You Want Me to Track What? Configuration Management and CMMC

CMMC does not scale down, because NIST-SP-800-171 did not get built for small and micro-businesses. 171 got carved from NIST-SP-800-53 which nerds and academics trained in gov speak genres wrote for the federal government.

NIST-SP-800-171 also assumes you do things as a small business that provide a foundation for cybersecurity. Sometimes this can feel like theater of the absurd to a small business.

Especially things like change management. The idea of writing a ticket to yourself, so you can do a security review, report back to yourself, so you can decide to tell yourself to make a change seems silly.

Everyone should track changes

As silly as it seems I think every company large or small should have a “ticketing system” and a record of change. I don’t care if you sit at the only desk in a company with no physical headquarters or have a staff of a hundred. Tracking the decisions about what you change, and why, makes you better at business.

You do not need a commercial ticketing system. Though the price point of many may make them cheaper than manually doing it for free. Regardless of your solution rely on more than email or disorganized notebooks

I will always recommend, even the smallest of companies to have a ticketing system. More likely you bring the ticketing system from your MSP in scope. You may still want your own internal ticketing system. The price of your labor doing this manually will exceed the monthly licensing costs.

Some companies, because of data security may want to keep all their data within their boundary. Utilizing Microsoft Forms with Conditional Access eliminates an external connection to your system. If you know how to do stuff with Automate and Powershell you can utilize the data in fun ways.

NIST-SP-800-171 demands you track changes, and revision three only gets more explicit.

What Changes Must I Track

I am a huge fan of starting your change process early in your 171 implementation and letting it grow with your maturity. You do have certain baselines you must meet for CMMC compliance.

In Rev 2 you had to track, review, approve or disapprove, and log changes to organizational systems. Rev. 3 turns the single requirement into four explicit outcomes. A procedure should now define the changes requiring tickets/approval, record the security consideration, document implementation, and require monitoring/review of the completed change. Meaning your ticket should have these fields

Rev. 3 also added a post-change validation, and not just a pre-change impact assessment like Rev 2. The ticket should record a test/validation result, such as confirmation that Intune compliance, MFA, logging, segmentation, encryption, or other affected controls still work.

The security review required in Rev 2 also got more explicit in Rev 3. Any change ticket should record a security review. Large organizations would probably rely on a secondary ticket or a security review form. Small shops should just include this in your ticket. You must also explicitly define your change types. Either ask your LLM to spin up definitions in your Configuration Management plan or add the explicit definitions right to the body of your ticket.

You also need to prove you reviewed what happened after the change. I would add a field to your ticket, but you might want to save other evidence along the way.

For a Rev. 3-ready change-management procedure, the minimum ticket workflow is:

• Classify whether the requested work is configuration-controlled.
• Document the proposed change and security impact.
• Obtain approval or disapproval.
• Implement and document the work.
• Test that affected security requirements remain satisfied.
• Update the baseline, inventory, and approved-deviation record where applicable.
• Retain logs and periodically review completed changes.

How Can a Small Business Manage All This

Not by email. Companies who try to track these procedures almost always fail. People do not hit reply all when they should and hit hit reply all when they shouldn’t. Template emails don’t get used. You have to search through mailboxes.

Why not just use a Microsoft (or Google) form?

You can create all the fields, and have a tidy spreadsheet to track everything:

You can even record who made the ticket, restrict it just to people at your company, or only to people authorized to request changes.

Directions

🧩 Build the form structure

1. Create a new form

   • Open Microsoft Forms.
   • Select New Form.
   • Set the form title to: NIST SP 800‑171 System Change Record.
   • Add the form description exactly as written in your template.

2. Section 1 — Change identification

   • Question 1 — Change ID

     • Add → Text
     • Title: Change ID
     • Required: On
     • Subtitle: Enter the same Change ID on every submission…

   • Question 2 — Record type

     • Add → Choice
     • Title: Record type
     • Required: On
     • Choices:
     • Open/Authorize Change
     • Close Change
     • Cancel or Roll Back Change
     • You will add branching later.

3. Section 2 — Open/Authorize Change

   • Shown only when Record type = Open/Authorize Change.

   • Question 3 — Proposed change

     • Add → Text → Long answer
     • Required: On
     • Title: Proposed change
     • Description: Describe the proposed change…

   • Question 4 — Security impact and implementation plan

     • Add → Text → Long answer
     • Required: On
     • Title: Security impact and implementation plan
     • Description: Describe the potential security impact…

   • Question 5 — Authorization decision

     • Add → Choice
     • Required: On
     • Title: Authorization decision
     • Choices:
     • Approved
     • Disapproved
     • Emergency change—approved for immediate implementation
     • More information required
     • Subtitle: Only the owner or another person designated…
     • Branching: Any answer → End of form

4. Section 3 — Close, cancel, or roll back

   • Shown when Record type = Close Change or Cancel or Roll Back Change.

   • Question 6 — Result and validation

     • Add → Text → Long answer
     • Required: On
     • Title: Result and validation
     • Description: State what was implemented…

   • Question 7 — Final status and documentation disposition

     • Add → Choice
     • Required: On
     • Title: Final status and documentation disposition
     • Choices:
     • Completed—baseline and affected documentation updated
     • Completed—no baseline or documentation update required
     • Completed—documentation update still pending
     • Rolled back
     • Cancelled
     • Unsuccessful—additional action required
     • Subtitle: A documentation update may include…
     • Branching: Any answer → End of form

🔀 Configure branching

1. In Microsoft Forms:

   • Click … (More options) → Branching.

2. For Record type:

   • Open/Authorize Change → Question 3
   • Close Change → Question 6
   • Cancel or Roll Back Change → Question 6

3. For Question 5 — Authorization decision:

   • All choices → End of form

4. For Question 7 — Final status:

   • All choices → End of form

This creates the requested workflow.

⚙️ Configure form settings

1. Go to … → Settings.

   • ✔ Only people in my organization can respond
   • ✔ Record name
   • ✖ One response per person — turn off
   • ✖ Allow respondents to edit responses — turn off
   • ✔ Email notification of each response
   • Optional: Response receipts

This ensures identity tracking and timestamps appear in the Excel workbook.

📊 Excel output

1. Forms will automatically create columns such as:

   • Name
   • Start time
   • Completion time
   • Change ID
   • Record type
   • Proposed change
   • Security impact and plan
   • Decision
   • Result and validation
   • Final status

2. Filter the workbook by a Change ID such as CHG-YYYY-### to view the complete lifecycle of that change.

When you read the standards thinking about a “Change control board” for a company of one can seem silly. You don’t need to think that big. Come up with a change system that works for you, and a ticketing system will work better.

If you want to, or need to roll your own, this form provides a tool that can work as part of your 171 system.

Img credit: “Confused” flickr photo by slava https://flickr.com/photos/slava/1167335643 shared under a Creative Commons (BY 2.0) license