Configuration management policy
procedures addressing access restrictions for changes to the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
user privilege reviews
user privilege recertifications
system component inventory
change control records
system audit records
system security plan
other relevant documents or records