Assessment Objective
Determine if:
- CM-09(01) the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing responsibilities for configuration management process development
- configuration management plan
- system security plan
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for configuration management process development
- organizational personnel with information security responsibilities
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | CM-09(01) Assignment of Responsibility |