Generally, the administrative files are kept under revision control just like any other file in the repository (the exceptions are noted). However, unlike other files, checked-out copies of the administrative files are stored in the repository, right next to their corresponding RCS files in the CVSROOT subdirectory. It is these checked-out copies which actually govern CVS's behavior.
The normal way to modify the administrative files is to check out a working copy of the CVSROOT module, make your changes, and commit. CVS updates the checked-out copies in the repository automatically. (See checkoutlist.) In an emergency, however, it is also possible to edit the checked-out copies in the repository directly.