Change Management

Change management is a structured process for planning, approving, implementing, and documenting changes to IT systems to minimize risk of unintended disruptions or security issues.

Change management ensures that modifications to IT systems are introduced in a controlled and coordinated manner. It's a critical control for maintaining system stability and security.

Key change management components: - Change Request: Formal request documenting the proposed change - Impact Assessment: Analysis of risks and affected systems - Approval Process: Authorization from appropriate stakeholders - Testing: Validation in non-production environments - Implementation Plan: Step-by-step deployment procedures - Rollback Plan: How to reverse the change if issues occur - Post-Implementation Review: Verification that change was successful

Change types: - Standard: Pre-approved, low-risk changes - Normal: Require CAB (Change Advisory Board) review - Emergency: Expedited process for urgent fixes

Best practices: - Separate environments (dev, staging, production) - Automated deployments reduce human error - Version control for all changes - Audit trail of who approved what

Why It Matters

Uncontrolled changes are one of the top causes of system outages and security incidents. SOC 2 auditors heavily scrutinize change management controls—they sample changes throughout the audit period and check for proper documentation, approval, and testing. Modern CI/CD pipelines can satisfy these requirements when configured with code reviews, approval gates, and audit trails.

Key Points

Core control in every compliance framework

Changes must be documented and approved before implementation

Requires separation of dev/staging/prod environments

Emergency changes need post-approval

Automated CI/CD can satisfy requirements if properly configured

Applicable Compliance Frameworks

SOC 2 ISO 27001 HIPAA PCI DSS

Related Terms

Version Control

Version control (source control) tracks changes to code and configuration, enabling collaboration, audit trails, and rollback capabilities.

Frequently Asked Questions

Does CI/CD satisfy change management requirements?

It can, if properly configured with: code review requirements, approval gates, automated testing, audit logs, and rollback capabilities.

What is a CAB?

Change Advisory Board (CAB) is a group that reviews and approves significant changes. In modern practice, this may be replaced by peer code review and automated approval workflows.