Attachment E_AWS Configuration Management Plan Associate Template.docx

OFFICE OF INFORMATION AND TECHNOLOGY – VAEC AWS

OFFICE OF

INFORMATION

AND TECHNOLOGY

Configuration Management Plan

VA Enterprise Cloud Amazon Web Services GovCloud High [VAEC AWS GovCloud HIGH] And Organization 2 Information System Name [Organization 2 Information System Name in GRC]

FOR INTERNAL USE ONLY

Entries in BLUE are instructions (to be replaced with instruction request) Entries in RED are to be replaced/completed by the System/Application Team Entries in BLACK should NOT to be changed, they are boiler plate changed (if changes are necessary, please highlight) [Organization2] is the organization/system/application hosted in the VAEC.

1. All colored texts should be removed or converted to black when finalized for signature.

2. This box/page should be removed when finalized.

3. Send to VAECSecurityTeam@va.gov for review PRIOR to final VAEC sign off/approval.

CONFIGURATION MANAGEMENT PLAN APPROVAL

The undersigned acknowledge that they have reviewed the VAEC Amazon Web Services (AWS) GovCloud High [VAEC AWS GOVCLOUD HIGH] & [Organization 2 name/acronym] Configuration Management Plan and agree with the information presented within this document. Changes to this Configuration Management Plan will be coordinated with, and approved by, the undersigned, or their designated representatives.

[Update the name, email address, and title for each stakeholder below (ADD Additional stakeholders if necessary)]

[Send to VAECSecurityTeam@va.gov for review when this document is completed, VAEC will internally route for final VAEC sign off/approval]

Revision History

01/20/2021

Table of Contents

LIST OF TABLES

Introduction System Information

Summary The Configuration Management Plan (CMP) is a Department of Veterans Affairs (VA) Office of Information and Technology (OIT) artifact describing the identification, control, accounting, and auditing of VA configuration items in a secure, orderly, and controlled manner. This artifact supports the Authorizing Official (AO) with information needed to ensure the compliance, quality, and availability of production VA systems deployed in the VAEC Amazon Web Services GovCloud AND [Organization 2 System Name].

Purpose The CMP objective is to identify configuration management (CM) roles and responsibilities, resources, activities, processes, and procedures to ensure all changes to the system are assessed and approved before implementation.

This CMP contains information pertinent to the system(s) named in Section 1.1. This CMP addresses security controls in accordance with the National Institute of Standards and Technology (NIST) Special Publication 800-53 Security and Privacy Control for Federal Information Systems and Organizations:

Table 1 NIST 800-53 Controls

Scope The system adheres to VA OIT enterprise configuration management policies, processes, and procedures set forth by the VA OIT Service Management Office and Enterprise Program Management Office.

This CMP document, along with the corresponding Enterprise Mission Assurance Support Service (eMASS) required security document artifacts for the system, defines the system structure and methods for:

Addressing roles, responsibilities, and configuration management processes and procedures for the system Establishing a process for identifying and managing configuration items throughout the system lifecycle from development/acquisition to retirement/decommission Defining the configuration items for the information system and places the configuration items under configuration management Establishes the configuration management plan as a configuration item to protect it from unauthorized disclosure and modification

The intended audience of the CMP are authorizing officials (AO), information system security officers (ISSO), system owners, and OIT service line, division, and/or facility staff responsible for the day-to-day sustainment of the system configuration items. This CMP is used in conjunction with OIT Configuration and Change Control Management policies and processes, required eMASS security artifacts, and the source repositories, automation tools, monitoring systems, and configuration discovery mechanisms utilized by the system.

Annual Review This CMP, in accordance with VA policy, is subject to annual review for accuracy, relevancy, and continued compliance with applicable federal laws, VA directives, policies, standards, and guidance.

Configuration Management Activities VAEC Roles and Responsibilities The following personnel are responsible for the configuration management tasks and duties for the roles which they are assigned. This information complies with NIST 800-53 CM-9.

