Requirement
The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.
Points of Focus
Manages Changes Throughout the System Life Cycle
Requirement: A process for managing system changes throughout the life cycle of the system and its components (infrastructure, data, software, and manual and automated procedures) is used to support the achievement of entity objectives.
Authorizes Changes
Requirement: A process is in place to authorize system and architecture changes prior to design, development, or acquisition and configuration.
Designs and Develops Changes
Requirement: A process is in place to design and develop system changes in a secure manner to support the achievement of entity objectives.
Documents Changes
Requirement: A process is in place to document system changes to support ongoing maintenance of the system and to support internal and external users in performing their responsibilities.
Tracks System Changes
Requirement: A process is in place to track system changes prior to implementation.
Configures Software
Requirement: A process is in place to select, implement, maintain, and monitor configuration parameters used to control the functionality of developed and acquired software.
Tests System Changes
Requirement: A process is in place to test internally developed and acquired system changes prior to implementation into the production environment. Examples of testing may include unit, integration, regression, static and dynamic application source code, quality assurance, or automated testing (whether point in time or continuous).
Approves System Changes
Requirement: A process is in place to approve system changes prior to implementation.
Deploys System Changes
Requirement: A process is in place to implement system changes with consideration of segregation of responsibilities (for example, restricting unilateral code development or testing and implementation by a single user) to prevent or detect unauthorized changes.
Identifies and Evaluates System Changes
Requirement: Objectives affected by system changes are identified, and the ability of the modified system to support the achievement of the objectives is evaluated throughout the system development life cycle.
Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents
Requirement: Changes in infrastructure, data, software, and procedures required to remediate incidents are identified and the change process is initiated upon identification.
Creates Baseline Configuration of IT Technology
Requirement: A baseline configuration of IT and control systems is created and maintained.
Provides for Changes Necessary in Emergency Situations
Requirement: A process is in place for authorizing, designing, testing, approving, and implementing changes necessary in emergency situations (that is, changes that need to be implemented in an urgent time frame).
Manages Patch Changes
Requirement: A process is in place to identify, evaluate, test, approve, and implement patches in a timely manner on infrastructure and software.
[A] Considers System Resilience
Requirement: The entity considers system resilience when designing its systems and tests resilience during development to help ensure the entity’s ability to respond to, recover from, and resume operations through significant disruptions.
[C] Protects Confidential Information
Requirement: The entity protects confidential information during system design, development, testing, implementation, and change processes to support the achievement of the entity’s objectives related to confidentiality.
[P] Protects Personal Information
Requirement: The entity protects personal information during system design, development, testing, implementation, and change processes to support the achievement of the entity’s objectives related to privacy.
[P] Privacy by Design
Requirement: The entity considers privacy requirements in the design of its systems and processes and limits the collection and processing of personal information to what is necessary for the identified purpose.
Explanation
All changes to infrastructure, data, software, and procedures must follow a controlled lifecycle: authorized before work starts, developed securely, tested, approved, and deployed with segregation of duties. Auditors sample changes and trace each through tickets, test evidence, and approvals — including emergency changes and patches — to confirm nothing reaches production uncontrolled.
