Configuration Management Policy

Configuration Management Policy template: Ready-to-adopt Configuration Management policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Configuration Management policy states what the organization requires for configuration management and who is accountable for it. It meets CM-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. CM-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
CM-1	Policy and Procedures	Yes	Yes	Yes	Yes
CM-2	Baseline Configuration	Yes	Yes	Yes
CM-2(2)	Automation Support for Accuracy and Currency		Yes	Yes
CM-2(3)	Retention of Previous Configurations		Yes	Yes
CM-2(7)	Configure Systems and Components for High-risk Areas		Yes	Yes
CM-3	Configuration Change Control		Yes	Yes
CM-3(1)	Automated Documentation, Notification, and Prohibition of Changes			Yes
CM-3(2)	Testing, Validation, and Documentation of Changes		Yes	Yes
CM-3(4)	Security and Privacy Representatives		Yes	Yes
CM-3(6)	Cryptography Management			Yes
CM-4	Impact Analyses	Yes	Yes	Yes	Yes
CM-4(1)	Separate Test Environments			Yes
CM-4(2)	Verification of Controls		Yes	Yes
CM-5	Access Restrictions for Change	Yes	Yes	Yes
CM-5(1)	Automated Access Enforcement and Audit Records			Yes
CM-6	Configuration Settings	Yes	Yes	Yes
CM-6(1)	Automated Management, Application, and Verification			Yes
CM-6(2)	Respond to Unauthorized Changes			Yes
CM-7	Least Functionality	Yes	Yes	Yes
CM-7(1)	Periodic Review		Yes	Yes
CM-7(2)	Prevent Program Execution		Yes	Yes
CM-7(5)	Authorized Software — Allow-by-exception		Yes	Yes
CM-8	System Component Inventory	Yes	Yes	Yes
CM-8(1)	Updates During Installation and Removal		Yes	Yes
CM-8(2)	Automated Maintenance			Yes
CM-8(3)	Automated Unauthorized Component Detection		Yes	Yes
CM-8(4)	Accountability Information			Yes
CM-9	Configuration Management Plan		Yes	Yes
CM-10	Software Usage Restrictions	Yes	Yes	Yes
CM-11	User-installed Software	Yes	Yes	Yes
CM-12	Information Location		Yes	Yes
CM-12(1)	Automated Tools to Support Information Location		Yes	Yes

Decisions to make first

The policy has 74 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Which published secure configurations does each component type start from?	CM-6	Vendor security baselines or checklists from the NIST National Checklist Program, tailored in the baseline configuration standard.	Chief Information Security Officer
Who sits on the change control board, and which changes may skip it?	CM-3, CM-3(4)	The system owner, technical leads and a security representative; preapproved standard changes and emergency changes reviewed after the fact.	System owner
Which tool is the authoritative component inventory?	CM-8, CM-8(2)	The asset discovery or endpoint management tool, reconciled with the system inventory.	Chief Information Security Officer

Record your values in the Configuration Management decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: CM pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet CM-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the CM-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Configuration Management, and who is accountable for meeting those requirements. (CM-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (CM-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (CM-1a.1(a))
• The Fill in: an official to manage the configuration management policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (CM-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (CM-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (CM-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (CM-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (CM-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (CM-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (CM-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (CM-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (CM-1a.1(a))

Procedures

The Fill in: an official to manage the configuration management policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (CM-1a.2)

Dissemination

• The Fill in: an official to manage the configuration management policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the configuration management policy is to be disseminated Typical: everyone within its scope, through the policy library. (CM-1a)
• The Fill in: an official to manage the configuration management policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the configuration management procedures are to be disseminated Typical: the people who carry them out, and the system owners. (CM-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Baseline configuration (CM-2)

• The System owner shall develop, document and maintain under configuration control a current baseline configuration of the system. (CM-2a)
• The System owner shall review and update the baseline configuration Fill in: the frequency of baseline configuration review and update Typical: at least annually. (CM-2b.1)
• The System owner shall review and update the baseline configuration when required by Fill in: the circumstances requiring baseline configuration review and update Typical: a significant change to the system, a new version of the secure configuration it is based on, or a security incident. (CM-2b.2)
• The System owner shall review and update the baseline configuration when system components are installed or upgraded. (CM-2b.3)

Automation support for accuracy and currency (CM-2(2))

• The System owner shall maintain the currency, completeness, accuracy and availability of the baseline configuration using Fill in: automated mechanisms for maintaining baseline configuration of the system Typical: configuration management and infrastructure-as-code tools that record the approved baseline. (CM-2(2))

Retention of previous configurations (CM-2(3))

• The System owner shall retain Fill in: the number of previous baseline configuration versions to be retained Typical: at least the two most recent previous versions of the baseline configuration to support rollback. (CM-2(3))

Configure systems and components for high-risk areas (CM-2(7))

