Operational changes to configuration items, including business processes, application software, configuration, data, infrastructure and services, are defined, authorized, assessed for impact and risk, carried out, tested in proportion to risk including regression, and approved before release, with impacted documentation, procedures, training, risk assessments and service agreements updated so the configuration baseline is maintained. Configuration management identifies the configuration items, controls changes to them, accounts for their status and evaluates that the records reflect the as-built state, supports restoration after a disaster, and covers standard, emergency, temporary and provider-driven changes, as detailed in Appendix O6.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.