In this third episode of my Configuration Management (CM) explanatory series, I break down NIST SP 800-53 CM-3: Configuration Change Control and simplify what the control is really asking you to do. I walk through the core idea: you don’t just “make changes” to a system—your organization needs a structured way to propose, review, approve/disapprove, implement, and keep records of those changes. I also explain the role of the Change Control Board (CCB) and why security impact analysis has to be explicitly considered before changes hit production. I also point out where CM-3 sits in Rev 5 (selected for Moderate and High systems, not Low) and go line-by-line through the requirements: determine what changes are configuration-controlled, document decisions, implement approved changes, retain records for an org-defined time period, and monitor/review change control activities. Then I shift into how I assess/test CM-3 as a security control assessor—what policies, plans, tickets, and baseline configuration documentation I request, and how I use real change samples (ServiceNow, Jira, Azure DevOps, etc.) to verify both design and operational effectiveness. I close by connecting CM-3 to what’s next—CM-4 Security Impact Analysis.