A Configuration Control Board (CCB) that meets at least every release cycle, for managing the Configuration Management (CM) process must be established.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-70345	APSC-DV-003020	SV-84967r1_rule		Medium

Description
Software Configuration Management (SCM) is very important in tracking code releases, baselines, and managing access to the configuration management repository. The SCM plan identifies what should be under configuration management control. Without an SCM plan code, and a CCB, releases can be tracked and vulnerabilities can be inserted intentionally or unintentionally into the code base of the application. This requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.

Description

Software Configuration Management (SCM) is very important in tracking code releases, baselines, and managing access to the configuration management repository. The SCM plan identifies what should be under configuration management control. Without an SCM plan code, and a CCB, releases can be tracked and vulnerabilities can be inserted intentionally or unintentionally into the code base of the application. This requirement is intended to be applied to application developers or organizations responsible for code management or who have and operate an application CM repository.

STIG	Date
Application Security and Development Security Technical Implementation Guide	2018-04-03

Details

Check Text ( C-70799r1_chk )
Interview the application representative and determine if application development is performed on site by the organization. If application development is not done in house, the requirement is not applicable. If so, determine if a CCB exists. Ask about the membership of the CCB, and identify the primary members. Ask if there is CCB charter documentation. Interview the application representative and determine how often the CCB meets. Ask if there is CCB charter documentation. The CCB charter documentation should indicate how often the CCB meets. If there is no charter documentation, ask when the last time the CCB met and when was the last release of the application. CCBs do not have to physically meet, and the CCB chair may authorize a release based on phone and/or e-mail conversations. If there is no evidence of CCB activity or meetings prior to the last release cycle, this is a finding.

Check Text ( C-70799r1_chk )

Interview the application representative and determine if application development is performed on site by the organization.

If application development is not done in house, the requirement is not applicable.

If so, determine if a CCB exists. Ask about the membership of the CCB, and identify the primary members. Ask if there is CCB charter documentation.

Interview the application representative and determine how often the CCB meets.

Ask if there is CCB charter documentation. The CCB charter documentation should indicate how often the CCB meets.

If there is no charter documentation, ask when the last time the CCB met and when was the last release of the application.

CCBs do not have to physically meet, and the CCB chair may authorize a release based on phone and/or e-mail conversations.

If there is no evidence of CCB activity or meetings prior to the last release cycle, this is a finding.

Fix Text (F-76581r1_fix)
Setup and maintain a Configuration Control Board.