# Configuration Management Policy

**Template version:** 1.0.0 · **Baseline:** Low · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/cm/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Configuration Management, and who is accountable for meeting those requirements. (CM-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CM-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CM-1a.1(a))
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CM-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CM-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CM-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CM-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CM-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CM-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CM-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CM-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CM-1a.1(a))

## Procedures

The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CM-1a.2)

## Dissemination

- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the configuration management policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CM-1a)
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the configuration management procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CM-1a)

## Policy statements

### Baseline configuration (CM-2)

- The [System owner] shall develop, document and maintain under configuration control a current baseline configuration of the system. (CM-2a)
- The [System owner] shall review and update the baseline configuration [Fill in: the frequency of baseline configuration review and update. Typical: at least annually]. (CM-2b.1)
- The [System owner] shall review and update the baseline configuration when required by [Fill in: the circumstances requiring baseline configuration review and update. Typical: a significant change to the system, a new version of the secure configuration it is based on, or a security incident]. (CM-2b.2)
- The [System owner] shall review and update the baseline configuration when system components are installed or upgraded. (CM-2b.3)

### Impact analyses (CM-4)

- The [System owner] shall analyze changes to the system to determine potential security and privacy impacts before the changes are implemented. (CM-4)

### Access restrictions for change (CM-5)

- The [System owner] shall define, document, approve and enforce physical and logical access restrictions associated with changes to the system. (CM-5)

### Configuration settings (CM-6)

- The [System owner] shall establish and document configuration settings for system components that reflect the most restrictive mode consistent with operational requirements, using [Fill in: common secure configurations to establish and document configuration settings for components employed within the system. Typical: the secure configuration baselines named in the baseline configuration standard]. (CM-6a)
- The [System owner] shall implement the configuration settings. (CM-6b)
- The [System owner] shall identify, document and approve any deviation from the established settings for [Fill in: system components for which approval of deviations is needed. Typical: all system components], based on [Fill in: operational requirements necessitating approval of deviations. Typical: documented operational needs that the system owner approves and the security team reviews]. (CM-6c)
- The [System owner] shall monitor and control changes to the configuration settings in accordance with this policy and its procedures. (CM-6d)

### Least functionality (CM-7)

- The [System owner] shall configure the system to provide only [Fill in: mission-essential capabilities for the system. Typical: the capabilities documented in the system security plan]. (CM-7a)
- The [System owner] shall prohibit or restrict the use of [Fill in: prohibited or restricted functions, system ports, protocols, software, and/or services. Typical: the functions, ports, protocols, software and services listed as prohibited or restricted in the baseline configuration standard]. (CM-7b)

### System component inventory (CM-8)

- The [System owner] shall develop and document an inventory of system components that accurately reflects the system and includes all its components. (CM-8a.1, a.2)
- The [System owner] shall ensure the inventory has no duplicate accounting of components and no components assigned to another system. (CM-8a.3)
- The [System owner] shall ensure the inventory is at the level of granularity needed for tracking and reporting. (CM-8a.4)
- The [System owner] shall ensure the inventory includes [Fill in: information deemed necessary to achieve effective system component accountability. Typical: name, type, manufacturer and model, serial number or asset tag, software version, location, network address, owner and administrator] for each component. (CM-8a.5)
- The [System owner] shall review and update the inventory [Fill in: frequency at which to review and update the system component inventory. Typical: at least quarterly]. (CM-8b)

### Software usage restrictions (CM-10)

- Users shall use software and its documentation in accordance with contract agreements and copyright laws. (CM-10a)
- The [System owner] shall track the use of software and documentation protected by quantity licenses to control copying and distribution. (CM-10b)
- The [System owner] shall control and document the use of peer-to-peer file sharing technology so that it is not used for unauthorized distribution, display, performance or reproduction of copyrighted work. (CM-10c)

### User-installed software (CM-11)

- The [Chief Information Security Officer] shall establish the following rules for software installation by users: [Fill in: policies governing the installation of software by users. Typical: users may install only software from the organization's approved software catalog; all other installation requires approval by the system owner]. (CM-11a)
- The [System owner] shall enforce those rules through [Fill in: methods used to enforce software installation policies. Typical: removing local administrator rights and using an application allow list]. (CM-11b)
- The [System owner] shall monitor compliance with those rules [Fill in: frequency with which to monitor compliance. Typical: at least monthly]. (CM-11c)

## Review and update

- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current configuration management policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current configuration management policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CM-1c.1)
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current configuration management procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require configuration management procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CM-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CM-1a.1(b))