NIST SP 800-171 REV. 3 03.04.04 Impact Analyses

Requirement

1. Analyze changes to the system to determine potential security impacts prior to change implementation.
2. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.

Explanation

Organizational personnel with security responsibilities conduct impact analyses that include reviewing system security plans, policies, and procedures to understand security requirements; reviewing system design documentation and operational procedures to understand how system changes might affect the security state of the system; reviewing the impacts of system changes on supply chain partners with stakeholders; and determining how potential changes to a system create new risks and the ability to mitigate those risks. Impact analyses also include risk assessments to understand the impacts of changes and determine whether additional security requirements are needed. Changes to the system may affect the safeguards and countermeasures previously implemented. This requirement is related to 03.04.03. Not all changes to the system are configuration controlled.