Doc:NIST SP 800-53Ar1 FPD Appendix F/Enhanced/CM

From FISMApedia
Jump to: navigation, search

SP 800-53Ar1 FPD Assessment Procedure Catalog, with SP 800-53r3 Security Controls


CONFIGURATION MANAGEMENT

CM-1

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-1


ASSESSMENT PROCEDURE
CM-1 CONFIGURATION MANAGEMENT POLICY AND PROCEDURES
CM-1.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and formally documents configuration management policy;
(ii) the organization configuration management policy addresses:
(iii) the organization disseminates formal documented configuration management policy to elements within the organization having associated configuration management roles and responsibilities;
(iv) the organization develops and formally documents configuration management procedures;
(v) the organization configuration management procedures facilitate implementation of the configuration management policy and associated configuration management controls; and
(vi) the organization disseminates formal documented configuration management procedures to elements within the organization having associated configuration management roles and responsibilities.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy and procedures; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration management and control responsibilities].
CM-1.2 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of configuration management policy reviews/updates;
(ii) the organization reviews/updates configuration management policy in accordance with organization-defined frequency;
(iii) the organization defines the frequency of configuration management procedure reviews/updates; and
(iv) the organization reviews/updates configuration management procedures in accordance with organization-defined frequency.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy and procedures; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration management and control responsibilities].


CM-2

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2


ASSESSMENT PROCEDURE
CM-2 BASELINE CONFIGURATION
CM-2.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and documents a baseline configuration of the information system and
(ii) the organization maintains, under configuration control, a current baseline configuration of the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; enterprise architecture documentation; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/1


CM-2(1) BASELINE CONFIGURATION
CM-2(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines:
(ii) the organization reviews and updates the baseline configuration of the information system
  • in accordance with the organization-defined frequency;
  • when required due to organization-defined circumstances; and
  • as an integral part of information system component installations and upgrades.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system architecture and configuration documentation; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/2


CM-2(2) BASELINE CONFIGURATION
CM-2(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available baseline configuration of the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing baseline configuration maintenance].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/3


CM-2(3) BASELINE CONFIGURATION
CM-2(3).1 ASSESSMENT OBJECTIVE:
Determine if the organization retains older versions of baseline configurations as deemed necessary to support rollback.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system architecture and configuration documentation; historical copies of baseline configurations; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/4


CM-2(4) BASELINE CONFIGURATION
CM-2(4).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and maintains a list of software programs not authorized to execute on the information system; and
(ii) the organization employs an allow-all, deny-by-exception authorization policy to identify software allowed to execute on the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; list of software programs not authorized to execute on the information system; information system architecture and configuration documentation; security plan; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/5


CM-2(5) BASELINE CONFIGURATION
CM-2(5).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and maintains a list of software programs authorized to execute on the information system; and
(ii) the organization employs a deny-all, permit-by-exception authorization policy to identify software allowed to execute on the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; list of software authorized to execute on the information system; information system architecture and configuration documentation; security plan; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-2/6


CM-2(6) BASELINE CONFIGURATION
CM-2(6).1 ASSESSMENT OBJECTIVE:
Determine if the organization maintains a baseline configuration for development and test environments that is managed separately from the operational baseline configuration.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing the baseline configuration of the information system; information system design documentation; information system architecture and configuration documentation; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing baseline configuration environments].


CM-3

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3


ASSESSMENT PROCEDURE
CM-3 CONFIGURATION CHANGE CONTROL
CM-3.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization determines the types of changes to the information system that are configuration controlled;
(ii) the organization approves configuration-controlled changes to the system with explicit consideration for security impact analyses;
(iii) the organization documents approved configuration-controlled changes to the system;
(iv) the organization retains and reviews records of configuration-controlled changes to the system;
(v) the organization audits activities associated with configuration-controlled changes to the system;
(vi) the organization defines:
  • the configuration change control element (e.g., committee, board) responsible for coordinating and providing oversight for configuration change control activities;
  • the frequency with which the configuration change control element convenes; and/or;
  • configuration change conditions that prompt the configuration change control element to convene.
(vii) the organization coordinates and provides oversight for configuration change control activities through the organization-defined configuration change control element that convenes at the organization-defined frequency and/or for any organization-defined configuration change conditions.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system architecture and configuration documentation; security plan; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3/1


CM-3(1) CONFIGURATION CHANGE CONTROL
CM-3(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the time period after which approvals that have not been received for proposed changes to the information system are highlighted; and
(ii) the organization employs automated mechanisms to:
  • document proposed changes to the information system;
  • notify designated approval authorities;
  • highlight approvals that have not been received by the organization-defined time period;
  • inhibit change until designated approvals are received; and
  • document completed changes to the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system design documentation; information system architecture and configuration documentation; automated configuration control mechanisms; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing configuration change control].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3/2


CM-3(2) CONFIGURATION CHANGE CONTROL
CM-3(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization tests, validates, and documents changes to the information system before implementing the changes on the operational system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3/3


CM-3(3) CONFIGURATION CHANGE CONTROL
CM-3(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization employs automated mechanisms to implement changes to the current information system baseline; and
(ii) the organization deploys the updated baseline across the installed base.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; information system design documentation; information system architecture and configuration documentation; automated configuration control mechanisms; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing changes to the information system baseline].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-3/4


CM-3(4) CONFIGURATION CHANGE CONTROL
CM-3(4).1 ASSESSMENT OBJECTIVE:
Determine if the organization requires an information security representative to be a member of the configuration change control element as defined by the organization in CM-3.1 (vi).
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system configuration change control; security plan; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with configuration change control responsibilities].


CM-4

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-4


ASSESSMENT PROCEDURE
CM-4 SECURITY IMPACT ANALYSIS
CM-4.1 ASSESSMENT OBJECTIVE:
Determine if the organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing security impact analysis for changes to the information system; security impact analysis documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for determining security impacts prior to implementation of information system changes].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-4/1


CM-4(1) SECURITY IMPACT ANALYSIS
CM-4(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization analyzes new software in a separate test environment before installation in an operational environment; and
(ii) the organization, when analyzing new software in a separate test environment, looks for security impacts due to flaws, weaknesses, incompatibility, or intentional malice.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing security impact analysis for changes to the information system; security impact analysis documentation; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; information system test and operational environments; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for determining security impacts prior to implementation of information system changes].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-4/2


CM-4(2) SECURITY IMPACT ANALYSIS
CM-4(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization, after the information system is changed, checks the security functions to verify that the functions are:
  • implemented correctly;
  • operating as intended; and
  • producing the desired outcome with regard to meeting the security requirements for the system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing security impact analysis for changes to the information system; security impact analysis documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for determining security impacts prior to implementation of information system changes].


CM-5

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5


ASSESSMENT PROCEDURE
CM-5 ACCESS RESTRICTIONS FOR CHANGE
CM-5.1 ASSESSMENT OBJECTIVE:
Determine if the organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with logical access control responsibilities; organizational personnel with physical access control responsibilities].
Test: [SELECT FROM: Change control process and associated restrictions for changes to the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/1


CM-5(1) ACCESS RESTRICTIONS FOR CHANGE
CM-5(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to enforce access restrictions and support auditing of the enforcement actions.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing access restrictions for changes to the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/2


CM-5(2) ACCESS RESTRICTIONS FOR CHANGE
CM-5(2).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency for conducting audits of information system changes; and
(ii) the organization conducts audits of information system changes in accordance with the organization-defined frequency and when indications so warrant to determine whether unauthorized changes have occurred.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system design documentation; information system architecture and configuration documentation; security plan; change control records; information system audit records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/3


CM-5(3) ACCESS RESTRICTIONS FOR CHANGE
CM-5(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines critical software programs that the information system will prevent from being installed if such software programs are not signed with a recognized and approved certificate; and
(ii) the information system prevents the installation of organization-defined critical software programs that are not signed with a certificate that is recognized and approved by the organization.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; list of critical software programs to be prohibited from installation without an approved certificate; information system design documentation; information system architecture and configuration documentation; security plan; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Information system mechanisms preventing installation of software programs not signed with an organization-approved certificate].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/4


CM-5(4) ACCESS RESTRICTIONS FOR CHANGE
CM-5(4).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines information system components and system-level information requiring enforcement of a two-person rule for information system changes; and
(ii) the organization enforces a two-person rule for changes to organization-defined information system components and system-level information.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; security plan; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel responsible for enforcing a two-person rule for system changes].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/5


