Control A.8.32Change management
What it means in practice
Changes to information processing facilities and information systems must be subject to change management procedures.
Change management is an information security control because most self-inflicted outages and a large share of exposures originate in a change — and because an unmanaged change path is also an unmanaged route into production.
The expectations are that changes are documented, assessed for security impact, tested, authorised by someone with the standing to authorise them, implemented in a controlled way, and reversible.
The requirement that is most often absent is the security impact assessment. Changes are reviewed for operational risk and scheduled; whether the change alters the attack surface, the access model or the logging is not asked.
Emergency change is where the process is genuinely tested. A procedure with no emergency path will be bypassed, and the bypass will become the norm; one with an emergency path and a retrospective review keeps the record intact, which is what A.5.29’s post-disruption reconciliation depends on.
How to put this in place
Unrecorded changes cause outages and open security holes that no one can trace. Your ISMS needs changes to live systems made in a controlled, recorded way, scaled to risk.
- Define change types: pre-approved standard, assessed normal and reviewed emergency changes.
- Decide who approves each and what testing is expected.
- Record every production change with its approval and test evidence.
- Make the route easy enough to be used, for example through pull requests and deployment records.
- Review emergency changes afterwards and look for patterns.
Evidence an auditor usually looks for: the change procedure, a sample of change records traced to approvals and deployments, and emergency change reviews.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Excel
Mandatory ISMS Documentation Checklist
in ISO 27001 Implementation & Certification ReadinessAnnex A Documents sheet: lists change management procedure and change records among the documents auditors commonly expect for this control. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Word
Patch Management Standard
in Patch ManagementIts Framework References list this control. Supported by: PM-03, PM-11 and PM-12: each route's change approval. - Word
Monthly Patch Cycle Operating Procedure
in Patch ManagementIts Framework References list this control. Supported by: CY-03: the month's standard change; the expedited route's normal change. - Excel
Patch Deployment Ring & Maintenance Window Plan
in Patch ManagementIts Framework References list this control. Supported by: Windows, rings and rollback criteria: patches deployed as controlled changes. - Word
Emergency Out-of-Band Patching Procedure
in Patch ManagementIts Framework References list this control. Supported by: ES-4: the emergency change and its approval. - Word
IT Disaster Recovery Procedure
in Business Continuity, Disaster Recovery & Cyber ResilienceIts Framework References list this control. Supported by: Failing back, planned like a change (RR-25).