ISO 10007: Guidelines for Configuration Management

ISO 10007 is the international standard that gives guidance on configuration management. Its full title is "Quality management — Guidelines for configuration management." It explains how an organization can keep track of exactly what a product or service is, in every version, throughout its life, and how to control changes so that what is built, what is documented and what was approved stay in agreement. The current edition, the third, is ISO 10007:2017, published in March 2017.

Configuration management sounds abstract until something goes wrong without it. A replacement part arrives that fits the old design but not the one installed. A software update is applied to some units and not others, and nobody can say which. A drawing is revised, but the factory keeps building from the old one. An auditor asks which version of a component was fitted to a particular aircraft five years ago, and the records cannot answer. Configuration management is the discipline that prevents these failures, and ISO 10007 is the quality-management community's guide to it.

This article covers what the standard says, where configuration management came from, how the five core activities work, how ISO 10007 relates to other standards such as ISO 9001, EIA-649 and IEEE 828, and where its limits lie.

ISO 10007 at a glance

The 2017 foreword states that the third edition "cancels and replaces the second edition (ISO 10007:2003), which has been technically revised," and that it aligns the document with ISO 9000:2015 and ISO 9001:2015.

What configuration management is

The standard's introduction gives a compact description. "Configuration management is a management activity that applies technical and administrative direction over the life cycle of a product and service, its configuration identification and status, and related product and service configuration information." It goes on: configuration management "documents the product or service configuration. It provides identification and traceability, the status of achievement of its physical and functional requirements, and access to accurate information in all phases of the life cycle."

Three phrases in that description are worth unpacking.

"Over the life cycle." Configuration management is not confined to design or production. The Wikipedia summary of ISO 10007 says it applies to supporting products "from concept through disposal." An aircraft, a rail signaling system or a medical device may be in service for decades, modified many times, and still needs an accurate record of what it is.

"Identification and traceability." Every item of significance gets a unique identity, and the relationships between items, versions and documents are recorded so that you can trace from a requirement to a design to a built unit, and back.

"Physical and functional requirements." Configuration covers both what the product is physically (dimensions, materials, parts, software builds) and what it does (performance and functions). Both must match the approved definition.

Configuration management versus related activities

A history of configuration management

Origins in U.S. defense

Configuration management began, according to the Wikipedia article on the subject, in the U.S. Department of Defense in the 1950s as "a technical management discipline for hardware material items." Weapons programs of that era were large, fast-moving and full of design changes, and the services found that they often could not say what configuration had been delivered or how it differed from what was specified.

The U.S. Air Force published an early manual, AFSCM 375-1, "Configuration Management During the Development and Acquisition Phases." A library catalog record lists a June 1964 edition that superseded a June 1962 edition.

The 480 series and MIL-STD-973

In the late 1960s the DoD developed a series of military standards known as the "480 series" (MIL-STD-480, 481 and 483), which were issued in the 1970s, according to the Wikipedia history. In 1991 the 480 series was consolidated into MIL-STD-973, "Configuration Management"; an EverySpec listing shows the base document dated 1992.

Acquisition reform and EIA-649

During the 1990s the DoD moved away from military-unique standards toward commercial and consensus standards. The Electronic Industries Alliance's G-33 committee began developing a national consensus standard for configuration management in 1994. EIA-649 was issued in August 1998. According to the Wikipedia article on EIA-649, the DoD adopted it in February 1999 in place of MIL-STD-973, and a Defense Standardization Program journal article states that MIL-STD-973 was canceled in 2000.

The DoD's guidance document, MIL-HDBK-61, first appeared in September 1997, with revision A in February 2001 and revision B dated 7 April 2020, according to EverySpec. The handbook gives program managers, systems engineers and logistics managers guidance on planning and carrying out configuration management across the life cycle, and states that it "is for guidance only and cannot be cited as a requirement."

EIA-649 itself was revised as EIA-649-A in April 2004 and EIA-649-B in June 2011, and the current version, SAE EIA-649C, was issued on 7 February 2019 after SAE International took ownership. A defense-specific supplement, EIA-649-1, followed in November 2014, and a NASA companion, EIA-649-2, in April 2015.

