10.9Configuration Management (CM) 10.9.1CM-1 – Configuration Management Policy and Procedures
Program-specific policies and procedures shall be included in the specific security controls listed below. There is no requirement for the Program to develop additional policy to meet the -1 control.
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization:
a. Develops, documents, and disseminates to Authorized designated users:
1. A configuration management policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Procedures to facilitate the implementation of the configuration management policy and associated configuration management controls; and
b. Reviews and updates the current:
1. Configuration management policy [annually]; and
2. Configuration management procedures [annually].
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
|
10.9.2CM-2 – Baseline Configuration
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
Organizations must develop, document, and maintain the current baseline configuration for all information systems under their purview to include, but not limited to, workstations, servers, network components and mobile devices.
A baseline configuration describes the approved configuration of an information system including all hardware (manufacturer, model and serial number or unique identifier), software (manufacturer, name, version number), and firmware components (manufacturer, name and version number), how various security controls are implemented, how the components are interconnected, and the physical and logical locations of each.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.2.1CM-2(1) – Baseline Configuration: Reviews & Updates
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization reviews and updates the baseline configuration of the information system.:
-
At least annually;
-
When required due to baseline configuration changes or as events dictate such as changes due to - Changes that modify the security structure; and
-
Operating system changes (e.g., Windows XP to Windows 7).
-
Major software version upgrades (e.g., Office 2007 to Office 2010).
-
Addition to servers.
-
Modification to system ports, protocols and services (PPS).
-
Major vulnerabilities discovered after assessment and/or authorization.
-
Changes to the confidentiality, integrity, or availability requirements (e.g., changing from a moderate impact level to high impact level).
-
Changes in system encryption methods
-
Changes in interconnections.
-
Changes to operating environment (e.g. External information System introduces media capability; introduction of Voice over internet Protocol (IP) (VOIP) (classified or unclassified; foreign nationals move in next door, system is relocated).
-
Significant increased threat increasing the organization/sites residual risk. Minor and non-security relevant hardware and software changes to information systems do not require assessment retesting. These upgrades require an administrative update to the SSP. Examples of changes that only require administrative updates include:
-
Non-security relevant software version updates and/or upgrades.
-
Addition of identical workstation type with approved image to an authorized system.
-
Replacement of failed servers/system components with identical spares
-
Replacement of hardware drives/tape back-up.
-
As an integral part of information system component installations and upgrades.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.2.2CM-2 (5) – Baseline Configuration: Authorized Software WITHDRAWN Incorporated Into CM-7 10.9.3CM-3 – Configuration Change Control
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The Organization must:
a. Determine the types of changes to the information system that are configuration-controlled;
b. Review proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;
c. Document configuration change decisions associated with the information system;
d. Implement approved configuration-controlled changes to the information system;
e. Retain records of configuration-controlled changes to the information system for the life of the system.
f. Audit and reviews activities associated with configuration-controlled changes to the information system; and
g. Coordinate and provide oversight for configuration change control activities through establishment of a group of individuals with the collective responsibility and authority to review and approve proposed changes to the IS that convenes as defined in the local SSP and when there is a significant change to the system or the environment in which the system operates. This could be a function overseen only by the ISSM and/or ISSO/AO.
|
Click here to enter text.
|
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.3.1CM-3(4) – Configuration Change Control: Security Representative
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization requires an information security representative to be a member of the change board. Usually, the ISSM or his/her designated representative shall serve as a voting member of the CCB, whether informal or formal. Since the ISSM is responsible for halting practices dangerous to security, the ISSM shall have authority to veto any proposed change he/she believes to be detrimental to security. In cases of disagreement, the change shall be postponed while the ISO or ISSM contacts the AO’s office for resolution.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.3.2CM-3(6) – Configuration Change Control: Cryptography Management (+ Classified Overlay) – NEW BASELINE
This MLL baseline control is also required by the Privacy Overlay for IS that process, store or transmit privacy information. The control description must include the means by which the organization addresses the privacy-related implementation of this control.