Table 2 Roles and Responsibilities

· Chairing and administering CCB meeting and assigning actions where appropriate;

· Identifying CCB voting members;

· Communicating CCB approval criteria to relevant stakeholders;

· Determining if contingent CCB approval criteria has been met;

· Approving/rejecting RFCs; and

· Communicating RFC rejection to relevant stakeholders

The Configuration Manager is the change and configuration management process owner and is held accountable for ensuring that this process is fit for purpose. The process owner’s responsibilities include design, change management, and continual improvement of the process and its metrics. Specific responsibilities include:

· VAEC change and configuration management process implementation;

· Serving as the spokesperson for change and configuration management;

· Communicating the process, initiating process improvements, and setting goals;

· Responding to recommendations put forward relating to the process and tool;

· Overseeing revisions to the change and configuration management processes and related procedures;

· Determining the scope and granularity of the CIs under CM control;

· Reviewing and confirm VAEC components to be treated as CIs;

· Ensuring configuration data is available when and where it is needed to support other service management processes;

· Reviewing RFCs for planned CI changes;

· Planning for audits of the change and configuration management processes;

· Carrying out periodic inventory and audit of VAEC CIs established baselines using cloud-native tools;

· Developing and coordinating general and role-specific change and configuration management training;

· Overseeing metrics, measurements, and reports of the process; and

· Enforcing the change and configuration management processes

· Scheduling CAB meetings;

· Ensuring appropriate attendance to the CAB meetings;

· Facilitating CAB agenda;

· Chairing and administering CAB meeting and assigning actions where appropriate;

· Identifying CAB voting members;

· Referring changes to the CCB for approval;

· Engaging the CCB Chair as necessary;

· Communicating CAB approval criteria to relevant stakeholders;

· Performing actions assigned at the CAB meeting (may include actions for approval criteria if contingent approval is granted to an RFC at the CAB meeting);

· Determining if contingent CAB approval criteria has been met;

· Approving/rejecting RFCs in the change management tool–also updating ‘CAB Comments’ for each RFC;

· Producing and distributing CAB meeting minutes;

· Communicating RFC rejection to relevant stakeholders;

· Determining approval and communicates with stakeholders for emergency changes; and

· Acting as the focal point for the change schedule and for the status change of any currently scheduled change.

· Implementing CCB/CAB approved configuration changes as planned, documented, and scheduled in accordance with direction from the Change Coordinator; and

· Tracking and maintenance of system components

· Coordinates development activities and assigns tasks

· Ensures CM Plan and work instructions are implemented and followed for all software, documentation, and/or any other components for which they are responsible

· Ensures all developers work within the specified CM process and related guidelines as specified in the CM Plan and work instructions

· Establishes the priority of work items

· Submits build/release requests Coordinates development activities and assigns tasks

· Ensures CM Plan and work instructions are implemented and followed for all software, documentation, and/or any other components for which they are responsible

· Ensures all developers work within the specified CM process and related guidelines as specified in the CM Plan and work instructions

· Implementing CCB/CAB approved configuration changes as planned, documented, and scheduled in accordance with direction from the Change Coordinator;

· and Tracking and maintenance of system components

· Developing new security configuration baselines;

· Reviewing and discussing proposed, submitted change(s);

· Evaluating the impact of the change(s) to the existing security configuration baseline;

· Approving/denying change(s) that impact security; and

· Determining security implementation approach.

0. [Organization 2 name/acronym] Roles and Responsibilities The following personnel are responsible for the configuration management tasks and duties for the roles which they are assigned. This information complies with NIST 800-53 CM-9.

Table 2 Roles and Responsibilities

· Chairing and administering CCB meeting and assigning actions where appropriate;

· Identifying CCB voting members;

· Communicating CCB approval criteria to relevant stakeholders;

· Determining if contingent CCB approval criteria has been met;

· Approving/rejecting RFCs; and

· Communicating RFC rejection to relevant stakeholders

System Configuration Manager

The Configuration Manager is the change and configuration management process owner and is held accountable for ensuring that this process is fit for purpose. The process owner’s responsibilities include design, change management, and continual improvement of the process and its metrics. Specific responsibilities include:

· Organization 2 change and configuration management process implementation;

· Serving as the spokesperson for change and configuration management;

· Communicating the process, initiating process improvements, and setting goals;

· Responding to recommendations put forward relating to the process and tool;

· Overseeing revisions to the change and configuration management processes and related procedures;

· Determining the scope and granularity of the CIs under CM control;

· Reviewing and confirm Organization 2 components to be treated as CIs;

· Ensuring configuration data is available when and where it is needed to support other service management processes;

· Reviewing RFCs for planned CI changes;

· Planning for audits of the change and configuration management processes;

