---

id: "CM-03(01)" title: "Automated Documentation, Notification, and Prohibition of Changes" family: "CM" family_name: "Configuration Management" sort_id: "cm-03.01" priority: "P1" implementation_level: "organization" parent: "CM-03" enhancement: True

---

Statement

Use {{ insert: param, cm-03.01_odp.01 }} to:

Document proposed changes to the system;

Notify {{ insert: param, cm-03.01_odp.02 }} of proposed changes to the system and request change approval;

Highlight proposed changes to the system that have not been approved or disapproved within {{ insert: param, cm-03.01_odp.03 }};

Prohibit changes to the system until designated approvals are received;

Document all changes to the system; and

Notify {{ insert: param, cm-03.01_odp.04 }} when approved changes to the system are completed.

Guidance

None.

Assessment Objective: {{ insert: param, cm-03.01_odp.01 }} are used to document proposed changes to the system;

Assessment Objective: {{ insert: param, cm-03.01_odp.01 }} are used to notify {{ insert: param, cm-03.01_odp.02 }} of proposed changes to the system and request change approval;

Assessment Objective: {{ insert: param, cm-03.01_odp.01 }} are used to highlight proposed changes to the system that have not been approved or disapproved within {{ insert: param, cm-03.01_odp.03 }};

Assessment Objective: {{ insert: param, cm-03.01_odp.01 }} are used to prohibit changes to the system until designated approvals are received;

Assessment Objective: {{ insert: param, cm-03.01_odp.01 }} are used to document all changes to the system;

Assessment Objective: {{ insert: param, cm-03.01_odp.01 }} are used to notify {{ insert: param, cm-03.01_odp.04 }} when approved changes to the system are completed.

Configuration management policy

procedures addressing system configuration change control

configuration management plan

system design documentation

system architecture and configuration documentation

automated configuration control mechanisms

system configuration settings and associated documentation

change control records

system audit records

change approval requests

change approvals

system security plan

other relevant documents or records

Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Organizational processes for configuration change control

automated mechanisms implementing configuration change control activities