CM-3(3)

Requirement

Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].

Discussion

Automated tools can improve the accuracy, consistency, and availability of configuration baseline information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; configuration management plan; procedures addressing system configuration change control; system design documentation; system architecture and configuration documentation; automated configuration control mechanisms; change control records; system component inventory; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with configuration change control responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; members of change control board or similar].

Test

[SELECT FROM: Organizational processes for configuration change control; automated mechanisms implementing changes to current system baseline].

ID	Assessment Objectives
CM-03(03)[01]	changes to the current system baseline are implemented using <CM-03(03)_ODP automated mechanisms>;
CM-03(03)[02]	the updated baseline is deployed across the installed base using <CM-03(03)_ODP automated mechanisms>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!