THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · CM-3

Configuration Change Control

US National Institute of Standards and Technology (NIST) · cited in 92 of our lessons

Explanation

What it asks for. The organisation must decide which changes are configuration controlled, review and approve proposed changes with security and privacy impact in mind, document decisions, implement approved changes, keep records, monitor and review change activity, and coordinate through a defined oversight body.

In practice. This means a change management process proportionate to risk: standard pre-approved changes, normal changes reviewed by a change board or peer review, and emergency changes reviewed after the fact. For infrastructure-as-code, pull request approval and pipeline logs serve as evidence. Auditors expect change records, approvals, test evidence and reconciliation of detected changes against approved ones. ITIL and ISO/IEC 27001 change management are closely related.

Common gaps. Unauthorised changes made directly in production consoles bypass the process. Security impact is often a checkbox rather than a real assessment.

Open SP 800-53 at NIST
The official text
a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c. Document configuration change decisions associated with the system; d. Implement approved configuration-controlled changes to the system; e. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period]; f. Monitor and review activities associated with configuration-controlled changes to the system; and g. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection: {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ]. Discussion: Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 92.