· Carrying out periodic inventory and audit of Organization 2 CIs established baselines using cloud-native tools;

· Developing and coordinating general and role-specific change and configuration management training;

· Overseeing metrics, measurements, and reports of the process; and

· Enforcing the change and configuration management processes

· Scheduling CAB meetings;

· Ensuring appropriate attendance to the CAB meetings;

· Facilitating CAB agenda;

· Chairing and administering CAB meeting and assigning actions where appropriate;

· Identifying CAB voting members;

· Referring changes to the CCB for approval;

· Engaging the CCB Chair as necessary;

· Communicating CAB approval criteria to relevant stakeholders;

· Performing actions assigned at the CAB meeting (may include actions for approval criteria if contingent approval is granted to an RFC at the CAB meeting);

· Determining if contingent CAB approval criteria has been met;

· Approving/rejecting RFCs in the change management tool–also updating ‘CAB Comments’ for each RFC;

· Producing and distributing CAB meeting minutes;

· Communicating RFC rejection to relevant stakeholders;

· Determining approval and communicates with stakeholders for emergency changes; and

· Acting as the focal point for the change schedule and for the status change of any currently scheduled change.

· Coordinates development activities and assigns tasks

· Ensures CM Plan and work instructions are implemented and followed for all software, documentation, and/or any other components for which they are responsible

· Ensures all developers work within the specified CM process and related guidelines as specified in the CM Plan and work instructions

· Establishes the priority of work items

· Implementing CCB/CAB approved configuration changes as planned, documented, and scheduled in accordance with direction from the Change Coordinator; and

· Tracking and maintenance of system components

· Submits build/release requests

· Coordinates development activities and assigns tasks

· Ensures CM Plan and work instructions are implemented and followed for all software, documentation, and/or any other components for which they are responsible

· Ensures all developers work within the specified CM process and related guidelines as specified in the CM Plan and work instructions

· Implementing CCB/CAB approved configuration changes as planned, documented, and scheduled in accordance with direction from the Change Coordinator; and

· Tracking and maintenance of system components

· Developing new security configuration baselines;

· Reviewing and discussing proposed, submitted change(s);

· Evaluating the impact of the change(s) to the existing security configuration baseline;

· Approving/denying change(s) that impact security; and

· Determining security implementation approach.

Communication System configuration information and activities surrounding configuration changes are communicated to relevant system stakeholders utilizing standard VA methods of meetings, email distribution lists, OIT Bulletins, et al.

Approval Methods VAEC change requests are entered into the VAEC Change Management System for review, approval, and implementation by the appropriate Servicing Divisions. Change Control and Advisory Board reviews are required for changes that impose downtime for the system or service or pose a risk or affect multiple facilities or services. It is the responsibility of the implementation team to notify potentially affected customers and personnel required to provide support, e.g., Organizational Servicing Divisions, Network Chief Information Officer (NCIO), Facility Chief Information Officer (FCIO), etc.

Enter additional System/Application Approval Methods below:

User/Stakeholder Notification The VAEC utilizes the VAEC Service Desk (VSD) to document, approve and track all changes related to the system infrastructure and/or GSS applications. The VSD provides a workflow that follows the VAEC process. The VAEC team coordinates and provides oversight for configuration change control activities. Impacted customers are notified through established OIT notification systems as required.

Enter additional System/Application User/Stakeholder Notifications below:

Baseline Configuration The configuration baseline is an agreed state of the attributes of the system, at a point in time, which serves as a basis for defining change. A change is a modification to the baseline that results in progressing to a new baseline state. The purpose of baseline management is to identify and document significant changes from an existing state to a new state while retaining a history of prior states.

Baseline changes to any configuration item within the collection of configuration items that comprise the system are approved as required by established VA policies and procedures, to include source code, system components, and controlled document artifacts.

The baseline may be a single work product, or a set of work products that are used as a logical basis for comparison. Baselines are established for the following:

Secure Configuration Baseline:

VA OIT has established secure configuration baselines for software products or technologies which become part of the product baseline for the system VAEC also follows CSP FedRAMP secure configuration baselines (when applicable) Allocated Baseline: defines the configuration items that compose the system and how it is distributed across the lower-level configuration items Product Baseline: the approved configuration of the production system components during the operational phase of its lifecycle Development Baseline: a static snapshot of the source code tree captured from within the system source control repository

The sections below describe the method for identifying and controlling the specified configuration items that comprise the system.

