CM-6 Configuration Settings
Guidance: draftPolicy clause: draftWhat these mean
cm6ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Low, Moderate, High | Organization | 2 (2 in a baseline) |
Related controls: AC-3, AC-19, AU-2, AU-6, CA-9, CM-2, CM-3, CM-5, CM-7, CM-11, CP-7, CP-9, CP-10, IA-3, IA-5, PL-8, PL-9, RA-5, SA-4, SA-5, SA-8, SA-9, SC-18, SC-28, SC-43, SI-2, SI-4, SI-6
Control statement
Section titled “Control statement”- a. Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [Assignment: organization-defined common secure configurations];
- b. Implement the configuration settings;
- c. Identify, document, and approve any deviations from established configuration settings for [Assignment: organization-defined system components] based on [Assignment: organization-defined operational requirements] ; and
- d. Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.
NIST discussion
Configuration settings are the parameters that can be changed in the hardware, software, or firmware components of the system that affect the security and privacy posture or functionality of the system. Information technology products for which configuration settings can be defined include mainframe computers, servers, workstations, operating systems, mobile devices, input/output devices, protocols, and applications. Parameters that impact the security posture of systems include registry settings; account, file, or directory permission settings; and settings for functions, protocols, ports, services, and remote connections. Privacy parameters are parameters impacting the privacy posture of systems, including the parameters required to satisfy other privacy controls. Privacy parameters include settings for access controls, data processing preferences, and processing and retention permissions. Organizations establish organization-wide configuration settings and subsequently derive specific configuration settings for systems. The established settings become part of the configuration baseline for the system.
Common secure configurations (also known as security configuration checklists, lockdown and hardening guides, and security reference guides) provide recognized, standardized, and established benchmarks that stipulate secure configuration settings for information technology products and platforms as well as instructions for configuring those products or platforms to meet operational requirements. Common secure configurations can be developed by a variety of organizations, including information technology product developers, manufacturers, vendors, federal agencies, consortia, academia, industry, and other organizations in the public and private sectors.
Implementation of a common secure configuration may be mandated at the organization level, mission and business process level, system level, or at a higher level, including by a regulatory agency. Common secure configurations include the United States Government Configuration Baseline USGCB and security technical implementation guides (STIGs), which affect the implementation of CM-6 and other controls such as AC-19 and CM-7 . The Security Content Automation Protocol (SCAP) and the defined standards within the protocol provide an effective method to uniquely identify, track, and control configuration settings.
Control enhancements
Section titled “Control enhancements”CM-6(1) Automated Management, Application, and Verification
Section titled “CM-6(1) Automated Management, Application, and Verification”Baselines: High
Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms].
Discussion and assessment objectives for CM-6(1)
Automated tools (e.g., hardening tools, baseline configuration tools) can improve the accuracy, consistency, and availability of configuration settings information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.
Determine if:
- CM-06(01)[01] configuration settings for [Assignment: organization-defined system components] are managed using [Assignment: organization-defined automated mechanisms];
- CM-06(01)[02] configuration settings for [Assignment: organization-defined system components] are applied using [Assignment: organization-defined automated mechanisms];
- CM-06(01)[03] configuration settings for [Assignment: organization-defined system components] are verified using [Assignment: organization-defined automated mechanisms].
Examine: Configuration management policy; procedures addressing configuration settings for the system; configuration management plan; system design documentation; system configuration settings and associated documentation; system component inventory; common secure configuration checklists; change control records; system audit records; system security plan; privacy plan; other relevant documents or records.
Interview: Organizational personnel with security configuration management responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.
Test: Organizational processes for managing configuration settings; automated mechanisms implemented to manage, apply, and verify system configuration settings.
CM-6(2) Respond to Unauthorized Changes
Section titled “CM-6(2) Respond to Unauthorized Changes”Baselines: High
Take the following actions in response to unauthorized changes to [Assignment: organization-defined configuration settings]: [Assignment: organization-defined actions].
Discussion and assessment objectives for CM-6(2)
Responses to unauthorized changes to configuration settings include alerting designated organizational personnel, restoring established configuration settings, or—in extreme cases—halting affected system processing.
Determine if [Assignment: organization-defined actions] are taken in response to unauthorized changes to [Assignment: organization-defined configuration settings].
Examine: System security plan; privacy plan; configuration management policy; procedures addressing configuration settings for the system; configuration management plan; system design documentation; system configuration settings and associated documentation; alerts/notifications of unauthorized changes to system configuration settings; system component inventory; documented responses to unauthorized changes to system configuration settings; change control records; system audit records; other relevant documents or records.
