CM.2.004 — Analyze Security Impact of Changes Prior to Implementation

What CM.2.004 means in plain English

Before you install that new quoting software, plug in that used laptop from eBay, or let an IT vendor remote into your server, someone needs to take 5 minutes to think through the security implications. Could this software introduce malware? Does it require opening firewall ports? Will it have access to your CUI folders? For a small shop, this does not need to be a formal risk assessment—a brief written "security impact analysis" in your change log entry is sufficient.

The assessment question

“Does the change management process include a documented security impact analysis step that must be completed before implementing changes to systems that process CUI?”

How to implement CM.2.004

1. Add a "Security Impact" column to your existing Change Log spreadsheet. Before approving any change, the approver must fill in this column with a brief assessment: "Low — standard patch update, no new attack surface" or "Medium — new software installed, requires firewall rule, tested in isolation first" or "High — new vendor access, requires monitoring, limited to specific files."
2. Create a simple Security Impact Analysis checklist (5 questions on a single page): (1) Does this change open new network ports or change firewall rules? (2) Does this change grant new access to CUI? (3) Does this software come from a trusted/vetted vendor? (4) Could this change break existing security controls (antivirus, audit logging)? (5) Does this require vendor/third-party access?
3. For any change rated Medium or High, require the checklist to be completed and filed with the change record before work begins. Low-impact changes (monthly Windows updates, password resets) can use a simplified one-line entry.
4. For vendor access specifically: require a Non-Disclosure Agreement (NDA) on file, supervise the session, and review audit logs after the session ends. Document this in the change record.
5. Train your IT-responsible person to ask these questions habitually before touching any system configuration.

Evidence your assessor will ask for

• Change log entries showing a security impact assessment was recorded before each significant change
• Completed security impact checklist for at least 3 recent changes (one high-impact example preferred)
• Written procedure specifying that security impact analysis is required before implementing changes
• Evidence that at least one change was modified or deferred based on the security impact analysis

More Configuration Management controls