CM-09 Configuration Management Plan

Configuration Management

Moderate High

Description

Develop, document, and implement a configuration management plan for the system that: a. Addresses roles, responsibilities, and configuration management processes and procedures; b. Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; c. Defines the configuration items for the system and places the configuration items under configuration management; and d. Is reviewed and approved by [Assignment: organization-defined personnel or roles].

Supplemental Guidance

Configuration management activities occur throughout the system development life cycle. As such, there are developmental configuration management activities (e.g., the control of code and software libraries) and operational configuration management activities (e.g., control of installed components and how those components are configured). Configuration management plans satisfy the requirements in configuration management policies while being tailored to individual systems.

Changes from Rev 4

No significant changes from Rev 4.

Compliance Mappings

ISO 27001:2022

A.8.9

ISO 27002:2022

5.378.9

COBIT 2019

BAI06BAI10

NIST CSF 2.0

PR.PS-01

CSA CCM v4

CCC-01CCC-03

CSA AICM v1

CCC-01CCC-03MDS-11

FINOS CCC

CCC-C07

BIO2

5.378.9

RBI CSF

Annex1.1

FISC Security Guidelines

FISC.O3

HKMA TM-E-1

TME1.4.1

SAMA CSF

2.13.5

NCA ECC

2-1

UAE IA

T7

CBB TM

TM-5

Qatar NIA

OS

CBUAE

CR-7

CBE CSF

CRM-2CTO-12

CBN CSF

Part3.1

BoG CISD

CISD-V

BoM CTRM

3.6

IOSCO Cyber Resilience

PROT-6

BCBS 239

Principle 6

FFIEC IS

II.C.10II.C.5

ECB CROE

CROE.2.3.4

EBA ICT Guidelines

3.6.3

SEBI CSCRF

ID.AM

BOT Cyber Resilience

Ch2.1

CMMC 2.0

CM

DOE C2M2 v2.1

ASSET

PCI PTS v6

K

Common Criteria

CC Part 2 — FMT

Lloyd's Minimum Standards

MS8.4

NAIC Insurance Data Security

4-config

PRA SS1/23

P3.3P3.4

FCA SYSC 13

SYSC 13.7.4

HITRUST CSF v11

07.a

FDA 21 CFR Part 11

§11.10(k)

NHS DSPT

NDG-8.3