NIST SP 800-171 & CMMC 2.0 Control 3.4.3 Requirement:

Track, review, approve, or disapprove, and log changes to organizational systems.

NIST SP 800-171 & CMMC 2.0 3.4.3 Requirement Explanation:

You must track, review, and approve configuration changes before committing them to your production systems. Configuration changes can create unintended and unforeseen issues that can affect the security and availability of your systems. You need to establish a change control board to review proposed changes. They should discuss potential impacts before deploying the changes.

Example NIST SP 800-171 & CMMC 2.0 3.4.3 Implementation:

Document all proposed changes to your IT systems. This includes operating system updates, software deployments, security setting changes, and IT infrastructure changes. Establish a "change control board" consisting of IT staff and persons with business operation responsibilities. Discuss proposed changes before deployment to your production environment. Identify any potential security and business operation risks associated with a proposed change. Only deploy proposed changes after they have been approved by the change control board. Use our configuration management plan document and change control form templates to help meet this requirement.

NIST SP 800-171 & CMMC 2.0 3.4.3 Scenario(s):

- Scenario 1:

Alice a system administrator wants to deploy security updates to her company's Windows 10 workstations. She completes a change request form detailing the proposed change. Every two weeks the change control board reviews proposed changes. The board reviews Alice's proposed change and approves the deployment of updates for Friday night at 7:00 PM. After deploying the updates no issues are reported an Alice closes her ticket.

Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:


Compliance Accelerator

Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.

Quantum Assessor

Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.

Supply Chain Verifier

Trust is everything. Verify, monitor, and support subcontactor compliance.