CM-3(6)

Requirement

Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls].

Discussion

The controls referenced in the control enhancement refer to security and privacy controls from the control catalog. Regardless of the cryptographic mechanisms employed, processes and procedures are in place to manage those mechanisms. For example, if system components use certificates for identification and authentication, a process is implemented to address the expiration of those certificates.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system configuration change control; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with configuration change control responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; members of change control board or similar].

Test

[SELECT FROM: Organizational processes for configuration change control; cryptographic mechanisms implementing organizational security safeguards (controls)].

ID	Assessment Objectives
CM-03(06)	cryptographic mechanisms used to provide <CM-03(06)_ODP controls> are under configuration management.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!