---

id: "CM-06(02)" title: "Respond to Unauthorized Changes" family: "CM" family_name: "Configuration Management" sort_id: "cm-06.02" priority: "P1" implementation_level: "organization" parent: "CM-06" enhancement: True

---

Statement

Take the following actions in response to unauthorized changes to {{ insert: param, cm-06.02_odp.02 }}: {{ insert: param, cm-06.02_odp.01 }}.

Guidance

Responses to unauthorized changes to configuration settings include alerting designated organizational personnel, restoring established configuration settings, or—in extreme cases—halting affected system processing.

Assessment Objective

{{ insert: param, cm-06.02_odp.01 }} are taken in response to unauthorized changes to {{ insert: param, cm-06.02_odp.02 }}.

System security plan

privacy plan

configuration management policy

procedures addressing configuration settings for the system

configuration management plan

system design documentation

system configuration settings and associated documentation

alerts/notifications of unauthorized changes to system configuration settings

system component inventory

documented responses to unauthorized changes to system configuration settings

change control records

system audit records

other relevant documents or records

Organizational personnel with security configuration management responsibilities

organizational personnel with security and privacy responsibilities

system/network administrators

Organizational process for responding to unauthorized changes to system configuration settings

mechanisms supporting and/or implementing actions in response to unauthorized changes