Change management

Plain-language summary

Putting changes to information systems and processing facilities — servers, applications, networks, cloud settings, firewalls — through a controlled process of request, risk assessment, approval, testing, implementation and review, so changes do not quietly break security or availability.

What the clause is really asking

Unplanned and untested changes cause a large share of outages and security gaps: the firewall rule added for a supplier and never removed, the update that broke the backup job. This control asks for change management procedures covering changes to systems and facilities: recording the request; assessing the impact on security, availability and dependent systems; authorisation by the right person; testing and a rollback plan; telling those affected; implementing; checking afterwards; and updating documentation such as network diagrams and the asset inventory. Emergency changes need a fast route that is still recorded and reviewed after the event. Two links help. Clause 6.3 of ISO 27001 covers planning changes to the ISMS itself — scope, policies, processes, roles — whereas this control covers changes to the technology. And ISO 9001 practitioners already run change control for processes and production (clauses 6.3 and 8.5.6); the same approval and record habits carry across, often in the same register. The common misunderstanding is that a ticketing system equals change management — the audit looks for risk assessment and approval, not only a log.

What auditors look for

Auditors ask for the change management procedure and then for the change log for the last few months. They pick a sample — a firewall rule change, a server upgrade, an ERP update, a cloud configuration change — and trace each one: request, impact assessment, approval by someone with authority, test evidence, rollback plan, implementation, post-change check. They look for changes that appear in system logs or configuration history but not in the change log. They ask how emergency changes were handled and reviewed. The hard question: which change in the last year caused a problem, and what did you change in the process as a result?

Typical evidence

Change management procedure covering standard, normal and emergency changes; change register or ticket records; impact and risk assessments; approval records; test and rollback plans; implementation and post-implementation review records; retrospective approvals of emergency changes; updated documentation after changes; change review meeting minutes where used.

How to comply — recommendations

Write a two-page procedure with three change types: standard (pre-approved, low-risk, repeatable — a new user, a routine patch), normal (assessed and approved before implementation) and emergency (make it, record it, approve it afterwards within a set time). Use one register — your service desk tool or a controlled spreadsheet — with fields for description, systems affected, risk, approver, test, rollback, date and outcome. Hold a short weekly review of normal changes. Each month, compare configuration history from firewalls and key cloud services with the register to catch unrecorded changes. Where you already run ISO 9001 change control, align the forms and approvers.

Common nonconformities

No documented change procedure; changes implemented without approval or impact assessment; no test or rollback plan for significant changes; emergency changes never reviewed after the event; changes visible in system logs but missing from the register; documentation and diagrams not updated after changes; changes made by suppliers outside the process.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.