CM-6(1)

Requirement

Manage, apply, and verify configuration settings for [Assignment: organization-defined system components] using [Assignment: organization-defined automated mechanisms].

Discussion

Automated tools (e.g., hardening tools, baseline configuration tools) can improve the accuracy, consistency, and availability of configuration settings information. Automation can also provide data aggregation and data correlation capabilities, alerting mechanisms, and dashboards to support risk-based decision-making within the organization.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing configuration settings for the system; configuration management plan; system design documentation; system configuration settings and associated documentation; system component inventory; common secure configuration checklists; change control records; system audit records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with security configuration management responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Organizational processes for managing configuration settings; automated mechanisms implemented to manage, apply, and verify system configuration settings].

ID	Assessment Objectives
CM-06(01)[01]	configuration settings for <CM-06(01)_ODP[01] system components> are managed using <CM-06(01)_ODP[02] automated mechanisms>;
CM-06(01)[02]	configuration settings for <CM-06(01)_ODP[01] system components> are applied using <CM-06(01)_ODP[03] automated mechanisms>;
CM-06(01)[03]	configuration settings for <CM-06(01)_ODP[01] system components> are verified using <CM-06(01)_ODP[04] automated mechanisms>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!