Definitions
Configuration Management
Systematic process of establishing and maintaining baseline configurations and tracking all changes to them throughout the system lifecycle to ensure the security of an information system.
Baseline Configuration
A formally documented set of specifications for an information system or component, established as a secure starting point.
Configuration-controlled
Configuration-controlled refers to any item, system, or component whose design, attributes, and changes are formally managed under an established configuration management process.
Directive (CM-1 Configuration Management)
GNB shall establish, implement, and maintain a formal Configuration Management Directive to ensure that the configuration of information systems is securely defined, documented, approved, monitored, and controlled throughout their lifecycle.
Purpose
The objective of the Configuration Management Directive is to ensure that all existing and future systems and components have a standardized secure configuration. A security impact analysis is included in Change Management.
