<commit_before>documentation_complete: false
name: Configuration Management
schema_version: 3.0.0
satisfies:

- control_key: CM-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing, documenting, and
        disseminating Configuration Management policy and procedures. A
        successful control response will need to address the content of the
        policy (which must include purpose, scope, roles, responsibilities,
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implementation of the policies and
        associated controls).>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        Configuration Management policy every 3 years, and procedures annually.
        A successful control response will need to address the review and
        update process, including the role(s) responsible for initiating the
        review process, updaitng the policy and procedures, and providing
        approval of the updates>'

- control_key: CM-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for developing, documenting, and
        maintaining configuration control, a current baseline configuration
        of the information system. A successful control response will need to
        address the way the baseline configurations are managed and
        maintained.>'

- control_key: CM-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for reviewing and updating the
        baseline configuration of the information system at least annually.
        A successful control response will need to address how often the
        baseline configuration is reviewed and updated.>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        baseline configuration of the information system when required by the
        JAB. A successful control response will need to address updates to the
        baseline configuration when required by the JAB.>'
    - key: c
      text: |
        '<The customer will be responsible for reviewing and updating the
        baseline configuration of the information system as a part of
        information system component installations and upgrades. A
        successful control response will need to address updates to the baseline
        configuration as a part of installations and upgrades.>'

- control_key: CM-2(2)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for employing automated mechanisms to
        maintain an up-to-date, completed, accurate, and readily available
        baseline configuration of the information system. A successful control
        response will need to address what automated mechanisms are in use to
        help maintain the baseline configurations of the information system.>'

- control_key: CM-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The cusotmer will be responsible for retaining previous versions of
        baseline configurations to support rollback. A successful control
        response will need to address how previous versions of baseline
        configurations will be retained in order to roll back to a previous
        version.>'

- control_key: CM-2 (7)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        'This control is not applicable to OpenShift operations.'
    - key: b
      text: |
        'This control is not applicable to OpenShift operations.'

- control_key: CM-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for determining the types of changes
        to the information system that are configuration controlled. A
        successful control response will need to address how decisions are made
        to determine configuration controlled changes.>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing proposed configuration
        controlled changes to the information system and approving or
        disapproving changes with explicit consideration for security impact
        analysis. A successful contorl response will need to address how
        decisions are made to approve configuration control changes, including
        how the security impact of these changes is considered.>'
    - key: c
      text: |
        '<The customer will be responsible for documenting configuration change
        decisions. A successful control response will need to address how
        configuration change decisions are documented. This can include, for
        example, what tools are used and what information is documented.>'
    - key: d
      text: |
        '<The customer will be responsible for implementing approved
        configuration-controlled changes to the system. A successful control
        response will need to address how changes are implemented after being
        approved. This can include tools used to ensure that changes are
        implemented after approval.>'
    - key: e
      text: |
        '<The customer will be responsible for retaining records of
        configuration-controlled changes to the information system for a
        defined period. A successful control response will need to address long
        records of configuration-controlled changes are kept, and where these
        records are maintained.>'
    - key: f
      text: |
        '<The customer will be responsible for auditing and reviewing activities
        associated with configuration-controlled changes to the information
        system for a defined period. A successful control response will need
        to ensure configuration control change activities are audited and
        reviewed. This can include tools used to track these changes and when
        these changes are reviewed.>'
    - key: g
      text: |
        '<The customer will be responsible for coordinating and providing
        oversight for the configuration control activities through a central
        means of communicating major changes or developments that may affect
        services to the federal government. The means of communication must
        be approved and accepted by the JAB. A successful control response
        will outline how major changes or developments that affect government
        services will be coordinated and overseen.>'

- control_key: CM-4
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for analyzing changes to the
        information system to determine potential security impacts prior to
        change implementation. A successful control response will explain the
        process used to analyze changes before their implementation. This can
        include any analysis and testing done prior to implementation.>'

- control_key: CM-5
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CM-5 goes here.

        This answer can be multi-line.

