CM-9 asks for a configuration management plan for the system. It sits above the other CM controls and says how they fit together for a given system.
The plan must address roles, responsibilities and processes. It must establish how configuration items are identified and managed through the development life cycle, and define the configuration items for the system and place them under management. It must be reviewed and approved by parties you define, and protected from unauthorized disclosure and modification.
800-53 binds US federal systems and others by contract. For everyone else it is a reference.
What it means in practice
NIST says configuration management covers both development activity, such as control of code and libraries, and operational activity, such as control of installed components and their configuration. The plan tailors your policy to one system. It describes how changes move through change management, how settings and baselines update, how inventories are kept, how development, test and operational environments are controlled, and how key documents are released.
Templates are encouraged, with a company level plan and system level subsets.
Evidence to collect
- The plan, with version history, approval record and access controls.
- A list of configuration items and where each is stored.
- Role assignments, including the person named under CM-9.1, Assignment of Responsibility.
- Proof the plan is protected, such as restricted wiki permissions.
Common gaps
- The plan describes tools nobody uses.
- Configuration items are listed, but not all are in version control.
- No approval record.
How to implement it
Write a short plan per product. Point to the baseline, the change process and the inventory, and name an owner. Store it where only authorized editors can change it.
Quick check
Is the plan a policy?
No. The policy states requirements. The plan is tailored to one system and says how those requirements are carried out.
