# CM-04 (02) Verification of Controls — NIST 800-53 Rev5 control

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /control/cm-4.2

Canonical id: `cm-4.2` · family `CM`

> After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.

_Control title and statement: NIST SP 800-53 Rev5 catalog (the pinned commit is in `/api` under `control_text`). The FedRAMP rules reference these controls by id only; everything below is what FedRAMP says about this id._

## Rev5 baseline membership

- certification class C
- certification class D

## Key Security Indicators that reach it

- `KSI-CMT-LMC` — Logging Changes (Change Management)
  Modifications to the cloud service offering are logged and monitored.
- `KSI-CMT-VTD` — Validating Throughout Deployment (Change Management)
  Persistent testing and validation of changes throughout deployment is automated.

## FedRAMP guidance

_No FedRAMP-specific guidance attaches to this control._