Configuration Management (CM)

The cm_family entry in the Federal Risk and Authorization Management Program defines the Configuration Management control family. It covers requirements for establishing and maintaining secure baselines, tracking hardware and software changes, and ensuring that all system components are documented, authorized, and protected throughout their lifecycle. This family helps agencies control configuration drift and maintain the integrity of their information systems.