nerdexam
(ISC)2

CISSP · Question #104

Which of the following are required components for implementing software configuration management systems?

The correct answer is A. Audit control and signoff. Software configuration management (SCM) systems require formal audit control and signoff to ensure changes are tracked, authorized, and accountable throughout the software lifecycle.

Submitted by haruto_sh· Mar 5, 2026Software Development Security

Question

Which of the following are required components for implementing software configuration management systems?

Options

  • AAudit control and signoff
  • BUser training and acceptance
  • CRollback and recovery processes
  • DRegression testing and evaluation

How the community answered

(51 responses)
  • A
    92% (47)
  • B
    2% (1)
  • C
    2% (1)
  • D
    4% (2)

Why each option

Software configuration management (SCM) systems require formal audit control and signoff to ensure changes are tracked, authorized, and accountable throughout the software lifecycle.

AAudit control and signoffCorrect

Audit control and signoff are foundational SCM components defined in standards like IEEE 828, ensuring that every configuration change is formally reviewed, approved, and recorded. This provides traceability and accountability, which are core mandates of any SCM system. Without audit control, the integrity and history of configuration items cannot be verified or enforced.

BUser training and acceptance

User training and acceptance is a change management and project management concern, not a required structural component of a software configuration management system itself.

CRollback and recovery processes

Rollback and recovery processes are important operational and business continuity practices but are not defined as required components within the formal SCM framework or standards.

DRegression testing and evaluation

Regression testing and evaluation is part of the software quality assurance and testing discipline, not a required component of the configuration management system itself, even though it may be triggered by configuration changes.

Concept tested: Required components of software configuration management systems

Source: https://standards.ieee.org/ieee/828/6242/

Topics

#software configuration management#change management#audit control#SDLC

Community Discussion

No community discussion yet for this question.

Full CISSP Practice