>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

CM-4—Impact Analyses

IL4 Mod
IL4 High
IL5
IL6

>Control Description

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

>DoD Impact Level Requirements

No specific parameter values or requirements for this impact level.

>Discussion

Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks.

Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.

>Programmatic Queries

Beta

Related Services

AWS Config
AWS CloudFormation
AWS Systems Manager Change Manager

CLI Commands

Preview CloudFormation change set impact
aws cloudformation create-change-set --stack-name STACK_NAME --template-body file://template.yaml --change-set-name impact-analysis
Describe change set to analyze impact
aws cloudformation describe-change-set --stack-name STACK_NAME --change-set-name impact-analysis
Check Config compliance drift
aws configservice get-compliance-details-by-config-rule --config-rule-name RULE_NAME --compliance-types NON_COMPLIANT
List SSM change requests with impact analysis
aws ssm list-ops-item-events --filters '[{"Key":"OpsItemType","Values":["/aws/changerequest"],"Operator":"Equal"}]'
Open AWS ConsoleDocumentation

>Related Controls

CA-7
CM-3
CM-8
CM-9
MA-2
RA-3
RA-5
RA-8
SA-5
SA-8
SA-10
SI-2

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of CM-4 (Impact Analyses)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring CM-4?
  • •How frequently is the CM-4 policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to CM-4?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce CM-4 requirements.
  • •What automated tools, systems, or technologies are deployed to implement CM-4?
  • •How is CM-4 integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce CM-4 requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of CM-4?
  • •What audit logs, records, reports, or monitoring data validate CM-4 compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of CM-4 effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate CM-4 compliance?

Ask AI

Configure your API key to use AI features.