ComplianceNIST 800-53 enhancement
NIST-CM-5(1) Automated Access Enforcement and Audit Records
- Framework
- NIST SP 800-53 rev5 (5.2.0)
- Family
- CM Configuration Management
- Control
- CM-5(1)
Control statement
(a) Enforce access restrictions using [Assignment: automated mechanisms] ; and
(b) Automatically generate audit records of the enforcement actions.
Discussion
Organizations log system accesses associated with applying configuration changes to ensure that configuration change control is implemented and to support after-the-fact actions should organizations discover any unauthorized changes.
Related
Enhancement of · Compliance (1)
- NIST-CM-5 Access Restrictions for Change NIST 800-53 control
Related control · Compliance (7)
- NIST-AU-12 Audit Record Generation NIST 800-53 control
- NIST-AU-2 Event Logging NIST 800-53 control
- NIST-AU-6 Audit Record Review, Analysis, and Reporting NIST 800-53 control
- NIST-AU-7 Audit Record Reduction and Report Generation NIST 800-53 control
- NIST-CM-11 User-installed Software NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-SI-12 Information Management and Retention NIST 800-53 control