CM.L2-3.4.3
System Change Management
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.3 in the reference catalog with its NIST cross-references
Official requirement
Track, review, approve or disapprove, and log changes to organizational systems.
Assessment objectives
a. changes to the system are tracked;
b. changes to the system are reviewed;
c. changes to the system are approved or disapproved; and
d. changes to the system are logged.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Track, review, approve, and log system changes.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Once a month, the management and technical team leads join a change control board meeting. During this meeting, everyone reviews all proposed changes to the environment [b,c]. This includes changes to the physical and computing environments. The meeting ensures that relevant subject- matter experts review changes and propose alternatives where needed.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing system configuration change control; configuration management plan; system architecture and configuration documentation; system security plan; change control records; system audit logs and records; change control audit and review reports; agenda/minutes from configuration change control oversight meetings; other relevant documents or records
Common mistakes
Making emergency or routine changes without recording and reviewing them.