📖 What is Change Management?
Change Management is a formal process used to ensure that modifications to the IT environment are recorded, evaluated, and approved before implementation. This prevents unauthorized changes and minimizes the risk of introducing new vulnerabilities or causing system instability.
"Look for 'Change Control Board (CCB)' in the question. The CCB is the governing body that approves or rejects changes to maintain system stability."
📚 Certification: Certified Information Systems Security Professional (CISSP)
🔑 What are the Key Concepts of Change Management?
- ▸ The Change Control Board (CCB) acts as the governing body responsible for reviewing, approving, or rejecting proposed changes to maintain system stability.
- ▸ A comprehensive rollback plan is mandatory for every change, providing a documented method to revert the system to its previous stable state if failure occurs.
- ▸ Impact analysis involves evaluating how a proposed modification affects existing security controls, system performance, and interdependencies with other organizational assets.
- ▸ Formal change requests (CRs) ensure that every modification is documented, providing an audit trail necessary for compliance and troubleshooting future incidents.
- ▸ Emergency changes follow an accelerated path for critical fixes but still require retrospective review and documentation to prevent unauthorized 'shadow' changes.
🎯 How does Change Management appear on the CISSP Exam?
You may be asked to identify the missing step in a scenario where a software update caused a system outage and the team was unable to restore service quickly, highlighting the necessity of a rollback plan.
A scenario might describe a developer implementing a 'hotfix' directly into production to resolve a critical bug; you must identify this as a violation of formal change management and a risk to stability.
Expect questions where you must distinguish between the roles of the system administrator who proposes the change and the Change Control Board (CCB) that provides the final authorization based on risk.
❓ Frequently Asked Questions
How does Change Management differ from Configuration Management?
Change Management is the process of requesting and approving modifications. Configuration Management is the practice of tracking the current state, versions, and attributes of assets to maintain an accurate baseline.
Can emergency changes bypass the Change Control Board entirely?
No. While emergency changes use an expedited approval process to resolve critical issues quickly, they must still be documented and undergo a retrospective review by the CCB to ensure accountability.