Catalog

Controls & assessment objectives

Every control is stored with its full statement and each published assessment objective, quoted verbatim from the source document. Examples and verdicts hang off the objectives, not off a vague summary.

9 controls

CM.L2-3.4.1CM · Configuration ManagementLevel 2CMMC L2
System Baselining
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
- 6objectives
- 1examples
- 0threads
CM.L2-3.4.2CM · Configuration ManagementLevel 2CMMC L2
Security Configuration Enforcement
Establish and enforce security configuration settings for information technology products employed in organizational systems.
- 2objectives
- 1examples
- 0threads
CM.L2-3.4.3CM · Configuration ManagementLevel 2CMMC L2
System Change Management
Track, review, approve or disapprove, and log changes to organizational systems.
- 4objectives
- 1examples
- 0threads
CM.L2-3.4.4CM · Configuration ManagementLevel 2CMMC L2
Security Impact Analysis
Analyze the security impact of changes prior to implementation.
- 1objectives
- 1examples
- 0threads
CM.L2-3.4.5CM · Configuration ManagementLevel 2CMMC L2
Access Restrictions for Change
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
- 8objectives
- 1examples
- 0threads
CM.L2-3.4.6CM · Configuration ManagementLevel 2CMMC L2
Least Functionality
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
- 2objectives
- 1examples
- 0threads
CM.L2-3.4.7CM · Configuration ManagementLevel 2CMMC L2
Nonessential Functionality
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
- 15objectives
- 1examples
- 0threads
CM.L2-3.4.8CM · Configuration ManagementLevel 2CMMC L2
Application Execution Policy
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
- 3objectives
- 1examples
- 0threads
CM.L2-3.4.9CM · Configuration ManagementLevel 2CMMC L2
User-installed Software
Control and monitor user-installed software.
- 3objectives
- 1examples
- 0threads