Configuration Management: A Support Process Area at Maturity Level 2
Purpose
The purpose of Configuration Management (CM) is to establish and maintain the integrity of work products using configuration identification, configuration control, configuration status accounting, and configuration audits.
Tip
Because CM is a Support process area, it is up to the acquisition project and organization to decide which customer, acquirer, or delivered supplier work products are subject to CM and to determine the level of control needed for each.
Introductory Notes
The Configuration Management process area involves the following activities:
• Identifying the configuration of selected work products that compose baselines at given points in time
• Controlling changes to configuration items
• Building or providing specifications to build work products from the configuration management system
• Maintaining the integrity of baselines
• Providing accurate status and current configuration data to developers, end users, and customers
Tip
The CM system should capture enough information to identify and maintain work products after the personnel who originally developed them have left the project.
The work products placed under configuration management include the products that are delivered to the customer, designated internal work products, acquired products, tools, and other items used in creating and describing these work products. (See the definition of “configuration management” in the glossary.)
Acquired products may need to be placed under configuration management by both the supplier and the acquirer. Provisions for conducting configuration management should be established in supplier agreements. Methods to ensure that data are complete and consistent should be established and maintained.
The configuration management approach depends on acquisition factors such as acquisition approach, number of suppliers, design responsibility, support concept, and associated costs and risks. In any case, configuration management involves interaction between the acquirer and supplier.
Planning for managing configuration items, including during the transition to operations and support, is addressed as part of project planning and supplier agreement development to avoid unexpected costs for both the acquirer and supplier. Project plans and supplier agreements should make provisions for managing configuration items in and across project teams and the infrastructure required to manage configuration items among the acquirer, supplier, operational users, and other relevant stakeholders.
Tip
During the transition to operations and support, the acquisition project should ensure that the configuration of both the delivered products and the items required to support the delivered products (e.g., support or test environments, requirements, architecture, design artifacts) are maintained.
Configuration management of work products can be performed at several levels of granularity. Configuration items can be decomposed into configuration components and configuration units. Only the term “configuration item” is used in this process area. Therefore, in these practices, “configuration item” may be interpreted as “configuration component” or “configuration unit” as appropriate. (See the definition of “configuration item” in the glossary.)
Tip
Many acquirer-developed work products, such as plans, requirements, and interfaces, are critical to guiding stakeholders through the life of the project. These work products must be maintained to reflect the current project scope and objectives.
Baselines provide a stable basis for the continuing evolution of configuration items.
Baselines are added to the configuration management system as they are developed. Changes to baselines and the release of work products built from the configuration management system are systematically controlled and monitored via the configuration control, change management, and configuration auditing functions of configuration management.
Hint
Make explicit decisions about who has the authority in the project to approve baseline changes; document these decisions in project plans.
This process area applies not only to configuration management on projects but also to configuration management of organizational work products such as standards, procedures, reuse libraries, and other shared supporting assets.
Tip
Any work product whose integrity should be ensured over a period of time might benefit from CM. For example, multiple acquisition programs may be ongoing and have schedule dependencies with one another. Establishing a cross-program CM approach may facilitate coordination efforts.
Configuration management is focused on the rigorous control of the managerial and technical aspects of work products, including the delivered product or service.
This process area covers the practices for performing the configuration management function and is applicable to all work products that are placed under configuration management.
For acquisition of product lines and standard services, configuration management can involve additional considerations due to the sharing of core assets across acquisitions (and perhaps organizations) and across multiple versions of core assets. In such a case, the configuration management approach and specific responsibilities should be specified in supplier and customer agreements. (See the definition of “product line” in the glossary.)
Related Process Areas
Refer to the Agreement Management process area for more information about accepting the acquired product.
Refer to the Project Monitoring and Control process area for more information about monitoring the project against the plan and managing corrective action to closure.
Refer to the Project Planning process area for more information about developing a project plan.
Specific Practices by Goal
SG 1 Establish Baselines
Baselines of identified work products are established.
Specific practices to establish baselines are covered by this specific goal. The specific practices under the Track and Control Changes specific goal serve to maintain the baselines. The specific practices of the Establish Integrity specific goal document and audit the integrity of the baselines.
SP 1.1 Identify Configuration Items
Identify configuration items, components, and related work products to be placed under configuration management.
