Draft v0.1.05 of 6 frameworks
Change management
Changes to systems and software are requested, tested, approved and tracked before release.
Where it appears
- SOC 2
CC8.1Authorizes, designs, develops, configures, documents, tests, approves and implements changes- PCI DSS 4.0
6.5Changes to all system components are managed securely (6.5.1 change control procedures)- NIST CSF 2.0
PR.PS-01Configuration management practices are established and applied- ISO 27001:2022
A.8.32Change management- HIPAA Security Rule
- no direct requirement
- NIST 800-53 r5
CM-3Configuration change controlCM-4Impact analysesCM-5Access restrictions for change
No direct HIPAA Security Rule citation.
Evidence auditors usually ask for
A typical starting list. Your assessor's request list is the one that counts.
- Change management policy
- Sample of change tickets/PRs with approval, testing and rollback documentation across the audit period
- Evidence of separation between requester/developer and approver
- Emergency change procedure and sample records
Crosswalks that include this
SOC 2 to PCI DSS 4.0SOC 2 to NIST CSF 2.0SOC 2 to ISO 27001:2022SOC 2 to NIST 800-53 r5PCI DSS 4.0 to SOC 2PCI DSS 4.0 to NIST CSF 2.0PCI DSS 4.0 to ISO 27001:2022PCI DSS 4.0 to NIST 800-53 r5NIST CSF 2.0 to SOC 2NIST CSF 2.0 to PCI DSS 4.0NIST CSF 2.0 to ISO 27001:2022NIST CSF 2.0 to NIST 800-53 r5