Configuration Management
NIST SP 800-53 Rev 5 Configuration Management controls.
Policy and Procedures
Develop, document, and disseminate to [parameter]:
Baseline Configuration
Develop, document, and maintain under configuration control, a current baseline configuration of the system; and
Configuration Change Control
Determine and document the types of changes to the system that are configuration-controlled;
Impact Analyses
Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
Access Restrictions for Change
Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.
Configuration Settings
Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using [parameter];
Least Functionality
Configure the system to provide only [parameter] ; and
System Component Inventory
Develop and document an inventory of system components that:
Configuration Management Plan
Develop, document, and implement a configuration management plan for the system that:
Software Usage Restrictions
Use software and associated documentation in accordance with contract agreements and copyright laws;
User-installed Software
Establish [parameter] governing the installation of software by users;
Information Location
Identify and document the location of [parameter] and the specific system components on which the information is processed and stored;
Data Action Mapping
Develop and document a map of system data actions.
Signed Components
Prevent the installation of [parameter] without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.