|

controlCM-6

Configuration Settings (CM-6)

Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [organization-defined]; Implement the configuration settings; Identify, document, and approve any deviations from established configuration settings for [organization-defined] based on [organization-defined] ; and Monitor and control changes to the configuration settings in accordance with organizational policies and procedu

Security Baselines

LOWMODERATEHIGH

configurationbaselineschange-control

Why These Connect

Maps To5

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports41

These related controls work together — a change to one may affect the others.

Mitigates8

This control helps defend against or reduce the risk of the linked threat technique.

Enhances4

These enhancements add specific capabilities or refinements to the base control.

Related Controls(32)

AC-19Access Control for Mobile Devices (AC-19)

AU-2Event Logging (AU-2)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)

CA-7Continuous Monitoring (CA-7)

CM-2Baseline Configuration (CM-2)

CM-3Configuration Change Control (CM-3)

AC-3Access Enforcement (AC-3)

CA-9Internal System Connections (CA-9)

CM-5Access Restrictions for Change (CM-5)

CM-7Least Functionality (CM-7)

CM-11User-installed Software (CM-11)

CP-7Alternate Processing Site (CP-7)

CP-9System Backup (CP-9)

CP-10System Recovery and Reconstitution (CP-10)

IA-3Device Identification and Authentication (IA-3)

IA-5Authenticator Management (IA-5)

PL-8Security and Privacy Architectures (PL-8)

PL-9Central Management (PL-9)RA-5Vulnerability Monitoring and Scanning (RA-5)

SA-4Acquisition Process (SA-4)

SA-5System Documentation (SA-5)

SA-8Security and Privacy Engineering Principles (SA-8)

SA-9External System Services (SA-9)

SC-18Mobile Code (SC-18)

SC-28Protection of Information at Rest (SC-28)

SC-43Usage Restrictions (SC-43)SI-2Flaw Remediation (SI-2)

SI-4System Monitoring (SI-4)

SI-6Security and Privacy Function Verification (SI-6)

IR-4Incident Handling (IR-4)

IR-6Incident Reporting (IR-6)

PM-31Continuous Monitoring Strategy (PM-31)

Threat Coverage(8 ATT&CK techniques)

T1547Boot or Logon Autostart Execution T1053Scheduled Task/Job T1505Server Software Component T1548Abuse Elevation Control Mechanism T1562Impair Defenses T1036Masquerading T1112Modify Registry T1087Account Discovery

Cross-Framework Mappings(5)

PR.PS-01PR.PS-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-09DE.CM-09Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ISO 27001ISO/IEC 27001:20221 mappingFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

PR.PS-01PR.PS-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

DE.CM-09DE.CM-09Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(3)

Assignmentorganization-defined common secure configurations

Assignmentorganization-defined system components

Assignmentorganization-defined operational requirements

Control Enhancements(4)

CM-6(1)Automated Management, Application, and Verification (CM-6(1))

CM-6(2)Respond to Unauthorized Changes (CM-6(2))

CM-6(3)Unauthorized Change Detection (CM-6(3))W

CM-6(4)Conformance Demonstration (CM-6(4))W

See Also

@SP 800-53 Overview ⚖Compare Baselines