CM-6—Configuration Settings

Establish and document configuration settings for components employed within the system that reflect the most restrictive mode consistent with operational requirements using ⚙organization-defined common secure configurations;

Implement the configuration settings;

Identify, document, and approve any deviations from established configuration settings for ⚙organization-defined system components based on ⚙organization-defined operational requirements; and

Monitor and control changes to the configuration settings in accordance with organizational policies and procedures.