Software configuration management

Software adopted configuration management in parallel. The Institute of Electrical and Electronics Engineers' IEEE Std 828 is the main software-oriented standard. Its current version is IEEE Std 828-2012, "IEEE Standard for Configuration Management in Systems and Software Engineering," which revised IEEE Std 828-2005. The Wikipedia article on ISO 10007 notes that a mapping between ISO 10007:2003 and IEEE Std 828-2012 exists.

ISO 10007 and the ISO 9000 family

ISO 10007 grew out of ISO's quality management work. The Wikipedia article on the standard explains that ISO/TC 176 began quality management standardization in 1979 and developed ISO 9000, and that Subcommittee SC 2 was formed in 1982. SC 2 developed ISO 9001, ISO 9004, ISO 10005, ISO 10006 and ISO 10007.

The first edition of ISO 10007 was published in 1995, the second in 2003, and the third in 2017. ISO's TC 176 committee site lists closely related documents: ISO 9001:2015, ISO/TS 9002:2016, ISO 10005:2018 (quality plans), ISO 10006:2017 (quality management in projects) and ISO 9004:2018.

Timeline

The structure of ISO 10007:2017

The table of contents of the 2017 edition, visible in the publicly available preview, shows how the guidance is organized.

The standard is short. The bibliography begins on page 10. Its brevity reflects its role as guidance that organizations adapt, rather than a detailed procedural manual like MIL-HDBK-61 or EIA-649.

Key terms

ISO 10007 relies on a small set of defined terms. The Wikipedia summary paraphrases them as follows.

Why "configuration item" matters

Choosing configuration items is one of the most consequential decisions in configuration management. A configuration item is the unit at which identity, baselines and change control are applied. If items are too large (the whole aircraft), changes cannot be tracked with useful precision. If they are too small (every bolt), the administrative load becomes crushing. ISO 10007's clause 5.3.1 addresses "product structure or service capability and selection of configuration items," which signals that selection follows from the product's structure and the functions its parts perform. In practice, items are chosen at the level where they are separately specified, separately supplied, separately tested or separately changed.

Products and services

The 2017 edition speaks of "product and service" throughout, which matches ISO 9001:2015's language. Configuration management is most often associated with physical products and software, but the standard's inclusion of services, and of "service capability" in clause 5.3.1, recognizes that a service such as a managed IT service or a maintenance program also has a defined configuration of processes, resources and deliverables that can be baselined and changed.

The five configuration management activities

ISO 10007 describes the process as five activities following the definition of responsibilities. The same five appear, with small differences in wording, in EIA-649 and MIL-HDBK-61.

1. Configuration management planning

Planning sets out how configuration management will be done for a specific product, project or organization. Annex A of ISO 10007 describes the structure and content of a configuration management plan. The Wikipedia article on configuration management describes the planning discipline, as treated in MIL-HDBK-61A and EIA-649, as producing a formal plan that covers personnel, training, naming conventions, audits and requirements placed on vendors.

A plan typically answers questions like these:

• Which items are configuration items, and how are they identified?
• Who has authority to approve which kinds of change?
• What baselines will be established, and when?
• What records will be kept, in what system, for how long?
• How will suppliers' configuration management be controlled?
• When and how will audits be done?

The standard's introduction notes that configuration management "can be implemented based on the size of the organization and the complexity and nature of the product or service and reflects the needs of specific lifecycle phases." A plan for a small manufacturer's product line might fit on a few pages. A plan for a defense program can be a substantial controlled document.

2. Configuration identification

Identification defines the product structure, selects configuration items, assigns unique identifiers, captures configuration information for each item, and establishes baselines. Clause 5.3 covers these in three parts: product structure and selection of items, configuration information, and baselines.

Baselines

A baseline is a formally approved snapshot of configuration information, against which later changes are controlled. U.S. defense practice, described in DoD acquisition guidance summarized by AcqNotes and Defense Acquisition University materials, uses three primary baselines:

ISO 10007 does not mandate these particular baselines; it treats baselines generally as approved configuration information at a point in time. Organizations choose baselines that suit their life cycle. A consumer electronics company might baseline at design freeze, at production release and at each field update.

