CM-3(3): Automated Change Implementation

Control Family:

Configuration Management

Parent Control:

CM-3: Configuration Change Control

CSF v1.1 References:

PR.IP-1
PR.IP-3
DE.CM-1
DE.CM-7

Threats Addressed:

Tampering
Elevation of Privilege

Baselines:

(Not part of any baseline)

Previous Version:

NIST Special Publication 800-53 Revision 4:
CM-3(3): Automated Change Implementation

Control Statement

Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].

Supplemental Guidance

Automated tools can improve the accuracy, consistency, and availability of configuration baseline information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.