CCI-000312

Maintain a baseline configuration for system test environments that is managed separately from the operational baseline configuration.

Implementation Guidance

Determine if: - a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained. - a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing the baseline configuration of the system; configuration management plan; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with configuration management responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for managing baseline configurations; mechanisms implementing separate baseline configurations for development, test, and operational environments].

The controls below (if any) were marked by NIST as being related to CCI-000312.