ezesecops/rmf-ato-core huggingface dataset:
Security and Privacy Controls for Information Systems and Organizations
CM > CM-5 > CM-5(6)

CM-5(6) Access Restrictions for Change | Limit Library Privileges
Family: Configuration Management (CM) > CM-5 Access Restrictions for Change

Limit privileges to change software resident within software libraries.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-6

CM-6 Configuration Settings
Family: Configuration Management (CM)

a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations];
b. Implement the configuration settings;
c. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements] ; and
d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-6 > Discussion

CM-6 Configuration Settings - Discussion
Family: Configuration Management (CM)

Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.

Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors.

Implementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline [USGCB](#98498928-3ca3-44b3-8b1e-f48685373087) and security technical implementation guides (STIGs), which affect the implementation of [CM-6](#cm-6) and other controls such as [AC-19](#ac-19) and [CM-7](#cm-7) . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-6 > CM-6(1) > Discussion

CM-6(1) Automated Management, Application, and Verification - Discussion
Family: Configuration Management (CM) > CM-6 Configuration Settings

Automated tools (e.g., hardening tools, baseline configuration tools) can improve the accuracy, consistency, and availability of configuration settings information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-6 > CM-6(1)

CM-6(1) Configuration Settings | Automated Management, Application, and Verification
Family: Configuration Management (CM) > CM-6 Configuration Settings

Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined organization-defined automated mechanisms].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-6 > CM-6(2) > Discussion

CM-6(2) Respond to Unauthorized Changes - Discussion
Family: Configuration Management (CM) > CM-6 Configuration Settings

Responses to unauthorized changes to configuration settings include alerting designated organizational personnel, restoring established configuration settings, or-in extreme cases-halting affected system processing.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-6 > CM-6(2)

CM-6(2) Configuration Settings | Respond to Unauthorized Changes
Family: Configuration Management (CM) > CM-6 Configuration Settings

Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7

CM-7 Least Functionality
Family: Configuration Management (CM)

a. Configure the system to provide only [Assignment: organization-defined mission-essential capabilities] ; and
b. Prohibit or restrict the use of the following functions, ports, protocols, software, and/or services: [Assignment: organization-defined organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > Discussion

CM-7 Least Functionality - Discussion
Family: Configuration Management (CM)

Systems provide a wide variety of functions and services. Some of the functions and services routinely provided by default may not be necessary to support essential organizational missions, functions, or operations. Additionally, it is sometimes convenient to provide multiple services from a single system component, but doing so increases risk over limiting the services provided by that single component. Where feasible, organizations limit component functionality to a single function per component. Organizations consider removing unused or unnecessary software and disabling unused or unnecessary physical and logical ports and protocols to prevent unauthorized connection of components, transfer of information, and tunneling. Organizations employ network scanning tools, intrusion detection and prevention systems, and end-point protection technologies, such as firewalls and host-based intrusion detection systems, to identify and prevent the use of prohibited functions, protocols, ports, and services. Least functionality can also be achieved as part of the fundamental design and development of the system (see [SA-8](#sa-8), [SC-2](#sc-2) , and [SC-3](#sc-3)).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(1) > Discussion

CM-7(1) Periodic Review - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Organizations review functions, ports, protocols, and services provided by systems or system components to determine the functions and services that are candidates for elimination. Such reviews are especially important during transition periods from older technologies to newer technologies (e.g., transition from IPv4 to IPv6). These technology transitions may require implementing the older and newer technologies simultaneously during the transition period and returning to minimum essential functions, ports, protocols, and services at the earliest opportunity. Organizations can either decide the relative security of the function, port, protocol, and/or service or base the security decision on the assessment of other entities. Unsecure protocols include Bluetooth, FTP, and peer-to-peer networking.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(1)

CM-7(1) Least Functionality | Periodic Review
Family: Configuration Management (CM) > CM-7 Least Functionality

(a) Review the system [Assignment: organization-defined frequency] to identify unnecessary and/or nonsecure functions, ports, protocols, software, and services; and
(b) Disable or remove [Assignment: organization-defined organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(2) > Discussion

