CM-9 CM · Configuration Management

Configuration Management Plan

LOW ✓ MODERATE ✓ HIGH
1 Enhancement 1 Overlay 9 Related Controls
Graph
Export ▾

Requirements NIST SOURCE

Develop, document, and implement a configuration management plan for the system that:

Discussion (NIST Supplemental Guidance)

Configuration management activities occur throughout the system development life cycle. As such, there are developmental configuration management activities (e.g., the control of code and software libraries) and operational configuration management activities (e.g., control of installed components and how the components are configured). Configuration management plans satisfy the requirements in configuration management policies while being tailored to individual systems. Configuration management plans define processes and procedures for how configuration management is used to support system development life cycle activities. Configuration management plans are generated during the development and acquisition stage of the system development life cycle. The plans describe how to advance changes through change management processes; update configuration settings and baselines; maintain component inventories; control development, test, and operational environments; and develop, release, and update key documents. Organizations can employ templates to help ensure the consistent and timely development and implementation of configuration management plans. Templates can represent a configuration management plan for the organization with subsets of the plan implemented on a system by system basis. Configuration management approval processes include the designation of key stakeholders responsible for reviewing and approving proposed changes to systems, and personnel who conduct security and privacy impact analyses prior to the implementation of changes to the systems. Configuration items are the system components, such as the hardware, software, firmware, and documentation to be configuration-managed. As systems continue through the system development life cycle, new configuration items may be identified, and some existing configuration items may no longer need to be under configuration control.

Enhancements NIST SOURCE

CM-9(1) Assignment of Responsibility LOW MODERATE HIGH

Assign responsibility for developing the configuration management process to organizational personnel that are not directly involved in system development.

Discussion

In the absence of dedicated configuration management teams assigned within organizations, system developers may be tasked with developing configuration management processes using personnel who are not directly involved in system development or system integration. This separation of duties ensures that organizations establish and maintain a sufficient degree of independence between the system development and integration processes and configuration management processes to facilitate quality control and more effective oversight.

Open full page for CM-9(1) →

Implementation Guidance

Engineering Interpretation

Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.

No engineering interpretation has been authored for CM-9 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.

Assessment

NIST SP 800-53A REV 5.2.0

Assessment Objectives

  1. personnel or roles to review and approve the configuration management plan is/are defined;
  2. a configuration management plan for the system is developed and documented;
  3. a configuration management plan for the system is implemented;
  4. the configuration management plan addresses roles;
  5. the configuration management plan addresses responsibilities;
  6. the configuration management plan addresses configuration management processes and procedures;
  7. the configuration management plan establishes a process for identifying configuration items throughout the system development life cycle;
  8. the configuration management plan establishes a process for managing the configuration of the configuration items;
  9. the configuration management plan defines the configuration items for the system;
  10. the configuration management plan places the configuration items under configuration management;
  11. the configuration management plan is reviewed and approved by <CM-09_ODP personnel or roles>;
  12. the configuration management plan is protected from unauthorized disclosure;
  13. the configuration management plan is protected from unauthorized modification.

Examine

[SELECT FROM: Configuration management policy; procedures addressing configuration management planning; configuration management plan; system design documentation; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for developing the configuration management plan; organizational personnel with responsibilities for implementing and managing processes defined in the configuration management plan; organizational personnel with responsibilities for protecting the configuration management plan; organizational personnel with information security and privacy responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for developing and documenting the configuration management plan; organizational processes for identifying and managing configuration items; organizational processes for protecting the configuration management plan; mechanisms implementing the configuration management plan; mechanisms for managing configuration items; mechanisms for protecting the configuration management plan].

Overlays

OT/ICS Overlay SP 800-82r3

NIST SP 800-82r3 Appendix F, Table 22. Blank baseline means the control/control enhancement is not selected in that initial OT baseline.

LOW

Not applicable at this tier.

MODERATE

  • Base control: Included (matches standard baseline)

HIGH

  • Base control: Included (matches standard baseline)

STIGs & CCIs

No STIG checks or CCI mappings are currently loaded for CM-9. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.

Learn more about STIG/CCI integration →

Evidence

Potential Evidence — Derived

Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.

Policy

  • system security plan
  • privacy plan

Configuration

  • Configuration management policy
  • procedures addressing configuration management planning
  • configuration management plan
  • system design documentation

Testing

  • Organizational processes for developing and documenting the configuration management plan
  • organizational processes for identifying and managing configuration items
  • organizational processes for protecting the configuration management plan
  • mechanisms implementing the configuration management plan
  • mechanisms for managing configuration items
  • mechanisms for protecting the configuration management plan

Other Records

  • other relevant documents or records