{COMMAND} {SYSTEM NAME} {ACRONYM} System Version: {VERSION} eMASS# {EMASS#} Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY} Department of the {SERVICE} {LOGO} Security-Focused Configuration Management Plan (Sec-CM) Document Version: 1.0.0 {DATE} Prepared by: {ORGANIZATION} DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS. OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}
CM-1 CM-1 (a) (1) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management policy via the inspected organization's information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated. Internal Web Portal CM-1 CM-1 (a) (2) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls. CM-1 CM-1 (a) (2) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the procedures to facilitate the implementation of the configuration management policy and associated configuration management controls via the inspected organization's information sharing capability (e.g. portal, intranet, email, etc.) to ensure it has been disseminated. Internal Web Portal CM-1 CM-1 (b) (1) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of occurrence of reviews and update actions for the configuration management policy to ensure annual review and necessary updates are occurring. DoD has defined the frequency as annually. CM-1 CM-1 (b) (1) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD level
policies are not appropriate to define at the Enterprise level. CM-11 CM-11 (b) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines software installation policies defined in CM-11, CCI 1804 and inspects the methods defined in CM-11, CCI 1806 to verify they are properly implemented. CM-11 CM-11 (c ) High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit trails of monitoring activities to ensure the organization being inspected/assessed monitors software installation policy compliance at least monthly. DoD has defined the frequency as at least monthly. CM-11 CM-11 (c ) High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as at least monthly. Automatically compliant with this CCI because they are covered at the DoD level CM-2 CM-2 High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented baseline configuration. CM-2 CM-2 High Moderate Low The organization conducting the inspection/assessment obtains and examines the current baseline to ensure the current configuration matches the current documented baseline. CM-2 (1) CM-2 (1) (a) High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of organizational reviews and update actions for the baseline configuration to ensure annual review and necessary updates are occurring. DoD has defined the frequency as annually. CM-2 (1) CM-2 (1) (a) High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. Automatically compliant with this CCI because they are covered at the DoD
CM-2 (2) CM-2 (2) High The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms used to maintain readily available baseline configuration of the information system. The organization being inspected/assessed may be required to demonstrate use of their identified automated mechanisms. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-2 (3) CM-2 (3) High Moderate The organization conducting the inspection/assessment obtains and examines the documentation of the previous version of the baseline configuration to determine if all IS components necessary for rollback are retained. DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months. CM-2 (3) CM-2 (3) High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the previous versions as the previous approved baseline configuration of IS components for a minimum of 3 months. Automatically compliant with this CCI because they are covered at the DoD CM-2 (6) CM-2 (6) blank blank blank The organization conducting the inspection/assessment obtains and examines development environment baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the development environment separate from the operational baseline configuration. NIST has not allocated this AP. Therefore, this AP is not applicable. CM-2 (6) CM-2 (6) blank blank blank The organization conducting the inspection/assessment obtains and examines test environment baseline configuration documentation and ensures the organization is maintaining and managing a baseline configuration for the test environment separate NIST has not allocated this AP. Therefore, this AP is not applicable.
CM-2 (7) CM-2 (7) b High Moderate The organization conducting the inspection/assessment obtains and examines the configuration management policy to ensure the organization being inspected/assessed defines the security safeguards to be applied to devices when they return from areas of significant risk. DoD has determined that this value is not appropriate to define at the Enterprise level. CM-3 (1) CM-3 (1) (a) High The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system documents proposed changes. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-3 (1) CM-3 (1) (b) High The organization conducting the inspection/assessment obtains and examines documentation of the use of the identified automated mechanisms to ensure that the identified system notifies designated approval authorities of proposed changes to the information system and request change approval. The organization inspected/assessed may be required to demonstrate use of their identified automated mechanisms. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-3 (1) CM-3 (1) (b) High The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the approval authorities as the configuration control board (CCB). Automatically compliant with this CCI because they are covered at the DoD level
CM-5 (2) CM-5 (2) High Moderate The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of reviews to ensure the organization being inspected/assessed reviews the information system changes when there is an incident or when planned changes have been performed to determine whether unauthorized changes have occurred. DoD has defined the circumstances as when there is an incident or when planned changes have been performed. CM-5 (2) CM-5 (2) High Moderate The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 90 days or more frequently as the organization defines for high systems AND at least annually or more frequently as the organization defines for low and moderate systems. Automatically compliant with this CCI because they are covered at the DoD level CM-5 (2) CM-5 (2) High Moderate The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the circumstances as when there is an incident or when planned changes have been performed. Automatically compliant with this CCI because they are covered at the DoD level
CM-8 (3) CM-8 (3) (a) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documentation identifying the automated mechanisms and examines the implemented automated mechanisms to ensure the organization inspected/assessed employs automated mechanisms, continuously, to detect the presence of unauthorized hardware, software, and firmware components within the information system. DoD has defined the frequency as continuously. System Security Plan (external link) CM-8 (3) CM-8 (3) (a) High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as continuously. Automatically compliant with this CCI because they are covered at the DoD level CM-8 (3) CM-8 (3) (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented list of personnel or roles to be notified when unauthorized hardware, software, and firmware components are detected within the information system to ensure the organization being inspected/assessed has either defined additional personnel or roles, or identified that there are no additional personnel or roles. DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate.
CM-8 (3) CM-8 (3) (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented process and audit trail for taking action upon detection of unauthorized components to ensure the organization being inspected/assessed takes action to disable network access by unauthorized software, hardware, and firmware components, isolate the components, and/or notify the ISSO and ISSM and others as the local organization deems appropriate. DoD has defined the personnel or roles as the ISSO and ISSM and others as the local organization deems appropriate. CM-8 (4) CM-8 (4) High High The organization conducting the inspection/assessment obtains and examines the information system component inventory to verify that the organization being inspected/assessed identifies within their inventory, the name and position or role of individuals responsible/accountable for administering those components or a means of identifying those individuals. The system is not considered a HIGH level. Therefore, this AP is not applicable. CM-8 (5) CM-8 (5) High Moderate The organization conducting the inspection/assessment obtains and examines the inventory list of the authorized information system and verifies that all components identified during the inspection are not duplicated in other information system inventories. System Security Plan (external link)
CM-9 CM-9 (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle. Checks should include verification that items being processed for CM are the items identified and that identified configuration items have not been changed without going through the documented process. CM-9 CM-9 (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure it establishes and documents a process for managing the configuration of the configuration items. CM-9 CM-9 (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. CM-9 CM-9 (c ) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure the organization being inspected/assessed implements a configuration management plan for the information system that