Configuration and Risk Management Only answer if the answer is consistently For partially implemented areas, answer and “yes” “yes”. “no” describe what is missing to achieve a answer. If inherited, please indicate partial or full inheritance “yes” in the Capability” column. Any non-inherited capabilities must be described. “Describe Table 5-7. Configuration and Risk Management Describe capability, supporting evidence, and any Question Yes No missing elements Does the CSP maintain a current, complete, and accurate baseline configuration of the information system? [CM-2] Does the CSP maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? [CM-8] Does the CSP configure the system to ensure least functionality? CM-7(1,2,5)] Does the CSP have a Configuration Management Plan? [CM-9, CM-11] Does the CSP follow a formal change control process that includes a security impact for any change, including security impact assessment? [CM-3, CM-3(4,6), Does the CSP employ automated mechanisms to detect inventory and configuration changes? CM-6(1), CM-8(3)] Does the CSP prevent unauthorized changes to the system? [CM-5, Does the CSP establish Describe which STIGs are used, and any portions of configuration settings for based on the systems NOT configured in accordance with DoD STIGs and SRGs and reflect the STIGs. most restrictive mode consistent with operational requirements? [CM-6] Does the CSP ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or (if validated checklists are not available)? [CM-6, CM-6(1)]
Configuration and Risk Management Only answer “yes” if the answer is consistently “yes”. For partially implemented areas, answer “no” and describe what is missing to achieve a “yes” answer. If inherited, please indicate partial or full inheritance in the “Describe Capability” column. Any non-inherited capabilities must be described. Table 5-7. Configuration and Risk Management Question Yes No Describe capability, supporting evidence, and any missing elements Does the CSP maintain a current, complete, and accurate baseline configuration of the information system? [CM-2] Does the CSP maintain a current, complete, and accurate inventory of the information system software, hardware, and network components? [CM-8] Does the CSP configure the system to ensure least functionality? CM-7(1,2,5)] Does the CSP have a Configuration Management Plan? [CM-9, CM-11] Does the CSP follow a formal change control process that includes a security impact for any change, including security impact assessment? [CM-3, CM-3(4,6), Does the CSP employ automated mechanisms to detect inventory and configuration changes? CM-6(1), CM-8(3)] Does the CSP prevent unauthorized changes to the system? [CM-5, Does the CSP establish configuration settings for based on DoD STIGs and SRGs and reflect the most restrictive mode consistent with operational requirements? [CM-6] Describe which STIGs are used, and any portions of the systems NOT configured in accordance with STIGs. Does the CSP ensure that checklists for configuration settings are Security Content Automation Protocol (SCAP)-validated or (if validated checklists are not available)? [CM-6, CM-6(1)]
DoD_RAR_template_DRAFT_%28002%29.docx