# Configuration Management Policy
**Template version:** 1.0.0 · **Baseline:** Privacy · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0
*Tailor this template before adoption; it is not legal advice.* Latest version: . Dedicated to the public domain under CC0 1.0 (): adopt and change it without attribution.
> **Guidance:** The sections before and after Policy statements meet CM-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CM-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.
## Purpose
This policy states what [Organization name] requires for Configuration Management, and who is accountable for meeting those requirements. (CM-1a.1(a))
## Scope
This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CM-1a.1(a))
## Roles and responsibilities
- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (CM-1a.1(a))
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (CM-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (CM-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (CM-1a.1(a))
## Management commitment
The [Senior leader] approves this policy and shall provide the resources needed to implement it. (CM-1a.1(a))
## Coordination
The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CM-1a.1(a))
## Compliance
- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (CM-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (CM-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (CM-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (CM-1a.1(a))
## Procedures
The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (CM-1a.2)
## Dissemination
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the configuration management policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (CM-1a)
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the configuration management procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (CM-1a)
## Policy statements
> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.
### Impact analyses (CM-4)
- The [System owner] shall analyze changes to the system to determine potential security and privacy impacts before the changes are implemented. (CM-4)
## Review and update
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current configuration management policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current configuration management policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (CM-1c.1)
- The [Fill in: an official to manage the configuration management policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current configuration management procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require configuration management procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (CM-1c.2)
### Federal systems
For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.
- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CM-1a.1(b))