Understanding Configuration Management (CM) in CMMC Level 2InCMMC Level 2, theConfiguration Management (CM) domainis critical for ensuring that systems aresecurely configured, maintained, and monitoredto prevent unauthorized changes. One key aspect of CM is managinguser-installed software, which can introducesecurity risksif not properly controlled.
The correct approach to managinguser-installed softwarealigns withCM.3.068fromNIST SP 800-171, which requires organizations to:
✅Establish and enforce configuration settingsto ensure security.
✅Monitor and control user-installed softwareto prevent unauthorized or insecure applications from running on organizational systems.
Why "Controlled and Monitored" is Correct?The CCP (Certified CMMC Professional) conducting theinterviewshould focus on whether theuser-installed softwareiscontrolled and monitoredto align withCMMC Level 2 requirements. This means verifying:
Approval processesfor user-installed software.
Monitoring mechanisms(e.g., system logs, audits) to track software changes.
Policies that restrict unauthorized installationsto prevent security risks.
Breakdown of Answer ChoicesOption
Description
Correct?
A. Controlled and monitored
✅Ensures compliance with CM.3.068, verifying that user-installed software ismanaged securely.
✅Correct
B. Removed from the system
Software isnot always removed—only unauthorized or risky software should be.
❌Incorrect
C. Scanned for malicious code
While scanning isimportant(covered in SI.3.218), it isnot the primary focusof Configuration Management.
❌Incorrect
D. Limited to mission-essential use only
While limiting software is useful,monitoring and controllingis the key security measure.
❌Incorrect
NIST SP 800-171, CM.3.068– "Control and monitor user-installed software."
CMMC 2.0 Level 2 Requirements– Directly aligned withNIST SP 800-171 security controls.
Official Reference from CMMC 2.0 DocumentationFinal Verification and ConclusionThe correct answer isA. Controlled and monitored, as perCM.3.068inNIST SP 800-171andCMMC 2.0documentation.
