ISO Configuration Management Guide for Engineers: A Complete Roadmap

Hello, this is Hermes Solution.
Starting this week, we are launching a new series for engineers preparing for ISO certifications — a practical and easy-to-follow guide to Configuration Management (CM).

Configuration Management is a core requirement across major industry standards such as:

• ISO 26262 (Functional Safety)

• ISO 42001 (AI Management System)

• ISO/SAE 21434 (Automotive Cybersecurity)

• ISO 9001 (Quality Management)

If you are new to ISO standards, you may often wonder:

• “What exactly is Configuration Management?”

• “Isn’t it just version control using Git?”

This roadmap is designed to help beginners clearly understand Configuration Management from the ground up and apply it effectively in real engineering environments.

1. Understanding the Why Behind Configuration Management

Configuration Management (CM) refers to the systematic control of changes to all components — including products, software, documents, and system elements.
Before learning the standards, it is crucial to understand why such management is necessary.

What Is Configuration Management?

Let’s explain it with a simple analogy.

Imagine you are building a complex LEGO castle:

• Recording which blocks are used → Configuration Identification

• Asking for approval before changing a block → Configuration Control

• Keeping track of who made what changes → Status Accounting

• Checking if the final castle matches the design → Configuration Audit

Without CM, if 10 people freely modify the castle, the structure collapses — the same happens in software development.

Real-World Software Example

• Developers modify files independently

• Testers use outdated versions

• The team loses track of which version is deployed

Such issues frequently lead to failures or safety incidents.
With proper CM, organizations maintain stability, traceability, and quality consistency.

2. Configuration Management vs Version Control: Key Differences

Many engineers assume CM and version control are the same, but they serve different purposes.

Version control manages file revisions.
Configuration Management manages the entire lifecycle flow, including changes, approvals (CCB), baselines, and traceability.

In simple terms:
Version control is part of CM, while CM is a broader discipline that ensures product integrity across the entire development lifecycle.

3. Essential Terminology in Configuration Management

For beginners, these foundational CM terms are important:

• Configuration Item (CI): Any managed artifact (documents, software, components)

• Baseline: An approved reference version

• CCB (Configuration Control Board): The group that reviews and approves changes

• Traceability: Linking requirements, design, code, and tests

• Change Request (CR): A formal request to update a configuration item

4. Why Configuration Management Matters: The Toyota Recall Case

A well-known example shows how CM failures lead to massive risks.

Toyota Unintended Acceleration Incident

• Millions of vehicles recalled

• Severe financial losses and global brand damage

NASA’s investigation found software issues and a major lack of CM, including:

• No clear record of software versions installed in each vehicle

• No ability to trace change history

• Difficulty identifying configuration of affected vehicles

If Proper CM Had Been Implemented:

• Faulty software version identified immediately

• Only affected vehicles would be recalled

• Costs could have dropped from trillions of won to mere billions

Configuration Management is not “just documentation”—
it is essential for safety, risk management, and product reliability.

5. The Four Core Activities of Configuration Management

According to ISO 10007 and ISO 26262, CM consists of four main activities.