Interview: Organizational personnel with security configuration management responsibilities; organizational personnel with security and privacy responsibilities; system/network administrators.
Test: Organizational process for responding to unauthorized changes to system configuration settings; mechanisms supporting and/or implementing actions in response to unauthorized changes.
Withdrawn enhancements: CM-6(3), CM-6(4).
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for CM-6
Determine if:
- CM-06a. configuration settings that reflect the most restrictive mode consistent with operational requirements are established and documented for components employed within the system using [Assignment: organization-defined common secure configurations];
- CM-06b. the configuration settings documented in CM-06a are implemented;
- CM-06c.
- CM-06c.[01] any deviations from established configuration settings for [Assignment: organization-defined system components] are identified and documented based on [Assignment: organization-defined operational requirements];
- CM-06c.[02] any deviations from established configuration settings for [Assignment: organization-defined system components] are approved;
- CM-06d.
- CM-06d.[01] changes to the configuration settings are monitored in accordance with organizational policies and procedures;
- CM-06d.[02] changes to the configuration settings are controlled in accordance with organizational policies and procedures.
Examine: Configuration management policy; procedures addressing configuration settings for the system; configuration management plan; system design documentation; system configuration settings and associated documentation; common secure configuration checklists; system component inventory; evidence supporting approved deviations from established configuration settings; change control records; system data processing and retention permissions; system audit records; system security plan; privacy plan; other relevant documents or records.
Interview: Organizational personnel with security configuration management responsibilities; organizational personnel with privacy configuration management responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators.
Test: Organizational processes for managing configuration settings; mechanisms that implement, monitor, and/or control system configuration settings; mechanisms that identify and/or document deviations from established configuration settings.
Policy statement
- The System owner shall establish and document configuration settings for system components that reflect the most restrictive mode consistent with operational requirements, using Fill in: common secure configurations to establish and document configuration settings for components employed within the system Typical: the secure configuration baselines named in the baseline configuration standard. (CM-6a)
- The System owner shall implement the configuration settings. (CM-6b)
- The System owner shall identify, document and approve any deviation from the established settings for Fill in: system components for which approval of deviations is needed Typical: all system components, based on Fill in: operational requirements necessitating approval of deviations Typical: documented operational needs that the system owner approves and the security team reviews. (CM-6c)
- The System owner shall monitor and control changes to the configuration settings in accordance with this policy and its procedures. (CM-6d)
CM-6(1) Automated management, application and verification
- The System owner shall manage, apply and verify configuration settings for Fill in: system components for which to manage, apply, and verify configuration settings Typical: all servers, workstations and network devices using Fill in: automated mechanisms Typical: configuration management tools and compliance scanning. (CM-6(1))
CM-6(2) Respond to unauthorized changes
- In response to an unauthorized change to Fill in: configuration settings requiring action upon an unauthorized change Typical: security-relevant settings in the baseline configuration, the System owner shall Fill in: actions to be taken upon an unauthorized change Typical: alert the security operations team, restore the approved setting and investigate the change as a potential incident. (CM-6(2))
From the Configuration Management Policy template (draft). Highlighted fields are values your organization sets.
How to apply it
Section titled “How to apply it”CM-6 asks you to set every component to the most restrictive settings that still let the system do its job, using a published secure configuration, and to approve and record every deviation. It is one of the most tested controls because scanners make it easy to measure.
Common implementations. Vendor security baselines or checklists from the NIST National Checklist Program (SP 800-70 Rev. 5, May 2026) chosen per component type and recorded in a baseline configuration standard, which also holds the deviation register and the scan evidence. Settings applied through group policy, configuration management or infrastructure as code. Compliance scans compare components against the standard, and deviations are approved and recorded with their reason.
Organization-defined parameters. Typical values, which your organization may set differently:
| Parameter | Typical value |
|---|---|
| Common secure configurations (a) | The secure configuration baselines named in the baseline configuration standard |
| Components needing approved deviations (c) | All system components |
| Operational requirements justifying deviations (c) | Documented operational needs that the system owner approves and the security team reviews |
Evidence assessors ask for.
- The baseline configuration standard naming the secure configurations used
- Recent configuration compliance scan results
- The list of approved deviations, with approvals
Inheritance. Standard images and centrally managed policies are often common; the system owns application settings and its deviations.
Common findings.
- Scan results showing failed settings with no recorded deviation.
- Deviations approved once and never revisited.
- Application and database settings left out of scope.
Enhancements in the Moderate baseline. None beyond the base control. High adds CM-6(1) automated management and CM-6(2) response to unauthorized changes.
Artifacts
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.