# Configuration Management Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/cm/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Configuration Management, and who is accountable for meeting those requirements. (CM-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CM-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CM-1a.1(a))
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CM-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CM-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CM-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CM-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CM-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CM-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CM-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CM-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CM-1a.1(a))

## Procedures

The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CM-1a.2)

## Dissemination

- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the configuration management policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CM-1a)
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the configuration management procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CM-1a)

## Policy statements

### Baseline configuration (CM-2)

- The [System owner] shall develop, document and maintain under configuration control a current baseline configuration of the system. (CM-2a)
- The [System owner] shall review and update the baseline configuration [Fill in: the frequency of baseline configuration review and update. Typical: at least annually]. (CM-2b.1)
- The [System owner] shall review and update the baseline configuration when required by [Fill in: the circumstances requiring baseline configuration review and update. Typical: a significant change to the system, a new version of the secure configuration it is based on, or a security incident]. (CM-2b.2)
- The [System owner] shall review and update the baseline configuration when system components are installed or upgraded. (CM-2b.3)

### Automation support for accuracy and currency (CM-2(2))

- The [System owner] shall maintain the currency, completeness, accuracy and availability of the baseline configuration using [Fill in: automated mechanisms for maintaining baseline configuration of the system. Typical: configuration management and infrastructure-as-code tools that record the approved baseline]. (CM-2(2))

### Retention of previous configurations (CM-2(3))

- The [System owner] shall retain [Fill in: the number of previous baseline configuration versions to be retained. Typical: at least the two most recent] previous versions of the baseline configuration to support rollback. (CM-2(3))

### Configure systems and components for high-risk areas (CM-2(7))

- The [Chief Information Security Officer] shall ensure individuals traveling to locations the organization deems to be of significant risk are issued [Fill in: the systems or system components to be issued when individuals travel to high-risk areas. Typical: loaner laptops and mobile devices] with [Fill in: configurations for systems or system components to be issued when individuals travel to high-risk areas. Typical: a minimal configuration with full-disk encryption, no stored organizational data and access only through the organization's VPN]. (CM-2(7)(a))
- When those individuals return, the [Chief Information Security Officer] shall ensure the following controls are applied to the devices: [Fill in: the controls to be applied when the individuals return from travel. Typical: inspecting the device, wiping and reimaging it before reuse, and resetting the user's credentials]. (CM-2(7)(b))

### Configuration change control (CM-3)

- The [System owner] shall determine and document the types of changes to the system that are configuration-controlled. (CM-3a)
- The [System owner] shall review proposed configuration-controlled changes and approve or disapprove them with explicit consideration of security and privacy impact analyses. (CM-3b)
- The [System owner] shall document configuration change decisions for the system. (CM-3c)
- The [System owner] shall implement only approved configuration-controlled changes. (CM-3d)
- The [System owner] shall retain records of configuration-controlled changes for [Fill in: the time period to retain records of configuration-controlled changes. Typical: at least one year, or the life of the system if longer]. (CM-3e)
- The [System owner] shall monitor and review activities associated with configuration-controlled changes. (CM-3f)
- Configuration change control activities shall be coordinated and overseen by [Fill in: the configuration change control element responsible for coordinating and overseeing change control activities. Typical: a change control board with the system owner, technical leads and a security representative], which convenes [Select one or more: [Assignment: organization-defined frequency]; when [Assignment: organization-defined configuration change conditions]. Typical: weekly, and when an emergency change is requested]. (CM-3g)

### Testing, validation and documentation of changes (CM-3(2))

- The [System owner] shall test, validate and document changes before finalizing their implementation. (CM-3(2))

### Security and privacy representatives (CM-3(4))

- The [System owner] shall require [Fill in: security and privacy representatives. Typical: a representative of the security team and, where the system processes personal information, of the privacy office] to be members of [Fill in: the configuration change control element of which the security and privacy representatives are to be members. Typical: the change control board]. (CM-3(4))

### Impact analyses (CM-4)

- The [System owner] shall analyze changes to the system to determine potential security and privacy impacts before the changes are implemented. (CM-4)

### Verification of controls (CM-4(2))

- After a system change, the [System owner] shall verify that the impacted controls are implemented correctly, operating as intended and producing the desired outcome. (CM-4(2))

### Access restrictions for change (CM-5)

- The [System owner] shall define, document, approve and enforce physical and logical access restrictions associated with changes to the system. (CM-5)

### Configuration settings (CM-6)

- The [System owner] shall establish and document configuration settings for system components that reflect the most restrictive mode consistent with operational requirements, using [Fill in: common secure configurations to establish and document configuration settings for components employed within the system. Typical: the secure configuration baselines named in the baseline configuration standard]. (CM-6a)
- The [System owner] shall implement the configuration settings. (CM-6b)
- The [System owner] shall identify, document and approve any deviation from the established settings for [Fill in: system components for which approval of deviations is needed. Typical: all system components], based on [Fill in: operational requirements necessitating approval of deviations. Typical: documented operational needs that the system owner approves and the security team reviews]. (CM-6c)
- The [System owner] shall monitor and control changes to the configuration settings in accordance with this policy and its procedures. (CM-6d)

### Least functionality (CM-7)

- The [System owner] shall configure the system to provide only [Fill in: mission-essential capabilities for the system. Typical: the capabilities documented in the system security plan]. (CM-7a)
- The [System owner] shall prohibit or restrict the use of [Fill in: prohibited or restricted functions, system ports, protocols, software, and/or services. Typical: the functions, ports, protocols, software and services listed as prohibited or restricted in the baseline configuration standard]. (CM-7b)

