Assessment Objective
Determine if:
- CM-09[01] a configuration management plan for the system is developed and documented;
- CM-09[02] a configuration management plan for the system is implemented;
- CM-09a.
- CM-09a.[01] the configuration management plan addresses roles;
- CM-09a.[02] the configuration management plan addresses responsibilities;
- CM-09a.[03] the configuration management plan addresses configuration management processes and procedures;
- CM-09b.
- CM-09b.[01] the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle;
- CM-09b.[02] the configuration management plan establishes a process for managing the configuration of the configuration items;
- CM-09c.
- CM-09c.[01] the configuration management plan defines the configuration items for the system;
- CM-09c.[02] the configuration management plan places the configuration items under configuration management;
- CM-09d. the configuration management plan is reviewed and approved by [Assignment: personnel or roles];
- CM-09e.
- CM-09e.[01] the configuration management plan is protected from unauthorized disclosure;
- CM-09e.[02] the configuration management plan is protected from unauthorized modification.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing configuration management planning
- configuration management plan
- system design documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing the configuration management plan
- organizational personnel with responsibilities for implementing and managing processes defined in the configuration management plan
- organizational personnel with responsibilities for protecting the configuration management plan
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Test
- Organizational processes for developing and documenting the configuration management plan
- organizational processes for identifying and managing configuration items
- organizational processes for protecting the configuration management plan
- mechanisms implementing the configuration management plan
- mechanisms for managing configuration items
- mechanisms for protecting the configuration management plan
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | CM-09 Configuration Management Plan |