CM-1 Policy and procedures
Configuration management policy and procedures: documenting, distributing, owning and periodically reviewing the policy and procedures behind baselines, change control and secure settings.
CM Configuration management
Configuration management (CM) family of NIST SP 800-53 Rev. 5: baseline configurations, change control, impact analysis, secure settings, least functionality, component inventory, software restrictions and signed components.
CM-2 Baseline configuration
Developing and keeping a current baseline configuration of the system under configuration control and updating it periodically and when components change, plus enhancements for automation, keeping previous configurations and configuring components used in high-risk areas.
CM-3 Configuration change control
Configuration change control: which changes are controlled, review and approval with security and privacy impact analysis, documenting decisions, implementing approved changes, keeping change records and oversight by a defined change control body.
CM-4 Impact analyses
Analyzing proposed system changes for potential security and privacy impacts before implementation, plus enhancements for separate test environments and verifying controls after a change.
CM-5 Access restrictions for change
Defining, approving and enforcing physical and logical access restrictions on who can change the system, plus enhancements for automated enforcement with audit records, dual authorization and limiting production privileges.
CM-6 Configuration settings
Secure configuration settings: documenting the most restrictive settings consistent with operations using common secure configurations, applying them, approving deviations and controlling changes, plus automated management and response to unauthorized changes.
CM-7 Least functionality
Least functionality: configuring systems to provide only mission-essential capabilities and restricting unneeded functions, ports, protocols, software and services, plus periodic review and allow-listing enhancements.
CM-8 System component inventory
Building and maintaining an accurate inventory of system components at a useful level of detail without duplicates, reviewed at a defined frequency, plus enhancements for updates on installation, automated maintenance and unauthorized component detection.
CM-9 Configuration management plan
The configuration management plan: roles and processes, identifying and managing configuration items through the life cycle, approval of the plan and protecting it from unauthorized disclosure and change.
CM-10 Software usage restrictions
Using software and documentation in line with contracts and copyright law, tracking quantity-licensed software and controlling peer-to-peer file sharing, plus the open-source software enhancement.
CM-11 User-installed software
Governing software that users install: setting installation policies, enforcing them through defined methods and monitoring compliance, plus enhancements for privileged installation and automated enforcement.
CM-12 Information location
Information location: documenting where defined information is processed and stored, on which components, who has access there, and changes to location, plus the automated tools enhancement in the moderate and high baselines.
CM-13 Data action mapping
Data action mapping: documenting a map of the system operations that process personally identifiable information across its life cycle, a privacy-focused control outside the SP 800-53B baselines.
CM-14 Signed components
Blocking installation of defined software and firmware components unless their digital signature is verified against a certificate the organization recognizes and approves; not in any SP 800-53B baseline.
