| 💼 CM-1 Policy and Procedures (L)(M)(H) | | | | |
| 💼 CM-2 Baseline Configuration (L)(M)(H) | 3 | | 13 | |
| 💼 CM-2(2) Automation Support for Accuracy and Currency (M)(H) | | | 13 | |
| 💼 CM-2(3) Retention of Previous Configurations (M)(H) | | | 1 | |
| 💼 CM-2(7) Configure Systems and Components for High-risk Areas (M)(H) | | | | |
| 💼 CM-3 Configuration Change Control (M)(H) | 2 | | 17 | |
| 💼 CM-3(2) Testing, Validation, and Documentation of Changes (M)(H) | | | | |
| 💼 CM-3(4) Security and Privacy Representatives (M)(H) | | | | |
| 💼 CM-4 Impact Analyses (L)(M)(H) | 1 | | | |
| 💼 CM-4(2) Verification of Controls (M)(H) | | | | |
| 💼 CM-5 Access Restrictions for Change (L)(M)(H) | 2 | | 8 | |
| 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H) | | | 9 | |
| 💼 CM-5(5) Privilege Limitation for Production and Operation (M)(H) | | | 1 | |
| 💼 CM-6 Configuration Settings (L)(M)(H) | 1 | | | |
| 💼 CM-6(1) Automated Management, Application, and Verification (M)(H) | | | 1 | |
| 💼 CM-7 Least Functionality (L)(M)(H) | 3 | | 18 | |
| 💼 CM-7(1) Periodic Review (M)(H) | | | 11 | |
| 💼 CM-7(2) Prevent Program Execution (M)(H) | | | | |
| 💼 CM-7(5) Authorized Software — Allow-by-exception (M)(H) | | | | |
| 💼 CM-8 System Component Inventory (L)(M)(H) | 2 | | 1 | |
| 💼 CM-8(1) Updates During Installation and Removal (M)(H) | | | | |
| 💼 CM-8(3) Automated Unauthorized Component Detection (M)(H) | | | | |
| 💼 CM-9 Configuration Management Plan (M)(H) | | | | |
| 💼 CM-10 Software Usage Restrictions (L)(M)(H) | | | | |
| 💼 CM-11 User-installed Software (L)(M)(H) | | | 4 | |
| 💼 CM-12 Information Location (M)(H) | 1 | | | |
| 💼 CM-12(1) Automated Tools to Support Information Location (M)(H) | | | | |