CM.SP 1.2 Establish a Configuration Management System

A configuration management system includes the storage media, procedures, and tools for accessing the system. A configuration management system can consist of multiple subsystems with different implementations that are appropriate for each configuration management environment.

A change management system includes the storage media, procedures, and tools for recording and accessing change requests.

The acquirer considers how configuration items are shared between the acquirer and supplier as well as among relevant stakeholders. If the use of an acquirer’s configuration management system is extended to a supplier, the acquirer should exercise security and access control procedures. In many cases, leaving acquired configuration items in the physical possession of the supplier and having access to supplier deliverables is an alternative solution. The supplier agreement specifies appropriate acquirer rights to supplier deliverables, in addition to requirements for delivery or access. Supplier work products, whenever they are delivered to the acquirer, are presented in accordance with accepted standards to ensure usability by the acquirer.

Example Work Products

1. Configuration management system with controlled work products
2. Configuration management system access control procedures
3. Change request database

Subpractices

1. Establish a mechanism to manage multiple levels of control.

The level of control is typically selected based on project objectives, risk, and resources. Control levels can vary in relation to the project lifecycle, type of system under development, and specific project requirements.

 

Levels of control can range from informal control that simply tracks changes made when configuration items are being developed by the acquirer or when supplier work products are delivered or made accessible to the acquirer, to formal configuration control using baselines that can only be changed as part of a formal configuration management process.

2. Provide access control to ensure authorized access to the configuration management system.

3. Store and retrieve configuration items in a configuration management system.

4. Share and transfer configuration items between control levels in the configuration management system.

5. Store and recover archived versions of configuration items.

6. Store, update, and retrieve configuration management records.

7. Create configuration management reports from the configuration management system.

8. Preserve the contents of the configuration management system.

 

9. Revise the configuration management structure as necessary.