• The Chief Information Security Officer shall ensure individuals traveling to locations the organization deems to be of significant risk are issued Fill in: the systems or system components to be issued when individuals travel to high-risk areas Typical: loaner laptops and mobile devices with Fill in: configurations for systems or system components to be issued when individuals travel to high-risk areas Typical: a minimal configuration with full-disk encryption, no stored organizational data and access only through the organization’s VPN. (CM-2(7)(a))
• When those individuals return, the Chief Information Security Officer shall ensure the following controls are applied to the devices: Fill in: the controls to be applied when the individuals return from travel Typical: inspecting the device, wiping and reimaging it before reuse, and resetting the user’s credentials. (CM-2(7)(b))

Configuration change control (CM-3)

Guidance

CM-3 is where most programs either show discipline or show a gap. Keep one change record per change, with the request, the impact analysis (CM-4), the decision, the test result and the implementation date. Assessors sample changes from the system and trace each back to an approved record.

• The System owner shall determine and document the types of changes to the system that are configuration-controlled. (CM-3a)
• The System owner shall review proposed configuration-controlled changes and approve or disapprove them with explicit consideration of security and privacy impact analyses. (CM-3b)
• The System owner shall document configuration change decisions for the system. (CM-3c)
• The System owner shall implement only approved configuration-controlled changes. (CM-3d)
• The System owner shall retain records of configuration-controlled changes for Fill in: the time period to retain records of configuration-controlled changes Typical: at least one year, or the life of the system if longer. (CM-3e)
• The System owner shall monitor and review activities associated with configuration-controlled changes. (CM-3f)
• Configuration change control activities shall be coordinated and overseen by Fill in: the configuration change control element responsible for coordinating and overseeing change control activities Typical: a change control board with the system owner, technical leads and a security representative, which convenes Select one or more: [Assignment: organization-defined frequency]; when [Assignment: organization-defined configuration change conditions] Typical: weekly, and when an emergency change is requested. (CM-3g)

Testing, validation and documentation of changes (CM-3(2))

• The System owner shall test, validate and document changes before finalizing their implementation. (CM-3(2))

Security and privacy representatives (CM-3(4))

• The System owner shall require Fill in: security and privacy representatives Typical: a representative of the security team and, where the system processes personal information, of the privacy office to be members of Fill in: the configuration change control element of which the security and privacy representatives are to be members Typical: the change control board. (CM-3(4))

Impact analyses (CM-4)

• The System owner shall analyze changes to the system to determine potential security and privacy impacts before the changes are implemented. (CM-4)

Verification of controls (CM-4(2))

• After a system change, the System owner shall verify that the impacted controls are implemented correctly, operating as intended and producing the desired outcome. (CM-4(2))

Access restrictions for change (CM-5)

• The System owner shall define, document, approve and enforce physical and logical access restrictions associated with changes to the system. (CM-5)

Configuration settings (CM-6)

Guidance

Pick a published secure configuration for each component type rather than writing your own: vendor security baselines and checklists from the NIST National Checklist Program (SP 800-70 Rev. 5, May 2026) are common starting points. Record each deviation with its reason and approval; assessors compare scan results against the baseline and ask for the approval of every difference.

• The System owner shall establish and document configuration settings for system components that reflect the most restrictive mode consistent with operational requirements, using Fill in: common secure configurations to establish and document configuration settings for components employed within the system Typical: the secure configuration baselines named in the baseline configuration standard. (CM-6a)
• The System owner shall implement the configuration settings. (CM-6b)
• The System owner shall identify, document and approve any deviation from the established settings for Fill in: system components for which approval of deviations is needed Typical: all system components, based on Fill in: operational requirements necessitating approval of deviations Typical: documented operational needs that the system owner approves and the security team reviews. (CM-6c)
• The System owner shall monitor and control changes to the configuration settings in accordance with this policy and its procedures. (CM-6d)

Least functionality (CM-7)

• The System owner shall configure the system to provide only Fill in: mission-essential capabilities for the system Typical: the capabilities documented in the system security plan. (CM-7a)
• The System owner shall prohibit or restrict the use of Fill in: prohibited or restricted functions, system ports, protocols, software, and/or services Typical: the functions, ports, protocols, software and services listed as prohibited or restricted in the baseline configuration standard. (CM-7b)

Periodic review (CM-7(1))

• The System owner shall review the system Fill in: the frequency at which to review the system to identify unnecessary and/or non-secure functions, ports, protocols, software, and/or services Typical: at least quarterly to identify unnecessary or nonsecure functions, ports, protocols, software and services. (CM-7(1)(a))
• The System owner shall disable or remove Fill in: functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure Typical: any function, port, protocol, software or service the review finds unnecessary or nonsecure. (CM-7(1)(b))

Prevent program execution (CM-7(2))

