CM-5(5) Privilege Limitation for Production and Operation
Control enhancement of CM-5 Access Restrictions for Change
Control
Limit privileges to change system components and system-related information within a production or operational environment; and
Review and reevaluate privileges [Assignment: organization-defined frequency].
Discussion
In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures.
Related controls
Need CM-5(5) implemented and evidenced?
We assess where you stand against this control, document the gap, and build the remediation plan your auditor and your board will both accept.
Control catalog and framework text on this page is reproduced from official NIST publications — a public-domain work of the U.S. Government (17 U.S.C. §105). Maverc commentary, groupings, and readiness guidance are our own and are not part of any NIST publication.