CM-9 Configuration management plan
Requires a configuration management plan for the system that sets out roles, responsibilities and processes, establishes how configuration items are identified and managed across the development life cycle, names the con
4
artefacts
1
held by a system
1
at each review
moderate
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Configuration item register showing what is under configuration management · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Evidence of the identification process applied across the development life cycle · Cloud console / configuration management
governing documentDocuments that govern the control
- Approved configuration management plan with roles, processes and approval signatures · Policy repository / GRC workspace
- Storage and permission settings that keep the configuration management plan from unauthorized change · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Cloud console / configuration management); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Plan describes a process that the delivery teams do not follow
- Configuration items never formally identified, so the plan has no subject
- Plan stored on an open share where anyone can modify it
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCM-8 System component inventory · CM-10 Software usage restrictions