CCI-001792

Implement a configuration management plan for the system that establishes a process for identifying configuration items throughout the system development life cycle.

Implementation Guidance

The organization being inspected/assessed will implement a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle. Checks should include verification that items being processed for CM are the items identified and that identified configuration items have not been changed without going through the documented process.

Compelling Evidence

1.) Signed and dated configuration management plan

The controls below (if any) were marked by NIST as being related to CCI-001792.