What this requirement asks
Track, review, approve or disapprove, and log changes to organizational systems.
This is a CMMC Level 2 requirement in the Configuration Management family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (4)
- 3.4.3[a] — changes to the system are tracked
- 3.4.3[b] — changes to the system are reviewed
- 3.4.3[c] — changes to the system are approved or disapproved
- 3.4.3[d] — changes to the system are logged
What an assessor examines
Examine:
- Configuration management policy
- procedures addressing system configuration change control
- configuration management plan
- system architecture and configuration documentation
- system security plan
- change control records
- system audit logs and records
- change control audit and review reports
- agenda/minutes from configuration change control oversight meetings
- other relevant documents or records
Interview:
- Personnel with configuration change control responsibilities
- personnel with information security responsibilities
- system or network administrators
- members of change control board or similar
Test:
- Organizational processes for configuration change control
- mechanisms that implement configuration change control
Evidence that defends it
Show change risk evaluation artifacts
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.