Configuration identification is the selection and specification of the following:
• Products delivered to the customer
• Designated internal work products
• Acquired products
• Tools and other capital assets of the project’s work environment
• Other items used in creating and describing these work products
Configuration items can include hardware, equipment, and tangible assets as well as software and documentation. Documentation can include requirements specifications and interface documents. Other documents that serve to identify the configuration of the product or service, such as test results, may also be included.
A “configuration item” is an entity designated for configuration management, which may consist of multiple related work products that form a baseline. This logical grouping provides ease of identification and controlled access. The selection of work products for configuration management should be based on criteria established during planning.
Configuration items can vary widely in complexity, size, and type, from an aircraft to commercial off-the-shelf software to a test meter or a project plan. Any item required for product support and designated for separate procurement is a configuration item. Acquirer work products provided to suppliers such as solicitation packages and technical standards are typically designated as configuration items.
Hint
When developing your project plan, consider configuration items and work products you receive from customers, those you develop internally, and those delivered by suppliers.
Example Work Products
1. Identified configuration items
Subpractices
1. Select configuration items and work products that compose them based on documented criteria.
Hint
Use criteria when selecting configuration items to ensure that the selection process is consistent and thorough.
Hint
Consider selecting configuration management tools that are compatible with the tools used by your suppliers and other stakeholders to ensure that unique identifiers are consistent.
2. Assign unique identifiers to configuration items.
3. Specify the important characteristics of each configuration item.
4. Specify when each configuration item is placed under configuration management.
Tip
Specifying when a configuration item must be placed under CM sets expectations among team members about the control of the project’s work products.
5. Identify the owner responsible for each configuration item.
6. Specify relationships among configuration items.
Incorporating the types of relationships (e.g., parent-child, dependency) that exist among configuration items into the configuration management structure (e.g., configuration management database) assists in managing the effects and impacts of changes.
SP 1.2 Establish a Configuration Management System
Establish and maintain a configuration management and change management system for controlling work products.
Tip
If the acquisition project maintains only the configuration of project documents, a simple spreadsheet or data management system may suffice. To maintain the configuration of products delivered to end users, more complex tools are necessary.
A configuration management system includes the storage media, procedures, and tools for accessing the system. A configuration management system can consist of multiple subsystems with different implementations that are appropriate for each configuration management environment.
A change management system includes the storage media, procedures, and tools for recording and accessing change requests.
Hint
The number of baselines you need to maintain and the complexities of working with geographically dispersed teams are two considerations that typically arise when selecting commercial software packages to help with CM.
The acquirer considers how configuration items are shared between the acquirer and supplier as well as among relevant stakeholders. If the use of an acquirer’s configuration management system is extended to a supplier, the acquirer should exercise security and access control procedures. In many cases, leaving acquired configuration items in the physical possession of the supplier and having access to supplier deliverables is an alternative solution. The supplier agreement specifies appropriate acquirer rights to supplier deliverables, in addition to requirements for delivery or access. Supplier work products, whenever they are delivered to the acquirer, are presented in accordance with accepted standards to ensure usability by the acquirer.
Hint
When dealing with sensitive information during the acquisition process, you must consider taking additional steps to ensure the integrity of the acquisition process and its products.
Example Work Products
1. Configuration management system with controlled work products
2. Configuration management system access control procedures
3. Change request database
Subpractices
1. Establish a mechanism to manage multiple levels of control.
The level of control is typically selected based on project objectives, risk, and resources. Control levels can vary in relation to the project lifecycle, type of system under development, and specific project requirements.
Tip
Not all configuration items require the same level of control. Some may require more control as they move through the project lifecycle.
Levels of control can range from informal control that simply tracks changes made when configuration items are being developed by the acquirer or when supplier work products are delivered or made accessible to the acquirer, to formal configuration control using baselines that can only be changed as part of a formal configuration management process.
Tip
A formal CM process is typically change-request based and requires extensive tracking, review, and approval of all changes.
2. Provide access control to ensure authorized access to the configuration management system.
Tip
Version control is an important part of CM. A variety of ways may be used to identify versions; the standard approach is to use sequential numbering.
3. Store and retrieve configuration items in a configuration management system.
4. Share and transfer configuration items between control levels in the configuration management system.
5. Store and recover archived versions of configuration items.
6. Store, update, and retrieve configuration management records.
Hint
Review the content of reports from the CM system regularly to ensure the integrity of configuration items and work products.
7. Create configuration management reports from the configuration management system.
8. Preserve the contents of the configuration management system.
9. Revise the configuration management structure as necessary.
Hint
Review the CM system regularly to ensure that it is meeting the needs of the projects it serves.
