U.S. Department of Health and Human Services
Configuration management plans are documented for systems to ensure technical integrity of data within the system. Key components of the configuration management plan include:
Roles and Responsibilities - Roles for system configuration management personnel and specific responsibilities (e.g., Executives, System Owners, Developers) are documented in detail.
Configuration Control Process - Procedures are documented that specify the initiation, approval, change, and acceptance processes for all change requests.
Supplemental Configuration Management Information - Information such as examples of change requests, explanation or user guidelines for automated configuration management tools should also be included in the plan.
Page 8 of 9
System Security Documentation
Configuration Management Plan