3.4.4—Configuration Management - Derived
>Control Description
>Discussion
Organizational personnel with information security responsibilities (e.g., system administrators, system security officers, system security managers, and systems security engineers) conduct security impact analyses. Individuals conducting security impact analyses possess the necessary skills and technical expertise to analyze the changes to systems and the associated security ramifications. Security impact analysis may include reviewing security plans to understand security requirements and reviewing system design documentation to understand the implementation of controls and how specific changes might affect the controls.
Security impact analyses may also include risk assessments to better understand the impact of the changes and to determine if additional controls are required. [SP 800-128] provides guidance on configuration change control and security impact analysis.
>Cross-Framework Mappings
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What policies govern analysis of security impact for proposed changes?
- •What procedures require security analysis before changes?
- •Who conducts security impact analyses for changes?
- •How are security risks documented and communicated?
- •What governance ensures security analysis results inform change decisions?
Technical Implementation:
- •What tools support security impact analysis for changes?
- •How do you assess configuration change security implications?
- •What testing validates changes don't introduce vulnerabilities?
- •How are security controls verified after changes?
- •What scanning occurs post-change to verify security posture?
Evidence & Documentation:
- •Can you provide security impact analyses for recent changes?
- •What change records document security considerations?
- •Can you demonstrate security testing before and after changes?
- •What evidence shows security impacts are analyzed and mitigated?
- •What audit findings verify security impact analysis compliance?
Ask AI
Configure your API key to use AI features.