id: "CM-06(01)" title: "Automated Management, Application, and Verification" family: "CM" family_name: "Configuration Management" sort_id: "cm-06.01" priority: "P1" implementation_level: "organization" parent: "CM-06" enhancement: True
Statement
Manage, apply, and verify configuration settings for {{ insert: param, cm-06.01_odp.01 }} using {{ insert: param, cm-6.1_prm_2 }}.
Guidance
Automated tools (e.g., hardening tools, baseline configuration tools) can improve the accuracy, consistency, and availability of configuration settings information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.
Assessment Objective: configuration settings for {{ insert: param, cm-06.01_odp.01 }} are managed using {{ insert: param, cm-06.01_odp.02 }};
Assessment Objective: configuration settings for {{ insert: param, cm-06.01_odp.01 }} are applied using {{ insert: param, cm-06.01_odp.03 }};
Assessment Objective: configuration settings for {{ insert: param, cm-06.01_odp.01 }} are verified using {{ insert: param, cm-06.01_odp.04 }}.
Configuration management policy
procedures addressing configuration settings for the system
configuration management plan
system design documentation
system configuration settings and associated documentation
system component inventory
common secure configuration checklists
change control records
system audit records
system security plan
privacy plan
other relevant documents or records
Organizational personnel with security configuration management responsibilities
organizational personnel with information security and privacy responsibilities
system/network administrators
system developers
Organizational processes for managing configuration settings
automated mechanisms implemented to manage, apply, and verify system configuration settings