Doc:NIST SP 800-53Ar1 Appendix F/Enhanced/CM/High

From FISMApedia
Jump to: navigation, search

NIST SP 800-53Ar1 Assessment Procedure Catalog, with SP 800-53r3 Security Controls


CONFIGURATION MANAGEMENT

CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-1 Configuration Management Policy and Procedures P1 LOW CM-1 MOD CM-1 HIGH CM-1


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-1


ASSESSMENT PROCEDURE
CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES
CM-1.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and formally documents configuration management policy;
(ii) the organization configuration management policy addresses:
(iii) the organization disseminates formal documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities;
(iv) the organization develops and formally documents configuration management procedures;
(v) the organization configuration management procedures facilitate implementation of the configuration management policy and associated configuration management controls; and
(vi) the organization disseminates formal documented configuration management procedures to elements within the organization having associated configuration management roles and responsibilities.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy and procedures; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration management and control responsibilities].
CM-1.2 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of configuration management policy reviews/updates;
(ii) the organization reviews/updates configuration management policy in accordance with organization-defined frequency;
(iii) the organization defines the frequency of configuration management procedure reviews/updates; and
(iv) the organization reviews/updates configuration management procedures in accordance with organization-defined frequency.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy and procedures; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration management and control responsibilities].


CM-2 BASELINE CONFIGURATION

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-2 Baseline Configuration P1 LOW CM-2 MOD CM-2 (1) (3) (4) HIGH CM-2 (1) (2) (3) (5) (6)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2


ASSESSMENT PROCEDURE
CM-2 BASELINE CONFIGURATION
CM-2.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and documents a baseline configuration of the information system and
(ii) the organization maintains, under configuration control, a current baseline configuration of the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; enterprise architecture documentation; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/1


CM-2(1) BASELINE CONFIGURATION
CM-2(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines:
(ii) the organization reviews and updates the baseline configuration of the information system
  • in accordance with the organization-defined frequency;
  • when required due to organization-defined circumstances; and
  • as an integral part of information system component installations and upgrades.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system architecture and configuration documentation; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/2


CM-2(2) BASELINE CONFIGURATION
CM-2(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing baseline configuration maintenance].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/3


CM-2(3) BASELINE CONFIGURATION
CM-2(3).1 ASSESSMENT OBJECTIVE:
Determine if the organization retains older versions of baseline configurations as deemed necessary to support rollback.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system architecture and configuration documentation; historical copies of baseline configurations; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/5


CM-2(5) BASELINE CONFIGURATION
CM-2(5).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and maintains a list of software programs authorized to execute on the information system; and
(ii) the organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; list of software authorized to execute on the information system; information system architecture and configuration documentation; security plan; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/6


CM-2(6) BASELINE CONFIGURATION
CM-2(6).1 ASSESSMENT OBJECTIVE:
Determine if the organization maintains a baseline configuration for development and test environments that is managed separately from the operational baseline configuration.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing baseline configuration environments].


CM-3 CONFIGURATION CHANGE CONTROL

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-3 Configuration Change Control P1 LOW Not Selected MOD CM-3 (2) HIGH CM-3 (1) (2)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3


ASSESSMENT PROCEDURE
CM-3 CONFIGURATION CHANGE CONTROL
CM-3.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization determines the types of changes to the information system that are configuration controlled;
(ii) the organization approves configuration-controlled changes to the system with explicit consideration for security impact analyses;
(iii) the organization documents approved configuration-controlled changes to the system;
(iv) the organization retains and reviews records of configuration-controlled changes to the system;
(v) the organization audits activities associated with configuration-controlled changes to the system;
(vi) the organization defines:
  • the configuration change control element (e.g., committee, board) responsible for coordinating and providing oversight for configuration change control activities;
  • the frequency with which the configuration change control element convenes; and/or;
  • configuration change conditions that prompt the configuration change control element to convene.
(vii) the organization coordinates and provides oversight for configuration change control activities through the organization-defined configuration change control element that convenes at the organization-defined frequency and/or for any organization-defined configuration change conditions.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system architecture and configuration documentation; security plan; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3/1


CM-3(1) CONFIGURATION CHANGE CONTROL
CM-3(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the time period after which approvals that have not been received for proposed changes to the information system are highlighted; and
(ii) the organization employs automated mechanisms to:
  • document proposed changes to the information system;
  • notify designated approval authorities;
  • highlight approvals that have not been received by the organization-defined time period;
  • inhibit change until designated approvals are received; and
  • document completed changes to the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system design documentation; information system architecture and configuration documentation; automated configuration control mechanisms; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing configuration change control].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3/2


CM-3(2) CONFIGURATION CHANGE CONTROL
CM-3(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].