- control_key: CM-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CM-5 (1) goes here.
<commit_msg>through CM-5<commit_after>documentation_complete: false
name: Configuration Management
schema_version: 3.0.0
satisfies:

- control_key: CM-1
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for developing, documenting, and
        disseminating Configuration Management policy and procedures. A
        successful control response will need to address the content of the
        policy (which must include purpose, scope, roles, responsibilities,
        management commitment, coordination, and compliance) and procedures
        (which must facilitate the implementation of the policies and
        associated controls).>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        Configuration Management policy every 3 years, and procedures annually.
        A successful control response will need to address the review and
        update process, including the role(s) responsible for initiating the
        review process, updaitng the policy and procedures, and providing
        approval of the updates>'

- control_key: CM-2
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for developing, documenting, and
        maintaining configuration control, a current baseline configuration
        of the information system. A successful control response will need to
        address the way the baseline configurations are managed and
        maintained.>'

- control_key: CM-2 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for reviewing and updating the
        baseline configuration of the information system at least annually.
        A successful control response will need to address how often the
        baseline configuration is reviewed and updated.>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing and updating the
        baseline configuration of the information system when required by the
        JAB. A successful control response will need to address updates to the
        baseline configuration when required by the JAB.>'
    - key: c
      text: |
        '<The customer will be responsible for reviewing and updating the
        baseline configuration of the information system as a part of
        information system component installations and upgrades. A
        successful control response will need to address updates to the baseline
        configuration as a part of installations and upgrades.>'

- control_key: CM-2(2)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for employing automated mechanisms to
        maintain an up-to-date, completed, accurate, and readily available
        baseline configuration of the information system. A successful control
        response will need to address what automated mechanisms are in use to
        help maintain the baseline configurations of the information system.>'

- control_key: CM-2 (3)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The cusotmer will be responsible for retaining previous versions of
        baseline configurations to support rollback. A successful control
        response will need to address how previous versions of baseline
        configurations will be retained in order to roll back to a previous
        version.>'

- control_key: CM-2 (7)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        'This control is not applicable to OpenShift operations.'
    - key: b
      text: |
        'This control is not applicable to OpenShift operations.'

- control_key: CM-3
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - key: a
      text: |
        '<The customer will be responsible for determining the types of changes
        to the information system that are configuration controlled. A
        successful control response will need to address how decisions are made
        to determine configuration controlled changes.>'
    - key: b
      text: |
        '<The customer will be responsible for reviewing proposed configuration
        controlled changes to the information system and approving or
        disapproving changes with explicit consideration for security impact
        analysis. A successful contorl response will need to address how
        decisions are made to approve configuration control changes, including
        how the security impact of these changes is considered.>'
    - key: c
      text: |
        '<The customer will be responsible for documenting configuration change
        decisions. A successful control response will need to address how
        configuration change decisions are documented. This can include, for
        example, what tools are used and what information is documented.>'
    - key: d
      text: |
        '<The customer will be responsible for implementing approved
        configuration-controlled changes to the system. A successful control
        response will need to address how changes are implemented after being
        approved. This can include tools used to ensure that changes are
        implemented after approval.>'
    - key: e
      text: |
        '<The customer will be responsible for retaining records of
        configuration-controlled changes to the information system for a
        defined period. A successful control response will need to address long
        records of configuration-controlled changes are kept, and where these
        records are maintained.>'
    - key: f
      text: |
        '<The customer will be responsible for auditing and reviewing activities
        associated with configuration-controlled changes to the information
        system for a defined period. A successful control response will need
        to ensure configuration control change activities are audited and
        reviewed. This can include tools used to track these changes and when
        these changes are reviewed.>'
    - key: g
      text: |
        '<The customer will be responsible for coordinating and providing
        oversight for the configuration control activities through a central
        means of communicating major changes or developments that may affect
        services to the federal government. The means of communication must
        be approved and accepted by the JAB. A successful control response
        will outline how major changes or developments that affect government
        services will be coordinated and overseen.>'

- control_key: CM-4
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for analyzing changes to the
        information system to determine potential security impacts prior to
        change implementation. A successful control response will explain the
        process used to analyze changes before their implementation. This can
        include any analysis and testing done prior to implementation.>'

- control_key: CM-5
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
    - text: |
        '<The customer will be responsible for defining, documenting, approving
        and enforcing physical and logical access restrictions associated with
        changes to the information system. A successful control response will
        include how logical access associated with change control is defined,
        documented, and enforced. This should include tools used to enforce
        these restrictions, such as Active Directory, and how these personnel
        are approved for access.>'

- control_key: CM-5 (1)
  standard_key: NIST-800-53
  covered_by: []
  implimentation_status: none
  narrative:
   - text: |
        Narrative text on how product can be configured against CM-5 (1) goes here.

{'fraction_non_alphanumeric': 0.04402671283700223, 'fraction_numerical': 0.008904279000742024, 'mean_word_length': 2.8793475653633966, 'pattern_counts': {'":': 0, '<': 36, '<?xml version=': 0, '>': 36, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5526777', 'n_tokens_mistral': 3705, 'n_tokens_neox': 3668, 'n_words': 1870}