Configuration management and control activities involve the documentation of any potential or actual changes done to the security plan. This activity allows personnel to get an idea of the potential threats or impacts resulting from certain changes performed on an information system.

Since information systems are likely to undergo changes in terms of hardware or software, documenting the changes ensures monitoring and keeping track of the changes done to the system.