id: "CM-03(07)" title: "Review System Changes" family: "CM" family_name: "Configuration Management" sort_id: "cm-03.07" priority: "P1" implementation_level: "organization" parent: "CM-03" enhancement: True
Statement
Review changes to the system {{ insert: param, cm-03.07_odp.01 }} or when {{ insert: param, cm-03.07_odp.02 }} to determine whether unauthorized changes have occurred.
Guidance
Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.
Assessment Objective
changes to the system are reviewed {{ insert: param, cm-03.07_odp.01 }} or when {{ insert: param, cm-03.07_odp.02 }} to determine whether unauthorized changes have occurred.
Configuration management policy
procedures addressing system configuration change control
configuration management plan
change control records
system architecture and configuration documentation
system configuration settings and associated documentation
system audit records
system component inventory
system security plan
other relevant documents or records
Organizational personnel with configuration change control responsibilities
organizational personnel with security responsibilities
system/network administrators
members of change control board or similar
Organizational processes for configuration change control
mechanisms implementing audit records for changes