Configuration Management (CM) templates
Templates for the Configuration Management (CM) family of controls in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Revision 5, with the family policy and procedure first.
- Configuration Management PolicyPOL-CM
In this policy, the CISO sets the Organization's requirements for configuration management in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:
- Configuration Management ProcedurePROC-CM
The people named in this procedure use it to carry out the CM control family policy (POL-CM). It covers every control in the configuration management family.
- Internet Protocol Version 6 (IPv6) PolicyPOL-IPV6-001
- IT Asset Management PolicyPOL-ITAM-001
The Organization manages its IT assets so that it can:
- Secure Configuration Baseline StandardSTD-CFG-001
This standard tells staff how the Organization chooses, approves, applies, checks, and fixes the secure configuration of each component. It covers every component in every system the Organization owns or that others run for it:
- IPv6 Transition ProcedurePROC-IPV6-001
Use this procedure to measure IPv6 readiness, keep the IPv6 integration plan, buy IPv6-capable products, move systems to IPv6-only, keep security monitoring equal for IPv6, handle waivers, and report progress. It covers every networked system and Internet Protocol (IP)-enabled asset in the scope of the IPv6 Policy.
- IT Asset Management ProcedurePROC-ITAM-001
The CIO owns this procedure, and the CISO concurs. It covers every IT asset in the scope of the IT Asset Management Policy, at every stage of its life. Each step names the person who acts, the action, the tool, the record it leaves, and the NIST SP 800-53 controls it supports.