HOME

CM-3 (1)

CM-3 (1) H
Description

The organization employs automated mechanisms to:
(a) Document proposed changes to the information system;
(b) Notify [Assignment: organized-defined approval authorities] of proposed changes to the information system and request change approval;
(c) Highlight proposed changes to the information system that have not been approved or disapproved by [Assignment: organization-defined time period];
(d) Prohibit changes to the information system until designated approvals are received;
(e) Document all changes to the information system; and
(f) Notify [Assignment: organization-defined personnel] when approved changes to the information system are completed.

FedRAMP
  • H CM-3 (1) (c) [organization agreed upon time period] CM-3 (1) (f) [organization defined configuration management approval authorities]