NIST SP 800-53 Rev 5 — Configuration Management (CM) family

NIST SP 800-53 Rev 5 — Configuration Management (CM) family — 100% of in-scope requirements covered.

2 requirements · 1 in scope (1 enforced) · 1 out-of-scope (outside KYE™’s authority layer). The 100% is weighted over the in-scope base.

NIST SP 800-53 Rev 5: requirement → the KYE™ artefact that enforces it

Demo data

You learn: Which requirements KYE™ enforces at runtime and with which artefact. You can: Walk the requirements.

  1. cm-3-configuration-change-control · enforced

    CM-3 Configuration change control: an AI-proposed change is approved & impact-analysed before commit, with a…

    Rule packs: kye:rule-pack:production-action-authority · Audit events: kye.purpose.request.v1, kye.purpose.admissibility.v1, kye.evidence.decision_map.v1, kye.evidence.pack.v1 · Constitution: 12…

  2. cm-2-baseline-inventory · out-of-scope

    CM-2 baseline configuration & CM-8 component inventory maintenance

    (no enforcement cited)

How this widget is built
Demonstrates
KYE™ Compliance Mapping Rail™
Components
  • Framework requirement (clause)
  • Coverage status
  • KYE™ enforcement artefact (event, decision-record field, Evidence Pack™ entry)
Flow
Clause → status → the KYE™ artefact that enforces it, enforced requirements first. Architecture diagram
Used on

Source: NIST SP 800-53 Rev 5 — Configuration Management (CM) family — US federal control catalogue (security & privacy controls). KYE Protocol™ governs the SUBSET that resolves at the action boundary — the moment an AI-driven production action (a rollback / hotfix / infra-change) moves toward a consequential effect — under a recorded change-authority decision, with the change-class due-diligence recorded, replay-provable provenance, and named sign-off. KYE™ does not detect the incident, perform RCA, monitor the system, or operate the change-management tooling. · License: NIST SP 800-53 is a US federal publication in the public domain; KYE™ registry cites the CM control family for mapping purposes.

By category

CategoryReqsEnforcedDesignedAdvisoryDeferredCoverage
Configuration change control — authority & impact analysis (enforced action-boundary subset)11000100%
Configuration baseline & inventory (out-of-scope — config-management / devsecops)100000%

Every requirement → the KYE™ artefact that enforces it

IDTitleStatusKYE™ enforcement
nist-800-53-cm.cm-3-configuration-change-controlCM-3 Configuration change control: an AI-proposed change is approved & impact-analysed before commit, with a retained change recordenforcedrule_packs: kye:rule-pack:production-action-authority
dictionaries: internal
engines: internal, internal, internal
audit_events: kye.purpose.request.v1, kye.purpose.admissibility.v1, kye.evidence.decision_map.v1, kye.evidence.pack.v1
constitution_refs: constitution/12-PURPOSE-PERMISSION.md, constitution/13-RESILIENCE-LOOP.md
nist-800-53-cm.cm-2-baseline-inventoryCM-2 baseline configuration & CM-8 component inventory maintenanceout-of-scope(no enforcement cited)

Canonical KYE™ surfaces referenced on this page: KYE Protocol™.