Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

cm-9

configuration management plan    

assessment objective:

Determine if the organization develops, documents, and implements a configuration management plan for the information system that:

cm-9(a)

cm-9(a)[1]

addresses roles;

cm-9(a)[2]

addresses responsibilities;

cm-9(a)[3]

addresses configuration management processes and procedures;

cm-9(b)

establishes a process for:

cm-9(b)[1]

identifying configuration items throughout the SDLC;

cm-9(b)[2]

managing the configuration of the configuration items;

cm-9(c)

cm-9(c)[1]

defines the configuration items for the information system;

cm-9(c)[2]

places the configuration items under configuration management;

cm-9(d)

protects the configuration management plan from unauthorized:

cm-9(d)[1]

disclosure; and

cm-9(d)[2]

modification.

potential assessment methods and objects:

Examine: [select from: Configuration management policy; procedures addressing configuration management planning; configuration management plan; security plan; other relevant documents or records].

Interview: [select from: Organizational personnel with responsibilities for developing the configuration management plan; organizational personnel with responsibilities for implementing and managing processes defined in the configuration management plan; organizational personnel with responsibilities for protecting the configuration management plan; organizational personnel with information security responsibilities; system/network administrators].

Test: [select from: Organizational processes for developing and documenting the configuration management plan; organizational processes for identifying and managing configuration items; organizational processes for protecting the configuration management plan; automated mechanisms implementing the configuration management plan; automated mechanisms for managing configuration items; automated mechanisms for protecting the configuration management plan].