[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fcm-3":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","cm-3","CM-3","Configuration Change Control",92,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must decide which changes are configuration controlled, review and approve proposed changes with security and privacy impact in mind, document decisions, implement approved changes, keep records, monitor and review change activity, and coordinate through a defined oversight body.\n\n**In practice.** This means a change management process proportionate to risk: standard pre-approved changes, normal changes reviewed by a change board or peer review, and emergency changes reviewed after the fact. For infrastructure-as-code, pull request approval and pipeline logs serve as evidence. Auditors expect change records, approvals, test evidence and reconciliation of detected changes against approved ones. ITIL and ISO\u002FIEC 27001 change management are closely related.\n\n**Common gaps.** Unauthorised changes made directly in production consoles bypass the process. Security impact is often a checkbox rather than a real assessment.","a. Determine and document the types of changes to the system that are configuration-controlled;\n  b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;\n  c. Document configuration change decisions associated with the system;\n  d. Implement approved configuration-controlled changes to the system;\n  e. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period];\n  f. Monitor and review activities associated with configuration-controlled changes to the system; and\n  g. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection: {{ insert: param, cm-03_odp.04 }} ; when {{ insert: param, cm-03_odp.05 }} ].\nDiscussion: Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also [SA-10](#sa-10).","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"windows-security-update-breaks-smart-app-control-feature","Windows Security Update Breaks Smart App Control Feature","2026-10-16T10:20:27.498+00:00",{"slug":25,"title":26,"published_at":27},"buggy-windows-update-causes-black-screens-and-explorer-crashes-in-azure-vdi-environments","Buggy Windows Update Causes Black Screens and Explorer Crashes in Azure VDI Environments","2026-10-15T10:20:36.39+00:00",{"slug":29,"title":30,"published_at":31},"microsoft-pauses-kb5002907-why-staged-patch-validation-matters","Microsoft Pauses KB5002907: Why Staged Patch Validation Matters","2026-09-29T10:21:25.401+00:00",{"slug":33,"title":34,"published_at":35},"re-enabled-compromised-github-actions-expose-cicd-pipelines-to-malicious-payloads","Re-enabled Compromised GitHub Actions Expose CI\u002FCD Pipelines to Malicious Payloads","2026-09-26T20:21:26.201+00:00",{"slug":37,"title":38,"published_at":39},"faulty-microsoft-update-deactivates-legitimate-office-licenses","Faulty Microsoft Update Deactivates Legitimate Office Licenses","2026-09-26T20:21:08.349+00:00",{"slug":41,"title":42,"published_at":43},"windows-update-causes-desktop-loading-failures-in-azure-virtual-desktop-environments","Windows Update Causes Desktop Loading Failures in Azure Virtual Desktop Environments","2026-09-25T12:21:25.667+00:00",{"slug":45,"title":46,"published_at":47},"re-enabled-malicious-github-actions-expose-15000-repos","Re-Enabled Malicious GitHub Actions Expose 15,000 Repos","2026-09-25T00:20:27.681+00:00",{"slug":49,"title":50,"published_at":51},"windows-security-update-breaks-always-on-vpn-protocol-misconfiguration-at-root","Windows Security Update Breaks Always On VPN — Protocol Misconfiguration at Root","2026-09-23T12:21:10.893+00:00",{"slug":53,"title":54,"published_at":55},"ransomware-group-hijacks-active-directory-gpo-to-weaponize-domain-admin-access","Ransomware Group Hijacks Active Directory GPO to Weaponize Domain Admin Access","2026-09-21T12:21:51.026+00:00",{"slug":57,"title":58,"published_at":59},"microsoft-security-update-breaks-domain-logins-via-enforcement-mode-bug","Microsoft Security Update Breaks Domain Logins via Enforcement Mode Bug","2026-09-17T10:21:14.734+00:00",{"slug":61,"title":62,"published_at":63},"ai-agents-can-self-modify-to-leak-secrets-and-bypass-safety-controls","AI Agents Can Self-Modify to Leak Secrets and Bypass Safety Controls","2026-09-17T08:20:38.264+00:00",{"slug":65,"title":66,"published_at":67},"windows-11-security-update-breaks-domain-trust-in-enterprise-environments","Windows 11 Security Update Breaks Domain Trust in Enterprise Environments","2026-09-16T22:20:20.086+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",66,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",35,{"slug":80,"name":81,"problem":82,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",30,{"slug":85,"name":86,"problem":87,"stories":88},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",21,{"slug":90,"name":91,"problem":92,"stories":93},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",10,{"slug":95,"name":96,"problem":97,"stories":98},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",8,[100,106,111,116,122,127,132,137],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",73,{"family":5,"item":107,"code":108,"title":109,"together":110},"si-2","SI-2","Flaw Remediation",58,{"family":112,"item":113,"code":114,"title":114,"together":115},"itil","overview","ITIL",33,{"family":117,"item":118,"code":119,"title":120,"together":121},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",32,{"family":101,"item":123,"code":124,"title":125,"together":126},"2","Control 2","Inventory and Control of Software Assets",23,{"family":101,"item":128,"code":129,"title":130,"together":131},"4","Control 4","Secure Configuration of Enterprise Assets and Software",20,{"family":101,"item":133,"code":134,"title":135,"together":136},"12","Control 12","Network Infrastructure Management",19,{"family":101,"item":138,"code":139,"title":140,"together":141},"8","Control 8","Audit Log Management",15]