SA-10(2): Alternative Configuration Management Processes
Control Family:
Parent Control:
Threats Addressed:
Baselines:
(Not part of any baseline)
Next Version:
- NIST Special Publication 800-53 Revision 5.2.0:
- SA-10(2): Alternative Configuration Management Processes
Control Statement
The organization provides an alternate configuration management process using organizational personnel in the absence of a dedicated developer configuration management team.
Supplemental Guidance
Alternate configuration management processes may be required, for example, when organizations use commercial off-the-shelf (COTS) information technology products. Alternate configuration management processes include organizational personnel that: (i) are responsible for reviewing/approving proposed changes to information systems, system components, and information system services; and (ii) conduct security impact analyses prior to the implementation of any changes to systems, components, or services (e.g., a configuration control board that considers security impacts of changes during development and includes representatives of both the organization and the developer, when applicable).