| name | CM-2(7)_configure-systems-and-components-for-high-risk-areas |
| description | Issue [organization-defined] with [organization-defined] to individuals traveling to locations that the organization deems to be of significant risk; |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","cm-2-7","cm","enhancement"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-16"] |
| chains_with | ["MP-4","MP-5"] |
| prerequisites | ["CM-2"] |
| severity_boost | {"MP-4":"Chain with MP-4 for comprehensive security coverage","MP-5":"Chain with MP-5 for comprehensive security coverage"} |
CM-2(7) Configure Systems and Components for High-risk Areas
Enhancement of: CM-2
High-Level Description
Family: Configuration Management (CM)
Framework: NIST SP 800-53 Rev 5
When it is known that systems or system components will be in high-risk areas external to the organization, additional controls may be implemented to counter the increased threat in such areas. For example, organizations can take actions for notebook computers used by individuals departing on and returning from travel. Actions include determining the locations that are of concern, defining the required configurations for the components, ensuring that components are configured as intended before travel is initiated, and applying controls to the components after travel is completed. Specially configured notebook computers include computers with sanitized hard drives, limited applications, and more stringent configuration settings. Controls applied to mobile devices upon return from travel include examining the mobile device for signs of physical tampering and purging and reimaging disk drives. Protecting information that resides on mobile devices is addressed in the MP (Media Protection) family.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for CM-2(7) implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
