CM-5 Access Restrictions for Change

Family CM

Baselines moderate

Mapped KSIs 3

Control statement

Define, document, approve, and enforce physical and logical access restrictions associated with changes to the system.

Parameter placeholders {{ insert: param, … }} reference FedRAMP-set values in the resolved profile. Full parameter map is preserved in the catalog database.

Covered by these Key Security Indicators

KSI	Title	Category
KSI-CMT-02	Redeployment Execute changes to _machine-based_ _information resources_ through redeployment of version controlled immutable resources rather than direct modification wherever possible.	Change Management
KSI-CMT-04	Change Management Procedures _Persistently_ review the effectiveness of documented change management procedures.	Change Management
KSI-IAM-04	Just-in-Time Authorization Use a least-privileged, role and attribute-based, and just-in-time security authorization model for all user and non-user accounts and services.	Identity and Access Management