CM-5(5) ACCESS RESTRICTIONS FOR CHANGE
CM-5(5).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization limits information system developer/integrator privileges to change hardware, software, and firmware components and system information directly within a production environment;
(ii) the organization defines the frequency for reviews and reevaluations of information system developer/integrator privileges; and
(iii) the organization reviews and reevaluates information system developer/integrator privileges in accordance with the organization-defined frequency.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; security plan; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with logical access control responsibilities; organizational personnel with physical access control responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/6


CM-5(6) ACCESS RESTRICTIONS FOR CHANGE
CM-5(6).1 ASSESSMENT OBJECTIVE:
Determine if the organization limits privileges to change software resident within software libraries (including privileged programs).
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-5/7


CM-5(7) ACCESS RESTRICTIONS FOR CHANGE
CM-5(7).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines safeguards and countermeasures to be employed by the information system if security functions (or mechanisms) are changed inappropriately; and
(ii) the information system automatically implements organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing access restrictions for changes to the information system; information system design documentation; information system architecture and configuration documentation; change control records; information system audit records; other relevant documents or records].
Test: [SELECT FROM: Information system implementing safeguards and countermeasures for inappropriate changes to security functions].


CM-6

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6


ASSESSMENT PROCEDURE
CM-6 CONFIGURATION SETTINGS
CM-6.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines security configuration checklists to be used to establish and document mandatory configuration settings for the information system technology products employed;
(ii) the organization-defined security configuration checklists reflect the most restrictive mode consistent with operational requirements;
(iii) the organization establishes and documents mandatory configuration settings for information technology products employed within the information system using organization-defined security configuration checklists;
(iv) the organization implements the security configuration settings;
(v) the organization identifies, documents, and approves exceptions from the mandatory configuration settings for individual components within the information system based on explicit operational requirements; and
(vi) the organization monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with security configuration responsibilities].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/1


CM-6(1) CONFIGURATION SETTINGS
CM-6(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to centrally manage, apply, and verify configuration settings.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; information system design documentation; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing the centralized management, application, and verification of configuration settings].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/2


CM-6(2) CONFIGURATION SETTINGS
CM-6(2).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines configuration settings that, if modified by unauthorized changes, initiate the automated mechanisms to be employed to respond to such changes; and
(ii) the organization employs automated mechanisms to respond to unauthorized changes to organization-defined configuration settings.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; security plan; information system design documentation; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing responses to unauthorized changes to configuration settings].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/3


CM-6(3) CONFIGURATION SETTINGS
CM-6(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization incorporates detection of unauthorized, security-relevant configuration changes into the organization's incident response capability; and
(ii) the organization ensures that such detected events are tracked, monitored, corrected, and available for historical purposes.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; procedures addressing incident response planning; information system design documentation; information system configuration settings and associated documentation; incident response plan; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with security configuration responsibilities; organization personnel with incident response planning responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-6/4


CM-6(4) CONFIGURATION SETTINGS
CM-6(4).1 ASSESSMENT OBJECTIVE:
Determine if the information system (including modifications to the baseline configuration) demonstrates conformance to security configuration guidance (i.e., security checklists), prior to being introduced into a production environment.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration settings for the information system; information system design documentation; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with security configuration responsibilities].


CM-7

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7


ASSESSMENT PROCEDURE
CM-7 LEAST FUNCTIONALITY
CM-7.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines for the information system prohibited or restricted:
  • functions;
  • ports;
  • protocols; and
  • services;
(ii) the organization configures the information system to provide only essential capabilities; and
(iii) the organization configures the information system to specifically prohibit or restrict the use of organization-defined:
  • functions;
  • ports;
  • protocols; and/or
  • services.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Test: [SELECT FROM: Information system for disabling or restricting functions, ports, protocols, and services].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7/1


CM-7(1) LEAST FUNCTIONALITY
CM-7(1).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of information system reviews to identify and eliminate unnecessary:
  • functions;
  • ports;
  • protocols; and/or
  • services; and
(ii) the organization reviews the information system in accordance with organization-defined frequency to identify and eliminate unnecessary:
  • functions;
  • ports;
  • protocols; and/or
  • services.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation; security configuration checklists; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for identifying and eliminating unnecessary functions, ports, protocols, and services on the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7/2


CM-7(2) LEAST FUNCTIONALITY
CM-7(2).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops and maintains one or more of the following specifications to prevent software program execution on the information system:
  • a list of software programs authorized to execute on the information system;
  • a list of software programs not authorized to execute on the information system; and/or
  • rules authorizing the terms and conditions of software program usage on the information system; and
(ii) the organization employs automated mechanisms to prevent software program execution on the information system in accordance with the organization-defined specifications.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system design documentation; specification of preventing software program execution; information system configuration settings and associated documentation; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms preventing software program execution on the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-7/3


CM-7(3) LEAST FUNCTIONALITY
CM-7(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines registration requirements for:
  • ports;
  • protocols; and
  • services; and
(ii) the organization ensures compliance with organization-defined registration requirements for:
  • ports;
  • protocols; and
  • services.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing least functionality in the information system; security plan; information system configuration settings and associated documentation; other relevant documents or records].



