CM.L2-3.4.4
Security Impact Analysis
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee CM.L2-3.4.4 in the reference catalog with its NIST cross-references
Official requirement
Analyze the security impact of changes prior to implementation.
Assessment objectives
a. the security impact of changes to the system is analyzed prior to implementation.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Analyze the security impact of changes before implementation.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You have been asked to deploy a new web browser plug -in. Your standard change management process requires that you produce a detailed plan for the change, including a review of its potential security impact. A subject- matter expert who did not submit the change reviews the plan and tests the new plug-in for functionality and security. You update the change plan based on the expert’s findings and submit it to the change control board for final approval [a].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Configuration management policy; procedures addressing security impact analysis for system changes; configuration management plan; security impact analysis documentation; system security plan; analysis tools and associated outputs; change control records; system audit logs and records; other relevant documents or records
Common mistakes
Treating functional testing as a substitute for security-impact review.