Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue CM-09: CM-09 Configuration management plan

The organisation develops, documents and implements a configuration management plan for the system that sets roles, responsibilities, processes and procedures, establishes how configuration items are identified and managed through the lifecycle, defines and places the items under configuration management, is reviewed and approved by defined roles, and is protected from unauthorized disclosure and change. 1 enhancement.