The organization develops a configuration management plan for the information system that defines the configuration items for the information system.
No STIG checks reference this CCI.