CM-4 SECURITY IMPACT ANALYSIS

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-4 Security Impact Analysis P2 LOW CM-4 MOD CM-4 HIGH CM-4 (1)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-4


ASSESSMENT PROCEDURE
CM-4 SECURITY IMPACT ANALYSIS
CM-4.1 ASSESSMENT OBJECTIVE:
Determine if the organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing security impact analysis for changes to the information system; security impact analysis documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for determining security impacts prior to implementation of information system changes].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-4/1


CM-4(1) SECURITY IMPACT ANALYSIS
CM-4(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization analyzes new software in a separate test environment before installation in an operational environment; and
(ii) the organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing security impact analysis for changes to the information system; security impact analysis documentation; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; information system test and operational environments; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for determining security impacts prior to implementation of information system changes].


CM-5 ACCESS RESTRICTIONS FOR CHANGE

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-5 Access Restrictions for Change P1 LOW Not Selected MOD CM-5 HIGH CM-5 (1) (2) (3)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5


ASSESSMENT PROCEDURE
CM-5 ACCESS RESTRICTIONS FOR CHANGE
CM-5.1 ASSESSMENT OBJECTIVE:
Determine if the organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with logical access control responsibilities; organizational personnel with physical access control responsibilities].
Test: [SELECT FROM: Change control process and associated restrictions for changes to the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/1


CM-5(1) ACCESS RESTRICTIONS FOR CHANGE
CM-5(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to enforce access restrictions and support auditing of the enforcement actions.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing access restrictions for changes to the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/2


CM-5(2) ACCESS RESTRICTIONS FOR CHANGE
CM-5(2).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency for conducting audits of information system changes; and
(ii) the organization conducts audits of information system changes in accordance with the organization-defined frequency and when indications so warrant to determine whether unauthorized changes have occurred.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system design documentation; information system architecture and configuration documentation; security plan; change control records; information system audit records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/3


CM-5(3) ACCESS RESTRICTIONS FOR CHANGE
CM-5(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate; and
(ii) the information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; list of critical software programs to be prohibited from installation without an approved certificate; information system design documentation; information system architecture and configuration documentation; security plan; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Information system mechanisms preventing installation of software programs not signed with an organization-approved certificate].


CM-6 CONFIGURATION SETTINGS

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-6 Configuration Settings P1 LOW CM-6 MOD CM-6 (3) HIGH CM-6 (1) (2) (3)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6


ASSESSMENT PROCEDURE
CM-6 CONFIGURATION SETTINGS
CM-6.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines security configuration checklists to be used to establish and document mandatory configuration settings for the information system technology products employed;
(ii) the organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements;
(iii) the organization establishes and documents mandatory configuration settings for information technology products employed within the information system using organization-defined security configuration checklists;
(iv) the organization implements the security configuration settings;
(v) the organization identifies, documents, and approves exceptions from the mandatory configuration settings for individual components within the information system based on explicit operational requirements; and
(vi) the organization monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with security configuration responsibilities].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/1


CM-6(1) CONFIGURATION SETTINGS
CM-6(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to centrally manage, apply, and verify configuration settings.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; information system design documentation; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing the centralized management, application, and verification of configuration settings].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/2


CM-6(2) CONFIGURATION SETTINGS
CM-6(2).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines configuration settings that, if modified by unauthorized changes, initiate the automated mechanisms to be employed to respond to such changes; and
(ii) the organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; security plan; information system design documentation; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing responses to unauthorized changes to configuration settings].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/3


CM-6(3) CONFIGURATION SETTINGS
CM-6(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization incorporates detection of unauthorized, security-relevant configuration changes into the organization's incident response capability; and
(ii) the organization ensures that such detected events are tracked, monitored, corrected, and available for historical purposes.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; procedures addressing incident response planning; information system design documentation; information system configuration settings and associated documentation; incident response plan; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with security configuration responsibilities; organization personnel with incident response planning responsibilities].


