Assessment Objective
Determine if:
- CM-03a. the types of changes to the system that are configuration-controlled are determined and documented;
- CM-03b.
- CM-03b.[01] proposed configuration-controlled changes to the system are reviewed;
- CM-03b.[02] proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;
- CM-03c. configuration change decisions associated with the system are documented;
- CM-03d. approved configuration-controlled changes to the system are implemented;
- CM-03e. records of configuration-controlled changes to the system are retained for [Assignment: time period];
- CM-03f.
- CM-03f.[01] activities associated with configuration-controlled changes to the system are monitored;
- CM-03f.[02] activities associated with configuration-controlled changes to the system are reviewed;
- CM-03g.
- CM-03g.[01] configuration change control activities are coordinated and overseen by [Assignment: configuration change control element];
- CM-03g.[02] the configuration control element convenes [Selection (one or more): [Assignment: frequency] ; when [Assignment: configuration change conditions] ].
Assessment Methods
Examine
- Configuration management policy
- procedures addressing system configuration change control
- configuration management plan
- system architecture and configuration documentation
- change control records
- system audit records
- change control audit and review reports
- agenda/minutes/documentation from configuration change control oversight meetings
- system security plan
- privacy plan
- privacy impact assessments
- system of records notices
- other relevant documents or records
Interview
- Organizational personnel with configuration change control responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- members of change control board or similar
Test
- Organizational processes for configuration change control
- mechanisms that implement configuration change control
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | CM-03 [H] Configuration Change Control |