CM-3(7)

Requirement

Review changes to the system [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.

Discussion

Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system configuration change control; configuration management plan; change control records; system architecture and configuration documentation; system configuration settings and associated documentation; system audit records; system component inventory; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with configuration change control responsibilities; organizational personnel with security responsibilities; system/network administrators; members of change control board or similar].

Test

[SELECT FROM: Organizational processes for configuration change control; mechanisms implementing audit records for changes].

ID	Assessment Objectives
CM-03(07)	changes to the system are reviewed <CM-03(07)_ODP[01] frequency> or when <CM-03(07)_ODP[02] circumstances> to determine whether unauthorized changes have occurred.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!