ComplianceNIST 800-53 control

NIST-CM-3 Configuration Change Control

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
CM Configuration Management
Control
CM-3
ATT&CK techniques mitigated
35

Control statement

a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c. Document configuration change decisions associated with the system; d. Implement approved configuration-controlled changes to the system; e. Retain records of configuration-controlled changes to the system for [Assignment: time period]; f. Monitor and review activities associated with configuration-controlled changes to the system; and g. Coordinate and provide oversight for configuration change control activities through [Assignment: configuration change control element] that convenes [Selection (one or more of): {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].

Discussion

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).

ATT&CK mappings (CTID)

• T1021.005 VNC • T1059.006 Python • T1176 Browser Extensions • T1195 Supply Chain Compromise • T1195.003 Compromise Hardware Supply Chain • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.005 Messaging Applications • T1495 Firmware Corruption • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1543.002 Systemd Service • T1546 Event Triggered Execution • T1547.007 Re-opened Applications • T1547.013 XDG Autostart Entries • T1548 Abuse Elevation Control Mechanism • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1555 Credentials from Password Stores • T1556.008 Network Provider DLL • T1562.008 Disable or Modify Cloud Logs • T1562.012 Disable or Modify Linux Audit System • T1564.008 Email Hiding Rules • T1578.005 Modify Cloud Compute Configurations • T1601 Modify System Image • T1601.001 Patch System Image • T1601.002 Downgrade System Image • T1647 Plist File Modification • T1653 Power Settings • T1666 Modify Cloud Resource Hierarchy — Monitoring and reviewing changes to the configuration of the IaaS environment (in this case, the cloud resource hierarchy) allows for the detection and reversal of unauthorized changes to prevent exploitation.

Related

Mitigates · not in database (2)

Mitigates · MITRE ATT&CK (33)

  • T1666 Modify Cloud Resource Hierarchy technique
  • T1213.005 Messaging Applications sub-technique
  • T1578.005 Modify Cloud Compute Configurations sub-technique
  • T1653 Power Settings technique
  • T1556.008 Network Provider DLL sub-technique
  • T1647 Plist File Modification technique
  • T1564.008 Email Hiding Rules sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T1542.004 ROMMONkit sub-technique
  • T1542.005 TFTP Boot sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
  • T1195.003 Compromise Hardware Supply Chain sub-technique
  • T1059.006 Python sub-technique
  • T1213.001 Confluence sub-technique
  • T1213.002 Sharepoint sub-technique
  • T1021.005 VNC sub-technique
  • T1555 Credentials from Password Stores technique
  • T1553 Subvert Trust Controls technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1547.007 Re-opened Applications sub-technique
  • T1546 Event Triggered Execution technique
  • T1543.002 Systemd Service sub-technique
  • T1543 Create or Modify System Process technique
  • T1542.001 System Firmware sub-technique
  • T1542.003 Bootkit sub-technique
  • T1542 Pre-OS Boot technique
  • T1547.013 XDG Autostart Entries sub-technique
  • T1495 Firmware Corruption technique
Show all 33 ›

Related control · Compliance (23)

  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-IA-3 Device Identification and Authentication NIST 800-53 control
  • NIST-MA-2 Controlled Maintenance NIST 800-53 control
  • NIST-PE-16 Delivery and Removal NIST 800-53 control
  • NIST-PT-6 System of Records Notice NIST 800-53 control
  • NIST-RA-8 Privacy Impact Assessments NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-34 Non-modifiable Executable Programs NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-11 Component Authenticity NIST 800-53 control

Referenced by Compliance · enhancement of (8)

  • NIST-CM-3(1) Automated Documentation, Notification, and Prohibition of Changes NIST 800-53 enhancement
  • NIST-CM-3(2) Testing, Validation, and Documentation of Changes NIST 800-53 enhancement
  • NIST-CM-3(3) Automated Change Implementation NIST 800-53 enhancement
  • NIST-CM-3(4) Security and Privacy Representatives NIST 800-53 enhancement
  • NIST-CM-3(5) Automated Security Response NIST 800-53 enhancement
  • NIST-CM-3(6) Cryptography Management NIST 800-53 enhancement
  • NIST-CM-3(7) Review System Changes NIST 800-53 enhancement
  • NIST-CM-3(8) Prevent or Restrict Configuration Changes NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-CM Configuration Management NIST 800-53 family

Referenced by Compliance · related control (25)

  • NIST-AU-2 Event Logging NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3(7) Review System Changes NIST 800-53 enhancement
  • NIST-CM-4 Impact Analyses NIST 800-53 control
  • NIST-CM-5(4) Dual Authorization NIST 800-53 enhancement
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-IA-3(4) Device Attestation NIST 800-53 enhancement
  • NIST-MA-2 Controlled Maintenance NIST 800-53 control
  • NIST-PE-16 Delivery and Removal NIST 800-53 control
  • NIST-PM-31 Continuous Monitoring Strategy NIST 800-53 control
  • NIST-SA-10 Developer Configuration Management NIST 800-53 control
  • NIST-SA-8(31) Secure System Modification NIST 800-53 enhancement
  • NIST-SA-8(8) Secure Evolvability NIST 800-53 enhancement
  • NIST-SC-12 Cryptographic Key Establishment and Management NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-34(2) Integrity Protection on Read-only Media NIST 800-53 enhancement
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control
  • NIST-SR-11(2) Configuration Control for Component Service and Repair NIST 800-53 enhancement