03.04 Configuration Management (CM)

Phase 1 - A suggested method would be to include in your policy, a statement that explicitly defines a configuration management process that adheres to NIST 800-171 Revision 3, Family Control CM. This process should detail how we establish and maintain secure configurations for all systems and software handling CUI. Specifically, it needs to outline procedures for baselining systems, continuously monitoring those configurations for vulnerabilities, and implementing a controlled change management process. This change management process should include impact analysis, approval workflows, and documentation of all changes. Crucially, the policy must mandate that all security configurations align with our organization's overall security policy and meet the federal requirements for protecting CUI, ensuring consistency and compliance.