The Sun Ray system is not under direct control of a site Configuration Control Board.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-16417	SUN0350	SV-17413r1_rule	DCCB-1	Medium

Description
Security integrity of the system and the ability to back-up and recover from failures cannot be maintained without the control of the system configuration. Unless the configuration is controlled by an independent board it is much less likely to be in its approved accredited state.

STIG	Date
Sun Ray 4 Policy STIG	2015-04-02

Details

Check Text ( C-17302r1_chk )
Ask to see the documented configuration management process for Sun Ray system. Ensure that the plan includes a site Configuration Control Board (CCB). If a plan that includes a CCB exists, this is not a finding. If a plan exists but does not include a CCB or there is not a plan, this is a finding.

Fix Text (F-16443r1_fix)
Implement a configuration management process for the Sun Ray system.