Testing, Validation, and Documentation of Changes
LOW ✓ MODERATE ✓ HIGHRequirements NIST SOURCE
Test, validate, and document changes to the system before finalizing the implementation of the changes.
Discussion (NIST Supplemental Guidance)
Changes to systems include modifications to hardware, software, or firmware components and configuration settings defined in CM-6 . Organizations ensure that testing does not interfere with system operations that support organizational mission and business functions. Individuals or groups conducting tests understand security and privacy policies and procedures, system security and privacy policies and procedures, and the health, safety, and environmental risks associated with specific facilities or processes. Operational systems may need to be taken offline, or replicated to the extent feasible, before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating controls.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for CM-3(2) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- changes to the system are tested before finalizing the implementation of the changes;
- changes to the system are validated before finalizing the implementation of the changes;
- changes to the system are documented before finalizing the implementation of the changes.
Examine
[SELECT FROM: Configuration management policy; configuration management plan; procedures addressing system configuration change control; system design documentation; system architecture and configuration documentation; system configuration settings and associated documentation; test records; validation records; change control records; system audit records; system security plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with configuration change control responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; members of change control board or similar].
Test
[SELECT FROM: Organizational processes for configuration change control; mechanisms supporting and/or implementing, testing, validating, and documenting system changes].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for CM-3(2). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- system security plan
Configuration
- Configuration management policy
- configuration management plan
- procedures addressing system configuration change control
- system design documentation
- system architecture and configuration documentation
- system configuration settings and associated documentation
Testing
- Organizational processes for configuration change control
- mechanisms supporting and/or implementing, testing, validating, and documenting system changes
Other Records
- test records
- validation records
- change control records
- system audit records
- other relevant documents or records