• The System owner shall ensure the system prevents program execution in accordance with Select one or more: [Assignment: organization-defined policies, rules of behavior, and/or access agreements regarding software program usage and restrictions]; rules authorizing the terms and conditions of software program usage Typical: the software rules in this policy, the rules of behavior and the access agreements. (CM-7(2))

Authorized software: allow by exception (CM-7(5))

• The System owner shall identify Fill in: software programs authorized to execute on the system Typical: the software on the approved software list for the system as the software programs authorized to execute on the system. (CM-7(5)(a))
• The System owner shall employ a deny-all, permit-by-exception policy to allow only authorized software programs to execute. (CM-7(5)(b))
• The System owner shall review and update the list of authorized software programs Fill in: frequency at which to review and update the list of authorized software programs Typical: at least quarterly. (CM-7(5)(c))

System component inventory (CM-8)

• The System owner shall develop and document an inventory of system components that accurately reflects the system and includes all its components. (CM-8a.1, a.2)
• The System owner shall ensure the inventory has no duplicate accounting of components and no components assigned to another system. (CM-8a.3)
• The System owner shall ensure the inventory is at the level of granularity needed for tracking and reporting. (CM-8a.4)
• The System owner shall ensure the inventory includes Fill in: information deemed necessary to achieve effective system component accountability Typical: name, type, manufacturer and model, serial number or asset tag, software version, location, network address, owner and administrator for each component. (CM-8a.5)
• The System owner shall review and update the inventory Fill in: frequency at which to review and update the system component inventory Typical: at least quarterly. (CM-8b)

Updates during installation and removal (CM-8(1))

• The System owner shall update the component inventory as part of component installations, removals and system updates. (CM-8(1))

Automated unauthorized component detection (CM-8(3))

• The System owner shall detect the presence of unauthorized hardware, software and firmware components using Fill in: automated mechanisms Typical: network access control, asset discovery scans and endpoint management tools Fill in: frequency at which automated mechanisms are used to detect the presence of unauthorized system components within the system Typical: continuously, and at least weekly by scan. (CM-8(3)(a))
• When unauthorized components are detected, the System owner shall Select one or more: disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: organization-defined personnel or roles] Typical: disable network access by unauthorized components, and notify the security operations team. (CM-8(3)(b))

Configuration management plan (CM-9)

• The System owner shall develop, document and implement a configuration management plan for the system that addresses roles, responsibilities, and configuration management processes and procedures. (CM-9a)
• The System owner shall ensure the plan establishes a process for identifying configuration items throughout the system development life cycle and for managing their configuration. (CM-9b)
• The System owner shall ensure the plan defines the configuration items for the system and places them under configuration management. (CM-9c)
• The plan shall be reviewed and approved by Fill in: personnel or roles to review and approve the configuration management plan Typical: the system owner and the Chief Information Security Officer. (CM-9d)
• The System owner shall protect the plan from unauthorized disclosure and modification. (CM-9e)

Software usage restrictions (CM-10)

• Users shall use software and its documentation in accordance with contract agreements and copyright laws. (CM-10a)
• The System owner shall track the use of software and documentation protected by quantity licenses to control copying and distribution. (CM-10b)
• The System owner shall control and document the use of peer-to-peer file sharing technology so that it is not used for unauthorized distribution, display, performance or reproduction of copyrighted work. (CM-10c)

User-installed software (CM-11)

• The Chief Information Security Officer shall establish the following rules for software installation by users: Fill in: policies governing the installation of software by users Typical: users may install only software from the organization’s approved software catalog; all other installation requires approval by the system owner. (CM-11a)
• The System owner shall enforce those rules through Fill in: methods used to enforce software installation policies Typical: removing local administrator rights and using an application allow list. (CM-11b)
• The System owner shall monitor compliance with those rules Fill in: frequency with which to monitor compliance Typical: at least monthly. (CM-11c)

Information location (CM-12)

• The System owner shall identify and document the location of Fill in: information for which the location is to be identified and documented Typical: the information types listed in the system security plan and the specific components on which it is processed and stored. (CM-12a)
• The System owner shall identify and document the users who have access to the system and components where that information is processed and stored. (CM-12b)
• The System owner shall document changes to the location where that information is processed and stored. (CM-12c)

Automated tools to support information location (CM-12(1))

• The System owner shall use automated tools to identify Fill in: information to be protected is defined by information type Typical: personal information and other sensitive information types listed in the system security plan on Fill in: system components where the information is located Typical: file shares, databases, cloud storage and endpoints to confirm controls are in place to protect organizational information and individual privacy. (CM-12(1))

Review and update

• The Fill in: an official to manage the configuration management policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current configuration management policy is reviewed and updated Typical: annually and following Fill in: events that would require the current configuration management policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (CM-1c.1)
• The Fill in: an official to manage the configuration management policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current configuration management procedures are reviewed and updated Typical: annually and following Fill in: events that would require configuration management procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (CM-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (CM-1a.1(b))