id: "SA-10(02)" title: "Alternative Configuration Management Processes" family: "SA" family_name: "System and Services Acquisition" sort_id: "sa-10.02" priority: "P1" implementation_level: "organization" parent: "SA-10" enhancement: True
Statement
Provide an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
Guidance
Alternate configuration management processes may be required when organizations use commercial off-the-shelf information technology products. Alternate configuration management processes include organizational personnel who review and approve proposed changes to systems, system components, and system services and conduct security and privacy impact analyses prior to the implementation of changes to systems, components, or services.
Assessment Objective
an alternate configuration management process has been provided using organizational personnel in the absence of a dedicated developer configuration management team.
System and services acquisition policy
system and services acquisition procedures
configuration management policy
configuration management plan
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system component, or system service
system developer configuration management plan
security impact analyses
privacy impact analyses
privacy impact assessment
privacy risk assessment documentation
system security plan
privacy plan
other relevant documents or records
Organizational personnel with acquisition responsibilities
organizational personnel with information security and privacy responsibilities
organizational personnel with configuration management responsibilities
system developers
Organizational processes for monitoring developer configuration management
mechanisms supporting and/or implementing the monitoring of developer configuration management