No. If the organization provides evidence of advanced system controls capabilities, it must submit policies and procedures for UM 12, Elements A and C and for CR 1, Element C. Policies and procedures must address all factors regarding advanced system control capabilities.
Organizations are only eligible to receive a score of Met for UM 12, Elements B and D, and for CR 1, Element D if they provide evidence of advanced system control capabilities that both automatically record dates and prevent changes that do not meet the organization’s policies and procedures.
UM_CR 2022