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization ensures that cryptographic mechanisms (public key, private key, etc…)used to provide safeguarding of classified information from unauthorized access or modification is under configuration management policy
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.4CM-4 – Security Impact Analysis)
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
The organization must maintain records of analysis of changes to the information system.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.5CM-5 – Access Restrictions for Change
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization defines documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
The organization permits only qualified and authorized individuals (Privileged) to access information systems for purposes of initiating changes, including upgrades and modifications. These access restrictions enforce configuration control to the information system.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.5.1CM-5(5) – Access Restrictions for Change: Limit Production/Operational Privileges (+ Classified Overlay) (- Standalone Overlay)
After a relevance determination, this control can be tailored out for standalone IS with a single user.
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization:
-
Limits developing/integrator privileges to change information system components (hardware, software, and firmware) and system-related information within a production or operational environment; and
-
Ensure the ISSM Reviews and reevaluates privileges at least annually.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.5.2CM-5(6) – Access Restrictions for Change: Limit Library Privileges
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
The organization limits privileges to change software resident within software libraries.
Where possible, organizations shall employ automated mechanisms to enforce access restrictions and support auditing of the enforcement actions. This control supports insider threat mitigation.
|
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.6CM-6 – Configuration Settings
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
Organizations shall monitor and control changes to the configuration settings. Any detected unauthorized security-relevant configuration changes to an information system must be documented and reported as a possible incident. See also the Incident Response family.
The organization:
|
Establishes and documents configuration settings for information technology products employed within the information system using organizationally approved guides such as DoD SRGs, STIGs, NIST Security Configuration Checklists, Service specific guidance or NSA SCGs; if such a reference document is not available, the following are acceptable in descending order as available: (1) Commercially accepted practices (e.g., SANS) (2) Independent testing results (e.g., ICSA) or (3) Vendor literature that reflect the most restrictive mode consistent with operational requirements
|
Click here to enter text.
|
Implements the configuration settings
|
Click here to enter text.
|
Identifies, documents, and approves any deviations from established configuration settings for all configurable IS components based on mission requirements
|
Click here to enter text.
|
Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.6.1CM-6(3) – Configuration Settings: Unauthorized Change Detection WITHDRAWN Incorporated Into SI-7 10.9.6.2CM-6(4) – Configuration Settings: Conformance Demonstration WITHDRAWN Incorporated Into CM-4 10.9.7CM-7 – Least Functionality
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization must:
a. Document in the security plan, essential capabilities which the information system must provide. The organization configures the information system to provide only those documented essential capabilities.
b. Prohibits or restricts the use of ports, protocols, and services using least functionality. Ports will be denied access by default, and allow access by exception as documented in the system security plan.
|
Click here to enter text.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.7.1CM-7(1) – Least Functionality: Periodic Review (- Standalone Overlay)
After a relevance determination, this control can be tailored out for standalone IS.
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization must:
-
Reviews the information system annually to identify unnecessary and/or nonsecure functions, ports, protocols, and services; and
-
Disables ports, protocols, and services within the information system deemed to be unnecessary (documented in the SSP CM-7)
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.7.2CM-7(2) – Least Functionality: Prevent Program Execution (- Standalone Overlay)
After a relevance determination, this control can be tailored out for standalone IS.
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The information system prevents program execution by disabling or uninstalling unused/unnecessary operating system (OS) functionality, protocols, ports, and services, and limiting the software that can be installed and the functionality of that software. Systems prevent program execution from organizationally specific locations: (e.g., removable media, temporary directory, a shared network drive, etc.).
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.7.3CM-7(3) – Least Functionality: Registration Compliance (- Standalone Overlay)
After a relevance determination, this control can be tailored out for standalone IS.
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
Organizations shall obtain and ensure compliance with the latest guidance regarding ports, protocols, and services. Organizations shall configure information systems and components to disable the capability for automatic execution of code (e.g. AutoRun, AutoPlay). This control supports insider threat mitigation.