Secure Configuration Baselines OIT Solution Delivery develops enterprise secure configuration baselines required to be applied to the information system. The secure configuration baselines are reviewed and updated by Solution Delivery on a semi-annual basis, or as needed, as defined by a substantial change to existing purpose, scope, roles, responsibilities, coordination among organizational entities, and/or a substantial change due to conformance and/or compliance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and/or guidance. A complete list of secure configuration baselines is located at: https://vaww.vashare.oit.va.gov/sites/itops/svcs/sma/BCM/Lists/Secure_Configuration_Baselines/GeneralView.aspx Secure configuration baselines utilized by the system are documented and detailed in eMASS Control Correlation Identifiers (CCI) and Assessment Procedures (AP).

Table 3 Secure Configuration Baseline Controls

Allocated and Product Baselines Allocated and product baselines for the system are detailed in eMASS CCIs and APs.

Table 4 Allocated and Product Baseline Controls

Component Inventories Hardware and Software Components Hardware and software component inventories for the system are detailed in eMASS CCIs and APs.

Table 5 Hardware and Software Component Controls

Configuration Change Control VA OIT has established and documented processes and procedures that dictate the configuration change control for all hardware, software, and source code/artifact configuration items. A VA authorized source control tool is used for controlling and approving changes to VA source code assets and artifacts. The VA authorized ITSM tool, ServiceNow, is used for requesting, approving, implementing, monitoring, and tracking, auditing and closing change requests affecting configuration items under change and configuration control.

Change Requests are entered into the authorized VA ITSM change control system, ServiceNow, for review, approval, and implementation by the appropriate VA OIT organizations or service providers. Configuration Control Board and Change Advisory Board reviews are required per the VA Enterprise Change Control Management Policy. It is the responsibility of the system team to notify potentially affected customers, system stakeholders, and personnel required to provide system support of planned changes.

Step 1: Establish System Configuration Baselines Step 2: Identify changes and complete Change Request Activity 1: Initiate Request for Change Activity 2: Review, Assess, and Authorize Change Activity 3: Develop, Package, and Test Activity 4: Plan and Schedule Activity 5: Approve for Implementation Activity 6: Coordinate Implementation Activity 7: Review and Close Activity E-1: Plan & Schedule Emergency Change Activity E-2: Coordinate and Implement Emergency Change Activity E-3: Review and Close Emergency Change Step 3: Verify Implemented changes are successful and did not introduce additional issues/incidents into the environment Step 4: Perform Configuration Status Accounting Step 5: Conduct Configuration Verification and Audit

Configuration Change Control details for the system are detailed in eMASS CCIs and APs.

Table 6 Configuration Change Control Controls

Security Impact Analysis A security impact analysis (SIA) is conducted by the System Owner for proposed changes impacting the security posture of the information system. The VA Risk Management Framework (RMF) guides SIA activities for the system. Activities are documented in the System Security Plan (SSP) as required by NIST 800-53 PL-2 System Security Plan. SIA activities occur during the Assessment and Authorization (A&A) process required for obtaining an authorization to operation (ATO) and is automated utilizing the eMASS system. Any significant changes altering the security posture of the information system require a reauthorization and occur prior to implementing the change.

SIA details for the system are detailed in eMASS CCIs and APs.

Table 7 Security Impact Analysis Control

Access Restrictions for Change Access Restrictions for Change for the system are detailed in eMASS CCIs and APs.

Table 8 Access Restrictions for Change Controls

Least Functionality Least functionality requirements are documented in the relevant Secure Configuration Baselines defined by VA. See Section 2.3.1 for additional Secure Configuration Baseline details.

Least Functionality for the system is detailed in eMASS CCIs and APs.

Table 9 Least Functionality Controls

Software Usage Restrictions Authorized Technologies The VA Technical Reference Model (TRM) establishes a common vocabulary and structure for describing information technology used to develop, operate, and maintain enterprise applications. The TRM includes the standards profile and product list used as a technology roadmap for OIT. All technologies, including development components, that comprise the system are evaluated and authorized by TRM (see References).

Appropriate Usage and Licensing Usage and licensing for the system are detailed in eMASS CCIs and APs.

Table 10 Appropriate Usage and Licensing Controls

Open Source Open Source Software authorization is established by VA and detailed in eMASS CCIs.

