Automated Documentation, Notification, and Prohibition of Changes
LOW MODERATE ✓ HIGHRequirements NIST SOURCE
Use [automated mechanisms] to:
Requirement Context
This element is part of CM-3(1) — Automated Documentation, Notification, and Prohibition of Changes. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of CM-3(1) — Automated Documentation, Notification, and Prohibition of Changes. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of CM-3(1) — Automated Documentation, Notification, and Prohibition of Changes. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of CM-3(1) — Automated Documentation, Notification, and Prohibition of Changes. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of CM-3(1) — Automated Documentation, Notification, and Prohibition of Changes. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Requirement Context
This element is part of CM-3(1) — Automated Documentation, Notification, and Prohibition of Changes. See the Assessment section below for the related SP 800-53A examine/interview/test procedures. No engineering interpretation has been authored for this control yet.
Discussion (NIST Supplemental Guidance)
None.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for CM-3(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- mechanisms used to automate configuration change control are defined;
- approval authorities to be notified of and request approval for proposed changes to the system are defined;
- the time period after which to highlight changes that have not been approved or disapproved is defined;
- personnel to be notified when approved changes are complete is/are defined;
- <CM-03(01)_ODP[01] automated mechanisms> are used to document proposed changes to the system;
- <CM-03(01)_ODP[01] automated mechanisms> are used to notify <CM-03(01)_ODP[02] approval authorities> of proposed changes to the system and request change approval;
- <CM-03(01)_ODP[01] automated mechanisms> are used to highlight proposed changes to the system that have not been approved or disapproved within <CM-03(01)_ODP[03] time period>;
- <CM-03(01)_ODP[01] automated mechanisms> are used to prohibit changes to the system until designated approvals are received;
- <CM-03(01)_ODP[01] automated mechanisms> are used to document all changes to the system;
- <CM-03(01)_ODP[01] automated mechanisms> are used to notify <CM-03(01)_ODP[04] personnel> when approved changes to the system are completed.
Examine
[SELECT FROM: Configuration management policy; procedures addressing system configuration change control; configuration management plan; system design documentation; system architecture and configuration documentation; automated configuration control mechanisms; system configuration settings and associated documentation; change control records; system audit records; change approval requests; change approvals; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with configuration change control responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; members of change control board or similar].
Test
[SELECT FROM: Organizational processes for configuration change control; automated mechanisms implementing configuration change control activities].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for CM-3(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- system security plan
Configuration
- Configuration management policy
- procedures addressing system configuration change control
- configuration management plan
- system design documentation
- system architecture and configuration documentation
- automated configuration control mechanisms
- system configuration settings and associated documentation
Testing
- Organizational processes for configuration change control
- automated mechanisms implementing configuration change control activities
Other Records
- change control records
- system audit records
- change approval requests
- change approvals
- other relevant documents or records