I am looking for good references providing an overview and/or best practices to configuration (or, change) management and how to evaluate risks and vulnerabilities. A good primer would be a great recommendation, but all suggestions are welcome as to not rule anything out.