CM-7(2) Prevent Program Execution - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Prevention of program execution addresses organizational policies, rules of behavior, and/or access agreements that restrict software usage and the terms and conditions imposed by the developer or manufacturer, including software licensing and copyrights. Restrictions include prohibiting auto-execute features, restricting roles allowed to approve program execution, permitting or prohibiting specific software programs, or restricting the number of program instances executed at the same time.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(2)

CM-7(2) Least Functionality | Prevent Program Execution
Family: Configuration Management (CM) > CM-7 Least Functionality

Prevent program execution in accordance with [Selection; one or more: [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions] ; rules authorizing the terms and conditions of software program usage].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(3) > Discussion

CM-7(3) Registration Compliance - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Organizations use the registration process to manage, track, and provide oversight for systems and implemented functions, ports, protocols, and services.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(3)

CM-7(3) Least Functionality | Registration Compliance
Family: Configuration Management (CM) > CM-7 Least Functionality

Ensure compliance with [Assignment: organization-defined registration requirements].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(4) > Discussion

CM-7(4) Unauthorized Software - Deny-by-exception - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Unauthorized software programs can be limited to specific versions or from a specific source. The concept of prohibiting the execution of unauthorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(4)

CM-7(4) Least Functionality | Unauthorized Software - Deny-by-exception
Family: Configuration Management (CM) > CM-7 Least Functionality

(a) Identify [Assignment: organization-defined software programs];
(b) Employ an allow-all, deny-by-exception policy to prohibit the execution of unauthorized software programs on the system; and
(c) Review and update the list of unauthorized software programs [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(5) > Discussion

CM-7(5) Authorized Software - Allow-by-exception - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Authorized software programs can be limited to specific versions or from a specific source. To facilitate a comprehensive authorized software process and increase the strength of protection for attacks that bypass application level authorized software, software programs may be decomposed into and monitored at different levels of detail. These levels include applications, application programming interfaces, application modules, scripts, system processes, system services, kernel functions, registries, drivers, and dynamic link libraries. The concept of permitting the execution of authorized software may also be applied to user actions, system ports and protocols, IP addresses/ranges, websites, and MAC addresses. Organizations consider verifying the integrity of authorized software programs using digital signatures, cryptographic checksums, or hash functions. Verification of authorized software can occur either prior to execution or at system startup. The identification of authorized URLs for websites is addressed in [CA-3(5)](#ca-3.5) and [SC-7](#sc-7).
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(5)

CM-7(5) Least Functionality | Authorized Software - Allow-by-exception
Family: Configuration Management (CM) > CM-7 Least Functionality

(a) Identify [Assignment: organization-defined software programs];
(b) Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system; and
(c) Review and update the list of authorized software programs [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(6) > Discussion

CM-7(6) Confined Environments with Limited Privileges - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Organizations identify software that may be of concern regarding its origin or potential for containing malicious code. For this type of software, user installations occur in confined environments of operation to limit or contain damage from malicious code that may be executed.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(6)

CM-7(6) Least Functionality | Confined Environments with Limited Privileges
Family: Configuration Management (CM) > CM-7 Least Functionality

Require that the following user-installed software execute in a confined physical or virtual machine environment with limited privileges: [Assignment: organization-defined user-installed software].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(7) > Discussion

CM-7(7) Code Execution in Protected Environments - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Code execution in protected environments applies to all sources of binary or machine-executable code, including commercial software and firmware and open-source software.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(7)

CM-7(7) Least Functionality | Code Execution in Protected Environments
Family: Configuration Management (CM) > CM-7 Least Functionality

Allow execution of binary or machine-executable code only in confined physical or virtual machine environments and with the explicit approval of [Assignment: organization-defined personnel or roles] when such code is:
(a) Obtained from sources with limited or no warranty; and/or
(b) Without the provision of source code.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(8) > Discussion

CM-7(8) Binary or Machine Executable Code - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Binary or machine executable code applies to all sources of binary or machine-executable code, including commercial software and firmware and open-source software. Organizations assess software products without accompanying source code or from sources with limited or no warranty for potential security impacts. The assessments address the fact that software products without the provision of source code may be difficult to review, repair, or extend. In addition, there may be no owners to make such repairs on behalf of organizations. If open-source software is used, the assessments address the fact that there is no warranty, the open-source software could contain back doors or malware, and there may be no support available.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(8)

