CM-3 Control Summary Information Responsible Role: Parameter CM-3(e): Parameter CM-3(g)-1: Parameter CM-3(g)-2: Parameter CM-3(g)-3: Parameter CM-3(g)-4: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-3 What is the solution and how is it implemented? Part a Part b Part c Part d Part e Part f Part g CM-3 (1) Control Enhancement (H) The organization employs automated mechanisms to: Document proposed changes to the information system; Notify [Assignment: organization-defined configuration management approval authorities] of proposed changes to the information system and request change approval; Highlight proposed changes to the information system that have not been approved or disapproved by [FedRAMP Assignment: organization agreed upon time period];
CM-3 Control Summary Information Responsible Role: Parameter CM-3(e): Parameter CM-3(g)-1: Parameter CM-3(g)-2: Parameter CM-3(g)-3: Parameter CM-3(g)-4: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing FedRAMP Authorization for , CM-3 What is the solution and how is it implemented? Part a Part b Part c Part d Part e Part f Part g CM-3 (1) Control Enhancement (H) The organization employs automated mechanisms to: Document proposed changes to the information system; Notify [Assignment: organization-defined configuration management approval authorities] of proposed changes to the information system and request change approval; Highlight proposed changes to the information system that have not been approved or disapproved by [FedRAMP Assignment: organization agreed upon time period];
FedRAMP-SSP-High-Baseline-Template-v1.2.docx