id: "CM-03(07)" title: "Review System Changes" family: "CM" family_name: "Configuration Management" sort_id: "cm-03.07" priority: "P1" implementation_level: "organization" parent: "CM-03" enhancement: True


Statement

Review changes to the system {{ insert: param, cm-03.07_odp.01 }} or when {{ insert: param, cm-03.07_odp.02 }} to determine whether unauthorized changes have occurred.

Guidance

Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.

Assessment Objective

changes to the system are reviewed {{ insert: param, cm-03.07_odp.01 }} or when {{ insert: param, cm-03.07_odp.02 }} to determine whether unauthorized changes have occurred.

Configuration management policy

procedures addressing system configuration change control

configuration management plan

change control records

system architecture and configuration documentation

system configuration settings and associated documentation

system audit records

system component inventory

system security plan

other relevant documents or records

Organizational personnel with configuration change control responsibilities

organizational personnel with security responsibilities

system/network administrators

members of change control board or similar

Organizational processes for configuration change control

mechanisms implementing audit records for changes