CM-3(1): Automated Documentation, Notification, and Prohibition of Changes

CSF v1.1 References:

Baselines:

  • High

Previous Version:

Control Statement

Use [Assignment: organization-defined automated mechanisms] to:

  1. Document proposed changes to the system;
  2. Notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval;
  3. Highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period];
  4. Prohibit changes to the system until designated approvals are received;
  5. Document all changes to the system; and
  6. Notify [Assignment: organization-defined personnel] when approved changes to the system are completed.

Supplemental Guidance

None.