CMMC 1.0 Practice CM.2.065 Requirement:
Track, review, approve, or disapprove, and log changes to organizational systems.
CMMC 1.0 CM.2.065 Requirement Explanation:
By documenting, testing, and approving changes you reduce the chance of negative impacts resulting from changes. Unapproved changes often create business operation and security risk.
Example CMMC 1.0 CM.2.065 Implementation:
Document all proposed changes to your IT systems. This includes operating system updates, software deployments, security setting changes, and IT infrastructure changes. Establish a "change control board" consisting of IT staff and persons with business operation responsibilities. Discuss proposed changes before deployment to your production environment. Identify any potential security and business operation risks associated with a proposed change. Only deploy proposed changes after they have been approved by the change control board.
CMMC 1.0 CM.2.065 Scenario(s):
- Scenario 1:
Alice a system administrator wants to deploy security updates to her company's Windows 10 workstations. She creates a ticket on her IT ticketing system documenting the proposed change and the testing she has already completed. Every two weeks the change control board reviews proposed changes. The board reviews Alice's proposed change and approves the deployment of updates for Friday night at 7:00 PM. After deploying the updates no issues are reported an Alice closes her ticket.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.