Configuration Management Plan CM-9

Source: NIST SP 800-53 Rev.5, Configuration Management family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

CM-9 (Configuration Management Plan) is the single document that ties the CM family together for one system. It names the roles and processes, describes how you identify the ‘configuration items’ (the parts you track, such as packages, key files, and services) across the system’s life, places those items under management, gets the plan reviewed and approved, and protects the plan itself from tampering. It sits in the Moderate baseline.

What good looks like

• Write one CM plan for the system that names roles, responsibilities, and the actual processes — not a generic template.
• Define your configuration items: the specific things you will track (installed packages, files under /etc, running services, firewall rules) and how they are identified.
• Cover the whole life cycle — how items come under management at build, stay managed in operation, and are handled at decommission.
• Have it reviewed and approved by a named person or role, so the plan is agreed rather than assumed.
• Protect the plan itself from unauthorized change or disclosure — it maps out how the system is built, which is useful to an attacker.

Framework mapping

• NIST CSF 2.0 — PR.PS-01 — Configuration management practices are established and applied
• CIS Controls v8 — Control 4 — Secure Configuration of Enterprise Assets and Software

How to move it toward Implemented

• Write the plan and list this server’s configuration items explicitly: the package set, the tracked files under /etc, the enabled services (systemctl list-unit-files --state=enabled), and the firewall rules.
• Describe how each item is identified and controlled — for example, the /etc git repo from CM-3 plus a baseline package list (dpkg -l on Debian/Ubuntu or rpm -qa on Red Hat-based systems) saved as a dated file.
• Get the plan reviewed and approved by a named role, and record the approval date in the document.
• Store the plan with restricted permissions so it cannot be read or edited by non-admins (for example, sudo install -o root -g root -m 600 cm-plan.md /etc/cm/cm-plan.md).
• Attach the approved CM plan (with its configuration-item list) as hardening evidence on the asset, naming CM-9 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.