CM-4 (2) What is the solution and how is it implemented? CM-5 (2) Access Restrictions for Change – The organization conducts audits of information system changes [Assignment: and when indications so warrant to determine whether unauthorized changes frequency] have occurred. DoD parameter: [every 7 days] CM-5 (2) Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation equivalence (explain below) – Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-5 (2) What is the solution and how is it implemented? CM-5 (3) Access Restrictions for Change – The information system prevents the installation of [Assignment: organization-defined critical that are not signed with a certificate that is recognized and approved by the software programs]
CM-4 (2) What is the solution and how is it implemented? CM-5 (2) – Access Restrictions for Change The organization conducts audits of information system changes [Assignment: frequency] and when indications so warrant to determine whether unauthorized changes have occurred. DoD parameter: [every 7 days] CM-5 (2) Control Summary Information Responsible Role: Parameter: Implementation Status (check all that apply): Implemented Partially implemented Planned Alternative implementation – equivalence (explain below) Configured by customer Not applicable Control Origination (check all that apply): Service Provider Corporate Service Provider System Specific Service Provider Hybrid (Corporate and System Specific) Configured by Customer (Customer System Specific) Provided by Customer (Customer System Specific) Shared (Service Provider and Customer Responsibility) Inherited from pre-existing Provisional Authorization (PA) for <Information System Name>, <Date of PA> CM-5 (2) What is the solution and how is it implemented? CM-5 (3) – Access Restrictions for Change The information system prevents the installation of [Assignment: organization-defined critical software programs] that are not signed with a certificate that is recognized and approved by the
U_CSM_level_5_iaas_ssptemplate.docx