Title

A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established. (Cat II impact)

Discussion

Software Configuration Management (SCM) is very important in tracking code releases, baselines, and managing access to the configuration management repository. An SCM plan or charter identifies what should be under configuration management control. Without an SCM plan and a CCB, application releases can't be tracked and vulnerabilities can be inserted intentionally or unintentionally into the code base of the application. This requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.

Check Content

Interview the application representative and determine if application development is performed on site by the organization. If application development is not done in house, the requirement is not applicable. If so, determine if a CCB exists. Ask about the membership of the CCB, and identify the primary members. Ask if there is CCB charter documentation. Interview the application representative and determine how often the CCB meets. Ask if there is CCB charter documentation. The CCB charter documentation should indicate how often the CCB meets. If there is no charter documentation, ask when the last time the CCB met and when was the last release of the application. CCBs do not have to physically meet, and the CCB chair may authorize a release based on phone and/or e-mail conversations. If there is no evidence of CCB activity or meetings prior to the last release cycle, this is a finding.

Fix Text

Setup and maintain a Configuration Control Board.

Additional Identifiers

Rule ID: SV-222633r879887_rule

Vulnerability ID: V-222633

Group Title: SRG-APP-000516

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.