Change Request Form template: The record of one configuration-controlled change, from request through security and privacy impact analysis, significant-change decision, testing, approval, implementation and verification, adapted from the sample change request and security impact analysis template in NIST SP 800-128, with a register of every change, as SP 800-53 CM-3 and CM-4 require.
The record of one configuration-controlled change, from request through security and privacy impact analysis, significant-change decision, testing, approval, implementation and verification, adapted from the sample change request and security impact analysis template in NIST SP 800-128, with a register of every change, as SP 800-53 CM-3 and CM-4 require.
Use this form for every type of change the system’s Configuration Management Plan lists as configuration-controlled (CM-3a). A standard change cites the change request that approved its class, and needs only Part A and Part F.
The analyst who completes Part B has security or privacy responsibilities and the skills to understand the change, and is not the person who will implement it. Part B is signed and dated before the decision in Part E (CM-4).
For an emergency change, the person the Configuration Management Plan names may approve the change so work can start. Part B is completed as soon as practical, and the change control board reviews the change at its next meeting, recording that review in Part E (CM-3).
Implement the change only after Part E records approval (CM-3d).
Keep the completed form, with its attachments, for Fill in: the time period to retain records of configuration-controlled changes Typical: at least one year, or the life of the system if longer (CM-3e).
Fill in: the configuration change control element responsible for coordinating and overseeing change control activities Typical: a change control board with the system owner, technical leads and a security representative reviews the register at each meeting for changes waiting on a decision, emergency changes not yet reviewed, and approved changes not yet verified (CM-3f, CM-3g).
1. Understand the change: how it will be built and deployed, with a high-level architecture overview where useful. For a change already made, what the audit records and the people who made it show
Fill in: summary
2. Identify vulnerabilities: known vulnerabilities in products being added, for example from the National Vulnerability Database or the vendor’s advisories; for custom code, the results of code review or testing
Fill in: vulnerabilities found, or none, with the sources checked
3. Assess risks: the likelihood and impact of each vulnerability being exploited, and whether to accept, avoid or reduce the risk
Fill in: risk rating and response
4. Assess the impact on existing controls: controls the change alters, settings or baselines it changes, and other components or systems that depend on what is changing, including supply chain partners
Fill in: controls affected, by control ID, and how
5. Plan safeguards and countermeasures: changes to the request, or controls to add, where the risk is not acceptable
OMB Circular A-130, Appendix I, section 5.i, defines a significant change as “a change that is likely to affect the security or privacy state of an information system,” and says that under ongoing authorization, reauthorization is typically an event-driven action in response to an event or significant change that raises security or privacy risk above the agency’s risk tolerance, and may be a complete or a targeted review. Section 5.a says systems undergoing significant changes are expected to meet NIST standards and guidelines immediately on deployment. As of October 2026.
The Part C decision shall use the OMB Circular A-130 definition of a significant change, and each significant change shall be reported to the authorizing official before it is implemented, or, for an emergency change, as soon as it is made. (CM-4)
A significant change shall be deployed meeting the current versions of the NIST standards and guidelines that apply to it, as OMB Circular A-130, Appendix I, section 5.a, expects. (CM-3)
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.