CMMC Practice CM.2.066

Analyze the security impact of changes prior to implementation.


CMMC Version 1.02, pg. 118

Bold Coast Security Guidance

For Level 2 compliance, your policy state that part of your change management plan and procedures requires security testing when the risk-level of a change warrants technical testing to ensure changes did not introduce new vulnerabilities. Mentioned previously, the work of the Change Advisory Board (CAB) is critical to ensuring change is well-managed in your environment. Don't be intimidated by the name! A CAB is created to suit your environment, size, and complexity. It can be as small as two people. What is important, regardless of size, is that someone from outside of your IT Department is involved. Like many other practices, preparation is the most important part. Preparation for assessing the risk, or potential impact, of an individual change starts with identifying and understanding the relative risks posed by each type of change in your environment. If you find yourself having a "brand new" conversation each time a significant change is requested, that's a signal to take a step back and spend some more time preparing for all the types of change that take place in your organization. Once that work is done, performing the process for each change becomes much easier, more predictable and less disruptive to business as usual.

Discussion From Source

DRAFT NIST SP 800-171 R2 Organizational personnel with information security responsibilities (e.g., system administrators, system security officers, system security managers, and systems security engineers) conduct security impact analyses. Individuals conducting security impact analyses possess the necessary skills and technical expertise to analyze the changes to systems and the associated security ramifications . Security impact analysis may include reviewing security plans to understand security requirements and reviewing system design documentation to understand the implementation of controls and how specific changes might affect the controls . Security impact analyses may also include risk assessments to better understand the impact of the changes and to determine if additional controls are required. NIST SP 800-128 provides guidance on configuration change control and security impact analysis.