{"data":{"id":"CM-03","name":"Configuration Change Control","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Determine and document the types of changes to the system that are configuration-controlled;\nb. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;\nc. Document configuration change decisions associated with the system;\nd. Implement approved configuration-controlled changes to the system;\ne. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period];\nf. Monitor and review activities associated with configuration-controlled changes to the system; and\ng. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; when [Assignment: organization-defined configuration change conditions]].","supplemental_guidance":"Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also SA-10.","enhancements":[{"id":"CM-03(01)","name":"Automated Documentation, Notification, and Prohibition of Changes","statement":"Use [Assignment: organization-defined automated mechanisms] to:\na. Document proposed changes to the system;\nb. Notify [Assignment: organization-defined approval authorities] of proposed changes to the system and request change approval;\nc. Highlight proposed changes to the system that have not been approved or disapproved within [Assignment: organization-defined time period];\nd. Prohibit changes to the system until designated approvals are received;\ne. Document all changes to the system; and\nf. Notify [Assignment: organization-defined personnel] when approved changes to the system are completed.","baselines":["high"]},{"id":"CM-03(02)","name":"Testing, Validation, and Documentation of Changes","statement":"Test, validate, and document changes to the system before finalizing the implementation of the changes.","baselines":["moderate","high"]},{"id":"CM-03(03)","name":"Automated Change Implementation","statement":"Implement changes to the current system baseline and deploy the updated baseline across the installed base using [Assignment: organization-defined automated mechanisms].","baselines":[]},{"id":"CM-03(04)","name":"Security and Privacy Representatives","statement":"Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element].","baselines":["moderate","high"]},{"id":"CM-03(05)","name":"Automated Security Response","statement":"Implement the following security responses automatically if baseline configurations are changed in an unauthorized manner: [Assignment: organization-defined security responses].","baselines":[]},{"id":"CM-03(06)","name":"Cryptography Management","statement":"Ensure that cryptographic mechanisms used to provide the following controls are under configuration management: [Assignment: organization-defined controls].","baselines":["high"]},{"id":"CM-03(07)","name":"Review System Changes","statement":"Review changes to the system [Assignment: organization-defined frequency] or when [Assignment: organization-defined circumstances] to determine whether unauthorized changes have occurred.","baselines":[]},{"id":"CM-03(08)","name":"Prevent or Restrict Configuration Changes","statement":"Prevent or restrict changes to the configuration of the system under the following circumstances: [Assignment: organization-defined circumstances].","baselines":[]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-03","name":"Configuration Change Control","description":"a. Determine and document the types of changes to the system that are configuration-controlled;\nb. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;\nc. Document configuration change decisions associated with the system;\nd. Implement approved configuration-controlled changes to the system;\ne. Retain records of configuration-controlled changes to the system for [Assignment: organization-defined time period];\nf. Monitor and review activities associated with configuration-controlled changes to the system; and\ng. Coordinate and provide oversight for configuration change control activities through [Assignment: organization-defined configuration change control element] that convenes [Selection (one or more): [Assignment: organization-defined frequency]; when [Assignment: organization-defined configuration change