CMMC CM.2.066 - Analyze System Change Security Impact

CMMC CM.2.066 - Analyze System Change Security Impact

Requirement text: CM.2.066: Analyze the security impact of changes prior to implementation.

DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Organizational personnel with information security responsibilities (e.g., system
administrators, system security officers, system security managers, and systems security
engineers) conduct security impact analyses. Individuals conducting security impact
analyses possess the necessary skills and technical expertise to analyze the changes to
systems and the associated security ramifications. Security impact analysis may include
reviewing security plans to understand security requirements and reviewing system design
documentation to understand the implementation of controls and how specific changes
might affect the controls. Security impact analyses may also include risk assessments to
better understand the impact of the changes and to determine if additional controls are
required.

NIST SP 800-128 provides guidance on configuration change control and security impact
analysis.

CMMC CLARIFICATION
You should analyze the potential security impact of changes before implementing them.
Changes to complex environments can cause unforeseen problems to systems and
environments. You should perform an analysis that focuses on the security impact of
changes. This can uncover potential problems before you implement the change. By doing
so, you can help mitigate unforeseen problems.

Example
Someone requests major changes to the system and environment. You must complete a
process with several steps before you can put the change in place. You document a detailed
plan which includes the security impact of the change. A SME who did not submit the change
reviews the plan. That SME tries to identify security-related issues that the change may
cause. Then, they document or correct the potential issues. Also, they submit the updated
change plan to your organization’s change control board.

References
• NIST SP 800-171 Rev 1 3.4.4

    • Related Articles

    • Personnel Security: SP 800-171 Security Family 3.9

      Users play a vital role in protecting a system as many important issues in information security involve users, designers, implementers, and managers. How these individuals interact with the system and the level of access they need to do their jobs ...

    • Security and Compliance Glossary of Terms

      Access Control - The process of granting or denying specific requests to:        1) obtain and use information and related information processing services and        2) enter specific physical facilities (e.g., federal buildings, military ...

    • System and Information Integrity: SP 800-171 Security Family 3.14

      Integrity is defined as guarding against improper information modification or destruction, and includes ensuring information non-repudiation and authenticity. It is the assertion that data can only be accessed or modified by the authorized employees. ...

    • CMMC RM.5.155 - Analyze the Effectiveness of Security Solutions

      Requirement text: RM.5.155: Analyze the effectiveness of security solutions at least annually to address anticipated risk to the system and the organization based on current and accumulated threat intelligence. DISCUSSION FROM SOURCE: DRAFT NIST SP ...

    • Security Assessment: SP 800-171 Security Family 3.12

      A security requirement assessment is the testing and/or evaluation of the management, operational, and technical security requirements on a system to determine the extent to which the requirements are implemented correctly, operating as intended, and ...