Change management and security
Exam objective 1.3: Explain the importance of change management processes and the impact to security.
On this page
Unplanned changes cause outages and open holes. Change management makes every change visible, approved, tested, reversible, and documented, which is why the exam treats it as a security process and not just an IT formality.
The business process
A change request names an owner, describes the change, and lists the stakeholders it affects. An impact analysis estimates what could break and what the risk is. A change advisory board (CAB) or approver reviews the request, and the change happens inside an agreed maintenance window. Every change needs a backout plan: the tested steps to return to the previous state if something goes wrong.
| Step | Purpose |
|---|---|
| Request and ownership | One accountable owner; the change is written down |
| Stakeholder identification | Everyone affected is known and informed |
| Impact analysis | Risk of the change, and of not making it, is understood |
| Test results | Proof from a non-production environment that it works |
| Approval | CAB or authorized approver signs off |
| Maintenance window | Change happens when the business can tolerate disruption |
| Backout plan | Known way to return to the prior state |
| Standard operating procedure | Routine changes follow a pre-approved script |
Technical implications
Changes have technical side effects that the plan must cover. Allow lists and deny lists may need updating when a new application talks to new hosts. Restricted activities, such as changes to domain controllers, may need extra approval. Some changes require downtime or a service or application restart, and legacy applications may have dependencies nobody documented. If one service depends on another, the order of changes matters.
Documentation and version control
After a change, update diagrams, policies, and procedures so the documentation matches reality. Version control (for code and for configuration) gives a history of who changed what and makes rollback possible. Out-of-date diagrams are a security risk, because incident responders rely on them.
Key terms
- Change advisory board (CAB)
- A group that reviews proposed changes for risk and business impact and approves or rejects them.
- Impact analysis
- An assessment of what a proposed change could affect and how risky it is.
- Backout plan
- Pre-planned steps to return a system to its previous state if a change fails.
- Maintenance window
- An agreed period when changes can be made with the least disruption to the business.
- Standard operating procedure (SOP)
- A documented, repeatable set of steps for a routine task that has been pre-approved.
- Change owner
- The person accountable for a change from request to completion.
- Stakeholders
- The people and teams affected by a change who need to be consulted or informed.
- Allow list and deny list updates
- Adjusting which applications, hosts, or ports are permitted or blocked so a change works securely.
- Dependencies
- Other systems or services that a component relies on, which a change may break.
- Version control
- A system that records every revision of code or configuration so changes can be tracked and rolled back.
Check yourself
20 practice questions on this objective
Practice this objectiveFlashcards for this objective