Under active development Content is continuously updated and improved · Last updated Feb 18, 2026, 2:55 AM UTC

CM-8(6)Assessed Configurations And Approved Deviations

>Control Description

Assessed configurations and approved deviations must be documented and tracked. Any changes to the baseline configurations of information systems and networks require a review by relevant stakeholders to ensure that the changes do not result in increased exposure to cybersecurity risks throughout the supply chain.

>Cross-Framework Mappings

Ask AI

Configure your API key to use AI features.