NIST 800-53 CM-3 Mappings

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also SA-10.

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
CM-3 Configuration Change Control Protects T1021.005 VNC
CM-3 Configuration Change Control Protects T1059.006 Python
CM-3 Configuration Change Control Protects T1176 Browser Extensions
CM-3 Configuration Change Control Protects T1195.003 Compromise Hardware Supply Chain
CM-3 Configuration Change Control Protects T1213 Data from Information Repositories
CM-3 Configuration Change Control Protects T1213.001 Confluence
CM-3 Configuration Change Control Protects T1213.002 Sharepoint
CM-3 Configuration Change Control Protects T1495 Firmware Corruption
CM-3 Configuration Change Control Protects T1542 Pre-OS Boot
CM-3 Configuration Change Control Protects T1542.001 System Firmware
CM-3 Configuration Change Control Protects T1542.003 Bootkit
CM-3 Configuration Change Control Protects T1542.004 ROMMONkit
CM-3 Configuration Change Control Protects T1542.005 TFTP Boot
CM-3 Configuration Change Control Protects T1543 Create or Modify System Process
CM-3 Configuration Change Control Protects T1543.002 Systemd Service
CM-3 Configuration Change Control Protects T1547.007 Re-opened Applications
CM-3 Configuration Change Control Protects T1547.011 Plist Modification
CM-3 Configuration Change Control Protects T1547.013 XDG Autostart Entries
CM-3 Configuration Change Control Protects T1553 Subvert Trust Controls
CM-3 Configuration Change Control Protects T1553.006 Code Signing Policy Modification
CM-3 Configuration Change Control Protects T1564.008 Email Hiding Rules
CM-3 Configuration Change Control Protects T1601 Modify System Image
CM-3 Configuration Change Control Protects T1601.001 Patch System Image
CM-3 Configuration Change Control Protects T1601.002 Downgrade System Image