Doc:NIST SP 800-53Ar1 Appendix F/Enhanced/CM/Low

From FISMApedia
Jump to: navigation, search

NIST SP 800-53Ar1 Assessment Procedure Catalog, with SP 800-53r3 Security Controls


CONFIGURATION MANAGEMENT

CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-1 Configuration Management Policy and Procedures P1 LOW CM-1 MOD CM-1 HIGH CM-1


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-1


ASSESSMENT PROCEDURE
CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES
CM-1.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and formally documents configuration management policy;
(ii) the organization configuration management policy addresses:
(iii) the organization disseminates formal documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities;
(iv) the organization develops and formally documents configuration management procedures;
(v) the organization configuration management procedures facilitate implementation of the configuration management policy and associated configuration management controls; and
(vi) the organization disseminates formal documented configuration management procedures to elements within the organization having associated configuration management roles and responsibilities.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy and procedures; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration management and control responsibilities].
CM-1.2 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of configuration management policy reviews/updates;
(ii) the organization reviews/updates configuration management policy in accordance with organization-defined frequency;
(iii) the organization defines the frequency of configuration management procedure reviews/updates; and
(iv) the organization reviews/updates configuration management procedures in accordance with organization-defined frequency.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy and procedures; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration management and control responsibilities].


CM-2 BASELINE CONFIGURATION

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-2 Baseline Configuration P1 LOW CM-2 MOD CM-2 (1) (3) (4) HIGH CM-2 (1) (2) (3) (5) (6)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2


ASSESSMENT PROCEDURE
CM-2 BASELINE CONFIGURATION
CM-2.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and documents a baseline configuration of the information system and
(ii) the organization maintains, under configuration control, a current baseline configuration of the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; enterprise architecture documentation; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].



CM-4 SECURITY IMPACT ANALYSIS

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-4 Security Impact Analysis P2 LOW CM-4 MOD CM-4 HIGH CM-4 (1)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-4


ASSESSMENT PROCEDURE
CM-4 SECURITY IMPACT ANALYSIS
CM-4.1 ASSESSMENT OBJECTIVE:
Determine if the organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing security impact analysis for changes to the information system; security impact analysis documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for determining security impacts prior to implementation of information system changes].



CM-6 CONFIGURATION SETTINGS

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-6 Configuration Settings P1 LOW CM-6 MOD CM-6 (3) HIGH CM-6 (1) (2) (3)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6


ASSESSMENT PROCEDURE
CM-6 CONFIGURATION SETTINGS
CM-6.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines security configuration checklists to be used to establish and document mandatory configuration settings for the information system technology products employed;
(ii) the organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements;
(iii) the organization establishes and documents mandatory configuration settings for information technology products employed within the information system using organization-defined security configuration checklists;
(iv) the organization implements the security configuration settings;
(v) the organization identifies, documents, and approves exceptions from the mandatory configuration settings for individual components within the information system based on explicit operational requirements; and
(vi) the organization monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with security configuration responsibilities].



CM-7 LEAST FUNCTIONALITY

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-7 Least Functionality P1 LOW CM-7 MOD CM-7 (1) HIGH CM-7 (1) (2)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7


ASSESSMENT PROCEDURE
CM-7 LEAST FUNCTIONALITY
CM-7.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines for the information system prohibited or restricted:
  • functions;
  • ports;
  • protocols; and
  • services;
(ii) the organization configures the information system to provide only essential capabilities; and
(iii) the organization configures the information system to specifically prohibit or restrict the use of organization-defined:
  • functions;
  • ports;
  • protocols; and/or
  • services.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Information system for disabling or restricting functions, ports, protocols, and services].


CM-8 INFORMATION SYSTEM COMPONENT INVENTORY

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


Security Control Baseline:
CM-8 Information System Component Inventory P1 LOW CM-8 MOD CM-8 (1) (5) HIGH CM-8 (1) (2) (3) (4) (5)


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8


ASSESSMENT PROCEDURE
CM-8 INFORMATION SYSTEM COMPONENT INVENTORY
CM-8.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines information deemed necessary to achieve effective property accountability; and
(ii) the organization develops, documents, and maintains an inventory of information system components that:
  • accurately reflects the current information system;
  • is consistent with the authorization boundary of the information system;
  • is at the level of granularity deemed necessary for tracking and reporting;
  • includes organization-defined information deemed necessary to achieve effective property accountability; and
  • is available for review and audit by designated organizational officials.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system inventory records; other relevant documents or records].



Source

Retrieved from "http://fismapedia.org/index.php?title=Doc:NIST_SP_800-53Ar1_Appendix_F/Enhanced/CM/Low&oldid=52941"