id: "CM-03(02)" title: "Testing, Validation, and Documentation of Changes" family: "CM" family_name: "Configuration Management" sort_id: "cm-03.02" priority: "P1" implementation_level: "organization" parent: "CM-03" enhancement: True
Statement
Test, validate, and document changes to the system before finalizing the implementation of the changes.
Guidance
Changes to systems include modifications to hardware, software, or firmware components and configuration settings defined in CM-6 . Organizations ensure that testing does not interfere with system operations that support organizational mission and business functions. Individuals or groups conducting tests understand security and privacy policies and procedures, system security and privacy policies and procedures, and the health, safety, and environmental risks associated with specific facilities or processes. Operational systems may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls.
Assessment Objective: changes to the system are tested before finalizing the implementation of the changes;
Assessment Objective: changes to the system are validated before finalizing the implementation of the changes;
Assessment Objective: changes to the system are documented before finalizing the implementation of the changes.
Configuration management policy
configuration management plan
procedures addressing system configuration change control
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
test records
validation records
change control records
system audit records
system security plan
other relevant documents or records
Organizational personnel with configuration change control responsibilities
organizational personnel with information security responsibilities
system/network administrators
system developers
members of change control board or similar
Organizational processes for configuration change control
mechanisms supporting and/or implementing, testing, validating, and documenting system changes