SA-10 Developer configuration management
Requires the developer of the system, component or service to perform configuration management during defined life cycle stages, to document and control the integrity of changes to defined configuration items, to impleme
4
artefacts
3
held by a system
1
at each review
easy
to go live
Vendor register / contract repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Contract or agreement clauses imposing developer configuration management duties · Vendor register / contract repository
- Developer change records showing approval before implementation · Document repository
- Documented configuration items under developer configuration management · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Flaw tracking records and reports received from the developer · Document repository
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your Vendor register / contract repository. Vendor register with review dates and attached assurance reports; expiry-driven reminders, not an annual scramble.
Common gaps auditors find
- Obligations assumed from the developer's own process with nothing in the contract
- No visibility of developer changes, so approval is nominal
- Flaw tracking exists at the developer but findings are never reported to the organization
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSA-9 External system services · SA-11 Developer testing and evaluation