Skip to content
ATO Pathways
  Log In

CM-6: Configuration Settings

An OSCAL Control

Statement

    • a.

      Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using ;

    • b.

      Implement the configuration settings;

    • c.

      Identify, document, and approve any deviations from established configuration settings for based on ; and

    • d.

      Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.

      • (a) Requirement 1:

        The service provider shall use the DoD STIGs or Center for Internet Security guidelines to establish configuration settings;

      • (a) Requirement 2:

        The service provider shall ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP) validated or SCAP compatible (if validated checklists are not available).

      • Guidance:

        Compliance checks are used to evaluate configuration settings and provide general insight into the overall effectiveness of configuration management activities. CSPs and 3PAOs typically combine compliance check findings into a single CM-6 finding, which is acceptable. However, for initial assessments, annual assessments, and significant change requests, FedRAMP requires a clear understanding, on a per-control basis, where risks exist. Therefore, 3PAOs must also analyze compliance check findings as part of the controls assessment. Where a direct mapping exists, the 3PAO must document additional findings per control in the corresponding SAR Risk Exposure Table (RET), which are then documented in the CSP's Plan of Action and Milestones (POA&M). This will likely result in the details of individual control findings overlapping with those in the combined CM-6 finding, which is acceptable.

        During monthly continuous monitoring, new findings from CSP compliance checks may be combined into a single CM-6 POA&M item. CSPs are not required to map the findings to specific controls because controls are only assessed during initial assessments, annual assessments, and significant change requests.