Which statement below MOST accurately describes configuration control?

A.
Assuring that only the proposed and approved system changes are implemented

B.
Tracking the status of current changes as they move through the configuration control process

C.
Verifying that all configuration management policies are being followed

D.
The decomposition process of a verification system into CIs

Explanation:
Configuration control is a means of assuring that system changes are approved before being
implemented, only the proposed and approved changes are implemented, and the implementation
is complete and accuratE. This involves strict procedures for proposing, monitoring, and approving
system changes and their implementation. Configuration control entails central direction of the
change process by personnel who coordinate analytical tasks, approve system changes, review the
implementation of changes, and supervise other tasks such as documentation. *Answer “The
decomposition process of a verification system into CIs” is configuration identification. The
decomposition process of a verification system into Configuration Items (CIs) is called configuration
identification. A CI is a uniquely identifiable subset of the system that represents the smallest
portion to be subject to independent configuration control procedures. Answer “Tracking the status
of current changes as they move through the configuration control process” is configuration
accounting. Configuration accounting documents the status of configuration control activities and, in
general, provides the information needed to manage a configuration effectively. It allows managers
to trace system changes and establish the history of any developmental problems and associated
fixes. Configuration accounting also tracks the status of current changes as they move through the
configuration control process. Configuration accounting establishes the granularity of recorded
information and thus shapes the accuracy and usefulness of the audit function. *Answer “Verifying
that all configuration management policies are being follow” is configuration audit. Configuration
audit is the quality assurance component of configuration management. It involves periodic checks
to determine the consistency and completeness of accounting information and to verify that all
configuration management policies are being followeD. A vendors configuration management
program must be able to sustain a complete configuration audit by an NCSC review team. Source:
NCSC-TG-014, Guidelines for Formal Verification Systems.