+CM-03(07) Review System Changes

CM-03(07) Review System Changes

Control

Review changes to the system [Assignement: frequency] or when [Assignement: circumstances] to determine whether unauthorized changes have occurred.

Discussion

Indications that warrant a review of changes to the system and the specific circumstances justifying such reviews may be obtained from activities carried out by organizations during the configuration change process or continuous monitoring process.

Assessment Objective

changes to the system are reviewed [Assignement: frequency] or when [Assignement: circumstances] to determine whether unauthorized changes have occurred.

Assessment Method

Examine

Configuration management policy procedures addressing system configuration change control configuration management plan change control records system architecture and configuration documentation system configuration settings and associated documentation system audit records system component inventory system security plan other relevant documents or records

Interview

Organizational personnel with configuration change control responsibilities organizational personnel with security responsibilities system/network administrators members of change control board or similar

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
is blocked by CM-03(07) Review System Changes – Assessment Procedure
is blocked by Test, Validate & Document Changes