Configuration Change Control is the discipline that keeps changes to your system from quietly undoing your security. Baseline Configuration (03.04.01) and Configuration Settings (03.04.02) define the secure state, and Configuration Change Control (03.04.03) governs how that state is allowed to change. It has four (4) parts: define which types of changes are configuration-controlled, review proposed changes and approve or disapprove them with explicit consideration for security impacts, implement and document approved changes, and monitor and review the activities associated with those changes. Per the NIST discussion, configuration change control is the systematic proposal, justification, implementation, testing, review, and disposition of changes, including upgrades and modifications.
A common difficulty with this requirement is running changes through a ticketing tool without the security-specific steps. R3 is explicit that approval decisions must consider security impacts, and it adds a monitoring-and-review objective that many change processes never formalized. It also expects you to have defined which change types are configuration-controlled in the first place, which is easy to skip.
Where things stand for companies facing the transition from NIST 800-171 R2 to R3:
The following is reproduced verbatim from NIST 800-171 R3, requirement 03.04.03 Configuration Change Control. Only the formatting has been adjusted for readability. This requirement has four (4) lettered parts:
The source control is CM-03 from NIST 800-53. There are no Organization-Defined Parameters (ODPs). Per the NIST discussion, configuration change control includes changes to baseline configurations, changes to configuration settings, unscheduled and unauthorized changes, and changes to remediate vulnerabilities, and this requirement is related to Impact Analyses (03.04.04). You can read the requirement directly at NIST 800-171 R3, 03.04.03 (p. 28).
None (0). Requirement 03.04.03 contains no bracketed assignment, so there is no organization-defined value to select and nothing for the DoD to specify. The requirement applies as written.
Your System Security Plan (SSP) narrative for 03.04.03 therefore records how the requirement is implemented rather than a parameter you chose.
NIST 800-171A R3 breaks 03.04.03 into seven (7) determination statements, and it has no Organization-Defined Parameters (ODPs). These AOs are:
Each of the four (4) parts decomposes into its testable pieces: review and the approve or disapprove decision are separate, implement and document are separate, and monitor and review are separate. An assessor checks each. The full guidance on assessment methods and objects, is in NIST 800-171A R3, 03.04.03 (p. 34).
Examine: configuration management policy and procedures; procedures for system configuration change control; configuration management plan; system architecture; configuration settings; change control records; system audit records; change control audit and review reports; agenda, minutes, and documentation from configuration change control oversight meetings; system security plan.
Interview: personnel with configuration change control responsibilities; personnel with information security responsibilities; members of change control board or similar; system administrators.
Test: processes for configuration change control; mechanisms that implement configuration change control.
03.04.03 maps from NIST 800-171 R2 requirement 3.4.3 (track, review, approve or disapprove, and log changes to organizational systems):
Mapped against the seven (7) AOs, three (3) are direct (minimal effort), one (1) is indirect (moderate effort), two (2) are net new, and one (1) has no clear mapping, with the last two (2) categories both counting as significant effort. The track, review, approve, and log concept carries forward, but defining the configuration-controlled change types and monitoring and reviewing change activities are the newer obligations. Three of the seven (7) objectives are significant effort.
Source Control in NIST 800-53 R5:
Secure Controls Framework (SCF) Crosswalk
Organizations running a single control set across multiple frameworks can satisfy 03.04.03 through the following SCF controls:
The crosswalks from NIST 800-171 R3 and NIST 800-171A R3 to the SCF are available at no cost through the SCF Set Theory Relationship Mapping (STRM): https://securecontrolsframework.com/start-here/set-theory-relationship-mapping-strm. The STRM also carries the relationship type for each mapping (Equal, Subset Of, Intersects With), which tells you whether an SCF control fully satisfies the requirement or only part of it. Mapping above taken from SCF 2026.3.
The following are issues teams may encounter rather than certainties. They are about the security-specific steps and the new monitoring objective, each of which needs documented evidence of due diligence and due care such as policies, standards, procedures, and configuration screenshots:
Reasonable objective evidence for an assessment is often subjective. The following examples of evidence to address NIST 800-171 R3 03.04.03 are sourced from the SCF Evidence Request List (ERL), available at https://securecontrolsframework.com/free-content/scf-download. These ERL artifacts are mapped to NIST 800-171 R3 03.04.03 through SCF controls. They establish a starting point for discussions on what an organization needs to have for evidence of due diligence and due care to withstand external scrutiny by an assessor or regulator.
Alongside these, keep the System Security Plan (SSP) narrative for 03.04.03.
With three (3) AOs mapping directly, one indirectly, two net new, and one with no clear mapping, 03.04.03 is a meaningful lift. A realistic sequence:
How many assessment objectives does NIST 800-171 R3 03.04.03 have? NIST 800-171A R3 breaks 03.04.03 into seven (7) assessment objectives. An assessor works through each one separately, so each needs its own evidence.
Which NIST 800-53 R5 control does NIST 800-171 R3 03.04.03 come from? CM-03.
How many Organization-Defined Parameters (ODPs) does NIST 800-171 R3 03.04.03 have? None (0). The requirement contains no bracketed assignment, so there is no organization-defined value and nothing for the DoD to specify.
Where does NIST 800-171 R3 03.04.03 sit in the NIST 800-171 R3 Kill Chain? Phase 7, Data Protection Practices. The Kill Chain is a phased model for sequencing R3 implementation, and it assigns this requirement to that phase.
03.04.03 Configuration Change Control defines which changes are configuration-controlled, reviews and approves them with explicit security consideration, implements and documents them, and monitors and reviews the associated activities. It maps from R2 3.4.3 with the track, review, approve, and log objectives transitioning directly, while the monitoring objectives are net new and the change-type definition has no clear R2 mapping. The recurring problem is a ticketing workflow without the security steps. Define your configuration-controlled change types, weigh security impacts in approvals, document changes, and monitor change activity.
Authoritative sources:
Authoritative sources:
This guide reproduces U.S. Government text from NIST 800-171 R3 and NIST 800-171A R3. It is educational, not legal or assessment advice. Last reviewed: 2026-09-22.
