id: "CM-09(01)" title: "Assignment of Responsibility" family: "CM" family_name: "Configuration Management" sort_id: "cm-09.01" priority: "P1" implementation_level: "organization" parent: "CM-09" enhancement: True
Statement
Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.
Guidance
In the absence of dedicated configuration management teams assigned within organizations, system developers may be tasked with developing configuration management processes using personnel who are not directly involved in system development or system integration. This separation of duties ensures that organizations establish and maintain a sufficient degree of independence between the system development and integration processes and configuration management processes to facilitate quality control and more effective oversight.
Assessment Objective
the responsibility for developing the configuration management process is assigned to organizational personnel who are not directly involved in system development.
Configuration management policy
procedures addressing responsibilities for configuration management process development
configuration management plan
system security plan
system security plan
other relevant documents or records
Organizational personnel with responsibilities for configuration management process development
organizational personnel with information security responsibilities