# NIST800 53 CM-2(7) — Configure Systems And Components For High-Risk Areas

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist80053_cm27_0e5ebbe1ec-nist800-53-cm-27-configure-systems-and-components-for-high-risk-areas
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Configuration Management](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_configurationmanagement)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 53 · Control CM-2(7) · Priority: high · Component: Configuration Management

### What this control covers

Issues specially configured systems for high-risk travel locations and applies controls upon return to mitigate increased threats. This control supports the High-Risk Configuration System capability within the Configuration Management family.

### Why it matters

Risk is the language an executive team understands; this control connects technical reality to board-level decisions and budget allocation.

### How to implement

#### AWS

Codify the policy intent as **SCPs, AWS Config conformance packs, and Security Hub standards** so the cloud enforces what the document says.

#### Azure

Codify in **Azure Policy initiatives** (built-in regulatory compliance for CIS, ISO 27001, SOC 2, HIPAA) and assign at management-group level.

#### GCP

**Org Policy Service** for guardrails and **Config Validator** in CI to pre-check Terraform plans against policy as code (Rego).

#### On-premises

Maintain a policy library with a documented review cadence (annual minimum); store in your GRC tool with attestation tracking. Map each policy to controls so an audit pull cites the exact policy clause.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Configure Systems And Components For High-Risk Areas.

### Quick checklist

-   Security — Management / System
-   Configuration — Management / System
-   Network — Management / System
-   System — Management / System
-   Control — Management / System
-   Configure — Management / System

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [NIST 800-171 3.4.2 Establish and enforce security configuration settings for information technology products employed in organizational systems.](https://support.icompaas.com/support/solutions/articles/62000229281-nist-800-171-3-4-2-establish-and-enforce-security-configuration-settings-for-information-technology-p)
-   [NIST 800-171 3.12.1 Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.](https://support.icompaas.com/support/solutions/articles/62000229330-nist-800-171-3-12-1-periodically-assess-the-security-controls-in-organizational-systems-to-determine-)
-   [NIST 800-171 3.8.7 Control the use of removable media on system components.](https://support.icompaas.com/support/solutions/articles/62000229316-nist-800-171-3-8-7-control-the-use-of-removable-media-on-system-components-)

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.