| name | CM-3_configuration-change-control |
| description | Determine and document the types of changes to the system that are configuration-controlled; |
| category | configuration |
| version | 5.2.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-53","rev5","cm-3","cm"] |
| tech_stack | ["aws","azure","gcp","linux","windows"] |
| cwe_ids | ["CWE-16"] |
| chains_with | ["CA-7","CM-2","CM-4","CM-5","CM-6","CM-9","CM-11","IA-3","MA-2","PE-16"] |
| prerequisites | [] |
| severity_boost | {"CA-7":"Chain with CA-7 for comprehensive security coverage","CM-2":"Chain with CM-2 for comprehensive security coverage","CM-4":"Chain with CM-4 for comprehensive security coverage"} |
CM-3 Configuration Change Control
High-Level Description
Family: Configuration Management (CM)
Framework: NIST SP 800-53 Rev 5
Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also SA-10.
What to Check
How to Test
Step 1: Review Documentation
Examine the System Security Plan (SSP) and related artifacts for CM-3 implementation details. Verify the organization has documented how this control is satisfied.
Step 2: Validate Implementation
# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly
# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null
Step 3: Test Operating Effectiveness
Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Check configuration baselines | cloud_audit_config |
