CM-8(6): Assessed Configurations / Approved Deviations

Control Family:

Configuration Management

Parent Control:

CM-8: Information System Component Inventory

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

ID.AM-1
ID.AM-2
PR.DS-3
DE.CM-7

Baselines:

(Not part of any baseline)

Next Version:

NIST Special Publication 800-53 Revision 5:
CM-8(6): Assessed Configurations and Approved Deviations

Control Statement

The organization includes assessed component configurations and any approved deviations to current deployed configurations in the information system component inventory.

Supplemental Guidance

This control enhancement focuses on configuration settings established by organizations for information system components, the specific components that have been assessed to determine compliance with the required configuration settings, and any approved deviations from established configuration settings.