CM-7(8) Least Functionality | Binary or Machine Executable Code
Family: Configuration Management (CM) > CM-7 Least Functionality

(a) Prohibit the use of binary or machine-executable code from sources with limited or no warranty or without the provision of source code; and
(b) Allow exceptions only for compelling mission or operational requirements and with the approval of the authorizing official.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(9) > Discussion

CM-7(9) Prohibiting The Use of Unauthorized Hardware - Discussion
Family: Configuration Management (CM) > CM-7 Least Functionality

Hardware components provide the foundation for organizational systems and the platform for the execution of authorized software programs. Managing the inventory of hardware components and controlling which hardware components are permitted to be installed or connected to organizational systems is essential in order to provide adequate security.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-7 > CM-7(9)

CM-7(9) Least Functionality | Prohibiting The Use of Unauthorized Hardware
Family: Configuration Management (CM) > CM-7 Least Functionality

(a) Identify [Assignment: organization-defined hardware components];
(b) Prohibit the use or connection of unauthorized hardware components;
(c) Review and update the list of authorized hardware components [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8

CM-8 System Component Inventory
Family: Configuration Management (CM)

a. Develop and document an inventory of system components that:
1. Accurately reflects the system;
2. Includes all components within the system;
3. Does not include duplicate accounting of components or components assigned to any other system;
4. Is at the level of granularity deemed necessary for tracking and reporting; and
5. Includes the following information to achieve system component accountability: [Assignment: organization-defined information] ; and
b. Review and update the system component inventory [Assignment: organization-defined frequency].
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > Discussion

CM-8 System Component Inventory - Discussion
Family: Configuration Management (CM)

System components are discrete, identifiable information technology assets that include hardware, software, and firmware. Organizations may choose to implement centralized system component inventories that include components from all organizational systems. In such situations, organizations ensure that the inventories include system-specific information required for component accountability. The information necessary for effective accountability of system components includes the system name, software owners, software version numbers, hardware inventory specifications, software license information, and for networked components, the machine names and network addresses across all implemented protocols (e.g., IPv4, IPv6). Inventory specifications include date of receipt, cost, model, serial number, manufacturer, supplier information, component type, and physical location.

Preventing duplicate accounting of system components addresses the lack of accountability that occurs when component ownership and system association is not known, especially in large or complex connected systems. Effective prevention of duplicate accounting of system components necessitates use of a unique identifier for each component. For software inventory, centrally managed software that is accessed via other systems is addressed as a component of the system on which it is installed and managed. Software installed on multiple organizational systems and managed at the system level is addressed for each individual system and may appear more than once in a centralized component inventory, necessitating a system association for each software instance in the centralized inventory to avoid duplicate accounting of components. Scanning systems implementing multiple network protocols (e.g., IPv4 and IPv6) can result in duplicate components being identified in different address spaces. The implementation of [CM-8(7)](#cm-8.7) can help to eliminate duplicate accounting of components.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(1) > Discussion

CM-8(1) Updates During Installation and Removal - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

Organizations can improve the accuracy, completeness, and consistency of system component inventories if the inventories are updated as part of component installations or removals or during general system updates. If inventories are not updated at these key times, there is a greater likelihood that the information will not be appropriately captured and documented. System updates include hardware, software, and firmware components.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(1)

CM-8(1) System Component Inventory | Updates During Installation and Removal
Family: Configuration Management (CM) > CM-8 System Component Inventory

Update the inventory of system components as part of component installations, removals, and system updates.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(2) > Discussion

CM-8(2) Automated Maintenance - Discussion
Family: Configuration Management (CM) > CM-8 System Component Inventory

Organizations maintain system inventories to the extent feasible. For example, virtual machines can be difficult to monitor because such machines are not visible to the network when not in use. In such cases, organizations maintain as up-to-date, complete, and accurate an inventory as is deemed reasonable. Automated maintenance can be achieved by the implementation of [CM-2(2)](#cm-2.2) for organizations that combine system component inventory and baseline configuration activities.
Security and Privacy Controls for Information Systems and Organizations
CM > CM-8 > CM-8(2)

CM-8(2) System Component Inventory | Automated Maintenance
Family: Configuration Management (CM) > CM-8 System Component Inventory

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using [Assignment: organization-defined organization-defined automated mechanisms].