CM-3(8)

Requirement

Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: organization-defined circumstances].

Discussion

System configuration changes can adversely affect critical system security and privacy functionality. Change restrictions can be enforced through automated mechanisms.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing system configuration change control; configuration management plan; change control records; system architecture and configuration documentation; system configuration settings and associated documentation; system component inventory; system audit records; system security plan; other relevant documents or records].

ID	Assessment Objectives
CM-03(08)	changes to the configuration of the system are prevented or restricted under <CM-03(08)_ODP circumstances>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!