CM-2(2) PR.IP-1 Baseline Please refer to the for enterprise tool(s) used to maintain the baseline OCISO Semiannually Configuration | configuration of information systems hosted at GSA facilities. Oversight Automation using Support for Automated Accuracy / Tools Currency CM-6 PR.IP-1 Configuration All systems must adhere to GSA hardening guides, United States OCISO Semiannually Settings Government Configuration Baseline, NIST guidelines, Center for Internet Oversight Security (CIS) Benchmarks (Level 1), or industry best practice guidelines, as using deemed appropriate by the AO. All information systems must document and Automated get approval for any deviations from GSA agency-wide hardening guides. Tools This control is inherited from the underlying major information system. Security Deviation Request Form and GSA Security Benchmarks, as applicable CM-6 (1) PR.IP-1 Configuration Please refer to the for enterprise tool(s) used to implement and monitor OCISO Semiannually Settings | security configuration settings of information systems IAW GSA hardening Oversight Automated guides, United States Government Configuration Baseline, NIST guidelines, using Central Center for Internet Security (CIS) Benchmarks (Level 1), or industry best Automated Management / practice guidelines, as deemed appropriate by the AO. Tools Application / Verification
CM-2(2) PR.IP-1 Baseline Configuration | Automation Support for Accuracy / Currency Please refer to the for enterprise tool(s) used to maintain the baseline configuration of information systems hosted at GSA facilities. OCISO Oversight using Automated Tools Semiannually CM-6 PR.IP-1 Configuration Settings All systems must adhere to GSA hardening guides, United States Government Configuration Baseline, NIST guidelines, Center for Internet Security (CIS) Benchmarks (Level 1), or industry best practice guidelines, as deemed appropriate by the AO. All information systems must document and get approval for any deviations from GSA agency-wide hardening guides. This control is inherited from the underlying major information system. OCISO Oversight using Automated Tools Security Deviation Request Form and GSA Security Benchmarks, as applicable Semiannually CM-6 (1) PR.IP-1 Configuration Settings | Automated Central Management / Application / Verification Please refer to the for enterprise tool(s) used to implement and monitor security configuration settings of information systems IAW GSA hardening guides, United States Government Configuration Baseline, NIST guidelines, Center for Internet Security (CIS) Benchmarks (Level 1), or industry best practice guidelines, as deemed appropriate by the AO. OCISO Oversight using Automated Tools Semiannually
Information_Security_Continuous_Monitoring_Strategy_%5BCIO_IT_12-66_Rev_2%5D_10-10-2017.docx