View source for Doc:NIST SP 800-53r3 Appendix F/CM-6


{{ControlName
| Number=CM-6
| Name=CONFIGURATION SETTINGS
}}

{{ControlDesignation
| Text=The organization:
}}

{{ControlElement
| Number=a
| Text=Establishes and documents mandatory [[Term:Configuration Settings|configuration settings]] for information technology products employed within the information system using [''Assignment: organization-defined security configuration checklists''] that reflect the most restrictive mode consistent with operational requirements;
}}

{{ControlElement
| Number=b
| Text=Implements the [[Term:Configuration Settings|configuration settings]];
}}

{{ControlElement
| Number=c
| Text=Identifies, documents, and approves exceptions from the mandatory [[Term:Configuration Settings|configuration settings]] for individual components within the information system based on explicit operational requirements; and
}}

{{ControlElement
| Number=d
| Text=Monitors and controls changes to the [[Term:Configuration Settings|configuration settings]] in accordance with organizational policies and procedures.
}}

{{SupplementalGuidance
| Text=Configuration settings are the configurable security-related parameters of information technology products that are part of the information system. Security-related parameters are those parameters impacting the security state of the system including parameters related to meeting other security control requirements. Security-related parameters include, for example, [[Term:Registry|registry]] settings; account, file, and directory settings (i.e., permissions); and settings for services, ports, protocols, and remote connections. Organizations establish organization-wide mandatory [[Term:Configuration Settings|configuration settings]] from which the settings for a given information system are derived. A security configuration checklist (sometimes referred to as a lockdown guide, [[Term:Hardening|hardening]] guide, security guide, [[Term:Security Technical Implementation Guide|security technical implementation guide]] [STIG], or benchmark) is a series of instructions or procedures for configuring an information system component to meet operational requirements. Checklists can be developed by information technology developers and vendors, [[Term:Consortia|consortia]], academia, industry, federal agencies (and other government organizations), and others in the public and private sectors. An example of a security configuration checklist is the [[Term:Federal Desktop Core Configuration|Federal Desktop Core Configuration]] ([[AnA:FDCC|FDCC]]) which potentially affects the implementation of CM-6 and other controls such as AC-19 and CM-7. The [[Term:Security Content Automation Protocol|Security Content Automation Protocol]] ([[AnA:SCAP|SCAP]]) and defined standards within the protocol (e.g., [[Term:Common Configuration Enumeration|Common Configuration Enumeration]]) provide an effective method to uniquely identify, track, and control [[Term:Configuration Settings|configuration settings]]. OMB establishes federal policy on configuration requirements for federal information systems. Related controls: CM-2, CM-3, SI-4.
}}

{{ControlEnhancements
| Text=
}}