CM-3.2: Testing, Validation, and Documentation of Changes

changes to the system are tested before finalizing the implementation of the changes;

changes to the system are validated before finalizing the implementation of the changes;

changes to the system are documented before finalizing the implementation of the changes.

Configuration management policy

configuration management plan

procedures addressing system configuration change control

system design documentation

system architecture and configuration documentation

system configuration settings and associated documentation

test records

validation records

change control records

system audit records

system security plan

other relevant documents or records

Organizational personnel with configuration change control responsibilities

organizational personnel with information security responsibilities

system/network administrators

system developers

members of change control board or similar

Organizational processes for configuration change control

mechanisms supporting and/or implementing, testing, validating, and documenting system changes