Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.4.6 and CMMC Level 2 assessment objective CM.L2-3.4.6[a].
What This Objective Means
This objective requires organizations to detect and identify system changes that occur outside of the approved configuration change control process.
Unauthorized changes may include unapproved software installations, altered security settings, modified system configurations, or changes made without documented authorization.
Why Detecting Unauthorized Changes Matters
Unauthorized changes can weaken security controls, introduce vulnerabilities, and cause systems to drift from approved baselines.
Detecting these changes helps maintain system integrity, supports accountability, and enables timely investigation when unexpected modifications occur.
How to Implement CM 3.4.6a
Organizations should implement technical or procedural mechanisms to monitor system configurations and identify deviations from approved baselines.
This may include configuration monitoring tools, file integrity monitoring, endpoint security tools, or manual review processes aligned with documented configuration management compliance requirements.
Implementation Summary
| Area | Description |
|---|---|
| Change Monitoring | Monitor systems for configuration changes and compare them against approved baselines. |
| Unauthorized Change Definition | Document what constitutes an unauthorized change within policies or procedures. |
| Detection Mechanisms | Use technical tools or manual processes to identify unapproved system modifications. |
| Response Actions | Review, document, and address detected unauthorized changes in a consistent manner. |
Evidence Assessors Commonly Expect
Assessors typically expect documentation defining unauthorized changes, monitoring outputs showing detected configuration drift, and logs or alerts demonstrating identification of unauthorized activity.
These artifacts should align with broader federal contractor compliance expectations and be consistently maintained.
Common Gaps to Avoid
Common gaps include assuming all changes are authorized, lacking monitoring for configuration drift, and failing to retain evidence showing how unauthorized changes are detected.
FAQ
What does CM.L2-3.4.6[a] require?
It requires organizations to detect and identify system configuration changes that occur without authorization.
What is considered an unauthorized system change?
An unauthorized change is any modification made outside the documented and approved configuration change control process.
What evidence supports compliance with this objective?
Evidence includes monitoring reports, alerts or logs showing detected changes, and documentation defining unauthorized changes.