CM-9 CM-9 (b) High The organization conducting Moderate the inspection/assessment Low obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle. Checks should include verification that items being processed for CM are the items identified and that identified configuration items have not been changed without going through the documented process. CM-9 CM-9 (b) High The organization conducting Moderate the inspection/assessment Low obtains and examines the configuration management plan to ensure it establishes and documents a process for managing the configuration of the configuration items. CM-9 CM-9 (b) High The organization conducting Moderate the inspection/assessment Low obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. CM-9 CM-9 (c ) High The organization conducting Moderate the inspection/assessment Low obtains and examines the configuration management plan to ensure the organization being inspected/assessed implements a configuration management plan for the information system that
CM-9 CM-9 (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for identifying configuration items throughout the system development life cycle. Checks should include verification that items being processed for CM are the items identified and that identified configuration items have not been changed without going through the documented process. CM-9 CM-9 (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure it establishes and documents a process for managing the configuration of the configuration items. CM-9 CM-9 (b) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan as well as evidence of implementation (e.g., completed change requests, meeting minutes, and other relevant documents) to ensure the organization being inspected/assessed implements a configuration management plan for the information system that establishes a process for managing the configuration of the configuration items. CM-9 CM-9 (c ) High Moderate Low The organization conducting the inspection/assessment obtains and examines the configuration management plan to ensure the organization being inspected/assessed implements a configuration management plan for the information system that
RMF_Configuration-Management-Plan.docx