CM-5(5)

Requirement
1. Limit privileges to change system components and system-related information within a production or operational environment; and
2. Review and reevaluate privileges [Assignment: organization-defined frequency].

Discussion

In many organizations, systems support multiple mission and business functions. Limiting privileges to change system components with respect to operational systems is necessary because changes to a system component may have far-reaching effects on mission and business processes supported by the system. The relationships between systems and mission/business processes are, in some cases, unknown to developers. System-related information includes operational procedures.

Title

Access Restrictions for Change | Privilege Limitation for Production and Operation
Family

Configuration Management
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing access restrictions for changes to the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; user privilege reviews; user privilege recertifications; system component inventory; change control records; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with information security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for managing access restrictions to change; mechanisms supporting and/or implementing access restrictions for change].

ID	Assessment Objectives
CM-05(05)(b)[02]	privileges are reevaluated <CM-05(05)_ODP[02] frequency>.
CM-05(05)(a)[01]	privileges to change system components within a production or operational environment are limited;
CM-05(05)(a)[02]	privileges to change system-related information within a production or operational environment are limited;
CM-05(05)(b)[01]	privileges are reviewed <CM-05(05)_ODP[01] frequency>;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!