CM-5 — Access Restrictions for Change
Changes to the hardware, software, or firmware components of systems or the operational procedures related to the system can potentially have significant effects on the security of the systems or individuals’ privacy. Therefore, organizations permit only qualified and authorized individuals to access systems for purposes of initiating changes. Access restrictions include physical and logical access controls (see [AC-3](#ac-3) and [PE-3](#pe-3) ), software libraries, workflow automation, media libraries, abstract layers (i.e., changes implemented into external interfaces rather than directly into systems), and change windows (i.e., changes occur only during specified times).
Read the official statement, discussion, parameters, enhancements, and assessment methods →
NIST CSF 2.0 informative references
These CSF Subcategories list this base control or one of its enhancements in the imported NIST informative reference.
NIST SP 800-171 and SP 800-172
SP 800-171 requirements sourcing this control
SP 800-172 enhanced requirements sourcing this control
MITRE D3FEND techniques
D3-EALExecutable Allowlistingnarrower · CM-5D3-EDLExecutable Denylistingnarrower · CM-5D3-LAMLocal Account Monitoringnarrower · CM-5D3-LAMLocal Account Monitoringnarrower · CM-5(1)D3-LAMLocal Account Monitoringnarrower · CM-5(3)D3-LAMLocal Account Monitoringnarrower · CM-5(5)D3-LAMLocal Account Monitoringnarrower · CM-5(6)D3-SCPSystem Configuration Permissionsnarrower · CM-5(3)D3-SCPSystem Configuration Permissionsnarrower · CM-5(5)D3-SCPSystem Configuration Permissionsnarrower · CM-5(6)
MITRE ATT&CK relationships
Curated mitigation mappings
M1018User Account ManagementCurated through D3-SCPM1024Restrict Registry PermissionCurated through D3-SCPM1026Privileged Account ManagementCurated through D3-LAMM1033Limit Software InstallationCurated through D3-EALM1033Limit Software InstallationCurated through D3-EDLM1038Execution PreventionCurated through D3-EALM1038Execution PreventionCurated through D3-EDLM1042Disable or Remove Feature or ProgramCurated through D3-EDLM1045Code SigningCurated through D3-EALM1047AuditCurated through D3-LAM
Inferred behavior relationships
Experimental: These relationships are inferred through D3FEND and must be validated against architecture, telemetry, and threat context.
T1007System Service DiscoveryInferred through D3-EALT1007System Service DiscoveryInferred through D3-EDLT1010Application Window DiscoveryInferred through D3-EALT1010Application Window DiscoveryInferred through D3-EDLT1012Query RegistryInferred through D3-SCPT1016System Network Configuration DiscoveryInferred through D3-EALT1016System Network Configuration DiscoveryInferred through D3-EDLT1018Remote System DiscoveryInferred through D3-EALT1018Remote System DiscoveryInferred through D3-EDLT1027.001Binary PaddingInferred through D3-EALT1027.001Binary PaddingInferred through D3-EDLT1027.002Software PackingInferred through D3-EAL
Show 106 additional relationships
T1027.002Software PackingInferred through D3-EDLT1027.004Compile After DeliveryInferred through D3-EALT1027.004Compile After DeliveryInferred through D3-EDLT1033System Owner/User DiscoveryInferred through D3-EALT1033System Owner/User DiscoveryInferred through D3-EDLT1036.001Invalid Code SignatureInferred through D3-EALT1036.001Invalid Code SignatureInferred through D3-EDLT1036.003Rename Legitimate UtilitiesInferred through D3-EALT1036.003Rename Legitimate UtilitiesInferred through D3-EDLT1037.001Logon Script (Windows)Inferred through D3-EALT1037.001Logon Script (Windows)Inferred through D3-EDLT1037.002Login HookInferred through D3-EALT1037.002Login HookInferred through D3-EDLT1037.003Network Logon ScriptInferred through D3-EALT1037.003Network Logon ScriptInferred through D3-EDLT1037.004RC ScriptsInferred through D3-EALT1037.004RC ScriptsInferred through D3-EDLT1047Windows Management InstrumentationInferred through D3-EALT1047Windows Management InstrumentationInferred through D3-EDLT1053Scheduled Task/JobInferred through D3-EALT1053Scheduled Task/JobInferred through D3-EDLT1055.003Thread Execution HijackingInferred through D3-EALT1055.003Thread Execution HijackingInferred through D3-EDLT1055.004Asynchronous Procedure CallInferred through D3-EALT1055.004Asynchronous Procedure CallInferred through D3-EDLT1055.013Process DoppelgängingInferred through D3-EALT1055.013Process DoppelgängingInferred through D3-EDLT1057Process DiscoveryInferred through D3-EALT1057Process DiscoveryInferred through D3-EDLT1059Command and Scripting