CM.2.005 — Define and Enforce Access Restrictions for Configuration Changes

What CM.2.005 means in plain English

Only specific, authorized people should be able to make configuration changes to your IT systems. The machinist running a job should not be able to install software, change firewall settings, or add new user accounts—even if they have good intentions. Enforce this with standard (non-admin) user accounts for regular employees, and a separate privileged admin account for IT tasks. The admin account should not be used for everyday work like email and web browsing—only for deliberate administrative actions.

The assessment question

“Are access rights to make configuration changes to systems restricted to designated authorized personnel through both technical controls (non-admin standard accounts for regular users) and documented procedures?”

How to implement CM.2.005

1. Audit all Windows accounts and their group memberships: open Computer Management > Local Users and Groups > Groups > Administrators. Confirm that only the IT-responsible person(s) account is in the Administrators group. Remove all regular employees from the Administrators group.
2. Create a separate admin account for IT tasks (e.g., "admin.jsmith") that is different from the daily-use account (e.g., "jsmith"). The daily-use account should be a standard user. IT personnel use their standard account for email and browsing, and the admin account only when making system changes.
3. Use Group Policy to prevent standard users from installing software: Computer Configuration > Administrative Templates > Windows Components > Windows Installer > set "Prohibit non-administrators from applying vendor signed updates" and "Prevent users from installing printer drivers" as appropriate.
4. For Microsoft 365: ensure only Global Administrators and designated admin roles can change tenant settings. Use the Principle of Least Privilege in the M365 Admin Center—assign the minimum role needed (e.g., User Administrator instead of Global Admin for user management tasks).
5. Document the access restriction policy: "System configuration changes may only be performed by [Name/Role]. Standard user accounts do not have local administrator rights. Admin accounts are used only for administrative tasks and not for daily computing activities."

Evidence your assessor will ask for

• Screenshot of Windows Administrators group showing only authorized IT accounts are members
• Account inventory showing regular employees have standard (non-admin) accounts
• Group Policy settings restricting software installation to administrators only
• Microsoft 365 admin role assignments showing minimal privilege principle applied
• Written policy specifying who is authorized to make configuration changes

More Configuration Management controls