The organization controls changes to the configuration settings in accordance with organizational policies and procedures.