CCI-000319

The organization coordinates and provides oversight for configuration change control activities through an organization-defined configuration change control element (e.g., committee, board) that convenes at the organization-defined frequency and/or for any organization-defined configuration change conditions.

Implementation Guidance

The organization being inspected/assessed coordinates and provides oversight for configuration change control activities through a configuration control board (CCB) that convenes at a frequency determined by the CCB and/or for any configuration change conditions determined by the CCB. DoD has defined the configuration change control element as a configuration control board. DoD has defined the frequency as at a frequency determined by the CCB. DoD has defined the configuration change conditions as configuration change conditions determined by the CCB.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the organization's configuration management policy and plan; document/charter establishing the organization's CCB; meeting minutes; information system change control records; and any other relevant documents or records. The objective of the review is to validate the organization is coordinating and overseeing the configuration change control activities through a CCB.

Compelling Evidence

1.) Signed and dated change control board charter

The controls below (if any) were marked by NIST as being related to CCI-000319.