03.04.03 Configuration Change Control

Statement

• a. Define the types of changes to the system that are configuration-controlled.

• b. Review proposed configuration-controlled changes to the system, and approve or disapprove such changes with explicit consideration for security impacts.

• c. Implement and document approved configuration-controlled changes to the system.

• d. Monitor and review activities associated with configuration-controlled changes to the system.

Guidance

Configuration change control refers to tracking, reviewing, approving or disapproving, and logging changes to the system. Specifically, it involves the systematic proposal, justification, implementation, testing, review, and disposition of changes to the system, including system upgrades and modifications. Configuration change control includes changes to baseline configurations for system components (e.g., operating systems, applications, firewalls, routers, mobile devices) and configuration items of the system, changes to configuration settings, unscheduled and unauthorized changes, and changes to remediate vulnerabilities. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.04.04) 03.04.04.

Assessment objective

the types of changes to the system that are configuration-controlled are defined.

Assessment objective

proposed configuration-controlled changes to the system are reviewed with explicit consideration for security impacts.

Assessment objective

proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security impacts.

Assessment objective

activities associated with configuration-controlled changes to the system are monitored.

Assessment objective

activities associated with configuration-controlled changes to the system are reviewed.

Assessment objective

approved configuration-controlled changes to the system are implemented.

Assessment objective

approved configuration-controlled changes to the system are documented.

Assessment method

• configuration management policy and procedures procedures for system configuration change control configuration management plan system architecture configuration settings change control records system audit records change control audit and review reports agenda, minutes, and documentation from configuration change control oversight meetings system security plan other relevant documents or records

Assessment method

• personnel with configuration change control responsibilities personnel with information security responsibilities members of change control board or similar system administrators

Assessment method

• processes for configuration change control mechanisms that implement configuration change control

1. Przegląd

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

3. Powiązane regulacje

Powiązane zgłoszenia

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.