Configuration Management (CM)
The Configuration Management family has 14 active controls in SP 800-53 release 5.2.0. “Yes” marks membership in the SP 800-53B baselines.
| Control | Title | Low | Moderate | High | Privacy |
|---|---|---|---|---|---|
| CM-1 | Policy and Procedures | Yes | Yes | Yes | Yes |
| CM-2 | Baseline Configuration | Yes | Yes | Yes | |
| CM-3 | Configuration Change Control | Yes | Yes | ||
| CM-4 | Impact Analyses | Yes | Yes | Yes | Yes |
| CM-5 | Access Restrictions for Change | Yes | Yes | Yes | |
| CM-6 | Configuration Settings | Yes | Yes | Yes | |
| CM-7 | Least Functionality | Yes | Yes | Yes | |
| CM-8 | System Component Inventory | Yes | Yes | Yes | |
| CM-9 | Configuration Management Plan | Yes | Yes | ||
| CM-10 | Software Usage Restrictions | Yes | Yes | Yes | |
| CM-11 | User-installed Software | Yes | Yes | Yes | |
| CM-12 | Information Location | Yes | Yes | ||
| CM-13 | Data Action Mapping | ||||
| CM-14 | Signed Components |
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.