Change management
Change management compliance is tested on newly installed systems.
What the published 2016 guidance says
Change management compliance is tested on newly installed systems. The measure is the share of new applications or systems with evidence that they followed the change practice and the hardening policy, against all new installations. The target is full compliance. Evidence is the ticket, the email, the report and the configuration checklist. It is collected each semester and reported yearly to management and each semester to the security manager. The risk owner owns and collects it, and the security manager is the client. A pie chart shows the position and a line chart the trend.
What it means in practice
Change management compliance is a sample of newly installed systems against the hardening policy. The evidence is the ticket and the configuration checklist. Report the current position and the trend; a single non-compliant system can be the one that matters.
Status of this record. For B.22, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the change tickets, the configuration checklist and the scan report. Count the new systems with evidence against all new systems. Report the current position and the trend. Review the baseline when a gap repeats.
Evidence an assessor asks for
- Change managementChange tickets for each new installation
- Configuration managementCompleted hardening checklists
- Change managementConfiguration review tool reports
The question an assessor will ask
An assessor will ask for change tickets for each new installation. The test for B.22 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- New systems discovered outside the change process, so the denominator understates installs
- Hardening checklist signed with no configuration review evidence
Before the next review
Before the next review, test this against one live record: new systems discovered outside the change process, so the denominator understates installs.
What to check when the revision publishes
When DIS 27004 is published, compare the B.22 Change management record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.