ComplianceNIST 800-53 control

NIST-CM-5 Access Restrictions for Change

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
CM Configuration Management
Control
CM-5
ATT&CK techniques mitigated
162

Control statement

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Discussion

Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).

ATT&CK mappings (CTID)

• T1003 OS Credential Dumping • T1003.001 LSASS Memory • T1003.002 Security Account Manager • T1003.003 NTDS • T1003.004 LSA Secrets • T1003.005 Cached Domain Credentials • T1003.006 DCSync • T1003.007 Proc Filesystem • T1003.008 /etc/passwd and /etc/shadow • T1020.001 Traffic Duplication • T1021 Remote Services • T1021.001 Remote Desktop Protocol • T1021.002 SMB/Windows Admin Shares • T1021.003 Distributed Component Object Model • T1021.004 SSH • T1021.005 VNC • T1021.006 Windows Remote Management • T1021.008 Direct Cloud VM Connections • T1047 Windows Management Instrumentation • T1053 Scheduled Task/Job • T1053.002 At • T1053.003 Cron • T1053.005 Scheduled Task • T1053.006 Systemd Timers • T1053.007 Container Orchestration Job • T1055 Process Injection • T1055.008 Ptrace System Calls • T1056.003 Web Portal Capture • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.006 Python • T1059.008 Network Device CLI • T1072 Software Deployment Tools • T1078 Valid Accounts • T1078.002 Domain Accounts • T1078.003 Local Accounts • T1078.004 Cloud Accounts • T1098 Account Manipulation • T1098.001 Additional Cloud Credentials • T1098.002 Additional Email Delegate Permissions • T1098.003 Additional Cloud Roles • T1098.004 SSH Authorized Keys • T1098.005 Device Registration • T1098.007 Additional Local or Domain Groups • T1134 Access Token Manipulation • T1134.001 Token Impersonation/Theft • T1134.002 Create Process with Token • T1134.003 Make and Impersonate Token • T1136 Create Account • T1136.001 Local Account • T1136.002 Domain Account • T1136.003 Cloud Account • T1137.002 Office Test • T1176 Browser Extensions • T1185 Browser Session Hijacking • T1190 Exploit Public-Facing Application • T1195 Supply Chain Compromise • T1195.001 Compromise Software Dependencies and Development Tools • T1195.003 Compromise Hardware Supply Chain • T1197 BITS Jobs • T1210 Exploitation of Remote Services • T1213 Data from Information Repositories • T1213.001 Confluence • T1213.002 Sharepoint • T1213.005 Messaging Applications • T1218 System Binary Proxy Execution • T1218.007 Msiexec • T1218.015 Electron Applications • T1222 File and Directory Permissions Modification • T1222.001 Windows File and Directory Permissions Modification • T1222.002 Linux and Mac File and Directory Permissions Modification • T1484 Domain or Tenant Policy Modification • T1489 Service Stop • T1495 Firmware Corruption • T1505 Server Software Component • T1505.002 Transport Agent • T1525 Implant Internal Image • T1528 Steal Application Access Token • T1530 Data from Cloud Storage • T1537 Transfer Data to Cloud Account • T1542 Pre-OS Boot • T1542.001 System Firmware • T1542.003 Bootkit • T1542.004 ROMMONkit • T1542.005 TFTP Boot • T1543 Create or Modify System Process • T1543.001 Launch Agent • T1543.002 Systemd Service • T1543.003 Windows Service • T1543.004 Launch Daemon • T1546.003 Windows Management Instrumentation Event Subscription • T1546.016 Installer Packages • T1547.003 Time Providers • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1547.007 Re-opened Applications • T1547.009 Shortcut Modification • T1547.012 Print Processors • T1547.013 XDG Autostart Entries • T1548 Abuse Elevation Control Mechanism • T1548.002 Bypass User Account Control • T1548.003 Sudo and Sudo Caching • T1548.005 Temporary Elevated Cloud Access • T1548.006 TCC Manipulation • T1550 Use Alternate Authentication Material • T1550.002 Pass the Hash • T1550.003 Pass the Ticket • T1552 Unsecured Credentials • T1552.002 Credentials in Registry • T1552.007 Container API • T1553 Subvert Trust Controls • T1553.006 Code Signing Policy Modification • T1554 Compromise Host Software Binary • T1556 Modify Authentication Process • T1556.001 Domain Controller Authentication • T1556.003 Pluggable Authentication Modules • T1556.004 Network Device Authentication • T1556.008 Network Provider DLL • T1556.009 Conditional Access Policies • T1558 Steal or Forge Kerberos Tickets • T1558.001 Golden Ticket • T1558.002 Silver Ticket • T1558.003 Kerberoasting • T1559 Inter-Process Communication • T1559.001 Component Object Model • T1559.003 XPC Services • T1562 Impair Defenses • T1562.001 Disable or Modify Tools • T1562.002 Disable Windows Event Logging • T1562.004 Disable or Modify System Firewall • T1562.006 Indicator Blocking • T1562.007 Disable or Modify Cloud Firewall • T1562.008 Disable or Modify Cloud Logs • T1562.009 Safe Mode Boot • T1562.011 Spoof Security Alerting • T1562.012 Disable or Modify Linux Audit System • T1563 Remote Service Session Hijacking • T1563.001 SSH Hijacking • T1563.002 RDP Hijacking • T1564.008 Email Hiding Rules • T1569 System Services • T1569.001 Launchctl • T1569.002 Service Execution • T1574 Hijack Execution Flow • T1574.005 Executable Installer File Permissions Weakness • T1574.010 Services File Permissions Weakness • T1574.011 Services Registry Permissions Weakness • T1574.012 COR_PROFILER • T1574.014 AppDomainManager • T1578 Modify Cloud Compute Infrastructure … and 12 more