conditions]].","discussion":"Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also SA-10.","related_controls":["CA-07","CM-02","CM-04","CM-05","CM-06","CM-09","CM-11","IA-03","MA-02","PE-16","PT-06","RA-08","SA-08","SA-10","SC-28","SC-34","SC-37","SI-02","SI-03","SI-04","SI-07","SI-10","SR-11"],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["6.3","8.1","9.3","A.8.9","A.8.32"],"iso_27002_2022":["5.37","8.9","8.32"],"cobit_2019":["BAI05","BAI06","BAI07","BAI10"],"pci_dss_v4":["1.2.8","6.5","11.6"],"nist_csf_2":["ID.RA-07","PR.PS-01","DE.CM-01","DE.CM-09"],"cis_controls_v8":["CIS 4","CIS 16.7"],"soc2_tsc":["CC3.4","CC8.1","CC8.1-POF1"],"finos_ccc":["CCC-C07"],"iso_42001_2023":["A.6.2.5"],"iec_62443":["3-3 SR 3.4","3-3 SR 7.6"],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["7"],"pra_op_resilience":["SS1/21-11.1"],"bsi_grundschutz":["OPS.1.1.2","OPS.1.1.3"],"anssi":["Hygiene.34","Hygiene.36","SecNumCloud.13.2"],"osfi_b13":["B-13.2.3"],"finma_circular":["IV.A(36)","IV.A(37)","IV.A(38)","IV.A(39)","IV.A(40)"],"gdpr":["Art.32(1)(b)","Art.32(1)(d)"],"dora":["Art.9(4)(e)"],"bio2":["5.37","8.9","8.32"],"rbi_csf":["Annex1.7","ITGRCA.13"],"fisc":["FISC.O3","FISC.O12"],"lgpd_bcb":[],"hkma_tme1":["TME1.3.3","TME1.4.1","TME1.4.2","TME1.4.3"],"mlps_2":["8.1.5.1","8.1.10.4","8.1.10.6","8.1.10.8"],"dnb_good_practice":["DNB.10.1","DNB.10.2","DNB.10.5","DNB.13.2"],"cra":["CRA.I.2c","CRA.II.2","CRA.II.7","CRA.Info.8b"],"swift_cscf":["SWIFT.6.2"],"cbb_tm":["TM-5","TM-11"],"cbuae":["CR-7"],"nca_ecc":["2-3"],"qatar_nia":["OS","SD"],"sama_csf":["3.3","3.5"],"uae_ia":["T7","T10"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.6"],"cbe_csf":["CTO-7","CTO-9","CTO-12"],"cbn_csf":["Part3.3"],"popia":["s19"],"sa_js2":["JS2-7.2","JS2-8.5"],"bcbs_239":["Principle 6"],"bot_cyber":["Ch2.1","Ch10.1"],"cpmi_pfmi":["CG.PR","PFMI.P17"],"eba_ict":["3.4.4","3.5(b)","3.6.3"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.10"],"hipaa_sr":["§164.316(b)(2)(iii)"],"iosco_cyber":["PROT-6"],"nydfs_500":["500.8"],"sebi_cscrf":["PR.IP"],"cmmc_2":["CM"],"nerc_cip":["CIP-010-4"],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":["SD-2 Sec D"],"ieee_1686":["5.4"],"ferc_cip":[],"doe_c2m2":["ASSET"],"api_1164":["Sec 7"],"awia":[],"iaea_nss":["Sec 5.4"],"pci_pts":["B","F","K"],"fips_140":["FIPS 140-3 §7.11"],"cbest":[],"tiber_eu":[],"pci_hsm":["4","5","8","9"],"common_criteria":[],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.7.1","SYSC 13.7.4","SYSC 13.8.4"],"fda_21_cfr_11":["§11.10(k)"],"fda_cyber":["PU-1","PU-2","SA-3"],"hitrust_csf":["09.a","10.d"],"iso_27799":["12.5"],"lloyds_ms":["MS5.1","MS8.4"],"naic_ds":["4-config","4E"],"nhs_dspt":["NDG-8.2"],"pra_ss1_23":["P3.3","P3.4","P4.4","P5.5"],"solvency_ii":["EIOPA-ICT-4.8","EIOPA-ICT-4.11"],"owasp_masvs_v2":["MASVS-CODE-2"],"csa_ccm_v4":["AIS-06","CCC-01","CCC-02","CCC-03","CCC-04","CCC-05","CCC-07","CCC-08","CCC-09","CEK-05","IVS-07","UEM-05"],"csa_aicm":["AIS-06","AIS-09","AIS-11","CCC-01","CCC-02","CCC-03","CCC-05","CCC-07","CCC-09","CEK-05","I&S-07","MDS-04","MDS-06","MDS-11","UEM-05"],"ccss_v9":["1.01.3","1.02.6"],"mica":[],"basel_sco60":["SCO60.52"],"bssc":["GSP-14","KMS-07","NOS-10","TIS-08"],"sec_custody_digital":["SEC-CD-07"],"dpdpa":[],"nist_ai_rmf_1":["GOVERN 5.2","MANAGE 4.1"],"eu_ai_act":["Art.17"]},"metadata":{"last_reviewed":"2026-10-03","review_notes":"2026-10-02: iec_62443 clauses derived through CSF 1.1 from ISA's 62443-3-3 mapping (OLIR entry 195) and NIST's SP 800-53 Rev 5 mapping (OLIR entry 81), which both place them and this control under PR.IP-3, \"Configuration change control processes are in place\". OSA had none. 2026-10-03: iso_27001_2022 8.1, 9.3 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 DE.CM-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines LMH to -MH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-004","SP-008","SP-011","SP-012","SP-017","SP-019","SP-021","SP-023","SP-025","SP-026","SP-028","SP-029","SP-030","SP-032","SP-037","SP-038","SP-039","SP-041","SP-044","SP-045","SP-046","SP-047","SP-049","SP-051","SP-052","SP-053","SP-054"],"attack":{"techniques":35,"route":"/api/v1/controls/CM-03?fields=attack"}}}