Configuration Settings CM-6
Configuration Management · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds CM-6 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
CM-6 (Configuration Settings) requires establishing, documenting, and enforcing the most-restrictive secure configuration settings for the system, drawing on recognized benchmarks, then monitoring and controlling changes so those settings do not drift from what was approved.
What good looks like
- Establish mandatory, most-restrictive secure settings from a recognized benchmark (for example a CIS Benchmark) for the operating system and applications.
- Document the chosen settings, and record any approved deviation with a written rationale.
- Enforce the settings on the running system through config files and policy so they actually take effect and persist across reboot.
- Monitor and control changes to the settings so they do not drift away from the approved values.
Framework mapping
- NIST CSF 2.0 — PR.PS-01 — Configuration management practices are established and applied
- CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software
How to move it toward Implemented
- A settings baseline is established — kernel and network hardening in
/etc/sysctl.d/99-hardening.conf(reverse-path filtering, no ICMP redirects or source routing, SYN cookies, full ASLR), pluslibpam-pwqualityandunattended-upgrades— but it is not yet complete. - The gap is the open benchmark items: the Lynis hardening index sat at 68, not 100. Re-run
sudo lynis audit system, remediate each flagged suggestion, and raise the index toward the benchmark, recording before-and-after in/var/log/lynis.log. - Adopt a named reference — the CIS Ubuntu Benchmark — as the authoritative settings source and document any approved deviations with rationale.
- Attach the improved Lynis report naming CM-6 in the Requirement field to move this asset from partial toward Completed.