Navigate

CCI-001793

CCI-001793 Definition

The organization develops a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will develop and document a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure it establishes and documents a process for managing the configuration of the configuration items.

Compelling Evidence

1.) Signed and dated configuration management plan

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001793.

Control	Description
CM-9	The organization develops, documents, and implements a configuration management plan for the information system that: CM-9a.: Addresses roles, responsibilities, and configuration management processes and procedures; CM-9b.: Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; CM-9c.: Defines the configuration items for the information system and places the configuration items under configuration management; and CM-9d.: Protects the configuration management plan from unauthorized disclosure and modification.

Control

Description

CM-9

The organization develops, documents, and implements a configuration management plan for the information system that:

CM-9a.: Addresses roles, responsibilities, and configuration management processes and procedures;

CM-9b.: Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items;

CM-9c.: Defines the configuration items for the information system and places the configuration items under configuration management; and

CM-9d.: Protects the configuration management plan from unauthorized disclosure and modification.