Navigate

CCI-000320

CCI-000320 Definition

Defines the frequency with which to convene the configuration change control element.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines within their CCB Charter, the frequency for configuration change control review. DoD has defined the frequency as at a frequency determined by the CCB.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the CCB Charter to ensure the frequency for configuration change control review is defined. DoD has defined the frequency as at a frequency determined by the CCB.

Compelling Evidence

1.) Signed and dated change control board charter

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000320.

Control	Description
CM-3	The organization: a: Determines the types of changes to the information system that are configuration-controlled; b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses; c: Documents configuration change decisions associated with the information system; d: Implements approved configuration-controlled changes to the information system; e: Retains records of configuration-controlled changes to the information system for [organization-defined time period]; f: Audits and reviews activities associated with configuration-controlled changes to the information system; and g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].

Control

Description

CM-3

The organization:

a: Determines the types of changes to the information system that are configuration-controlled;

b: Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;

c: Documents configuration change decisions associated with the information system;

d: Implements approved configuration-controlled changes to the information system;

e: Retains records of configuration-controlled changes to the information system for [organization-defined time period];

f: Audits and reviews activities associated with configuration-controlled changes to the information system; and

g: Coordinates and provides oversight for configuration change control activities through [organization-defined configuration change control element (e.g., committee, board)] that convenes [one or more of {{ insert: param, cm-3_prm_4 }} / {{ insert: param, cm-3_prm_5 }} ].