{"id":1117,"date":"2024-07-16T21:39:32","date_gmt":"2024-07-16T21:39:32","guid":{"rendered":"https:\/\/www.tarleton.edu\/security-controls-catalog\/?page_id=1117"},"modified":"2026-09-01T14:34:50","modified_gmt":"2026-09-01T14:34:50","slug":"cm-1-configuration-management-policy-and-procedures","status":"publish","type":"page","link":"https:\/\/www.tarleton.edu\/security-controls-catalog\/configuration-management-cm\/cm-1-configuration-management-policy-and-procedures\/","title":{"rendered":"CM-1: Configuration Management Policy and Procedures"},"content":{"rendered":"\n<h1 class=\"wp-block-heading has-large-font-size\">CM-1: Configuration Management Policy and Procedures<\/h1>\n\n\n\n<div style=\"height:20px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.2px) * 0.294), 16px);\"><strong>NIST Baseline: &nbsp;<\/strong>Low<strong> Privacy Baseline:<\/strong> &nbsp;Yes&nbsp;<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.2px) * 0.294), 16px);\"><strong>DIR Required By: &nbsp;<\/strong>07\/20\/2023&nbsp;<\/h2>\n\n\n\n<h2 class=\"wp-block-heading\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.2px) * 0.294), 16px);\"><strong>Review Date: \u00a0<\/strong>09\/01\/2026<\/h2>\n\n\n\n<hr class=\"wp-block-separator aligncenter has-text-color has-tarleton-purple-color has-alpha-channel-opacity has-tarleton-purple-background-color has-background is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Purpose &#8211;<\/strong>&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Configuration Management Policy and associated controls describe the requirements for managing risks associated with configuring new information systems, controlling changes to information systems, configuration, and security settings. Requirements are also defined for reducing information security risk by implementing least functionality, an information system inventory, and software use restrictions.&nbsp;<\/p>\n\n\n\n<hr class=\"wp-block-separator aligncenter has-text-color has-tarleton-purple-color has-alpha-channel-opacity has-tarleton-purple-background-color has-background is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>&nbsp;Scope and Roles &#8211;&nbsp;<\/strong>&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This policy applies to information resources owned or managed by Tarleton State University (Tarleton). The intended audience includes the Tarleton Chief Information Officer (CIO), Chief Information Security Officer (CISO), and information resource owners and custodians.&nbsp;<\/p>\n\n\n\n<hr class=\"wp-block-separator aligncenter has-text-color has-tarleton-purple-color has-alpha-channel-opacity has-tarleton-purple-background-color has-background is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Compliance &#8211;&nbsp;<\/strong>&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Configuration Management controls are implemented to ensure compliance with the Texas Cyber Command (TXCC) as required by Title 1 Texas Administrative Code\u00a0<a href=\"https:\/\/texas-sos.appianportalsgov.com\/rules-and-meetings?$locale=en_US&amp;interface=VIEW_TAC_SUMMARY&amp;queryAsDate=08%2F25%2F2026&amp;recordId=228882\">\u00a7477.74<\/a>,\u00a0<a href=\"https:\/\/texas-sos.appianportalsgov.com\/rules-and-meetings?$locale=en_US&amp;interface=VIEW_TAC_SUMMARY&amp;queryAsDate=08%2F24%2F2026&amp;recordId=228884\">\u00a7477.76<\/a>, the\u00a0<a href=\"https:\/\/dir.texas.gov\/resource-library-item\/security-controls-standards-catalog\">Texas Department of Information Resources (DIR) Security Control Standards Catalog<\/a>, and Texas A&amp;M University System <a href=\"https:\/\/policies.tamus.edu\/29-01-03.pdf\">Regulation 29.01.03, Information Security<\/a>.\u00a0\u00a0<\/p>\n\n\n\n<hr class=\"wp-block-separator aligncenter has-text-color has-tarleton-purple-color has-alpha-channel-opacity has-tarleton-purple-background-color has-background is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Implementation &#8211;&nbsp;<\/strong>&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list its-nested-list\">\n<li>The Tarleton Chief Information Security Officer (CISO), in coordination with information resource owners, shall develop, document, and disseminate to units a set of controls that addresses the Configuration Management for information resources. These controls should:&nbsp;\n<ul class=\"wp-block-list\">\n<li>Address purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and&nbsp;<\/li>\n\n\n\n<li>Be consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.&nbsp;<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>The CISO, or their designee, shall review and update the Configuration Management controls as necessary.&nbsp;<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator aligncenter has-text-color has-tarleton-purple-color has-alpha-channel-opacity has-tarleton-purple-background-color has-background is-style-wide\"\/>\n\n\n\n<h3 class=\"wp-block-heading has-medium-font-size\">References\/Additional Resources<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/texas-sos.appianportalsgov.com\/rules-and-meetings?$locale=en_US&amp;interface=VIEW_TAC_SUMMARY&amp;queryAsDate=08%2F25%2F2026&amp;recordId=228882\">1 TAC \u00a7477.74<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/texas-sos.appianportalsgov.com\/rules-and-meetings?$locale=en_US&amp;interface=VIEW_TAC_SUMMARY&amp;queryAsDate=08%2F24%2F2026&amp;recordId=228884\">1 TAC \u00a7477.76<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>CM-1: Configuration Management Policy and Procedures NIST Baseline: &nbsp;Low Privacy Baseline: &nbsp;Yes&nbsp; DIR Required By: &nbsp;07\/20\/2023&nbsp; Review Date: \u00a009\/01\/2026 Purpose &#8211;&nbsp; The Configuration Management Policy and associated controls describe the &#8230;<\/p>\n","protected":false},"author":1,"featured_media":580,"parent":1390,"menu_order":1,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"inline_featured_image":false,"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","footnotes":""},"class_list":["post-1117","page","type-page","status-publish","has-post-thumbnail","hentry"],"acf":[],"coauthors":[],"author_meta":{"author_link":"https:\/\/www.tarleton.edu\/security-controls-catalog\/author\/brian-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-2-3\/","display_name":"brian"},"relative_dates":{"created":"Posted 2 years ago","modified":"Updated 1 week ago"},"absolute_dates":{"created":"Posted on July 16, 2024","modified":"Updated on September 1, 2026"},"absolute_dates_time":{"created":"Posted on July 16, 2024 9:39 pm","modified":"Updated on September 1, 2026 2:34 pm"},"featured_img_caption":"","featured_img":false,"series_order":"","_links":{"self":[{"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/pages\/1117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/comments?post=1117"}],"version-history":[{"count":4,"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/pages\/1117\/revisions"}],"predecessor-version":[{"id":2791,"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/pages\/1117\/revisions\/2791"}],"up":[{"embeddable":true,"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/pages\/1390"}],"wp:attachment":[{"href":"https:\/\/www.tarleton.edu\/security-controls-catalog\/wp-json\/wp\/v2\/media?parent=1117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}