Configuration management is the management discipline that keeps the documents defining a product's or system's functional and physical characteristics, the changes to those documents and the product as actually built consistent with each other throughout the life cycle. It can be summed up in one question: which approved document set, and which revision, does the product in front of us correspond to?
Two main frameworks apply. The current 2017 version of ISO 10007, the guidance standard from the International Organization for Standardization (ISO), applies to supporting products and services from concept to disposal. SAE International's EIA-649C, in its version dated 7 February 2019, defines five configuration management functions and their underlying principles.
In short:
- The five functions of configuration management: planning and management, identification, change management, status accounting, and verification and audit (EIA-649C, NASA).
- ISO 10007:2017 was reviewed and confirmed in 2023; according to ISO, the standard is now being revised.
- Poor configuration management, as NASA puts it, can result in incorrect, ineffective or unsafe products being released.
What is configuration management and why is it needed?
NASA's systems engineering handbook defines configuration management as a management discipline applied over the product's life cycle and, drawing on SAE/EIA 649B, gives an important warning: improper configuration management may result in incorrect, ineffective and/or unsafe products being released. The most common symptoms in practice are not knowing which drawing revision a fielded product was built to, an unapproved change slipping into production, and spare parts that do not fit the configuration in the field.
Configuration management is not limited to hardware. According to the EIA-649C abstract, its principles apply equally to a company's internal information, processes and supporting systems and to contracted relationships between acquirer and supplier.
What is the difference between ISO 10007 and EIA-649?
ISO 10007:2017 is a guidelines standard; it does not set certification requirements but gives guidance on how an organisation can use configuration management. According to ISO's page, it is a 10-page third edition prepared by ISO/TC 176/SC 3, it replaced the 2003 version and it was reviewed and confirmed in 2023. The same page shows the standard at the "to be revised" stage, with a new working draft (ISO/WD 10007) under development. No publication date for the new version has been set; the 2017 version remains current.
EIA-649C is a US-origin standard widely used in defence and aerospace. According to SAE, it defines five functions and principles that capture the essence of each; taken together, the principles form a "best practice" checklist for evaluating a configuration management programme. SAE also notes that acquirers can use these principles to evaluate supplier plans or to make them a contract requirement.
In short, ISO 10007 explains how to set up configuration management within a quality management system, while EIA-649C defines, at the level of principles, what can be expected, especially in supply chain relationships.
What are the five functions of configuration management?
The NASA handbook lists the five functions in line with EIA-649 as follows:
- Planning and management: Who approves what, which records are kept, which tool is used? These decisions are written down in a configuration management plan.
- Configuration identification: According to NASA, the systematic process of selecting, organising and stating product attributes. Configuration items (CIs) to be controlled are selected, each is given a unique identifier, and baselines are established. The handbook defines functional, allocated and product baselines separately.
- Change management (change control): Every change to a baseline is proposed, evaluated, and approved or rejected. NASA recommends a well-disciplined Configuration Control Board (CCB) for this, whose members have authority to commit the teams they represent. Changes are classified by impact: according to NASA, a minor change corrects or modifies documentation or processes without affecting the interchangeability of products.
- Configuration status accounting (CSA): According to NASA, CSA should provide complete current and historical configuration documentation with unique identifiers and track the status of proposed changes, deviations and waivers. This is where the quick answer to "which revision is serial number X?" comes from.
- Configuration verification and audit: Documents, products and records are inspected to verify that the product conforms to its approved documentation. NASA notes that this is sometimes divided into functional and physical configuration audits. In common usage, the functional audit checks that the product meets its performance requirements, and the physical audit checks that the product as built matches its documentation.
What is a baseline?
A baseline is a set of configuration documents approved at a given point and changeable from then on only through the formal change process. The NASA handbook distinguishes three main baselines:
- Functional baseline: Approved documentation setting out the system's top-level performance requirements and how they will be verified; established at the system definition review.
- Allocated baseline: Approved, performance-oriented documentation for a configuration item still to be developed, carrying the functional, performance and interface characteristics flowed down from higher-level requirements. It is typically established at the end of the preliminary design review.
- Product baseline: Approved technical documentation describing a configuration item's configuration during production, fielding and operational support; typically established at the end of the critical design review.
The handbook also mentions an "as-deployed" baseline at the operational readiness review, by which point all changes are expected to have been incorporated into the documentation. The practical meaning is simple: when a change request arrives, first determine which baseline it affects and choose the approval level accordingly. A change process that is flexible during design becomes much stricter once the product baseline is set.
How does configuration management connect to quality and safety?
Configuration management is the ground other quality processes stand on. In aviation, for example, a first article inspection (FAI) report means little unless it is matched to the part and drawing revision; a partial FAI is possible only if the baseline configuration it builds on is clearly known. Likewise, an FMEA or fault tree analysis loses its currency if the revision of the analysed design is not recorded.
Conclusion: where to start?
Configuration management starts not with a large software project but with a few clear decisions. A practical start is to list the items to be controlled and their reference documents, concentrate change approval authority in a single board, and keep the revision of every fielded product in a record that can be queried. Once these three steps are in place, closing the gaps between documents and the product as built through periodic audits becomes much easier.
"Configuration Management" is part of Orient Global's corporate training catalogue; details are on the trainings page.
#interimmanagement #forwarddeployedengineering #configurationmanagement #iso10007 #eia649 #changecontrol