Key takeaways
- Control changes to systems and information processing facilities.
- Uncontrolled changes cause outages and security gaps.
- Start here: define a change management process with risk assessment and approval.
Purpose
Control changes to systems and information processing facilities.
Requirement
Requirement summaryChanges to information processing facilities and information systems shall be subject to change management procedures.
Why it matters
Uncontrolled changes cause outages and security gaps.
How to implement
- Define a change management process with risk assessment and approval.
- Test changes before deployment.
- Record changes and outcomes.
- Have rollback plans.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.32. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your change management process: how changes are requested, assessed, approved, tested and rolled back if needed.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.32 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Recent change tickets showing approval, testing and a back-out plan.
- Emergency change records reviewed after the fact.
- Your change log or calendar.
Things you should be able to show or explain
- Be able to walk through how a change gets approved.
How much to show: 10 or so changes including emergency ones.
Common mistakes
- Changes made without approval.
- Emergency changes never reviewed.
- Emergency changes never reviewed afterwards.
- Changes with no record.
- Tip: Every production change needs a ticket and approval.
Policies & documents to have
- Operations Security Policy
- Secure Development Policy
FAQ
Is A.8.32 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.32?
Be ready to explain how the control works in your organisation and to provide things like: Your change management process: how changes are requested, assessed, approved, tested and rolled back if needed…