|

controlCM-3

Configuration Change Control (CM-3)

Determine and document the types of changes to the system that are configuration-controlled; Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; Document configuration change decisions associated with the system; Implement approved configuration-controlled changes to the system; Retain records of configuration-controlled changes to the system for [organization-defined]; Monitor

Security Baselines

MODERATEHIGHLOW

configurationbaselineschange-control

Why These Connect

Maps To9

These are equivalent or closely aligned requirements in other frameworks.

Baselined In2

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports31

These related controls work together — a change to one may affect the others.

Enhances8

These enhancements add specific capabilities or refinements to the base control.

Related Controls(26)

AU-2Event Logging (AU-2)

CA-7Continuous Monitoring (CA-7)

CM-2Baseline Configuration (CM-2)

CM-4Impact Analyses (CM-4)

CM-5Access Restrictions for Change (CM-5)

CM-6Configuration Settings (CM-6)

CM-9Configuration Management Plan (CM-9)

CM-11User-installed Software (CM-11)

IA-3Device Identification and Authentication (IA-3)

MA-2Controlled Maintenance (MA-2)

PE-16Delivery and Removal (PE-16)

PT-6System of Records Notice (PT-6)RA-8Privacy Impact Assessments (RA-8)SA-8Security and Privacy Engineering Principles (SA-8)

SA-10Developer Configuration Management (SA-10)

SC-28Protection of Information at Rest (SC-28)

SC-34Non-modifiable Executable Programs (SC-34)SC-37Out-of-band Channels (SC-37)SI-2Flaw Remediation (SI-2)

SI-3Malicious Code Protection (SI-3)

SI-4System Monitoring (SI-4)

SI-7Software, Firmware, and Information Integrity (SI-7)

SI-10Information Input Validation (SI-10)

SR-11Component Authenticity (SR-11)

PM-31Continuous Monitoring Strategy (PM-31)SC-12Cryptographic Key Establishment and Management (SC-12)

Cross-Framework Mappings(9)

ID.RA-07ID.RA-07Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

PR.PS-01PR.PS-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-01DE.CM-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-09DE.CM-09Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ISO 27001ISO/IEC 27001:20224 mappingsFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

ID.RA-07ID.RA-07Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

PR.PS-01PR.PS-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-01DE.CM-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-09DE.CM-09Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(5)

Assignmentorganization-defined time period

Assignmentorganization-defined configuration change control element

SelectionSelection (one-or-more): {{ insert: param, cm-03_odp.04 }} / when {{ insert: param, cm-03_odp.05 }}

Assignmentorganization-defined frequency

Assignmentorganization-defined configuration change conditions

Control Enhancements(8)

CM-3(1)Automated Documentation, Notification, and Prohibition of Changes (CM-3(1))

CM-3(2)Testing, Validation, and Documentation of Changes (CM-3(2))

CM-3(3)Automated Change Implementation (CM-3(3))

CM-3(4)Security and Privacy Representatives (CM-3(4))

CM-3(5)Automated Security Response (CM-3(5))

CM-3(6)Cryptography Management (CM-3(6))

CM-3(7)Review System Changes (CM-3(7))

CM-3(8)Prevent or Restrict Configuration Changes (CM-3(8))

See Also

@SP 800-53 Overview ⚖Compare Baselines