CCN-1 - Change Management and Control
Control for the structured management of system changes
Control Definition
A formal process must be established to manage all changes to systems, applications and infrastructure, classifying them by type and requiring an impact analysis, a rollback plan and formal approval before implementation. A change approval board must be set up, change windows and freeze periods defined according to business criticality, and emergency changes managed through an abbreviated process with guaranteed minimum approval. Every change must be required to go through the defined environments before reaching production, relying on the cloud provider's shared responsibility model to reduce the operational burden of infrastructure change management.
Requirements
Requirement 1
We establish a formal, structured process to manage all changes to systems, applications and infrastructure.
Requirement 2
We classify changes into categories: standard, normal, emergency and minor.
Requirement 3
We set up a Change Advisory Board (CAB) with representation from the main leaders of each change.
Requirement 4
We define scheduled change windows for implementing normal changes.
Requirement 5
We establish freeze periods tied to critical business events, peak seasons, fiscal calendar dates, among others...
Requirement 6
For each change we document the success criteria and escalation contacts.
Requirement 7
We manage emergency changes with an abbreviated process that guarantees minimum approval from two main approvers.
Requirement 8
We complete post-implementation documentation for emergency changes within a defined time frame.
Requirement 9
We require all changes to go through a chain of environments defined by the company before reaching production.
Requirement 10
We seek and apply a shared responsibility model that favors the Cloud Service Provider (CSP) to reduce the organization's operational burden in managing infrastructure changes.
Requirement 11
We identify single points of failure from the platform diagram as part of each change's impact analysis.
Requirement 12
We implement automatic deployments to environments separate from production as part of the change process's environment chain.