id: "CM-04(01)" title: "Separate Test Environments" family: "CM" family_name: "Configuration Management" sort_id: "cm-04.01" priority: "P1" implementation_level: "organization" parent: "CM-04" enhancement: True
Statement
Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
Guidance
A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation.
Assessment Objective: changes to the system are analyzed in a separate test environment before implementation in an operational environment;
Assessment Objective: changes to the system are analyzed for security impacts due to flaws;
Assessment Objective: changes to the system are analyzed for privacy impacts due to flaws;
Assessment Objective: changes to the system are analyzed for security impacts due to weaknesses;
Assessment Objective: changes to the system are analyzed for privacy impacts due to weaknesses;
Assessment Objective: changes to the system are analyzed for security impacts due to incompatibility;
Assessment Objective: changes to the system are analyzed for privacy impacts due to incompatibility;
Assessment Objective: changes to the system are analyzed for security impacts due to intentional malice;
Assessment Objective: changes to the system are analyzed for privacy impacts due to intentional malice.
Configuration management policy
procedures addressing security impact analyses for changes to the system
procedures addressing privacy impact analyses for changes to the system
configuration management plan
security impact analysis documentation
privacy impact analysis documentation
privacy impact assessment
privacy risk assessment documentation
analysis tools and associated outputs system design documentation
system architecture and configuration documentation
change control records
procedures addressing the authority to test with PII
system audit records
documentation of separate test and operational environments
system security plan
privacy plan
other relevant documents or records
Organizational personnel with responsibility for conducting security and privacy impact analyses
organizational personnel with information security and privacy responsibilities
system/network administrators
members of change control board or similar
Organizational processes for security and privacy impact analyses
mechanisms supporting and/or implementing security and privacy impact analyses of changes