SSP cleanup after catalog import
A GRC tool imported legacy IDs including CM-20. The HIPAA compliance team marks CM-20 Not Selected / Withdrawn and links evidence to CM-1, CM-2, CM-6, CM-8 so the control does not appear as an open gap.
CM-20 Withdrawn / Not Selected in Current Baseline
Low Risk
Easy
Low Cost
CM-20 is not an active NIST SP 800-53 Revision 5 base control. The identifier appears in some legacy catalogs or as an unused numbering slot within the Configuration Management family, but organizations should not treat CM-20 as a selectable Rev. 5 baseline requirement. Unused CM family slot / placeholder. Not selected because it is not defined as a Rev. 5 base control. Healthcare security programs, System Security Plans (SSPs), and HIPAA Security Rule mappings should cite the related active controls instead of inventing implementation evidence for CM-20.
Control Objective
Do not select CM-20 as an active Rev. 5 baseline control; document withdrawn/unused status and satisfy the underlying intent through the related active NIST controls listed for this identifier.
Implementation Guidance
- Confirm in NIST SP 800-53 Rev. 5 (and overlays you use) that CM-20 is withdrawn or not defined as a base control.
- Mark CM-20 as Not Selected / Withdrawn in the SSP control catalog with a short rationale.
- Map any legacy checklist rows that still cite CM-20 to related active controls: CM-1, CM-2, CM-6, CM-8.
- Update HIPAA Security Rule crosswalks so assessors are pointed at live AC/AU/CM/IA/RA/SC/SI controls.
- Remove CM-20 from vulnerability scanners, GRC templates, and RFP questionnaires that imply it is current.
- If a partner still asks for CM-20, provide the withdrawn note plus evidence against the successor controls.
- Keep a one-page family appendix for auditors who search by legacy ID.
- Re-check after catalog upgrades so placeholders are not reintroduced as "open findings."
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Assessor asks for CM-20 evidence
An external assessor’s workbook still lists CM-20. The organization provides the Rev. 5 withdrawn/unused explanation and walks the assessor through related active controls rather than fabricating CM-20-specific procedures.
Vendor questionnaire hygiene
A BA security questionnaire requires "implement CM-20." Security responds that CM-20 is not an active Rev. 5 base control and maps answers to CM-1, CM-2, CM-6, CM-8, avoiding false attestation.
Best Practices
- Prefer Rev. 5 (or your authorized overlay) as the source of truth for control IDs.
- Record Not Selected with rationale for withdrawn/unused IDs.
- Keep a legacy-ID → active-control map for assessors.
- Do not invent policies solely to "satisfy" withdrawn numbers.
- Align HIPAA mappings to active controls only.
- Purge withdrawn IDs from automated scanners and scorecards.
Common Gaps & Violations
- Leaving CM-20 as "Partially Implemented" with empty evidence.
- Writing boilerplate procedures for a control that does not exist in Rev. 5.
- Failing HIPAA assessments because the crosswalk still keys off withdrawn IDs.
- Vendors claiming CM-20 certification as if it were current.
- Placeholder title "Configuration Management" left unpublished with empty use cases.
Required Documentation
- SSP entry: CM-20 Not Selected / Withdrawn (rationale)
- Legacy ID mapping table to active controls
- Updated HIPAA–NIST crosswalk pages
- Assessor FAQ / appendix for withdrawn IDs
- Change ticket removing CM-20 from GRC open items
How to Test & Validate
- Search SSP and GRC for CM-20; expect Not Selected / Withdrawn, not Open.
- Confirm related active controls CM-1, CM-2, CM-6, CM-8 have owners and evidence.
- Spot-check HIPAA crosswalk for live control IDs only.
- Verify scanners/questionnaires do not score CM-20 as failed.
- Ask a sample assessor question path: legacy ID → successor evidence.
Audit Considerations
Auditors may still search by historical numbers. A clear withdrawn/unused statement plus mapped evidence on active controls is stronger than empty placeholder pages or forced "implementation" narratives for CM-20.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1) Risk Analysis / Risk Management — map safeguards to controls that actually exist and are operated.
- 164.306 Security Standards: General Rules — reasonable and appropriate measures; do not chase withdrawn catalog slots.
- 164.316 Policies and Procedures — documentation should reflect the current control baseline used by the organization.
- Assessment practice: HIPAA evaluations should map to active NIST SP 800-53 Rev. 5 controls (and HIPAA implementation specifications), not withdrawn IDs like CM-20.
Compliance Tips
- Add CM-20 to a "withdrawn/unused" appendix rather than the implementable baseline list.
- Train GRC admins not to reopen withdrawn IDs after tool upgrades.
- When in doubt, implement and evidence CM-1, CM-2, CM-6, CM-8.
Frequently Asked Questions
Should we implement CM-20 for HIPAA?
No. CM-20 is not an active Rev. 5 base control. Satisfy the intent through related active controls (CM-1, CM-2, CM-6, CM-8) and map those to the HIPAA Security Rule.
Why is CM-20 in our database?
Legacy catalogs and sequential family numbering often retain withdrawn or unused slots. This page documents that status so thin/placeholder content is not mistaken for a live requirement.
What do we show an assessor who insists on CM-20?
Show the Not Selected / Withdrawn rationale and the evidence package for the successor/related controls.
References & Resources
- NIST SP 800-53 Rev. 5 control catalog (withdrawn / not defined entries)
- Related active controls: CM-1, CM-2, CM-6, CM-8
- NIST SP 800-53B control baselines (confirm non-selection)
Related Guidelines
Related controls that commonly accompany CM-20.
Need Help Implementing CM-20?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.