{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Secure Configuration & Change Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-09","description":"Develop, document, and implement a configuration management plan defining roles, responsibilities, processes, and procedures for identifying, managing, and protecting configuration items throughout the system development life cycle. Deploy these expectations through approved policies and actionable procedures, review them periodically, and update them when the environment or organization changes.","details":{"control_category":"administrative","control_type":"preventive","domain":"Secure Configuration & Change Management","guidance":[],"members":[{"control_id":"CM-9","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"P12","coverage":"partial","delta":"COSO expects policies and procedures deploying all control activities, not only CM","framework":"coso-ic","relationship":"intersects_with"}],"statement":"Develop, document, and implement a configuration management plan defining roles, responsibilities, processes, and procedures for identifying, managing, and protecting configuration items throughout the system development life cycle. Deploy these expectations through approved policies and actionable procedures, review them periodically, and update them when the environment or organization changes.","title":"Document configuration management policy, plan, and procedures","unified_id":"UC-CONFIG-09"},"id":"uc:UC-CONFIG-09","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-09","sourceIds":["coso-ic","nist-800-53"],"sourceUrl":null,"title":"UC-CONFIG-09 — Document configuration management policy, plan, and procedures","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3b26e94b700880beb32e18f95ddf00ad9d0fc5fcc1b55fc76d62f1c7c798eabf","properties":{},"sourceDetailPath":"/data/v1/records/wf-c42-b0991cdd.json","sourceId":"wf:C42","targetDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","targetId":"uc:UC-CONFIG-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8cffd54d2a669546e3e6de1f6dea63838956e2c961d1ad376bbdf876dd21ed07","properties":{"rationale":"Documenting configuration-management processes and roles enables disciplined change control, but executing change management is the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/risk-config-weak-change-control-e7d90eaf.json","targetId":"risk:config-weak-change-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9d147ec8ab153ea90f0c50688d14b3b7b06089d8192ff993b2a9f36bf1b6f479","properties":{},"sourceDetailPath":"/data/v1/records/wf-c9-75fb1752.json","sourceId":"wf:C9","targetDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","targetId":"uc:UC-CONFIG-09","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:a03a6c886e769fac0436dc1b51e316365b4763858182610cc4965151db1907f1","properties":{"rationale":"A documented CM plan defining how configuration items are identified and managed is the foundation enabling baseline control, but not the operative drift defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e537e5b2837cd006b7c0c8623e9df67f6302ad989a2953e0d341862a0c0dcd82","properties":{"control_id":"CM-9","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-9-b51b7985.json","targetId":"ctrl:nist-800-53:CM-9","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e6798aa9b0a1d867ae39cb7563852c565d8ac6347cc932eed3c151ba1fda2ae9","properties":{},"sourceDetailPath":"/data/v1/records/wf-g9-d1e65641.json","sourceId":"wf:G9","targetDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","targetId":"uc:UC-CONFIG-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fc798f57020128c2304ced9e83b5e2bc542716be475a026d320e85ef491f566a","properties":{"control_id":"P12","coverage":"partial","delta":"COSO expects policies and procedures deploying all control activities, not only CM","framework":"coso-ic","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"intersects_with","source_version":"2013"},"sourceDetailPath":"/data/v1/records/uc-uc-config-09-3da3afe2.json","sourceId":"uc:UC-CONFIG-09","targetDetailPath":"/data/v1/records/ctrl-coso-ic-p12-233c8710.json","targetId":"ctrl:coso-ic:P12","type":"maps_to"}],"schemaVersion":1}