Level - 2
Category - Support
The purpose of Configuration Management (CM) is to establish and maintain the integrity of work products using configuration identification, configuration control, configuration status accounting, and configuration audits.
SG 1 Establish Baselines
SP 1.1 Identify Configuration Items
SP 1.2 Establish a Configuration Management System
SP 1.3 Create or Release Baselines
SG 2 Track and Control Changes
SP 2.1 Track Change Requests
SP 2.2 Control Configuration Items
SG 3 Establish Integrity
SP 3.1 Establish Configuration Management Records
SP 3.2 Perform Configuration Audits
Identified configuration items
Select configuration items and work products that compose them based on documented criteria.
Assign unique identifiers to configuration items.
Specify the important characteristics of each configuration item.
Specify when each configuration item is placed under configuration management.
Identify the owner responsible for each configuration item.
Specify relationships among configuration items.
Configuration management system with controlled work products
Configuration management system access control procedures
Change request database
Establish a mechanism to manage multiple levels of control.
Provide access control to ensure authorized access to the configuration management system.
3. Store and retrieve configuration items in a configuration management system.
4. Share and transfer configuration items between control levels in the configuration management system.
5. Store and recover archived versions of configuration items.
Store, update, and retrieve configuration management records.
Create configuration management reports from the configuration management system.
Preserve the contents of the configuration management system.
Revise the configuration management structure as necessary.
Baselines
Description of baselines
Obtain authorization from the CCB before creating or releasing baselines of configuration items.
Create or release baselines only from configuration items in the configuration management system.
Document the set of configuration items that are contained in a baseline.
Make the current set of baselines readily available.
Change requests
Initiate and record change requests in the change request database.
Analyze the impact of changes and fixes proposed in change requests.
Categorize and prioritize change requests.
Review change requests to be addressed in the next baseline with relevant stakeholders and get their agreement.
Track the status of change requests to closure.
Revision history of configuration items
Archives of baselines
Control changes to configuration items throughout the life of the product or service.
Obtain appropriate authorization before changed configuration items are entered into the configuration management system.
Check in and check out configuration items in the configuration management system for incorporation of changes in a manner that maintains the correctness and integrity of configuration items.
Perform reviews to ensure that changes have not caused unintended effects on the baselines (e.g., ensure that changes have not compromised the safety or security of the system).
Record changes to configuration items and reasons for changes as appropriate.
1. Revision history of configuration items
2. Change log
3. Change request records
4. Status of configuration items
5. Differences between baselines
1. Record configuration management actions in sufficient detail so the content and status of each configuration item is known and previous versions can be recovered.
2. Ensure that relevant stakeholders have access to and knowledge of the configuration status of configuration items.
3. Specify the latest version of baselines.
4. Identify the version of configuration items that constitute a particular baseline.
5. Describe differences between successive baselines.
6. Revise the status and history (i.e., changes, other actions) of each configuration item as necessary.
1. Configuration audit results
2. Action items
Assess the integrity of baselines.
Confirm that configuration management records correctly identify configuration items.
Review the structure and integrity of items in the configuration management system.
Confirm the completeness, correctness, and consistency of items in the configuration management system.
Confirm compliance with applicable configuration management standards and procedures.
Track action items from the audit to closure.