Table 11 Open Source Controls

User Installed Software User Installed Software for the system are detailed in eMASS CCIs and APs.

Table 12 User Installed Software Controls

Configuration Management Resources Environments Table 13 Environments

Locations Table 14 Locations

Configuration Management Database Configuration item (CI) records for physical hardware system components are discovered using the VA Configuration Management System (CMS) which includes a configuration management database (CMDB) for automating the collection, storage, management, updates, analysis, and presentation of attribute data about hardware configuration items and their relationships throughout their lifecycle. The VA ServiceNow CMS is maintained by the VA OIT Service Management Office.

Change Control Tool The VA ServiceNow ITSM change control system is the automated mechanism used for tracking proposed changes to configuration items. Change requests are entered into the system and assigned to the appropriate groups for review, approval, implementation, configuration status accounting, and configuration verification. Changes are time stamped to provide a timeline and reviewed per VA enterprise change control process and procedures to ensure that changes are processed correctly and are implemented to meet established requirements. Changes are not implemented without approval per OIT change control management policy and procedures.

Build, Deployment, Orchestration Tools GitHub GitHub Enterprise will be used as a centralized distributed version control system/repository that securely stores application code and configuration items, as well as audit history. The VAEC will retain three (3) versions of code baseline configuration: Legacy, Pre-Production, and Production.

Enter additional GitHub usages below:

Red Hat Ansible Tower Ansible Tower is a scripting framework for deploying configuration item changes. Baseline configuration settings are based on the Defense Information Systems Agency (DISA) Security Technical Implementation Guides (STIGs), DISA Security Requirements Guides (SRGs), and VA CRISP Guidelines. It is used to develop and deploy the baseline configuration and other server configurations. Ansible playbooks are stored in GitHub. Ansible Tower also provides an enterprise framework for controlling, securing, and managing the Ansible automation with a user interface and RESTful (representational state transfer) Application Programming Interface (API).

Enter additional Red Hat Ansible Tower usages below:

AWS CloudFormation (TBD) AWS CloudFormation allows the VAEC the ability to create and provision AWS infrastructure deployments predictably and repeatedly. AWS CloudFormation enables you to use a template file to create and delete a collection of resources together as a single unit (a stack). AWS CloudFormation allows you to model your entire infrastructure and application resources with either a text file or programming languages. The AWS CloudFormation Registry and CLI make it easy to manage third party resources with CloudFormation. AWS CloudFormation provisions your application resources in a safe, repeatable manner, allowing you to build and rebuild your infrastructure and applications, without having to perform manual actions or write custom scripts. AWS CloudFormation allows the VAEC to deploy infrastructure as code. CloudFormation template languages in either YAML or JavaScript Object Notation (JSON) format.

Enter additional AWS CloudFormation usages below:

AWS Config AWS Config is a service that enables the VAEC to assess, audit, and evaluate the configurations of deployed AWS resources. Config continuously monitors and records VAEC customer AWS resource configurations and allows the ability to automate the evaluation of recorded configurations against desired configurations. With Config, the VAEC can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine overall compliance against the configurations specified in guidelines. This enables you to simplify compliance auditing, security analysis, change management, and operational troubleshooting.

Enter additional AWS Config usages below:

IBM BigFix As available, IBM BigFix is used to centrally manage, apply, monitor, and verify server configuration settings in accordance with VA CRISP Guidelines. It is an endpoint security and management platform that provides real-time visibility and control across endpoints; however, they are connected. The VAEC employs IBM BigFix to automatically maintain an up-to-date, complete, accurate, and readily available server baseline configuration. The VAEC retains three (3) versions of server baseline configurations: Legacy, Pre-Production, and Production. IBM BigFix is also employed to identify and audit for unauthorized configuration changes to operational systems. An alert is sent to system engineers/administrators from BigFix if an unauthorized change occurs. The VA OIT SDE and NSOC employ automated mechanisms (System Center Configuration Manager, BigFix, etc.) to continuously detect the presence of unauthorized hardware, software, and firmware components within the information system (as a series of dashboards). The VAEC will maintain an online real-time inventory of system components utilizing IBM BigFix and a CASB. The inventory includes network-based components and cloud services implemented. The real-time inventory list provides a level of granularity deemed necessary for tracking and reporting.

VAEC Workflow Manager VWFM (VAEC Workflow Manager) is an Information Technology Service Management system to submit and track incident and change requests and escalate and progress requests through designated workflows, from submission through closure.

