From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Change management

- [Narrator] Information technology is in a constant state of change. It's hard to find an organization that relies on technology that doesn't go through changes every day, ranging from simple software updates to major system deployments. Cybersecurity professionals must understand the role that change management plays in protecting an organization. Change is a good thing. Progress comes from change and organizations change on a daily basis. When it comes to information technology, organizations need to take steps to ensure that change achieves business objectives without disrupting operations. That's where change management comes into play. Change management processes ensure that organizations follow a standard process for requesting, reviewing, approving, and implementing changes to information systems. They have the goal of minimizing the probability and impact of disruptions to normal IT service because of a change. This includes an assessment of the security impact of a proposed change. The standard tool used for change management is the request for change, or RFC. In an organization practicing strong change control, any individual who wants to change a system writes the change in an RFC that includes some standard elements. It should include a description of the change, an explanation of the expected impact, an assessment of the risk involved, a plan for rolling back the change if it fails, the identity of the individuals or groups involved in the change, a proposed schedule for the change, and the configuration items affected by the change. Once someone submits an RFC for review, it must be approved by a relevant authority. For minor changes, this may simply be the person's manager. In the case of major changes, the organization's change advisory board, or CAB, may review and approve the change. Some routine changes may have pre-approved status and can be made as soon as the RFC is submitted. For example, if storage engineers replace backup tapes every month, they might have a pre-approved change in the change management system for that activity. They still submit an RFC, but the RFC is immediately approved due to the fact that it's for a pre-approved change. The engineers may then begin work on schedule with no other action required.

Contents