---

id: "CM-03" title: "Configuration Change Control" family: "CM" family_name: "Configuration Management" sort_id: "cm-03" priority: "P1" implementation_level: "organization" enhancements: - cm-3.1 - cm-3.2 - cm-3.3 - cm-3.4 - cm-3.5 - cm-3.6 - cm-3.7 - cm-3.8

---

Determine and document the types of changes to the system that are configuration-controlled;

Review proposed configuration-controlled changes to the system and approve or disapprove such changes with explicit consideration for security and privacy impact analyses;

Document configuration change decisions associated with the system;

Implement approved configuration-controlled changes to the system;

Retain records of configuration-controlled changes to the system for {{ insert: param, cm-03_odp.01 }};

Monitor and review activities associated with configuration-controlled changes to the system; and

Coordinate and provide oversight for configuration change control activities through {{ insert: param, cm-03_odp.02 }} that convenes {{ insert: param, cm-03_odp.03 }}.

Guidance

Configuration change control for organizational systems involves the systematic proposal, justification, implementation, testing, review, and disposition of system changes, including system upgrades and modifications. Configuration change control includes changes to baseline configurations, configuration items of systems, operational procedures, configuration settings for system components, remediate vulnerabilities, and unscheduled or unauthorized changes. Processes for managing configuration changes to systems include Configuration Control Boards or Change Advisory Boards that review and approve proposed changes. For changes that impact privacy risk, the senior agency official for privacy updates privacy impact assessments and system of records notices. For new systems or major upgrades, organizations consider including representatives from the development organizations on the Configuration Control Boards or Change Advisory Boards. Auditing of changes includes activities before and after changes are made to systems and the auditing activities required to implement such changes. See also SA-10.

Assessment Objective: the types of changes to the system that are configuration-controlled are determined and documented;

Assessment Objective: proposed configuration-controlled changes to the system are reviewed;

Assessment Objective: proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;

Assessment Objective: configuration change decisions associated with the system are documented;

Assessment Objective: approved configuration-controlled changes to the system are implemented;

Assessment Objective: records of configuration-controlled changes to the system are retained for {{ insert: param, cm-03_odp.01 }};

Assessment Objective: activities associated with configuration-controlled changes to the system are monitored;

Assessment Objective: activities associated with configuration-controlled changes to the system are reviewed;

Assessment Objective: configuration change control activities are coordinated and overseen by {{ insert: param, cm-03_odp.02 }};

Assessment Objective: the configuration control element convenes {{ insert: param, cm-03_odp.03 }}.

Configuration management policy

procedures addressing system configuration change control

configuration management plan

system architecture and configuration documentation

change control records

system audit records

change control audit and review reports

agenda/minutes/documentation from configuration change control oversight meetings

system security plan

privacy plan

privacy impact assessments

system of records notices

other relevant documents or records

Organizational personnel with configuration change control responsibilities

organizational personnel with information security and privacy responsibilities

system/network administrators

members of change control board or similar

Organizational processes for configuration change control

mechanisms that implement configuration change control