CM-3 Configuration Change Control
Control
Determine and document the types of changes to the system that are configuration-controlled;
Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;
Document configuration change decisions associated with the system;
Implement approved configuration-controlled changes to the system;
Retain records of configuration-controlled changes to the system for [Assignment: time period];
Monitor and review activities associated with configuration-controlled changes to the system; and
Coordinate and provide oversight for configuration change control activities through [Assignment: configuration change control element] that convenes [Assignment: Selection (one-or-more): [cm-03_odp.04] | when [cm-03_odp.05] ].
Discussion
Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).
Control enhancements (8)
- CM-3(1)Automated Documentation, Notification, and Prohibition of ChangesHIGH
- CM-3(2)Testing, Validation, and Documentation of ChangesMODERATEHIGH
- CM-3(3)Automated Change Implementation
- CM-3(4)Security and Privacy RepresentativesMODERATEHIGH
- CM-3(5)Automated Security Response
- CM-3(6)Cryptography ManagementHIGH
- CM-3(7)Review System Changes
- CM-3(8)Prevent or Restrict Configuration Changes
Related controls
Need CM-3 implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.