Overview
Changes to the DoD information system are assessed for IA and accreditation impact prior to implementation.
Threat
Arbitrary changes to DoD information systems have the potential to affect not only the primary system but any interconnected system as well. All changes must be analyzed for IA and accreditation impact prior to implementation to maintain system stability and accreditation.
Guidance
1. A formal process that identifies changes that will affect IA and accreditation impact shall be developed.
2. The CCB and the DIACAP Team shall work together to assess system changes for IA and accreditation impact prior to implementation.
DoD classifies this control in the subject area of “Security Design and Configuration” with a impact of “Medium”.