cm-3-configuration-change-control

name	CM-3_configuration-change-control
description	Determine and document the types of changes to the system that are configuration-controlled;
category	configuration
version	5.2.0
author	cyberstrike-official
tags	["nist","sp800-53","rev5","cm-3","cm"]
tech_stack	["aws","azure","gcp","linux","windows"]
cwe_ids	["CWE-16"]
chains_with	["CA-7","CM-2","CM-4","CM-5","CM-6","CM-9","CM-11","IA-3","MA-2","PE-16"]
prerequisites	[]
severity_boost	{"CA-7":"Chain with CA-7 for comprehensive security coverage","CM-2":"Chain with CM-2 for comprehensive security coverage","CM-4":"Chain with CM-4 for comprehensive security coverage"}

CM-3 Configuration Change Control

High-Level Description

Family: Configuration Management (CM) Framework: NIST SP 800-53 Rev 5

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also SA-10.

What to Check

• Verify CM-3 Configuration Change Control is documented in SSP
• Validate all 7 control requirements are implemented
• Confirm control is operating effectively
• Review evidence of continuous monitoring for CM-3

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for CM-3 implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Tool	Purpose	Usage
cloud-audit-mcp	Check configuration baselines	cloud_audit_config