3. Change control

Change control is the activity most people picture when they think of configuration management. After a baseline is established, changes to it are proposed, evaluated, decided and implemented in a controlled way. ISO 10007 divides change control into four steps after general considerations (clause 5.4.1):

1. Initiation, identification and documentation of the need for change (5.4.2). Someone raises a change request that records what is proposed and why.
2. Evaluation of change (5.4.3). The technical, cost, schedule, safety, regulatory and supply consequences are assessed, including effects on other configuration items and on units already delivered.
3. Disposition of change (5.4.4). The dispositioning authority approves, rejects or defers the change. A summary of the 2017 guidance notes that after initial release, all changes should be controlled, with a dispositioning authority deciding on approval.
4. Implementation and verification of change (5.4.5). The approved change is carried out, documentation is updated, and it is verified that the change was made as approved and that it achieved its purpose.

In many organizations the dispositioning authority is a body called a configuration control board or change control board. The Wikipedia article on software configuration management notes that configuration control is usually handled through a change control board.

4. Configuration status accounting

Status accounting is the record-keeping that makes configuration management useful. It formally records and reports configuration information, the status of proposed changes and the implementation status of approved changes. Clause 5.5 addresses general principles, documented information and reports.

Good status accounting lets an organization answer, quickly and reliably, questions such as:

• What is the current approved configuration of this item?
• Which serial numbers have this change incorporated, and which do not?
• Which changes are pending, and what is their status?
• What was the configuration of a particular unit at a particular date?
• Which documents are affected by a proposed change?

5. Configuration audit

Configuration audit checks that a product conforms to its configuration information and that the records are accurate. A summary of the 2017 edition describes the audit clause as checking conformity with baselines and requirements.

U.S. defense practice distinguishes two kinds of audit, a distinction that also appears in software configuration management:

Responsibilities and authorities

Before describing the process, ISO 10007 addresses responsibility (clause 4). It asks organizations to define who is responsible for configuration management and who has authority to make configuration decisions, including the dispositioning authority (clause 4.2). This sequencing is deliberate. Configuration management fails less often for lack of procedures than for lack of clear authority. If engineers, production staff and suppliers can each make changes without a defined approval route, records diverge from reality no matter how good the forms are.

A worked example: controlling a change

The following example is hypothetical and simplified. It shows how the five activities connect.

The situation

A company makes a pump assembly, model P-100, used in industrial cooling systems. The product baseline for revision C defines the assembly as including a motor (item M-20), a housing (H-15, drawing revision B), an impeller (I-08) and controller firmware (F-3, version 2.1). Fifty units have been delivered with this configuration, serial numbers 0001 to 0050.

Step 1: Need for change

Field reports show that the housing seal wears faster than expected in high-temperature installations. An engineer raises a change request: replace the seal material in housing H-15 and update the drawing to revision C.

Step 2: Evaluation

The evaluation team assesses:

• Technical: The new material is rated for higher temperature. Testing is needed to confirm compatibility with the coolant.
• Interchangeability: The new seal fits the existing housing dimensions, so revised housings are interchangeable with old ones. That means the housing part number can be retained with a new drawing revision, following the company's identification rules.
• Firmware: No effect on F-3.
• Delivered units: Units 0001 to 0050 have the old seal. Should they be retrofitted?
• Cost and schedule: New seal costs slightly more; tooling unaffected.
• Documentation affected: housing drawing, parts list, maintenance manual, spare parts catalog.

Step 3: Disposition

The change control board approves the change for production starting with serial number 0051, and approves a retrofit kit for delivered units in high-temperature installations at their next scheduled maintenance.

Step 4: Implementation and verification

Production updates the drawing to H-15 revision C, issues the new parts list, and builds unit 0051 with the new seal. Quality inspection verifies that 0051 matches drawing revision C. Field service begins retrofits.

Step 5: Status accounting

The configuration records now show:

If, two years later, a customer reports a seal failure on unit 0023, the company can look up immediately whether 0023 was retrofitted, when, by whom, and with which kit, and can compare failure rates between revision B and revision C housings.

