CM-4(2): Verification Of Security Functions

Control Family:

Configuration Management

Parent Control:

CM-4: Security Impact Analysis

Priority:

P2: Implement P2 security controls after implementation of P1 controls.

CSF v1.1 References:

PR.IP-1
PR.IP-3

PF v1.0 References:

CT.DM-P9

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5.2.0:
CM-4(2): Verification of Controls

Control Statement

The organization, after the information system is changed, checks the security functions to verify that the functions are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security requirements for the system.

Supplemental Guidance

Implementation is this context refers to installing changed code in the operational information system.