CCI-000314

The organization approves or disapproves configuration-controlled changes to the information system, with explicit consideration for security impact analysis.

Implementation Guidance

The organization being inspected/assessed approves or disapproves configuration controlled changes to the information system with explicit consideration for security impact analysis. The organization must maintain an audit trail of approval/disapproval of configuration controlled changes. This action will be implemented by the CCB as defined in CM-3, CCI 1586.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of the approval/disapproval of configuration controlled changes to ensure a security impact analysis was conducted.

Compelling Evidence

1.) Signed and dated configuration management policies

The controls below (if any) were marked by NIST as being related to CCI-000314.