Control A.8.32Change management
Changes to information processing facilities and information systems must be subject to change management procedures.
Change management is an information security control because most self-inflicted outages and a large share of exposures originate in a change — and because an unmanaged change path is also an unmanaged route into production.
The expectations are that changes are documented, assessed for security impact, tested, authorised by someone with the standing to authorise them, implemented in a controlled way, and reversible.
The requirement that is most often absent is the security impact assessment. Changes are reviewed for operational risk and scheduled; whether the change alters the attack surface, the access model or the logging is not asked.
Emergency change is where the process is genuinely tested. A procedure with no emergency path will be bypassed, and the bypass will become the norm; one with an emergency path and a retrospective review keeps the record intact, which is what A.5.29’s post-disruption reconciliation depends on.
How to put this in place
Unrecorded changes cause outages and open security holes that no one can trace. Your ISMS needs changes to live systems made in a controlled, recorded way, scaled to risk.
- Define change types: pre-approved standard, assessed normal and reviewed emergency changes.
- Decide who approves each and what testing is expected.
- Record every production change with its approval and test evidence.
- Make the route easy enough to be used, for example through pull requests and deployment records.
- Review emergency changes afterwards and look for patterns.
Evidence an auditor usually looks for: the change procedure, a sample of change records traced to approvals and deployments, and emergency change reviews.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists change management procedure and change records among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.