id: "CM-06(01)" title: "Automated Management, Application, and Verification" family: "CM" family_name: "Configuration Management" sort_id: "cm-06.01" priority: "P1" implementation_level: "organization" parent: "CM-06" enhancement: True


Statement

Manage, apply, and verify configuration settings for {{ insert: param, cm-06.01_odp.01 }} using {{ insert: param, cm-6.1_prm_2 }}.

Guidance

Automated tools (e.g., hardening tools, baseline configuration tools) can improve the accuracy, consistency, and availability of configuration settings information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.

Assessment Objective: configuration settings for {{ insert: param, cm-06.01_odp.01 }} are managed using {{ insert: param, cm-06.01_odp.02 }};

Assessment Objective: configuration settings for {{ insert: param, cm-06.01_odp.01 }} are applied using {{ insert: param, cm-06.01_odp.03 }};

Assessment Objective: configuration settings for {{ insert: param, cm-06.01_odp.01 }} are verified using {{ insert: param, cm-06.01_odp.04 }}.

Configuration management policy

procedures addressing configuration settings for the system

configuration management plan

system design documentation

system configuration settings and associated documentation

system component inventory

common secure configuration checklists

change control records

system audit records

system security plan

privacy plan

other relevant documents or records

Organizational personnel with security configuration management responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

system developers

Organizational processes for managing configuration settings

automated mechanisms implemented to manage, apply, and verify system configuration settings