Control index

94/409 fetchable across every Rev5 baseline

- orphanCM-01 — Policy and Procedures — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-02 — Baseline Configuration
- recipe · 1 recipeCM-02 (02) — Automation Support for Accuracy and Currency
- KSI onlyCM-02 (03) — Retention of Previous Configurations
- KSI onlyCM-02 (07) — Configure Systems and Components for High-risk Areas
- recipe · 1 recipeCM-03 — Configuration Change Control
- orphanCM-03 (01) — Automated Documentation, Notification, and Prohibition of Changes — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyCM-03 (02) — Testing, Validation, and Documentation of Changes
- recipe · 1 recipeCM-03 (04) — Security and Privacy Representatives
- orphanCM-03 (06) — Cryptography Management — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-04 — Impact Analyses — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-04 (01) — Separate Test Environments — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-04 (02) — Verification of Controls
- recipe · 1 recipeCM-05 — Access Restrictions for Change
- orphanCM-05 (01) — Automated Access Enforcement and Audit Records — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-05 (05) — Privilege Limitation for Production and Operation — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-06 — Configuration Settings
- orphanCM-06 (01) — Automated Management, Application, and Verification — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-06 (02) — Respond to Unauthorized Changes — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-07 — Least Functionality
- recipe · 1 recipeCM-07 (01) — Periodic Review
- KSI onlyCM-07 (02) — Prevent Program Execution
- KSI onlyCM-07 (05) — Authorized Software — Allow-by-exception
- recipe · 1 recipeCM-08 — System Component Inventory
- recipe · 1 recipeCM-08 (01) — Updates During Installation and Removal
- orphanCM-08 (02) — Automated Maintenance — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-08 (03) — Automated Unauthorized Component Detection
- orphanCM-08 (04) — Accountability Information — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- KSI onlyCM-09 — Configuration Management Plan
- orphanCM-10 — Software Usage Restrictions — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- orphanCM-11 — User-installed Software — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- recipe · 1 recipeCM-12 — Information Location
- recipe · 1 recipeCM-12 (01) — Automated Tools to Support Information Location
- orphanCM-14 — Signed Components — No page: no KSI reaches this control, so there is nothing to show beyond its baseline membership.
- All CM in the catalog

209 of these have a page: a control no indicator reaches is hollow, and hollow rows are listed rather than linked.

CM-03 Configuration Change Controlcm-3

Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.

Partial1 of 1 recipe reaches CM-03, and none is rated full — the output narrows the question, a human judgement closes it.

AWS CloudTrail · AWS Config · AWS Systems Manager Change Manager1 recipe · 3 calls

The calls

Collect evidence (1)

Authored AWS recipes whose output is evidence for CM-03. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.

partialWho changed what, when, and from which state to which — CloudTrail's record of every mutating API call and Config's per-resource configuration history, plus, where Change Manager is in use, the change-request executions that carry the approvalweeklycli
cloudtrail-config-change-historyAWS CloudTrail · AWS Config · AWS Systems Manager Change Manager
CloudTrail and Config prove a change was recorded and is reconstructable — actor, time, parameters, and the before/after configuration state — which is CM-03's record-retention and monitoring half. They do not prove the change was proposed, reviewed and approved before it happened; that decision lives in your CCB or ticketing system and has to be joined by ticket or change id. State the retention limits plainly rather than implying full history: lookup-events reaches back only 90 days and returns management (and Insights) events only, so anything older must be read from the trail's S3 objects or a CloudTrail Lake event data store, and get-resource-config-history honours your Config retention period (30 days minimum, up to 7 years) but each call spans at most 7 days, so a long window needs paging by time. Substitute your real resource type, resource id and time window. Change Manager has also been closed to new customers since 2025-11-07, so treat that command as available only if you were already signed up. Whether the post-change configuration is still compliant is a different question answered by the Config rule recipes.

What NIST requires of CM-03

The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.

a. Determine and document the types of changes to the system that are configuration-controlled; b. Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses; c. Document configuration change decisions associated with the system; d. Implement approved configuration-controlled changes to the system; e. Retain records of configuration-controlled changes to the system for [time period]; f. Monitor and review activities associated with configuration-controlled changes to the system; and g. Coordinate and provide oversight for configuration change control activities through [configuration change control element] that convenes [assignment].

NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.

Rev5 baseline membership

Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.

Class Bour reading: Rev5 Low

not in baseline

Class B readiness

Class Cour reading: Rev5 Moderate

in baseline

Class C readiness

Class Dour reading: Rev5 High

in baseline

Class D readiness

KSI indicators reaching this control (4)

Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.

Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.

Keyboard shortcuts

Go

Move

Act