### Periodic review (CM-7(1))

- The [System owner] shall review the system [Fill in: the frequency at which to review the system to identify unnecessary and/or non-secure functions, ports, protocols, software, and/or services. Typical: at least quarterly] to identify unnecessary or nonsecure functions, ports, protocols, software and services. (CM-7(1)(a))
- The [System owner] shall disable or remove [Fill in: functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure. Typical: any function, port, protocol, software or service the review finds unnecessary or nonsecure]. (CM-7(1)(b))

### Prevent program execution (CM-7(2))

- The [System owner] shall ensure the system prevents program execution in accordance with [Select one or more: [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage. Typical: the software rules in this policy, the rules of behavior and the access agreements]. (CM-7(2))

### Authorized software: allow by exception (CM-7(5))

- The [System owner] shall identify [Fill in: software programs authorized to execute on the system. Typical: the software on the approved software list for the system] as the software programs authorized to execute on the system. (CM-7(5)(a))
- The [System owner] shall employ a deny-all, permit-by-exception policy to allow only authorized software programs to execute. (CM-7(5)(b))
- The [System owner] shall review and update the list of authorized software programs [Fill in: frequency at which to review and update the list of authorized software programs. Typical: at least quarterly]. (CM-7(5)(c))

### System component inventory (CM-8)

- The [System owner] shall develop and document an inventory of system components that accurately reflects the system and includes all its components. (CM-8a.1, a.2)
- The [System owner] shall ensure the inventory has no duplicate accounting of components and no components assigned to another system. (CM-8a.3)
- The [System owner] shall ensure the inventory is at the level of granularity needed for tracking and reporting. (CM-8a.4)
- The [System owner] shall ensure the inventory includes [Fill in: information deemed necessary to achieve effective system component accountability. Typical: name, type, manufacturer and model, serial number or asset tag, software version, location, network address, owner and administrator] for each component. (CM-8a.5)
- The [System owner] shall review and update the inventory [Fill in: frequency at which to review and update the system component inventory. Typical: at least quarterly]. (CM-8b)

### Updates during installation and removal (CM-8(1))

- The [System owner] shall update the component inventory as part of component installations, removals and system updates. (CM-8(1))

### Automated unauthorized component detection (CM-8(3))

- The [System owner] shall detect the presence of unauthorized hardware, software and firmware components using [Fill in: automated mechanisms. Typical: network access control, asset discovery scans and endpoint management tools] [Fill in: frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system. Typical: continuously, and at least weekly by scan]. (CM-8(3)(a))
- When unauthorized components are detected, the [System owner] shall [Select one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles]. Typical: disable network access by unauthorized components, and notify the security operations team]. (CM-8(3)(b))

### Configuration management plan (CM-9)

- The [System owner] shall develop, document and implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures. (CM-9a)
- The [System owner] shall ensure the plan establishes a process for identifying configuration items throughout the system development life cycle and for managing their configuration. (CM-9b)
- The [System owner] shall ensure the plan defines the configuration items for the system and places them under configuration management. (CM-9c)
- The plan shall be reviewed and approved by [Fill in: personnel or roles to review and approve the configuration management plan. Typical: the system owner and the Chief Information Security Officer]. (CM-9d)
- The [System owner] shall protect the plan from unauthorized disclosure and modification. (CM-9e)

### Software usage restrictions (CM-10)

- Users shall use software and its documentation in accordance with contract agreements and copyright laws. (CM-10a)
- The [System owner] shall track the use of software and documentation protected by quantity licenses to control copying and distribution. (CM-10b)
- The [System owner] shall control and document the use of peer-to-peer file sharing technology so that it is not used for unauthorized distribution, display, performance or reproduction of copyrighted work. (CM-10c)

### User-installed software (CM-11)

- The [Chief Information Security Officer] shall establish the following rules for software installation by users: [Fill in: policies governing the installation of software by users. Typical: users may install only software from the organization's approved software catalog; all other installation requires approval by the system owner]. (CM-11a)
- The [System owner] shall enforce those rules through [Fill in: methods used to enforce software installation policies. Typical: removing local administrator rights and using an application allow list]. (CM-11b)
- The [System owner] shall monitor compliance with those rules [Fill in: frequency with which to monitor compliance. Typical: at least monthly]. (CM-11c)

### Information location (CM-12)

- The [System owner] shall identify and document the location of [Fill in: information for which the location is to be identified and documented. Typical: the information types listed in the system security plan] and the specific components on which it is processed and stored. (CM-12a)
- The [System owner] shall identify and document the users who have access to the system and components where that information is processed and stored. (CM-12b)
- The [System owner] shall document changes to the location where that information is processed and stored. (CM-12c)

### Automated tools to support information location (CM-12(1))

- The [System owner] shall use automated tools to identify [Fill in: information to be protected is defined by information type. Typical: personal information and other sensitive information types listed in the system security plan] on [Fill in: system components where the information is located. Typical: file shares, databases, cloud storage and endpoints] to confirm controls are in place to protect organizational information and individual privacy. (CM-12(1))

## Review and update

- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current configuration management policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current configuration management policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CM-1c.1)
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current configuration management procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require configuration management procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CM-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CM-1a.1(b))