CM-3(1): Automated Documentation, Notification, and Prohibition of Changes
Control Family:
Parent Control:
Threats Addressed:
Baselines:
- High
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- CM-3(1): Automated Document / Notification / Prohibition Of Changes
Control Statement
Use [Assignment: organization-defined automated mechanisms] to:
- Document proposed changes to the system;
- Notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval;
- Highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period];
- Prohibit changes to the system until designated approvals are received;
- Document all changes to the system; and
- Notify [Assignment: organization-defined personnel] when approved changes to the system are completed.
Supplemental Guidance
None.