Supplemental Guidance: Organizations use the registration process to manage, track, and provide oversight for information systems and implemented functions, ports, protocols, and services.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.7.4CM-7(5) – Least Functionality: Authorized Software/Whitelisting – NEW BASELINE
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization:
-
Identifies develops and maintains an approved software list to execute on the information system. Change to this list is managed within CM-3.
-
Employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the information system; and
-
Reviews and updates the list of authorized software programs on a monthly basis.
The organization must maintain an audit trail of the review and update.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.8CM-8 – Information System Component Inventory
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization:
-
Develops and documents an inventory of information system components that:
-
Accurately reflects the current information system;
-
Includes all components within the authorization boundary of the information system;
-
Is at the level of granularity deemed necessary for tracking and reporting; and
-
Includes a local hardware list providing as a minimum, type, make, model, quantity, serial number.
-
Reviews and updates the information system component inventory at least annually
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.8.1CM-8(2) – Information System Component Inventory: Automated Maintenance (- Standalone Overlay) – NEW BASELINE
After a relevance determination, this control can be tailored out for standalone IS.
Recommended Continuous Monitoring Frequency: Semi-Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization employs automated mechanisms to help maintain an up-to-date, complete, accurate, and readily available inventory of information system components.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.8.2CM-8(3) – Information System Component Inventory: Automated Unauthorized Component Detection (- Standalone Overlay) – NEW BASELINE
After a relevance determination, this control can be tailored out for standalone IS.
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization must:
(a) Employ automated mechanisms continuously to detect the presence of unauthorized hardware, software, and firmware components within the information system; and
(b) Take the following actions when unauthorized components are detected: Documents and implements a process to take action to disable network access by unauthorized software, hardware, and firmware components, isolate the components, and/or notify the ISSO and ISSM and others as the local organization deems appropriate. The organization must maintain an audit trail of actions taken upon detection of unauthorized software, hardware, and firmware components.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.9CM-9 – Configuration Management Plan
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization develops, documents, and implements a configuration management plan for the information system that:
|
Addresses roles, responsibilities, and configuration management processes and procedures
|
Click here to enter text.
|
Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items
|
Click here to enter text.
|
Defines the configuration items for the information system and places the configuration items under configuration management
|
Click here to enter text.
|
Protects the configuration management plan from unauthorized disclosure and modification
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.10CM-10 – Software Usage Restrictions – NEW BASELINE
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
Software use within an environment can make licensing difficult, but system specific controls that are in place to ensure licensing is properly managed are required.
The organization:
|
Uses software and associated documentation in accordance with contract agreements and copyright laws
|
Click here to enter text.
|
Tracks the use of software and associated documentation protected by quantity licenses to control copying and distribution
|
Click here to enter text.
|
Controls and documents the use of peer-to-peer file sharing technology to ensure that this capability is not used for unauthorized distribution, display, performance, or reproduction of copyrighted work.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.10.1CM-10(1) – Software Usage Restrictions: Open Source Software – NEW BASELINE
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization establishes the following restrictions on the use of open source software:
Open source software may only be used if specifically approved by the DAO and the organization meets all licensing issues associated with the software.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.11CM-11 – User Installed Software – NEW BASELINE
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The organization:
-
Establishes policies governing the installation of software by users (e.g. user agreements, CM Plan, etc.)
-
Define and document the methods employed to enforce the software installation policies
-
Monitors policy compliance monthly.
|
Click here to enter text.
|
Click here to enter text.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
| 10.9.11.1CM-11(2) – User Installed Software: Prohibit Installation with Privileged Status – NEW BASELINE
Recommended Continuous Monitoring Frequency: Annual
|
Program Frequency:
|
Choose an item.
|
Implementation Status:
Implemented Planned
Organizational Tailoring:
Compensatory Control (Provide justification below) Tailored In (Provide justification below)
Tailored Out (Provide justification below) Modified (Provide justification below)
|
Control Origination (check all that apply):
Common System Specific Hybrid (Common and System Specific)
|
The IS prohibits user installation of software without explicit privileged status.
|
Click here to enter text.
|
CONTINUOUS MONITORING STRATEGY
|
Click here to enter text.
|
Dostları ilə paylaş: |
