N
|
controlCM-1

Policy and Procedures (CM-1)

Develop, document, and disseminate to [organization-defined]: Designate an [organization-defined] to manage the development, documentation, and dissemination of the configuration management policy and procedures; and Review and update the current configuration management:

Security Baselines

LOWMODERATEHIGH
configurationbaselineschange-control

Why These Connect

Maps To20

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports6

These related controls work together — a change to one may affect the others.

Related Controls(5)

PM-9Risk Management Strategy (PM-9)PS-8Personnel Sanctions (PS-8)
LMH
SA-8Security and Privacy Engineering Principles (SA-8)
LMH
SI-12Information Management and Retention (SI-12)
LMH
CM-2Baseline Configuration (CM-2)
LMH

Cross-Framework Mappings(20)

GV.PO-02GV.PO-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.OV-01GV.OV-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.OC-03GV.OC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-03GV.SC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-01ID.IM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-02ID.IM-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-03ID.IM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
PR.PS-01PR.PS-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.PO-01GV.PO-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ISO 27001ISO/IEC 27001:202212 mappingsFinal
NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022
HIPAAHIPAA Security Rule2 mappingsFinal
NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5
GV.PO-02GV.PO-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.OV-01GV.OV-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.OC-03GV.OC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.SC-03GV.SC-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-01ID.IM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-02ID.IM-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-03ID.IM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
PR.PS-01PR.PS-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
GV.PO-01GV.PO-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(8)

Assignmentorganization-defined personnel or roles
Assignmentorganization-defined personnel or roles
SelectionSelection (one-or-more): organization-level / mission/business process-level / system-level
Assignmentorganization-defined official
Assignmentorganization-defined frequency
Assignmentorganization-defined events
Assignmentorganization-defined frequency
Assignmentorganization-defined events

See Also

@SP 800-53 Overview⚖Compare Baselines