CyberStrikeus/CyberStrike - Page 122

cm-11-1-alerts-for-unauthorized-installations

Alerts for Unauthorized Installations

cm-11-2-software-installation-with-privileged-status

Allow user installation of software only with explicit privileged status.

cm-11-3-automated-enforcement-and-monitoring

Enforce and monitor compliance with software installation policies using [organization-defined].

cm-11-user-installed-software

Establish [organization-defined] governing the installation of software by users;

cm-12-1-automated-tools-to-support-information-location

Use automated tools to identify [organization-defined] on [organization-defined] to ensure controls are in place to protect organizational information

cm-12-information-location

Identify and document the location of [organization-defined] and the specific system components on which the information is processed and stored;

cm-13-data-action-mapping

Develop and document a map of system data actions.

cm-14-signed-components

Prevent the installation of [organization-defined] without verification that the component has been digitally signed using a certificate that is recog

cm-2-1-reviews-and-updates

Reviews and Updates

cm-2-2-automation-support-for-accuracy-and-currency

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using [organization-defined].

cm-2-3-retention-of-previous-configurations

Retain [organization-defined] of previous versions of baseline configurations of the system to support rollback.

cm-2-4-unauthorized-software

Unauthorized Software

cm-2-5-authorized-software

Authorized Software

cm-2-6-development-and-test-environments

Maintain a baseline configuration for system development and test environments that is managed separately from the operational baseline configuration.

cm-2-7-configure-systems-and-components-for-high-risk-areas

Issue [organization-defined] with [organization-defined] to individuals traveling to locations that the organization deems to be of significant risk;

cm-2-baseline-configuration

Develop, document, and maintain under configuration control, a current baseline configuration of the system;

cm-3-2-testing-validation-and-documentation-of-changes

Test, validate, and document changes to the system before finalizing the implementation of the changes.

cm-3-3-automated-change-implementation

Implement changes to the current system baseline and deploy the updated baseline across the installed base using [organization-defined].

cm-3-4-security-and-privacy-representatives

Require [organization-defined] to be members of the [organization-defined].

cm-3-5-automated-security-response

Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [organization-defined].

cm-3-6-cryptography-management

Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [organization-defined].

cm-3-7-review-system-changes

Review changes to the system [organization-defined] or when [organization-defined] to determine whether unauthorized changes have occurred.

cm-3-8-prevent-or-restrict-configuration-changes

Prevent or restrict changes to the configuration of the system under the following circumstances: [organization-defined].

cm-3-configuration-change-control

Determine and document the types of changes to the system that are configuration-controlled;

cm-4-1-separate-test-environments

Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy imp

cm-4-2-verification-of-controls

After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regar

cm-4-impact-analyses

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

cm-5-1-automated-access-enforcement-and-audit-records

Enforce access restrictions using [organization-defined] ;

cm-5-2-review-system-changes

Review System Changes

cm-5-3-signed-components

Signed Components

cm-5-4-dual-authorization

Enforce dual authorization for implementing changes to [organization-defined].

cm-5-5-privilege-limitation-for-production-and-operation

Limit privileges to change system components and system-related information within a production or operational environment;

cm-5-6-limit-library-privileges

Limit privileges to change software resident within software libraries.

cm-5-7-automatic-implementation-of-security-safeguards

Automatic Implementation of Security Safeguards

cm-5-access-restrictions-for-change

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

cm-6-1-automated-management-application-and-verification

Manage, apply, and verify configuration settings for [organization-defined] using [organization-defined].

cm-6-2-respond-to-unauthorized-changes

Take the following actions in response to unauthorized changes to [organization-defined]: [organization-defined].

cm-6-3-unauthorized-change-detection

Unauthorized Change Detection

cm-6-4-conformance-demonstration

Conformance Demonstration

cm-6-configuration-settings

Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with oper...