CM-9(1): Assignment Of Responsibility
Control Family:
Parent Control:
CSF v1.1 References:
Baselines:
(Not part of any baseline)
Next Version:
- NIST Special Publication 800-53 Revision 5:
- CM-9(1): Assignment of Responsibility
Control Statement
The organization assigns responsibility for developing the configuration management process to organizational personnel that are not directly involved in information system development.
Supplemental Guidance
In the absence of dedicated configuration management teams assigned within organizations, system developers may be tasked to develop configuration management processes using personnel who are not directly involved in system development or integration. This separation of duties ensures that organizations establish and maintain a sufficient degree of independence between the information system development and integration processes and configuration management processes to facilitate quality control and more effective oversight.