iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Season 6, Episode 4 of Ben Link’s “How to Be Friends With Compliance” series is about NIST SP 800-53 control CM-3(2), which its episode page titles “Testing, Validation, and Documenting Changes.” The page frames the discussion around compliance overhead, the cost relationship between compliance and security, CI/CD pipelines, risk-based tiering, and documentation kept as code in Git. Those implementation ideas are the author’s framing of the episode, not NIST’s prescribed method for meeting the control.
What the episode covers
The episode page, published on DEV Community by Ben Link, lists the episode as Season 6, Episode 4 in a five-part series. It shows “Posted on Sep 24” but no year in the opened article, so check the publication date on the page itself before citing it. The page links the episode and its embedded video.
The written description names these topics:
- Perceived compliance overhead and common myths about it
- The cost relationship between compliance and security
- CI/CD pipelines as a way to run testing and validation
- Risk-based tiering of changes
- Git-driven documentation, treated as code
The embedded video has no transcript on the page, so this article does not describe what is said or shown in the video. Everything below is drawn from the written description and from NIST’s own publication pages.
Reading the control identifier
The episode title uses the shorthand “CM(3),” while the page description names the control as CM-3(2). CM-3 is a control in the Configuration Management (CM) family. The parenthetical “(2)” marks an enhancement to that base control. This article uses CM-3(2) because it is the identifier the description uses for the specific subject of the episode.
#1 Best Overall
- Outdoor 4 is our most affordable wireless smart security camera yet, offering up to two-year battery life for around-the-clock peace of mind. Local storage not included with Sync Module Core.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module Core.
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
Where CM-3(2) sits in SP 800-53 Rev. 5
NIST describes SP 800-53 Rev. 5 as a catalog of security and privacy controls for information systems and organizations. The controls are flexible and customizable, and they are implemented as part of an organization-wide risk-management process. The NIST publication page lists the Rev. 5 publication date as September 2020, with updates as of December 10, 2020.
That same page records a later release. NIST issued release 5.2.0 on August 27, 2025. According to the page, that release adds specified new controls, revises SI-07(12), and updates selected control discussions and related controls. The page does not identify CM-3(2) as changed in that release, so do not assume its wording changed. If you are mapping CM-3(2) to an assessment, confirm the text in the catalog version your program uses.
Rank #2
- Our second-generation Video Doorbell and fourth-generation Outdoor 4 cameras offer up to two years of battery life and improved security features for more peace of mind, no matter where you are.
- Last longer with two-year battery life — Experience up to two years of smart security coverage on both devices with included AA Energizer lithium batteries and a Blink Sync Module (included with Outdoor 4).
- See and speak from the Blink app — Experience head-to-toe HD viewing from Video Doorbell and 1080p HD live view from Outdoor 4 as well as infrared night vision and crisp two-way audio.
- See more at your door with Blink Video Doorbell — Greet guests and watch packages get delivered, day and night, with head-to-toe HD view and infrared night vision. Use two-way talk to hear and speak through the Blink app.
- Enhanced motion detection with Outdoor 4 — With Outdoor 4, enjoy a wider field of view and be alerted to motion faster with dual-zone, enhanced motion detection.
NIST also publishes supplemental materials and OSCAL (machine-readable) versions of the Rev. 5 controls. The OSCAL content repository’s SP800-53 Rev. 5 directory shows the Rev. 5 files, but the directory view does not display the text of CM-3(2) itself. Open the catalog file for your version to read the control’s exact wording.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThe three implementation lenses
The episode description presents CI/CD, risk-based tiering, and documentation as code as ways to think about meeting the control. The table below is analysis, not a ranking or a claim from the episode. It shows what each lens can contribute to the evidence a change process produces and what an organization still has to decide.
Rank #3
- Outdoor 4 is our fourth-generation wireless smart security camera with up to two-year battery life for around-the-clock peace of mind.
- See and speak from the Blink app — Experience 1080p HD live view, infrared night vision, and crisp two-way audio.
- Two-year battery life — Set up in minutes and get up to two years of power with the included AA Energizer lithium batteries and a Blink Sync Module (sold separately).
- Enhanced motion detection — Be alerted to motion faster from your smartphone with dual-zone, enhanced motion detection.
- Person detection — Get alerts when a person is detected with embedded computer vision (CV) as part of an optional Blink Subscription Plan (sold separately).
| Lens | What it can contribute | What your organization must still decide |
|---|---|---|
| CI/CD pipeline | Repeatable test runs and recorded results attached to each change | Which tests apply to which changes, and who may override a failed or skipped check |
| Risk-based tiering | A way to match the depth of testing and validation to the impact of a change | The tier criteria, the owner of each tier, and the minimum evidence per tier |
| Git-driven documentation | Versioned records, such as commit history and pull request descriptions, kept with the code they describe | Which documents are required, who reviews them, and how long they are retained |
None of these lenses is a substitute for the control’s own requirements. A pipeline that runs tests does not, by itself, show that testing was appropriate for the risk of the change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical sequence for building the evidence
The steps below are a reasonable way to organize work around CM-3(2). They are not NIST requirements, and the order may vary by organization.
Rank #4
- Mini camera, max performance — Mini 2K+ is our third-generation compact plug-in camera, delivering sharper 2K video resolution and improved audio clarity, so you can see and hear more of what matters.
- See everything, miss nothing — With 2K video resolution, expansive coverage, and up to 4x zoom, you'll capture more detailed footage, even in challenging light conditions.
- Two-way talk that feels natural — Enjoy improved audio with noise cancellation for clearer conversations around your home, making it feel like you're there in person.
- Smarter protection — Receive smart detection like person and vehicle detection with an optional Blink Subscription Plan (sold separately).
- Plug in anywhere — Place or mount indoors, or take it outside with the Weather Resistant Power Adapter (sold separately). Installation takes just minutes.
- Confirm the CM-3(2) wording in the catalog version your program is assessed against, using the NIST publication and its OSCAL files.
- Write down your change categories and the risk tier each category falls into.
- For each tier, define the testing and validation steps a change must complete before it is finalized.
- Configure the pipeline to record which tests ran, their results, and who approved any exception, for each change.
- Link each change to its documentation, for example through a commit or pull request reference, so the record can be traced later.
- Review the tier definitions and the evidence records on a set schedule, and recheck the NIST catalog when a new release is published.
What this source does and does not establish
- The episode page establishes that the episode is about CM-3(2), named as “Testing, Validation, and Documenting Changes,” and that it discusses CI/CD, risk-based tiering, and documentation as code.
- The episode page does not establish NIST’s testing methods, the exact wording of the control in any version, or the content of the video.
- Nothing on the episode page shows that a particular CI/CD configuration satisfies CM-3(2). Compliance depends on an assessment of your own systems and risks.
- The episode page contains no statistics or attributed quotations, so none appear here.
Read the episode as an introduction to how CM-3(2) connects to everyday change work. For the control’s requirements, use the NIST catalog for the version you are assessed against.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
