CCI-003159

The organization defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled.

Implementation Guidance

The organization being inspected/assessed defines and documents the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled. DoD has determined the configuration items are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented configuration items to ensure the organization being inspected/assessed defines the configuration items under configuration management that require the integrity of changes to be documented, managed and controlled. DoD has determined the configuration items are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation. 3.) Continuous monitoring plan must define configuration items under configuration management that require integrity of changes to be documented, managed and controlled.

The controls below (if any) were marked by NIST as being related to CCI-003159.