CM-3.1: Automated Documentation, Notification, and Prohibition of Changes

automated mechanisms are used to document proposed changes to the system;

automated mechanisms are used to notify approval authorities of proposed changes to the system and request change approval;

automated mechanisms are used to highlight proposed changes to the system that have not been approved or disapproved within time period ;

automated mechanisms are used to prohibit changes to the system until designated approvals are received;

automated mechanisms are used to document all changes to the system;

automated mechanisms are used to notify personnel when approved changes to the system are completed.

Configuration management policy

procedures addressing system configuration change control

configuration management plan

system design documentation

system architecture and configuration documentation

automated configuration control mechanisms

system configuration settings and associated documentation

change control records

system audit records

change approval requests

change approvals

system security plan

other relevant documents or records

Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Organizational processes for configuration change control

automated mechanisms implementing configuration change control activities