CM-8

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8


ASSESSMENT PROCEDURE
CM-8 INFORMATION SYSTEM COMPONENT INVENTORY
CM-8.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines information deemed necessary to achieve effective property accountability; and
(ii) the organization develops, documents, and maintains an inventory of information system components that:
  • accurately reflects the current information system;
  • is consistent with the authorization boundary of the information system;
  • is at the level of granularity deemed necessary for tracking and reporting;
  • includes organization-defined information deemed necessary to achieve effective property accountability; and
  • is available for review and audit by designated organizational officials.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system inventory records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/1


CM-8(1) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization updates the inventory of information system components as an integral part of component:
  • installations;
  • removals; and
  • information system updates.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system inventory records; component installation records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with information system installation and inventory responsibilities].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/2


CM-8(2) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(2).1 ASSESSMENT OBJECTIVE:
Determine if the organization employs automated mechanisms to maintain an up-to-date, complete, accurate, and readily available inventory of information system components.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system design documentation; information system inventory records; component installation records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms implementing information system component inventory management].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/3


CM-8(3) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(3).1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization defines the frequency of employing automated mechanisms to detect the addition of unauthorized components/devices into the information system;
(ii) the organization employs automated mechanisms, in accordance with the organization-defined frequency, to detect the addition of unauthorized components/devices into the information system; and
(iii) the organization disables network access by such components/devices or notifies designated organizational officials.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system design documentation; information system inventory records; component installation records; change control records; other relevant documents or records].
Test: [SELECT FROM: Automated mechanisms for detecting unauthorized components/devices on the information system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/4


CM-8(4) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(4).1 ASSESSMENT OBJECTIVE:
Determine if the organization includes in property accountability information for information system components, a means for identifying by name, position, or role, individuals responsible for administering those components.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system inventory records; component installation records; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/5


CM-8(5) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(5).1 ASSESSMENT OBJECTIVE:
Determine if the organization verifies that all components within the authorization boundary of the information system are either inventoried as a part of the system or recognized by another system as a component within that system.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; security plan; information system inventory records; component installation records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with information system inventory responsibilities; organizational personnel with responsibilities for defining information system components within the authorization boundary of the system].


SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-8/6


CM-8(6) INFORMATION SYSTEM COMPONENT INVENTORY
CM-8(6).1 ASSESSMENT OBJECTIVE:
Determine if the organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing information system component inventory; information system design documentation; information system inventory records; component installation records; other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with inventory management and assessment responsibilities for information system components].


CM-9

FAMILY: CONFIGURATION MANAGEMENT CLASS: OPERATIONAL


SECURITY CONTROL

Template:Doc:NIST SP 800-53r3 Appendix F/CM-9


ASSESSMENT PROCEDURE
CM-9 CONFIGURATION MANAGEMENT PLAN
CM-9.1 ASSESSMENT OBJECTIVE:
Determine if:
(i) the organization develops, documents, and implements a configuration management plan for the information system that:
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing configuration management planning; security plan; other relevant documents or records].



SECURITY CONTROL ENHANCEMENT

Template:Doc:NIST SP 800-53r3 Appendix F/CM-9/1


CM-9(1) CONFIGURATION MANAGEMENT PLAN
CM-9(1).1 ASSESSMENT OBJECTIVE:
Determine if the organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
POTENTIAL ASSESSMENT METHODS AND OBJECTS:
Examine: [SELECT FROM: Configuration management policy; configuration management plan; procedures addressing responsibilities for configuration management process development; security plan other relevant documents or records].
Interview: [SELECT FROM: Organizational personnel with responsibilities for configuration management process development].


Source

Retrieved from "http://fismapedia.org/index.php?title=Doc:NIST_SP_800-53Ar1_FPD_Appendix_F/Enhanced/CM&oldid=52470"