CMMC Practice CM.L2-3.4.4

Security Impact Analysis: Analyze the security impact of changes prior to implementation.

Monarch ISC Guidance

For Level 2 compliance, your policy state that part of your change management plan and procedures requires security testing when the risk-level of a change warrants technical testing to ensure changes did not introduce new vulnerabilities. Mentioned previously, the work of the Change Advisory Board (CAB) is critical to ensuring change is well-managed in your environment. Don't be intimidated by the name! A CAB is created to suit your environment, size, and complexity. It can be as small as two people. What is important, regardless of size, is that someone from outside of your IT Department is involved. Like many other practices, preparation is the most important part. Preparation for assessing the risk, or potential impact, of an individual change starts with identifying and understanding the relative risks posed by each type of change in your environment. If you find yourself having a "brand new" conversation each time a significant change is requested, that's a signal to take a step back and spend some more time preparing for all the types of change that take place in your organization. Once that work is done, performing the process for each change becomes much easier, more predictable and less disruptive to business as usual.
Security Catapult

Be prepared for CMMC

Our Q&A assessment tool is designed by security advisors for MSPs and DoD contractors of all sizes.

Try now for free

Understand your gaps
Security Catapult

Understand your gaps

See compliance gaps, compliance scores and proactive security tasks in a single interface.

Try now for free

Validate NIST SP 800-171
Security Catapult

Validate NIST SP 800-171

Based on your CMMC answers, we let you know where you stand on NIST.

Try now for free

Build a plan of action
Security Catapult

Build a plan of action

Track your burn down and stay on top of security needs.

Try now for free

Build your policy
Security Catapult

Build your policy

Say goodbye to maintaining a security policy. We do it for you.

Try now for free

Discussion From Source

NIST SP 800-171 R2 Organizational personnel with information security responsibilities (e.g., system administrators, system security officers, system security managers, and systems security engineers) conduct security impact analyses. Individuals conducting security impact analyses possess the necessary skills and technical expertise to analyze the changes to systems and the associated security ramifications. Security impact analysis may include reviewing security plans to understand security requirements and reviewing system design documentation to understand the implementation of controls and how specific changes might affect the controls. Security impact analyses may also include risk assessments to better understand the impact of the changes and to determine if additional controls are required. NIST SP 800-128 provides guidance on configuration change control and security impact analysis.

References