InterpreterInferred through D3-EALT1059Command and Scripting InterpreterInferred through D3-EDLT1078.003Local AccountsInferred through D3-LAMT1082System Information DiscoveryInferred through D3-EALT1082System Information DiscoveryInferred through D3-EDLT1087.001Local AccountInferred through D3-LAMT1112Modify RegistryInferred through D3-SCPT1124System Time DiscoveryInferred through D3-EALT1124System Time DiscoveryInferred through D3-EDLT1134.004Parent PID SpoofingInferred through D3-EALT1134.004Parent PID SpoofingInferred through D3-EDLT1136.001Local AccountInferred through D3-LAMT1137.001Office Template MacrosInferred through D3-EALT1137.001Office Template MacrosInferred through D3-EDLT1137.006Add-insInferred through D3-SCPT1140Deobfuscate/Decode Files or InformationInferred through D3-EALT1140Deobfuscate/Decode Files or InformationInferred through D3-EDLT1204.002Malicious FileInferred through D3-EALT1204.002Malicious FileInferred through D3-EDLT1207Rogue Domain ControllerInferred through D3-SCPT1218.001Compiled HTML FileInferred through D3-EALT1218.001Compiled HTML FileInferred through D3-EDLT1218.002Control PanelInferred through D3-EALT1218.002Control PanelInferred through D3-EDLT1218.003CMSTPInferred through D3-EALT1218.003CMSTPInferred through D3-EDLT1218.005MshtaInferred through D3-EALT1218.005MshtaInferred through D3-EDLT1218.011Rundll32Inferred through D3-EALT1218.011Rundll32Inferred through D3-EDLT1218.014MMCInferred through D3-SCPT1220XSL Script ProcessingInferred through D3-EALT1220XSL Script ProcessingInferred through D3-EDLT1505.001SQL Stored ProceduresInferred through D3-EALT1505.001SQL Stored ProceduresInferred through D3-EDLT1505.003Web ShellInferred through D3-EALT1505.003Web ShellInferred through D3-EDLT1543.003Windows ServiceInferred through D3-SCPT1546.002ScreensaverInferred through D3-EALT1546.002ScreensaverInferred through D3-EDLT1546.005TrapInferred through D3-EALT1546.005TrapInferred through D3-EDLT1546.006LC_LOAD_DYLIB AdditionInferred through D3-EALT1546.006LC_LOAD_DYLIB AdditionInferred through D3-EDLT1546.008Accessibility FeaturesInferred through D3-EALT1546.008Accessibility FeaturesInferred through D3-EDLT1546.009AppCert DLLsInferred through D3-EALT1546.009AppCert DLLsInferred through D3-EDLT1546.010AppInit DLLsInferred through D3-EALT1546.010AppInit DLLsInferred through D3-EDLT1546.012Image File Execution Options InjectionInferred through D3-SCPT1546.013PowerShell ProfileInferred through D3-EALT1546.013PowerShell ProfileInferred through D3-EDLT1546.015Component Object Model HijackingInferred through D3-EALT1546.015Component Object Model HijackingInferred through D3-EDLT1546.015Component Object Model HijackingInferred through D3-SCPT1547.001Registry Run Keys / Startup FolderInferred through D3-EALT1547.001Registry Run Keys / Startup FolderInferred through D3-EDLT1547.009Shortcut ModificationInferred through D3-EALT1547.009Shortcut ModificationInferred through D3-EDLT1548.002Bypass User Account ControlInferred through D3-EALT1548.002Bypass User Account ControlInferred through D3-EDLT1548.004Elevated Execution with PromptInferred through D3-SCPT1552.002Credentials in RegistryInferred through D3-SCP
T1562.003Impair Command History LoggingInferred through D3-EAL
T1562.003Impair Command History LoggingInferred through D3-EDL
T1564.003Hidden WindowInferred through D3-SCPT1564.005Hidden File SystemInferred through D3-SCPT1565.003Runtime Data ManipulationInferred through D3-EALT1565.003Runtime Data ManipulationInferred through D3-EDLT1574.007Path Interception by PATH Environment VariableInferred through D3-EALT1574.007Path Interception by PATH Environment VariableInferred through D3-EDLT1574.008Path Interception by Search Order HijackingInferred through D3-EALT1574.008Path Interception by Search Order HijackingInferred through D3-EDLT1574.009Path Interception by Unquoted PathInferred through D3-EALT1574.009Path Interception by Unquoted PathInferred through D3-EDLT1614.001System Language DiscoveryInferred through D3-SCPUse the map without overclaiming.
A CSF informative reference is not an equivalence statement. A source-control relationship is not proof of implementation. A D3FEND semantic relationship is not a product claim. An inferred ATT&CK link is a hypothesis for engineering analysis.
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST or MITRE. Informative references and cross-framework relationships support navigation and analysis; they do not establish compliance, applicability, equivalence, control inheritance, or guaranteed mitigation effectiveness.