CCI-000436

Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.

Implementation Guidance

Determine if the responsibility for developing the configuration management process is assigned to Organizational personnel who are not directly involved in system development.

Validation Procedures

Examine: [SELECT FROM: Configuration management policy; procedures addressing responsibilities for configuration management process development; configuration management plan; system security plan; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for configuration management process development; organizational personnel with information security responsibilities].

The controls below (if any) were marked by NIST as being related to CCI-000436.