{"data":{"id":"CM-05","name":"Access Restrictions for Change","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.","supplemental_guidance":"Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see AC-03 and PE-03), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).","enhancements":[{"id":"CM-05(01)","name":"Automated Access Enforcement and Audit Records","statement":"a. Enforce access restrictions using [Assignment: organization-defined automated mechanisms]; and\nb. Automatically generate audit records of the enforcement actions.","baselines":["high"]},{"id":"CM-05(02)","name":"Review System Changes","withdrawn":true,"incorporated_into":["CM-03(07)"]},{"id":"CM-05(03)","name":"Signed Components","withdrawn":true,"incorporated_into":["CM-14"]},{"id":"CM-05(04)","name":"Dual Authorization","statement":"Enforce dual authorization for implementing changes to [Assignment: organization-defined system components and system-level information].","baselines":[]},{"id":"CM-05(05)","name":"Privilege Limitation for Production and Operation","statement":"a. Limit privileges to change system components and system-related information within a production or operational environment; and\nb. Review and reevaluate privileges [Assignment: organization-defined frequency].","baselines":[]},{"id":"CM-05(06)","name":"Limit Library Privileges","statement":"Limit privileges to change software resident within software libraries.","baselines":[]},{"id":"CM-05(07)","name":"Automatic Implementation of Security Safeguards","withdrawn":true,"incorporated_into":["SI-07"]}],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-05","name":"Access Restrictions for Change","description":"Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.","discussion":"Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see AC-03 and PE-03), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).","related_controls":["AC-03","AC-05","AC-06","CM-09","PE-03","SC-28","SC-34","SC-37","SI-02","SI-10"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.8.2","A.8.4","A.8.9","A.8.19","A.8.31","A.8.32"],"iso_27002_2022":["5.37","8.4","8.9","8.19","8.32"],"cobit_2019":["BAI06","BAI10"],"pci_dss_v4":["6.5"],"nist_csf_2":["PR.PS-01"],"cis_controls_v8":["CIS 4.6","CIS 12.3"],"soc2_tsc":[],"finos_ccc":["CCC-C07"],"iso_42001_2023":["A.6.2.5"],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["OPS.1.1.2"],"anssi":["Hygiene.15","Hygiene.16","Hygiene.17","Hygiene.34","SecNumCloud.13.2"],"osfi_b13":["B-13.2.3","B-13.3.2"],"finma_circular":["IV.A(36)","IV.A(37)","IV.B.d(59)"],"gdpr":["Art.32(1)(b)"],"dora":["Art.9(4)(c)","Art.9(4)(e)"],"bio2":["5.37","8.4","8.9","8.19","8.32"],"rbi_csf":["Annex1.7","ITGRCA.13"],"fisc":["FISC.O3"],"lgpd_bcb":[],"hkma_tme1":["TME1.3.3","TME1.4.1","TME1.4.2"],"mlps_2":["8.1.5.1","8.1.10.8"],"dnb_good_practice":["DNB.7.1","DNB.10.1","DNB.10.5"],"cra":[],"swift_cscf":["SWIFT.6.2"],"cbb_tm":["TM-5"],"cbuae":["CR-7"],"nca_ecc":["2-3"],"qatar_nia":["OS","SD"],"sama_csf":["3.5"],"uae_ia":["T7","T10"],"bog_cisd":["CISD-VI"],"bom_ctrm":["3.6"],"cbe_csf":["CTO-12"],"cbn_csf":["Part3.3"],"sa_js2":["JS2-7.2"],"bot_cyber":["Ch2.1"],"cpmi_pfmi":["CG.PR"],"eba_ict":["3.4.4","3.6.3"],"ecb_croe":["CROE.2.3.4"],"ffiec_is":["II.C.7(c)","II.C.10"],"iosco_cyber":["PROT-6"],"sebi_cscrf":["PR.IP"],"cmmc_2":["CM"],"nerc_cip":["CIP-004-7","CIP-010-4"],"nrc_73_54":["RG5.71-B-CM"],"tsa_psd":[],"ieee_1686":["5.4"],"ferc_cip":[],"doe_c2m2":["ASSET"],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":["B"],"fips_140":["FIPS 140-3 §7.11"],"cbest":[],"tiber_eu":[],"pci_hsm":["4"],"common_criteria":["CC Part 2 — FMT"],"isae_3402":["Clause 4"],"fca_sysc_13":["SYSC 13.6.2","SYSC 13.7.4"],"fda_21_cfr_11":["§11.10(k)"],"fda_cyber":["SA-3"],"hitrust_csf":["09.a"],"iso_27799":[],"lloyds_ms":["MS5.1","MS8.4"],"naic_ds":["4-config"],"nhs_dspt":["NDG-4.4"],"pra_ss1_23":["P3.3","P3.4"],"solvency_ii":["EIOPA-ICT-4.8","EIOPA-ICT-4.11"],"owasp_masvs_v2":[],"csa_ccm_v4":["CCC-03","CCC-04"],"csa_aicm":["CCC-03","CCC-04","IAM-19","MDS-04","MDS-07"],"ccss_v9":["1.01.3"],"mica":[],"basel_sco60":["SCO60.52","SCO60.66"],"bssc":["GSP-14","TIS-08"],"sec_custody_digital":["SEC-CD-05"],"dpdpa":[],"nist_ai_rmf_1":[],"eu_ai_act":[]},"metadata":{"last_reviewed":"2026-10-26","review_notes":"2026-10-03: iso_27001_2022 A.8.2, A.8.31 added from NIST's SP 800-53 Rev 5 to ISO/IEC 27001:2022 crosswalk (OLIR entry 155), which OSA's mapping now takes as its base. 2026-10-03: nist_csf_2 PR.PS-01 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-26: nerc_cip CIP-004-7, CIP-010-4 added from NIST and NERC's SP 800-53 Rev 5.2.0 to NERC CIP crosswalk (OLIR entry 232), which OSA's mapping now takes as its base.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-008","SP-011","SP-023","SP-025","SP-029","SP-037"],"attack":{"techniques":160,"route":"/api/v1/controls/CM-05?fields=attack"}}}