SP 1.3 Create or Release Baselines
Create or release baselines for internal use and for delivery to the customer.
A baseline is represented by the assignment of an identifier to a configuration item or a collection of configuration items and associated entities at a distinct point in time. As a product or service evolves, multiple baselines can be used to control development and testing. (See the definition of “baseline” in the glossary.)
Hardware products as well as software and documentation should also be included in baselines for infrastructure related configurations (e.g., software, hardware) and in preparation for system tests that include interfacing hardware and software.
Tip
Because acquirer-developed work products drive the activities of the acquirer, supplier, and other key stakeholders, having a single source of “truth” is critical for project orchestration and success.
The acquirer reviews and approves the release of product baselines created by the supplier. The acquirer creates baselines for acquirer work products that describe the project, requirements, funding, schedule, and project performance measures and makes a commitment to manage the project to those baselines.
Example Work Products
1. Baselines
2. Description of baselines
Tip
If the project or organization uses multiple baselines, it is critical to ensure that everyone is using the correct baseline.
Example Supplier Deliverables
1. Product baselines
2. Description of product baselines
Tip
The acquisition project team may run or participate in several CCBs. These CCBs can be with customers, with members internal to the acquisition organization, with collaborating acquisition teams in a systems-of-systems environment, or with suppliers. A clear and common understanding of how these CCBs interact is critical.
Subpractices
1. Obtain authorization from the CCB before creating or releasing baselines of configuration items.
2. Create or release baselines only from configuration items in the configuration management system.
3. Document the set of configuration items that are contained in a baseline.
4. Make the current set of baselines readily available.
SG 2 Track and Control Changes
Changes to the work products under configuration management are tracked and controlled.
The specific practices under this specific goal serve to maintain baselines after they are established by specific practices under the Establish Baselines specific goal.
Tip
Depending on the types of work products and levels of control required, changes may be tracked and controlled by individuals through management forums or through formal CCBs.
SP 2.1 Track Change Requests
Track change requests for configuration items.
Change requests address not only new or changed requirements but also failures and defects in work products.
Tip
Change requests must be sufficiently detailed to enable their analysis and disposition. Using mechanisms that require certain types of information to be documented when gathering change requests can save time and ensure adequate information.
Change requests can be initiated either by the acquirer or supplier. Changes that affect acquirer work products and supplier deliverables as defined in the supplier agreement are handled through the acquirer’s configuration management process.
Change requests are analyzed to determine the impact that the change will have on the work product, related work products, the budget, and the schedule.
Example Work Products
1. Change requests
Tip
The acquirer may need to track change requests to supplier products that are not within the scope of the supplier’s contract.
Example Supplier Deliverables
1. Change requests
Subpractices
1. Initiate and record change requests in the change request database.
2. Analyze the impact of changes and fixes proposed in change requests.
Changes are evaluated through activities that ensure that they are consistent with all technical and project requirements.
Changes are evaluated for their impact beyond immediate project or contract requirements. Changes to an item used in multiple products can resolve an immediate issue while causing a problem in other applications.
The acquirer analyzes the impact that submitted change requests can have on supplier agreements.
Refer to the Solicitation and Supplier Agreement Development process area for more information about establishing the supplier agreement.
Changes are evaluated for their impact on release plans.
Tip
A database provides a flexible environment for storing and tracking change requests.
3. Categorize and prioritize change requests.
Emergency requests are identified and referred to an emergency authority if appropriate.
Changes are allocated to future baselines.
Tip
The acquirer and end user may determine that certain change requests are outside the scope of current supplier agreements and may require the initiation of a new acquisition project for a follow-on system, major system modification, or rescoping of the current agreement. Alternatively, the change may be deferred indefinitely.
4. Review change requests to be addressed in the next baseline with relevant stakeholders and get their agreement.
Conduct the change request review with appropriate participants. Record the disposition of each change request and the rationale for the decision, including success criteria, a brief action plan if appropriate, and needs met or unmet by the change. Perform the actions required in the disposition and report results to relevant stakeholders.
5. Track the status of change requests to closure.
Change requests brought into the system should be handled in an efficient and timely manner. Once a change request has been processed, it is critical to close the request with the appropriate approved action as soon as it is practical. Actions left open result in larger than necessary status lists, which in turn result in added costs and confusion.
Hint
Track change requests to closure to ensure that if a change request is not addressed, it was not lost or missed.
