Which statement below MOST accurately describes configuration
control?

A.
Assuring that only the proposed and approved system changes are implemented

B.
Tracking the status of current changes as they move through the configuration control process

C.
Verifying that all configuration management policies are being followed

D.
The decomposition process of a verification system into CIs

Explanation:
Configuration control is a means of assuring that system changes
are approved before being implemented, only the proposed and
approved changes are implemented, and the implementation is
complete and accuratE. This involves strict procedures for
proposing, monitoring, and approving system changes and their
implementation. Configuration control entails central direction of
the change process by personnel who coordinate analytical tasks,
approve system changes, review the implementation of changes,
and supervise other tasks such as documentation.
*Answer “The decomposition process of a verification system into CIs” is configuration
identification. The decomposition
process of a verification system into Configuration Items (CIs) is
called configuration identification. A CI is a uniquely identifiable
subset of the system that represents the smallest portion to be subject
to independent configuration control procedures.
Answer “Tracking the status of current changes as they move through the configuration control
process” is configuration accounting. Configuration accounting
documents the status of configuration control activities and, in general,
provides the information needed to manage a configuration
effectively. It allows managers to trace system changes and establish
the history of any developmental problems and associated fixes.
Configuration accounting also tracks the status of current changes as
they move through the configuration control process. Configuration
accounting establishes the granularity of recorded information and
thus shapes the accuracy and usefulness of the audit function.
*Answer “Verifying that all configuration management policies are being follow” is configuration
audit. Configuration audit is the quality
assurance component of configuration management. It involves periodic
checks to determine the consistency and completeness of
accounting information and to verify that all configuration management
policies are being followeD. A vendors configuration management

program must be able to sustain a complete configuration audit
by an NCSC review team.
Source: NCSC-TG-014, Guidelines for Formal Verification Systems.