CM-5(5): Privilege Limitation for Production and Operation
Control Family:
Parent Control:
CSF v1.1 References:
Threats Addressed:
Baselines:
(Not part of any baseline)
Previous Version:
- NIST Special Publication 800-53 Revision 4:
- CM-5(5): Limit Production / Operational Privileges
Control Statement
- Limit privileges to change system components and system-related information within a production or operational environment; and
- Review and reevaluate privileges [Assignment: organization-defined frequency].
Supplemental Guidance
In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures.