CM-12 CM · Configuration Management

Information Location

LOW ✓ MODERATE ✓ HIGH
1 Enhancement 1 Overlay 16 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Discussion (NIST Supplemental Guidance)

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see FIPS 199 ). The location of the information and system components is also a factor in the architecture and design of the system (see SA-4, SA-8, SA-17).

Enhancements NIST SOURCE

CM-12(1) Automated Tools to Support Information Location LOW ✓ MODERATE ✓ HIGH

Use automated tools to identify [information by information type] on [system components] to ensure controls are in place to protect organizational information and individual privacy.

Discussion

The use of automated tools helps to increase the effectiveness and efficiency of the information location capability implemented within the system. Automation also helps organizations manage the data produced during information location activities and share such information across the organization. The output of automated information location tools can be used to guide and inform system architecture and design decisions.

Open full page for CM-12(1) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for CM-12 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. information for which the location is to be identified and documented is defined;
  2. the location of <CM-12_ODP information> is identified and documented;
  3. the specific system components on which <CM-12_ODP information> is processed are identified and documented;
  4. the specific system components on which <CM-12_ODP information> is stored are identified and documented;
  5. the users who have access to the system and system components where <CM-12_ODP information> is processed are identified and documented;
  6. the users who have access to the system and system components where <CM-12_ODP information> is stored are identified and documented;
  7. changes to the location (i.e., system or system components) where <CM-12_ODP information> is processed are documented;
  8. changes to the location (i.e., system or system components) where <CM-12_ODP information> is stored are documented.

Examine

[SELECT FROM: Configuration management policy; procedures addressing identification and documentation of information location; configuration management plan; system design documentation; system architecture documentation; PII inventory documentation; data mapping documentation; audit records; list of users with system and system component access; change control records; system component inventory; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for managing information location and user access to information; organizational personnel with responsibilities for operating, using, and/or maintaining the system; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Organizational processes governing information location; mechanisms enforcing policies and methods for governing information location].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

  • Base control: Included (matches standard baseline)
  • Included: (1)

HIGH

  • Base control: Included (matches standard baseline)
  • Included: (1)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for CM-12. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • system security plan
  • privacy plan

Configuration

  • Configuration management policy
  • configuration management plan
  • system design documentation
  • system architecture documentation
  • PII inventory documentation
  • system component inventory

Testing

  • Organizational processes governing information location
  • mechanisms enforcing policies and methods for governing information location

Other Records

  • procedures addressing identification and documentation of information location
  • data mapping documentation
  • audit records
  • list of users with system and system component access
  • change control records
  • other relevant documents or records