Related

Mitigates · not in database (10)

Mitigates · MITRE ATT&CK (152)

  • T1213.005 Messaging Applications sub-technique
  • T1098.007 Additional Local or Domain Groups sub-technique
  • T1574.014 AppDomainManager sub-technique
  • T1548.006 TCC Manipulation sub-technique
  • T1218.015 Electron Applications sub-technique
  • T1556.009 Conditional Access Policies sub-technique
  • T1548.005 Temporary Elevated Cloud Access sub-technique
  • T1021.008 Direct Cloud VM Connections sub-technique
  • T1556.008 Network Provider DLL sub-technique
  • T1546.016 Installer Packages sub-technique
  • T1647 Plist File Modification technique
  • T1621 Multi-Factor Authentication Request Generation technique
  • T1098.005 Device Registration sub-technique
  • T1559.003 XPC Services sub-technique
  • T1619 Cloud Storage Object Discovery technique
  • T1564.008 Email Hiding Rules sub-technique
  • T1553.006 Code Signing Policy Modification sub-technique
  • T1552.007 Container API sub-technique
  • T1611 Escape to Host technique
  • T1053.007 Container Orchestration Job sub-technique
  • T1059.008 Network Device CLI sub-technique
  • T1542.004 ROMMONkit sub-technique
  • T1542.005 TFTP Boot sub-technique
  • T1020.001 Traffic Duplication sub-technique
  • T1556.004 Network Device Authentication sub-technique
  • T1599 Network Boundary Bridging technique
  • T1599.001 Network Address Translation Traversal sub-technique
  • T1601 Modify System Image technique
  • T1601.001 Patch System Image sub-technique
  • T1601.002 Downgrade System Image sub-technique
Show all 152 ›

Related control · Compliance (10)

  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-PE-3 Physical Access Control NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-34 Non-modifiable Executable Programs NIST 800-53 control
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control

Referenced by Compliance · enhancement of (4)

  • NIST-CM-5(1) Automated Access Enforcement and Audit Records NIST 800-53 enhancement
  • NIST-CM-5(4) Dual Authorization NIST 800-53 enhancement
  • NIST-CM-5(5) Privilege Limitation for Production and Operation NIST 800-53 enhancement
  • NIST-CM-5(6) Limit Library Privileges NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-CM Configuration Management NIST 800-53 family

Referenced by Compliance · related control (22)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AU-12 Audit Record Generation NIST 800-53 control
  • NIST-AU-2 Event Logging NIST 800-53 control
  • NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
  • NIST-AU-7 Audit Record Reduction and Report Generation NIST 800-53 control
  • NIST-CM-11 User-installed Software NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-3 Configuration Change Control NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-9 Configuration Management Plan NIST 800-53 control
  • NIST-MA-2 Controlled Maintenance NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-34(2) Integrity Protection on Read-only Media NIST 800-53 enhancement
  • NIST-SC-37 Out-of-band Channels NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3(4) Updates Only by Privileged Users NIST 800-53 enhancement
  • NIST-SI-7(15) Code Authentication NIST 800-53 enhancement