CM-7 LEAST FUNCTIONALITY

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-7 Least Functionality P1 LOW CM-7 MOD CM-7 (1) HIGH CM-7 (1) (2)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7


ASSESSMENT PROCEDURE
CM-7 LEAST FUNCTIONALITY
CM-7.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines for the information system prohibited or restricted:
  • functions;
  • ports;
  • protocols; and
  • services;
(ii) the organization configures the information system to provide only essential capabilities; and
(iii) the organization configures the information system to specifically prohibit or restrict the use of organization-defined:
  • functions;
  • ports;
  • protocols; and/or
  • services.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Information system for disabling or restricting functions, ports, protocols, and services].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7/1


CM-7(1) LEAST FUNCTIONALITY
CM-7(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of information system reviews to identify and eliminate unnecessary:
  • functions;
  • ports;
  • protocols; and/or
  • services; and
(ii) the organization reviews the information system in accordance with organization-defined frequency to identify and eliminate unnecessary:
  • functions;
  • ports;
  • protocols; and/or
  • services.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for identifying and eliminating unnecessary functions, ports, protocols, and services on the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7/2


CM-7(2) LEAST FUNCTIONALITY
CM-7(2).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and maintains one or more of the following specifications to prevent software program execution on the information system:
  • a list of software programs authorized to execute on the information system;
  • a list of software programs not authorized to execute on the information system; and/or
  • rules authorizing the terms and conditions of software program usage on the information system; and
(ii) the organization employs automated mechanisms to prevent software program execution on the information system in accordance with the organization-defined specifications.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system design documentation; specification of preventing software program execution; information system configuration settings and associated documentation; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms preventing software program execution on the information system].


CM-8 INFORMATION SYSTEM COMPONENT INVENTORY

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-8 Information System Component Inventory P1 LOW CM-8 MOD CM-8 (1) (5) HIGH CM-8 (1) (2) (3) (4) (5)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8


ASSESSMENT PROCEDURE
CM-8 INFORMATION SYSTEM COMPONENT INVENTORY
CM-8.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines information deemed necessary to achieve effective property accountability; and
(ii) the organization develops, documents, and maintains an inventory of information system components that:
  • accurately reflects the current information system;
  • is consistent with the authorization boundary of the information system;
  • is at the level of granularity deemed necessary for tracking and reporting;
  • includes organization-defined information deemed necessary to achieve effective property accountability; and
  • is available for review and audit by designated organizational officials.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system inventory records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/1


CM-8(1) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization updates the inventory of information system components as an integral part of component:
  • installations;
  • removals; and
  • information system updates.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system inventory records; component installation records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with information system installation and inventory responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/2


CM-8(2) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available inventory of information system components.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system design documentation; information system inventory records; component installation records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing information system component inventory management].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/3


CM-8(3) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of employing automated mechanisms to detect the addition of unauthorized components/devices into the information system;
(ii) the organization employs automated mechanisms, in accordance with the organization-defined frequency, to detect the addition of unauthorized components/devices into the information system; and
(iii) the organization disables network access by such components/devices or notifies designated organizational officials.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system design documentation; information system inventory records; component installation records; change control records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms for detecting unauthorized components/devices on the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/4


CM-8(4) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(4).1 ASSESSMENT OBJECTIVE:
Determine if the organization includes in property accountability information for information system components, a means for identifying by name, position, or role, individuals responsible for administering those components.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system inventory records; component installation records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/5


CM-8(5) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(5).1 ASSESSMENT OBJECTIVE:
Determine if the organization verifies that all components within the authorization boundary of the information system are either inventoried as a part of the system or recognized by another system as a component within that system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system inventory records; component installation records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with information system inventory responsibilities; organizational personnel with responsibilities for defining information system components within the authorization boundary of the system].


CM-9 CONFIGURATION MANAGEMENT PLAN

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-9 Configuration Management Plan P1 LOW Not Selected MOD CM-9 HIGH CM-9


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-9


ASSESSMENT PROCEDURE
CM-9 CONFIGURATION MANAGEMENT PLAN
CM-9.1 ASSESSMENT OBJECTIVE:
Determine if the organization develops, documents, and implements a configuration management plan for the information system that:
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration management planning; security plan; other relevant documents or records].



Source

Retrieved from "http://fismapedia.org/index.php?title=Doc:NIST_SP_800-53Ar1_Appendix_F/Enhanced/CM/High&oldid=52875"