CM-3(3): Automated Change Implementation

Control Family:

Configuration Management

Parent Control:

CM-3: Configuration Change Control

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

PR.IP-1
PR.IP-3
DE.CM-1
DE.CM-7

Threats Addressed:

Tampering
Elevation of Privilege

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5:
CM-3(3): Automated Change Implementation

Control Statement

The organization employs automated mechanisms to implement changes to the current information system baseline and deploys the updated baseline across the installed base.