CM-3 Configuration Change Control (M) (H)

CM-3 Configuration Change Control (M) (H)

1. 
   Determines the types of changes to the information system that are configuration-controlled;
   
2. 
   Reviews proposed configuration-controlled changes to the information system and approves or disapproves such changes with explicit consideration for security impact analyses;
   
3. 
   Documents configuration change decisions associated with the information system;
   
4. 
   Implements approved configuration-controlled changes to the information system;
   
5. 
   Retains records of configuration-controlled changes to the information system for [Assignment: organization-defined time period];