Home / Fast Track / Change management
Shared control area · counts toward 6 standards
Change management
Change management is the process of ensuring that modifications to production systems are documented, tested, and authorized before implementation. Frameworks require this to prevent unauthorized changes from introducing security vulnerabilities or causing unplanned system outages.
Implement it once
- Establish a formal change request process using a ticketing system to track all proposed modifications.
- Require technical peer reviews for all code or configuration changes prior to approval.
- Define an approval workflow that assigns authority based on the risk level of the change.
- Enforce separation of duties so that the person who develops the change is not the sole person deploying it to production.
- Implement a staging environment where changes are validated and tested before being promoted to production.
Evidence it produces
- Change tickets containing the description, justification, risk assessment, and approval timestamps.
- Version control logs or pull requests demonstrating peer review and merge approvals.
- Deployment logs that link specific approved change IDs to actual system updates.
- User Acceptance Testing (UAT) records or test results confirming the change works as intended.
Where it counts
Most security frameworks require a mechanism to prevent unauthorized changes from compromising system integrity and availability. Implementing a centralized process creates a single audit trail that satisfies these common operational requirements across multiple certifications simultaneously.