The organization develops, documents, and implements a configuration management plan for the information system that: CM-9a.
Addresses roles, responsibilities, and configuration management processes and procedures; CM-9b.
Establishes a process for identifying configuration items throughout the system development life cycle and for managing the configuration of the configuration items; CM-9c.
Defines the configuration items for the information system and places the configuration items under configuration management; and CM-9d.
Protects the configuration management plan from unauthorized disclosure and modification.