documentation_complete: true

title: |-
    Ensure Only Approved Administrators Can Change System
    Configurations

description: |-
    The server must enforce logical access restrictions
    associated with changes to application configuration.

rationale: |-
    When dealing with access restrictions pertaining to change control,
    it should be noted that any changes to the hardware, software,
    and/or firmware components of the information system and/or
    application can potentially have significant effects on the overall
    security of the system. Accordingly, only qualified and authorized
    individuals should be allowed to obtain access to server components
    for the purposes of initiating changes, including upgrades and
    application modifications.

severity: high

identifiers:
    cce: ""

references:
    cis: ""
    disa: ""
    nist: ""

ocil_clause: 'unathorized users can make system changes'
