for Production and Operation - Discussion
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(5)

CM-5(5) Access Restrictions for Change | Privilege Limitation for Production and Operation
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

(a) Limit privileges to change system components and system-related information within a production or operational environment; and
(b) Review and reevaluate privileges [Assignment: organization-defined organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(6) > Discussion

CM-5(6) Limit Library Privileges - Discussion
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

Software libraries include privileged programs.