Agencies should follow this outline for change management: raise a written change request; send the request to every stakeholder for approval; document the changes to be made; test the approved changes; tell users the change schedule and the likely effect or outage; implement approved changes once testing has succeeded; bring the relevant information security documentation up to date, the SRMP, SSP and SOPs included; tell system users about, and educate them on, implemented changes as close as possible to when the change is applied; and keep educating system users about changes on an ongoing basis.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.