Change is a part of any production process and must be meticulously managed. System Change Management is a CMMC requirement, and you have been called…

CMMC practice CM.L2-3.4.3 requires an organization to "Track, review, approve or disapprove, and log changes to organizational systems." While a policy establishes intent, an assessor must verify implementation. Organizational procedures provide the detailed, step-by-step instructions for how change control is executed. Change control and audit review reports serve as the objective evidence—the logs and records—that the procedures are being followed. These artifacts directly demonstrate that changes are being formally tracked, reviewed, and approved, fulfilling the core requirements of the practice. They are essential for moving beyond policy and proving operational compliance.

A. Employee satisfaction surveys are subjective metrics about process perception, not objective evidence that the change control process was actually followed.

B. System uptime statistics represent an outcome or benefit of a good process but do not directly prove that changes were tracked, reviewed, and logged.

D. Antivirus scan reports are evidence for malware protection and system monitoring controls (e.g., SI domain), not for the configuration management (CM) domain.

---

1. Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0, Department of Defense, December 2021.

Page 31, CM.L2-3.4.3: The practice is defined as "Track, review, approve or disapprove, and log changes to organizational systems." This establishes the core activities that must be evidenced.

2. CMMC Assessment Guide – Level 2, Department of Defense, December 2021.

Pages 61-62, CM.L2-3.4.3: Under "Potential Assessment Methods and Objects," the guide explicitly lists "Examine: ...procedures addressing configuration change control; ...list of approved changes to the systems; ...change control records; system audit logs and records..." This directly supports that procedures and reports/records are primary evidence artifacts.

3. NIST Special Publication 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, February 2020.

Page 21, Section 3.4.3: This publication, which forms the basis for CMMC Level 2, contains the identical requirement. The discussion notes emphasize "the systematic proposal, justification, implementation, testing, review, and disposition of changes" and the "review and analysis of change records," which are documented in procedures and reports.

4. NIST Special Publication 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations, September 2020.

Page 131, Control CM-3, Configuration Change Control: This foundational control, from which NIST SP 800-171 derives its requirements, explicitly calls for organizations to "Review proposed...changes...and approve or disapprove," "Document configuration change decisions," and "Implement approved...changes." These actions are captured in procedures and change control reports.