CM-3 (6) What is the solution and how is it implemented? CM-4 (1) - Security Impact Analysis | Separate Test Environments The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. CM-4 (1) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-4 (1) What is the solution and how is it implemented? CM-5 (6) – Access Restrictions for Change | Limit Library Privileges The organization limits privileges to change software resident within software libraries. CM-5 (6) Control Summary Information Responsible Role:
CM-3 (6) What is the solution and how is it implemented? CM-4 (1) - Security Impact Analysis | Separate Test Environments The organization analyzes changes to the information system in a separate test environment before implementation in an operational environment, looking for security impacts due to flaws, weaknesses, incompatibility, or intentional malice. CM-4 (1) Control Summary Information Responsible Role: Implementation Status (check all that apply): Implemented Partially implemented Not implemented – risk acceptance sought Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-4 (1) What is the solution and how is it implemented? CM-5 (6) – Access Restrictions for Change | Limit Library Privileges The organization limits privileges to change software resident within software libraries. CM-5 (6) Control Summary Information Responsible Role: