In this episode, I kick off my Configuration Management control explanatory series by breaking down NIST SP 800-53 CM-1: Configuration Management Policy and Procedure. Before we even touch the control language, I explain why configuration management matters: you’re managing and controlling changes to system configuration across the lifecycle so you don’t introduce unexpected vulnerabilities. That includes hardware, software, firmware, documentation—everything that makes up your baseline. The whole point is to maintain oversight so people can’t just make production changes without authorization and without going through the proper Change Control Board (CCB) approvals. Then I walk through the actual CM-1 requirements in Rev. 5, including what you must develop, document, and disseminate, and who it should go to (organization-defined personnel/roles). I also highlight key Rev. 5 additions—like aligning the policy with applicable federal laws, executive orders, directives, regulations, standards, and guidelines, plus designating an official to manage development and dissemination. Finally, I cover how to assess/test CM-1: obtain and examine the policy/procedure and SSP, verify review/update frequency, confirm signatures, and validate dissemination (for example, SharePoint evidence showing who has access).