id: "CM-03(05)" title: "Automated Security Response" family: "CM" family_name: "Configuration Management" sort_id: "cm-03.05" priority: "P1" implementation_level: "system" parent: "CM-03" enhancement: True
Statement
Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: {{ insert: param, cm-03.05_odp }}.
Guidance
Automated security responses include halting selected system functions, halting system processing, and issuing alerts or notifications to organizational personnel when there is an unauthorized modification of a configuration item.
Assessment Objective
{{ insert: param, cm-03.05_odp }} are automatically implemented if baseline configurations are changed in an unauthorized manner.
System security plan
configuration management policy
procedures addressing system configuration change control
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
alerts/notifications of unauthorized baseline configuration changes
system audit records
other relevant documents or records
Organizational personnel with configuration change control responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
members of change control board or similar
Organizational processes for configuration change control
automated mechanisms implementing security responses to unauthorized changes to the baseline configurations