Tenable Nessus The Tenable Nessus scanner is used to provide vulnerability management detection and auditing of assets within VAEC.

Appendix A: References The following table summarizes the documents referenced in this document.

Table 15 References

Standard Operating Procedures https://vaww.vashare.oit.va.gov/sites/ois/KnowledgeService/eMASS%20Documents/Authorization%20Requirements%20SOP%20Guide_eMASS%20-%2001132020.pdf

and Organizations https://csrc.nist.gov/publications/detail/sp/800-53/rev-4/final

Appendix B: Acronyms VA Acronym Lookup: https://vaww.va.gov/Acronyms/update.cfm Table 16 Acronyms

Appendix C: Configuration Item Examples A configuration item (CI) is any component of a system or related artifact that needs to be managed, controlled, and baselined to deliver an IT service. Information about a configuration item is controlled and maintained through its lifecycle by configuration management.

Table 17 Configuration Item Examples

Appendix D: Development Configuration Management The VA OIT Enterprise Program Management Office (EPMO) Enterprise Portfolio Management Division (EPMD) oversees program and project management in enterprise-wide scheduling, resource allocation, testing, design, engineering, and implementation of VA services.

1. Source Management Activities Table 18 Source Management Activities

Development Resources Table 19 Development Resources

Development Roles and Responsibilities Table 20 Development Roles and Responsibilities

Supports change and configuration management through Backlog Grooming Manages project scope by facilitating Sprint Planning

Oversees the CM process Ensures team members have completed the training for the source tools Supports change management protocol defined by CM Works with System Owner on Product Backlog Identifies dependent projects Establishes/revises list of required artifacts

Establishes, promotes, and releases baselines Works with the enterprise tools teams to create and administer the CM tool environment Performs or validates interim and final builds Prepares release package, release archives, and VDD Accountable for instituting the established processes and reporting progress statistics based on change requests Identifies product baselines as necessary for all products within their assigned projects Conducts CM audits and necessary status accounting related to the product at scheduled milestones

Coordinates development activities and assigns tasks Ensures CM Plan and work instructions are implemented and followed for all software, documentation, and/or any other components for which they are responsible Ensures all developers work within the specified CM process and related guidelines as specified in the CM Plan and work instructions

Maintains source code and documentation within the VA enterprise CM tool Apply links between artifacts as appropriate

Updates all assigned work items with accurate, detailed information

Verifies that only CM-approved deliverables are installed into the test environment(s) Ensures that SQA Analysts are always testing from official CM deliverables Reviews status accounting related to the project Reviews deliverable artifacts

Updates work items assigned to them according to test activity results Determines Pass/Fail for each work item scheduled for a release Opens defect work items for any newly discovered problems during testing Apply links between artifacts as appropriate

Development Configuration Manager Activities The System Configuration Manager is engaged with system development from the planning stage through to project closeout to provide complete lifecycle support.

Development Environment Planning and Setup Collaborates with Project Managers to identify products to be modified during the development cycle and document the configuration items Identifies and obtains access to the appropriate CM repositories Requests isolated area(s) within the CM repositories for product development and artifacts Submits access requests with the appropriate roles for product team members Creates development, integration, and baselines as appropriate Populates the branch with the appropriate baselines to create the foundation from which development will begin Creates specific identifiers for use in change records to uniquely identify the product and any specific elements within the product Collaborates with the Scrum Master to map change records to specific backlogs or sprint plans Creates work instructions to identify processes and assist the development team in proper use of the CM tools Creates CM Plan

Development Support Activities Assists with code merges between branches Coordinates implementation of build tools Applies baselines immediately following build completion Validates appropriate change record status Identifies changes between builds to assist with testing scope by following baseline processes Assists with linking capabilities between change records, test artifacts and requirements

Release Preparation Packages and documents releases Verifies baselines to identify the artifacts that comprise the release Finalizes the VDD that has been continuously updated with each build that was promoted outside of the integration test environment; the VDD contains all changes made since the previous release Bundles the artifacts and perform the handoff to the appropriate parties

Project Closeout Works with the PM and Release Manager to:

Update all change records and promote through to completion Make sure no artifacts are checked out in source control Make sure that no artifacts are locked to prevent updates in source control Archive anything that is project specific and will not be reused by a future project Request source repository access…