SP 2.2 Control Configuration Items
Control changes to configuration items.
Control is maintained over the configuration of the work product baseline. This control includes tracking the configuration of each configuration item, approving a new configuration if necessary, and updating the baseline.
Hint
When deciding whether the acquirer or the supplier will maintain configuration control, consider the risk to the integrity of critical work products if the supplier fails to meet contractual requirements and that breach results in legal action.
The acquirer decides which configuration items require version control, or more stringent levels of configuration control, and establishes mechanisms to ensure configuration items are controlled. Although the supplier can manage configuration items on the acquirer’s behalf, the acquirer is responsible for approval and control of changes to these configuration items.
Tip
A revision history usually identifies not only what was changed, but also who made the changes and when and why they were made.
Example Work Products
1. Revision history of configuration items
2. Archives of baselines
Subpractices
1. Control changes to configuration items throughout the life of the product or service.
2. Obtain appropriate authorization before changed configuration items are entered into the configuration management system.
Tip
The life of the product is typically longer than the life of the acquisition project. The responsibility for configuration items may change over time.
Hint
Define authorization procedures so that it is clear how to receive authorization to enter an updated configuration item into the CM system.
3. Check in and check out configuration items in the configuration management system for incorporation of changes in a manner that maintains the correctness and integrity of configuration items.
Tip
An important part of check-in and check-out is ensuring that only one copy of a configuration item is authorized for update at one time.
4. Perform reviews to ensure that changes have not caused unintended effects on the baselines (e.g., ensure that changes have not compromised the safety or security of the system).
5. Record changes to configuration items and reasons for changes as appropriate.
If a proposed change to the work product is accepted, a schedule is identified for incorporating the change into the work product and other affected areas.
Configuration control mechanisms can be tailored to categories of changes. For example, the approval considerations could be less stringent for component changes that do not affect other components.
Changed configuration items are released after review and approval of configuration changes. Changes are not official until they are released.
SG 3 Establish Integrity
Integrity of baselines is established and maintained.
The integrity of baselines, established by processes associated with the Establish Baselines specific goal, and maintained by processes associated with the Track and Control Changes specific goal, is addressed by the specific practices under this specific goal.
Tip
Because baselines are often the “footprints” of a product, it is important that they are accurate.
SP 3.1 Establish Configuration Management Records
Establish and maintain records describing configuration items.
Tip
When the acquisition project team is small and CM is informal, records describing the status of configuration items are as critical as they are with a large team. These records ensure a smooth handoff when team members leave the project.
Example Work Products
1. Revision history of configuration items
2. Change log
4. Status of configuration items
5. Differences between baselines
Example Supplier Deliverables
1. Revision history of product and supplier deliverables defined in the supplier agreement
Subpractices
1. Record configuration management actions in sufficient detail so the content and status of each configuration item is known and previous versions can be recovered.
2. Ensure that relevant stakeholders have access to and knowledge of the configuration status of configuration items.
3. Specify the latest version of baselines.
4. Identify the version of configuration items that constitute a particular baseline.
5. Describe differences between successive baselines.
6. Revise the status and history (i.e., changes, other actions) of each configuration item as necessary.
Hint
When describing the differences between baselines, be detailed enough so that users of the baselines can differentiate them easily.
SP 3.2 Perform Configuration Audits
Perform configuration audits to maintain the integrity of configuration baselines.
Configuration audits confirm that the resulting baselines and documentation conform to a specified standard or requirement. Configuration item related records can exist in multiple databases or configuration management systems. In such instances, configuration audits should extend to these other databases as appropriate to ensure accuracy, consistency, and completeness of configuration item information. (See the definition of “configuration audit” in the glossary.)
Hint
Consider conducting audits prior to the handoff of work products among the customer, acquirer, supplier, and other stakeholders.
Example Work Products
1. Configuration audit results
2. Action items
Example Supplier Deliverables
1. Supplier configuration audit results
Subpractices
1. Assess the integrity of baselines.
2. Confirm that configuration management records correctly identify configuration items.
Tip
Integrity includes both accuracy and completeness.
3. Review the structure and integrity of items in the configuration management system.
4. Confirm the completeness, correctness, and consistency of items in the configuration management system.
Completeness, correctness, and consistency of the configuration management system’s content are based on requirements as stated in the plan and the disposition of approved change requests.
Tip
An audit is effective only when all action items from the audit are addressed.
5. Confirm compliance with applicable configuration management standards and procedures.
6. Track action items from the audit to closure.