+CM-03(02) Testing, Validation, and Documentation of Changes
|
CM-03(02) Testing, Validation, and Documentation of Changes
Control
Test, validate, and document changes to the system before finalizing the implementation of the changes.
Discussion
Changes to systems include modifications to hardware, software, or firmware components and configuration settings defined in [CM-6](#cm-6) . Organizations ensure that testing does not interfere with system operations that support organizational mission and business functions. Individuals or groups conducting tests understand security and privacy policies and procedures, system security and privacy policies and procedures, and the health, safety, and environmental risks associated with specific facilities or processes. Operational systems may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls.
Assessment Objective
- changes to the system are tested before finalizing the implementation of the changes;
- changes to the system are validated before finalizing the implementation of the changes;
- changes to the system are documented before finalizing the implementation of the changes.
Assessment Method
Examine
Configuration management policy
configuration management plan
procedures addressing system configuration change control
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
test records
validation records
change control records
system audit records
system security plan
other relevant documents or records
Interview
Organizational personnel with configuration change control responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
members of change control board or similar
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|