CM-3(4)—Configuration Change Control

Information security representatives can include, for example, senior agency information security officers, information system security officers, or information system security managers. Representation by personnel with information security expertise is important because changes to information system configurations can have unintended side effects, some of which may be security-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security state of organizational information systems.

The configuration change control element in this control enhancement reflects the change control elements defined by organizations in CM-3.