Information Location CM-12

Configuration Management · Moderate baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds CM-12 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CM-12 (Information Location) is about knowing where your important information actually lives. You identify and document which system components process and store each type of information, who can reach it, and you keep that record current when data moves. It is a Configuration Management control that enters at the Moderate baseline, and it is the map you need before you can protect data well.

What good looks like

Define the information that matters — the data types worth tracking on this server (for example, application data, backups, logs).
Document where each type lives: the directories, databases, and components that process or store it.
Document who can reach it — the users and groups with access to those locations.
Keep the record current: when data moves to a new path, host, or component, update the map and note the change.
Treat this map as the foundation the other data controls build on (backup, access, and data-loss prevention).

Framework mapping

NIST CSF 2.0 — ID.AM-07 — Inventories of data and corresponding metadata for designated data types are maintained
CIS Controls v8 — Control 3 — Data Protection

How to move it toward Implemented

List the data types on this server (for example, application data, database contents, logs, backups, user home directories) and where each is meant to live.
Find and record the actual paths: use find and ls to locate the data directories, and note the database data path (for example, /var/lib/postgresql or /var/lib/mysql).
Document who has access to each location — read the owning users and groups with ls -l, getfacl, and getent group — and save it all as a dated data-location record.
Set a review to re-check the map whenever storage changes (a new mount, a moved database, a new share), and date each update.
Attach the data-location record as hardening evidence on the asset, naming CM-12 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.