CM.2.003 — Track, Review, Approve, and Log Changes to Systems

What CM.2.003 means in plain English

Every significant change to your IT systems—installing new software, adding a user account, changing firewall rules, plugging in a new piece of equipment—should go through a simple approval process and be documented. This does not need to be a formal IT change management system with tickets; for an 8-person shop a shared change log in a spreadsheet works fine. The goal is that if something breaks, or if an assessor asks "why was this software installed?"—you have an answer. No undocumented shadow IT.

The assessment question

“Is there a documented change management process requiring approval before significant system changes are made, and is a change log maintained showing what was changed, when, by whom, and why?”

How to implement CM.2.003

1. Create a Change Log spreadsheet with columns: Change ID, Date Requested, Requester, System Affected, Description of Change, Business Justification, Approver, Approval Date, Implementation Date, Implemented By, and Result/Notes.
2. Define what constitutes a "significant change" requiring a log entry: installing or removing software, adding or removing user accounts, changing firewall or network settings, adding new hardware, applying major software updates (OS upgrades), and changing Group Policy.
3. Establish a simple approval process: any change to a system handling CUI must be approved by the owner or designated IT manager before implementation. Document the approval in the Change Log (even if it is just an email reply, paste the email reference number).
4. Configure Windows to help you track changes automatically: ensure Event ID 4688 (Process Creation) is logged so new software executions appear in audit logs. Enable Software Restriction Policy logging or AppLocker event log to capture software installation attempts.
5. Review the change log monthly for completeness and accuracy. At the annual configuration review, verify that all changes in the log are reflected in the updated baseline configuration document.

Evidence your assessor will ask for

• Change log spreadsheet showing recent entries with required fields (who, what, when, why, approval)
• Written change management procedure defining what requires a change request and approval
• Evidence of approvals (email excerpts, signatures, or digital approvals in the log)
• At least one example of a rejected or deferred change showing the process was followed

More Configuration Management controls