Step 6: Audit

At the next scheduled configuration audit, an auditor selects unit 0057 from production and compares it physically against the product baseline, including H-15 revision C. The auditor also samples the records for retrofitted units to confirm that the records match the field service reports. Discrepancies would trigger corrective action.

Without configuration management, each of these questions might have required searching emails and asking individuals. With it, the answers are in the records.

How ISO 10007 relates to other standards

ISO 9001:2015

ISO 9001 is the requirements standard for quality management systems, the one organizations are certified against. ISO 10007 is guidance. The standard's introduction makes the link explicit: "Configuration management can be used to meet the product and service identification and traceability requirements specified in ISO 9001:2015, 8.5.2." In other words, an organization certified to ISO 9001 does not have to adopt ISO 10007, but ISO 10007 is a recognized way of meeting the identification and traceability clause, particularly for complex products.

AS9100

The Wikipedia article states that ISO 10007 is recommended for meeting the product identification and traceability requirements in both ISO 9001:2015 and AS9100 Revision D, the aerospace quality management standard published by SAE International. Aerospace is one of the sectors where configuration management is most mature, because aircraft are long-lived, heavily modified and regulated.

EIA-649

SAE EIA-649C is a fuller statement of configuration management principles and practices, widely used in U.S. defense and aerospace. ISO 10007 is shorter and framed within the ISO quality management family. Both describe the same five functions. Organizations working in defense supply chains frequently use EIA-649 (and its defense supplement EIA-649-1) for contractual requirements, while organizations whose quality systems are built on ISO 9001 often reference ISO 10007.

IEEE 828

IEEE Std 828-2012 addresses configuration management in systems and software engineering, with particular attention to software. It covers concerns specific to software, such as build management and release management, in more depth. A published mapping between ISO 10007:2003 and IEEE 828-2012 allows organizations to align the two.

Safety standards

The Wikipedia article on ISO 10007 notes, under related topics, that safety standards for safety-critical systems require configuration management, citing an article by the functional safety consultancy exida on configuration management and ISO 26262, the automotive functional safety standard. When a safety case argues that a system is acceptably safe, the argument applies to a specific configuration. If the configuration changes without control, the safety argument may no longer hold.

ISO 10006 and project management

ISO 10006 gives guidelines for quality management in projects. Configuration management is often a project-level activity: a project establishes baselines and controls changes to its deliverables. The two documents are closely related within TC 176's portfolio.

Comparison of configuration management standards

Where configuration management is used

Aerospace and defense

Configuration management originated here and remains most formal here. Aircraft and weapon systems are built to tightly controlled baselines, modified through formal change processes, and audited. Airworthiness and safety depend on knowing exactly what is installed on each airframe.

Automotive

Modern vehicles combine mechanical parts with large amounts of software across many electronic control units. Functional safety standards such as ISO 26262 require configuration management so that safety analyses apply to the actual configuration fielded, and so that software updates are controlled.

Software and IT services

Software configuration management, as described in the Wikipedia article on the subject, covers identification, control, status accounting and audit, plus build, release and environment management. In IT service management, configuration management databases (CMDBs) record configuration items such as servers, applications and network devices and the relationships between them, supporting impact analysis and change management. The Wikipedia article notes that in ITIL version 3 the practice was renamed Service Asset and Configuration Management.

Construction and infrastructure

The Wikipedia article on configuration management notes that the U.S. Federal Highway Administration has used configuration management on infrastructure projects, and cites a case study of its use on the Los Angeles County Metropolitan Transportation Authority's Red Line. Large infrastructure is long-lived and frequently modified, which makes accurate as-built records valuable for maintenance and future works.

Medical devices, rail and energy

These sectors share the characteristics that make configuration management worthwhile: long service lives, regulatory oversight, safety consequences and frequent modification. While ISO 10007 does not name them, its life-cycle scope and its alignment with ISO 9001 make it applicable.

Implementing ISO 10007 in practice

Scale to the need

The standard explicitly allows tailoring to "the size of the organization and the complexity and nature of the product or service." A small company might implement configuration management with disciplined part numbering, a change request form, a weekly change review meeting and a spreadsheet of serial numbers and configurations. A large program might use product lifecycle management software, formal boards at several levels and dedicated configuration management staff.

Start with authority and identification

Two foundations matter most. First, clear authority: who may approve which changes. Second, sound identification: unique, consistent identifiers for items and documents, and rules for when a change requires a new revision versus a new part number. With those in place, change control and status accounting have something solid to work with.

Connect to the supply chain

Products increasingly contain items designed and built by suppliers. Configuration management therefore has to extend to suppliers, through contractual requirements, supplier change notification and acceptance of supplier configuration records. Planning (clause 5.2) and the plan structure in Annex A are where these arrangements are typically recorded.

Keep records usable

Status accounting is only as good as the questions it can answer. Organizations should decide in advance which reports they need, such as configuration of each delivered unit, open changes and change history, and design their records accordingly.

A second example: configuration management for a software release

The pump example involved hardware. The same five activities apply to software, with different mechanics. The following example is also hypothetical.

Identification

A company ships a monitoring application to hospitals. Its configuration items are the server application, the mobile client, the database schema, the installation scripts and the user manual. Each has its own identifier and version. A release, say release 4.2, is a baseline that names exactly which version of each item belongs together: server 4.2.0, mobile client 4.2.1, schema version 17, installer 4.2.0 and manual edition 9. The baseline also records the build environment, such as compiler and library versions, because rebuilding the same source with different tools can produce a different product.

Change control

A developer finds that the server writes timestamps in local time rather than coordinated universal time, causing confusion when hospitals in different time zones share data. A change request is raised. Evaluation shows that the fix touches the server and the database schema, requires a data migration for existing installations, and affects a report described in the manual. The change control board approves it for release 4.3 rather than as an emergency patch, because the migration needs testing at customer sites.

Status accounting

Records show which customer sites run which release. When release 4.3 ships, the company can list every site still on 4.2, schedule migrations, and track completion site by site. If a hospital later reports a problem, support staff can see immediately which configuration that hospital runs.

Audit

Before release 4.3 is declared, a functional audit confirms that the test results show the timestamp defect fixed and no regression in other functions. A physical audit confirms that the release package contains exactly the item versions named in the baseline, built from the recorded source revisions with the recorded tools.

What the example shows

Software makes some activities easier, because version control systems capture every change automatically, and some harder, because software can be copied and modified invisibly in the field. The configuration management principles in ISO 10007 do not change: identify items, baseline them, control change through a defined authority, keep accurate status records and audit that reality matches the records.

What changed in the 2017 edition

The 2017 foreword states only that the edition was technically revised and aligned with ISO 9000:2015 and ISO 9001:2015. Visible consequences of that alignment in the text include the consistent use of "product and service" rather than "product" alone, and the term "documented information" in the status accounting clause (5.5.2), which is the vocabulary ISO 9001:2015 uses for what earlier editions called documents and records. The introduction's explicit reference to ISO 9001:2015 clause 8.5.2 ties the guidance to the current requirements standard. Organizations that implemented the 2003 edition generally find the underlying process unchanged, with terminology updated to match the rest of their ISO 9001-based quality system.

Limitations and criticisms

Guidance, not requirements

Because ISO 10007 is guidance, it cannot by itself be used for certification. The BSI description states that it is not intended for certification or registration purposes. Organizations that need contractual teeth typically cite EIA-649-1 or customer-specific requirements, or rely on ISO 9001 and AS9100 audits of identification and traceability.

Brevity

The standard's short length means it states principles without much procedural detail. Practitioners often supplement it with EIA-649, MIL-HDBK-61B, IEEE 828 or sector guidance.

Overhead

Configuration management imposes administrative cost. Poorly scaled implementations can slow engineering change to a crawl, encourage informal workarounds and ultimately produce records that do not match reality. The standard's emphasis on tailoring is a response to this risk, but tailoring well takes judgment.

Tools are not the discipline

Product lifecycle management software and version control systems make configuration management easier but do not by themselves achieve it. If authority is unclear or people bypass the process, tools faithfully record a fiction.

Common misconceptions

"Configuration management is the same as version control."

