CM-3(4) - Configuration Change Control | Security and Privacy Representatives
Require [Assignment: organization-defined security and privacy representatives] to be members of the [Assignment: organization-defined configuration change control element].