CM-5 asks you to define, document, approve and enforce physical and logical access restrictions for changes to the system. Where CM-3 asks whether a change was approved, CM-5 asks who was even able to make it.
800-53 binds US federal systems and others by contract. It is a reference for everyone else, and access to change systems is a standard audit sample.
What it means in practice
NIST's guidance explains why. Changes to hardware, software, firmware or operating procedures can significantly affect security and privacy, so only qualified and authorized people should be able to initiate them. The listed mechanisms include physical and logical access controls, software libraries, workflow automation, media libraries, abstraction layers and change windows. It points to AC-3 and PE-3 for related access and physical controls.
For a software company that translates to branch protection, protected deploy credentials, restricted production consoles and a pipeline that holds the keys instead of individuals.
Evidence to collect
- The policy that says who may change what, by role.
- Repository settings showing protected branches, required reviews and restricted force pushes.
- Cloud or platform role assignments for production change rights, exported with dates.
- Pipeline permissions showing who can approve and trigger a production deploy.
- Change window definitions where used.
- Audit logs of changes made through restricted paths.
Common gaps
- Many engineers hold standing production admin.
- Pipeline credentials are shared, so a person can push without leaving a trace.
- A break glass account exists but its use is not reviewed.
- Library or registry write access is broad.
How to implement it
Give humans read access to production and let the pipeline do the writing. Keep a break glass path with alerts and a review. Review change rights each quarter. The enhancements provide a ladder. CM-5.1 is Automated Access Enforcement and Audit Records, CM-5.2 is Review System Changes, CM-5.3 is Signed Components, CM-5.4 is Dual Authorization, CM-5.5 is Privilege Limitation for Production and Operation, CM-5.6 is Limit Library Privileges and CM-5.7 is Automatic Implementation of Security Safeguards.
Quick check
How is CM-5 different from CM-3?
CM-3 governs how changes are reviewed and approved. CM-5 governs who has the access needed to make the change in the first place.