Version control is one technique for identifying and storing versions of software files. Configuration management also covers selecting configuration items, establishing baselines, approving changes, tracking which units contain which changes, and auditing that products match their records.

"Configuration management is just document control."

Document control manages the approval and issue of documents. Configuration management uses controlled documents but ties them to product items, baselines and individual units, and it covers functional and physical characteristics, not just paperwork.

"You can be certified to ISO 10007."

No. It is a guidelines document. Certification is to requirements standards such as ISO 9001 or AS9100, where configuration management may be the method used to meet traceability requirements.

"Configuration management is only for defense."

It began in defense, but ISO 10007's life-cycle and product-and-service scope applies to any organization whose products or services need controlled definition and change, including software, automotive, medical, rail, energy, construction and IT services.

"Once a product is in production, configuration management is finished."

The in-service phase is where configuration management often matters most. Modifications, repairs, retrofits and software updates continue for years or decades, and the record of each unit's configuration must keep pace.

Frequently asked questions

What is the latest edition of ISO 10007?

The third edition, ISO 10007:2017, published in March 2017. It replaced the 2003 edition, which replaced the 1995 first edition.

What are the five elements of configuration management in ISO 10007?

Configuration management planning, configuration identification, change control, configuration status accounting and configuration audit.

Which ISO 9001 clause does ISO 10007 support?

Clause 8.5.2 of ISO 9001:2015, on identification and traceability. The ISO 10007 introduction states that configuration management can be used to meet those requirements.

What is a configuration baseline?

Approved configuration information that fixes the characteristics of a product or service at a point in time, serving as the reference against which later changes are controlled.

What is a dispositioning authority?

The person or group with responsibility and authority to make decisions on proposed configuration changes. In many organizations this is a configuration or change control board.

How does ISO 10007 differ from EIA-649?

Both describe the same core functions. ISO 10007 is a short guidance document within the ISO quality management family. EIA-649 (now SAE EIA-649C) is a fuller consensus standard of principles and practices, with a separate defense requirements supplement, EIA-649-1, and it is widely used in U.S. defense and aerospace.

Is ISO 10007 useful for software?

Yes, its principles apply to software, and the standard covers products generally. Software organizations often also use IEEE Std 828-2012, which treats software-specific issues in more depth, and a mapping between ISO 10007:2003 and IEEE 828-2012 exists.

Who prepares ISO 10007?

ISO/TC 176, Quality management and quality assurance, Subcommittee SC 2, Quality systems.

Summary

ISO 10007 gives guidance on configuration management: the discipline of defining what a product or service is, keeping that definition accurate through its whole life, and controlling changes so that design, documentation and reality stay aligned. The 2017 edition, prepared by ISO/TC 176/SC 2, sets out responsibilities and then five activities: planning, identification, change control, status accounting and audit, with an annex on the configuration management plan. It descends from a lineage that began in U.S. defense in the 1950s and passed through the military 480 series, MIL-STD-973 and the industry consensus standard EIA-649. Within the ISO family it is the recognized guide for meeting ISO 9001's identification and traceability requirements, and it sits alongside EIA-649, MIL-HDBK-61B and IEEE 828 as one of the main references for practitioners. Its strength is a clear, scalable statement of principles; its limits are that it is guidance only and short on procedural detail, so organizations usually combine it with sector-specific practice.

Sources

• ISO 10007 (Wikipedia)
• ISO 10007:2017 preview, iTeh Standards (foreword, introduction and contents)
• ISO/TC 176 committee site, ISO 10007:2017
• BSI Knowledge, Quality management. Guidelines for configuration management
• Configuration management (Wikipedia)
• EIA-649 National Consensus Standard for Configuration Management (Wikipedia)
• Software configuration management and IEEE 828 (Wikipedia)
• EverySpec, MIL-HDBK-61B Configuration Management Guidance (2020)
• Defense Standardization Program Journal, article on configuration management standards
• AcqNotes, Functional Configuration Audit
• Defense Acquisition University, Major Capability Acquisition: Physical Configuration Audit
• UNT Libraries catalog, AFSCM 375-1 record