CCI-000316

The organization retains records of configuration-controlled changes to the information system for an organization-defined time period.

Implementation Guidance

The organization being inspected/assessed retains records of all configuration-controlled changes to the information system, as a result of CM-3, CCI 1819, for a time period defined by the organization's CCB. DoD has defined the time period as a time period defined by the organization's CCB.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the records of all configuration-controlled changes to the information system to ensure the organization being inspected/assessed retains the records of all configuration controlled changes for a time period defined by the organization's CCB. DoD has defined the time period as a time period defined by the organization's CCB.

Compelling Evidence

1.) Example of previous documentation of configuration changes

The controls below (if any) were marked by NIST as being related to CCI-000316.