CM.L2-3.4.9[g] – Determine if mechanisms preventing the execution of unauthorized software are tested or verified.

This objective ensures your organization is testing or verifying that the controls meant to prevent unauthorized software execution are working correctly. It’s not enough to have controls in place—you need to validate their effectiveness through testing or system checks.

CM.L2-3.4.9[e] – Determine if unauthorized software, firmware, and information is prevented from being loaded onto organizational systems.

This objective confirms whether your organization’s controls and configurations are actually preventing unauthorized software, firmware, and data from being loaded onto systems handling Controlled Unclassified Information (CUI). It goes beyond policy and looks for evidence of functional prevention, not just intent or design.

CM.L2-3.4.9[f] – Determine if defined measures to protect the integrity of system information are implemented.

This objective evaluates whether your organization has actually implemented the measures it previously defined and documented to protect the integrity of system information, especially for systems handling Controlled Unclassified Information (CUI). It verifies that your stated protections are real, active, and enforced across relevant systems—not just written in policy.

CM.L2-3.4.7[d] – Examine audit logs to verify that the use of system maintenance tools is monitored.

This objective ensures that your organization monitors and logs the use of powerful system maintenance tools, particularly in systems that store, process, or transmit Controlled Unclassified Information (CUI). It confirms that use of these tools is not only restricted, but also visible and auditable.

CM.L2-3.4.7[b] – Examine configuration settings to verify that mechanisms are in place to control the use of system maintenance tools.

This objective ensures your systems are technically configured to control and restrict the use of system maintenance tools, especially on devices that store, process, or transmit Controlled Unclassified Information (CUI).

CM.L2-3.4.2[b] – Examine configuration change control documentation to verify that changes are documented.

This objective ensures your organization tracks and records configuration changes, confirming that your change control process is not only defined but being followed—especially on systems that handle Controlled Unclassified Information (CUI).

CM.L2-3.4.6[a] – Identify unauthorized changes to the system.

This objective requires your organization to have the capability to detect and identify unauthorized changes to systems that store, process, or transmit Controlled Unclassified Information (CUI). This includes changes that were not approved or that deviate from your baseline configuration.

CM.L2-3.4.7[a] – Identify types of mechanisms employed to control the use of system maintenance tools.

This objective requires your organization to identify and document the tools and methods used to control access to system maintenance utilities, especially on systems that handle Controlled Unclassified Information (CUI). These tools often have elevated privileges and must be tightly regulated.

CM.L2-3.4.7[e] – Examine audit logs to verify that audit logs contain records of the use of system maintenance tools.

This objective ensures your audit logs include specific entries documenting the use of system maintenance tools, especially on systems that handle Controlled Unclassified Information (CUI). It verifies that logging is properly configured to capture privileged tool usage.

CM.L2-3.4.6[b] – Examine system configurations to verify that mechanisms are implemented to detect unauthorized changes to the system.

This objective ensures that your systems are technically configured to detect and alert on unauthorized configuration changes, especially on systems that store, process, or transmit Controlled Unclassified Information (CUI).