CM-1 Policy and Procedures

Control statement

a. Develop, document, and disseminate to {{ insert: param, cm-1_prm_1 }}:
        1.  {{ insert: param, cm-01_odp.03 }} configuration management policy that:
            (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
        2. Procedures to facilitate the implementation of the configuration management policy and the associated configuration management controls;
    b. Designate an {{ insert: param, cm-01_odp.04 }} to manage the development, documentation, and dissemination of the configuration management policy and procedures; and
    c. Review and update the current configuration management:
        1. Policy {{ insert: param, cm-01_odp.05 }} and following {{ insert: param, cm-01_odp.06 }} ; and
        2. Procedures {{ insert: param, cm-01_odp.07 }} and following {{ insert: param, cm-01_odp.08 }}.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators