Configuration Management (CM)

Configuration Management (CM)

CM.L2-3.4.1 System Baselining

CM.L2-3.4.2 Security Configuration Enforcement

CM.L2-3.4.3 System Change Management

CM.L2-3.4.4 Security Impact Analysis

CM.L2-3.4.5 Access Restrictions for Change

CM.L2-3.4.6 Least Functionality

CM.L2-3.4.7 Nonessential Functionality

CM.L2-3.4.8 Application Execution Policy

CM.L2-3.4.9 User-Installed Software

CM.L3-3.4.1E Authoritative Repository

CM.L3-3.4.2E Automated Detection & Remediation

CM.L3-3.4.3E Automated Inventory

There are currently no requirements in the Configuration Management domain at Level 1.

CM.L2-3.4.1 System Baselining

CM.L2-3.4.2 Security Configuration Enforcement

CM.L2-3.4.3 System Change Management

CM.L2-3.4.4 Security Impact Analysis

CM.L2-3.4.5 Access Restrictions for Change

CM.L2-3.4.6 Least Functionality

CM.L2-3.4.7 Nonessential Functionality

CM.L2-3.4.8 Application Execution Policy

CM.L2-3.4.9 User-Installed Software

CM.L3-3.4.1E Authoritative Repository

CM.L3-3.4.2E Automated Detection & Remediation

CM.L3-3.4.3E Automated Inventory