CM-5: Access Restrictions for Change
Control Family:
CSF v1.1 References:
CSF v2.0 References:
PF v1.0 References:
Threats Addressed:
Baselines:
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- CM-5: Access Restrictions For Change
Control Statement
Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
Supplemental Guidance
Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals' privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see AC-3 and PE-3 ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).
OT Discussion
Some OT devices allow for the configuration and use of mode change switches. Where available, these should be used to prevent unauthorized changes. For example, many PLCs have key switches that allow the device to be placed in a programming mode or a running mode. Those PLCs should be placed in a running or remote mode to prevent unauthorized programming changes, and the key should be removed from the key switch and managed appropriately.
Control Enhancements
CM-5(1): Automated Access Enforcement and Audit Records
Baseline(s):
- High
- OT High (SP 800-82r3)
Enforce access restrictions using [Assignment: organization-defined automated mechanisms] ; and Automatically generate audit records of the enforcement actions.
CM-5(4): Dual Authorization
Baseline(s):
Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].
CM-5(5): Privilege Limitation for Production and Operation
Baseline(s):
Limit privileges to change system components and system-related information within a production or operational environment; and Review and reevaluate privileges [Assignment: organization-defined frequency].
CM-5(6): Limit Library Privileges
Baseline(s):
Limit privileges to change software resident within software libraries.