The Ultimate Guide to ISO 27001:2022 Annex A 8.32: Change Management

ISO 27001 Change Management

ISO 27001 Annex A 8.32 Change Management is an ISO 27001 control that requires organisations to manage changes to both the information security management system (ISMS) and to the information processing facilities.

Purpose

ISO 27001 Annex A 8.32 is a preventive control to preserve information security when executing changes.

Definition

ISO 27001 defines ISO 27001 Annex A 8.32 as:

Changes to information processing facilities and information systems should be subject to change management procedures.

ISO27001:2022 Annex A 8.32 Change Management

Ownership

In close collaboration with domain experts, the Information Security Officer is responsible for establishing and maintaining effective change management controls and procedures.

Key Takeaways

• Formal management of changes is mandatory
• Consider the help of a change management professional
• The control is called ISO 27001:2022 Annex A 8.32 Change Management
• The implementation guidance is given in ISO 27002:2022 Control A 8.32 Change Management

Implementation Guide

Change management can be a profession in it’s own right and this control is no substitute for that. What we are going to do is manage our changes to the information processing facilities for in-scope products and services and we are going to manage changes to the information security management system.

There are nine essential elements of a comprehensive Change Management procedure:

• Impact Assessment: Thoroughly assess and plan for the potential impact of all planned changes, considering all dependencies.
• Authorisation Controls: Implement robust authorisation controls for all proposed changes.
• Stakeholder Communication: Effectively communicate planned changes to all relevant internal and external stakeholders.
• Rigorous Testing: Establish and execute rigorous testing and acceptance testing processes for all changes.
• Implementation Strategy: Define a clear and detailed implementation strategy, including practical deployment procedures.
• Emergency and Contingency Planning: Develop and maintain comprehensive emergency and contingency plans, including a fallback procedure.
• Comprehensive Record Keeping: Maintain detailed records of all changes and related activities.
• Documentation Updates: Review and update all relevant operating documentation and user procedures to reflect the changes.
• ICT Continuity Plan Review: Review and revise all ICT continuity plans, recovery, and response procedures to accommodate the changes.

Implementation Checklist

Change Management ISO 27001 Annex A 8.32 Implementation Checklist

1. Define Change Management Process

Challenge

Lack of a clear and documented process, leading to inconsistencies and confusion.

Solution

Develop a comprehensive change management process with clear roles and responsibilities, documented procedures, and standardised forms.

2. Identify and Assess Changes

Challenge

Difficulty in identifying all potential changes impacting the ISMS.

Solution

Implement a proactive change identification process, such as regular risk assessments, internal audits, and management reviews.

3. Conduct Impact Assessments

Challenge

Inaccurate or incomplete impact assessments, leading to inadequate risk mitigation measures.

Solution

Utilise a standardised risk assessment methodology and involve relevant stakeholders in the impact assessment process.

4. Obtain Authorisations

Challenge

Delays and bottlenecks in obtaining necessary approvals for changes.

Solution

Establish clear approval workflows, delegate appropriate authority levels, and utilise electronic approval systems to streamline the process.

5. Implement and Test Changes

Challenge

Inadequate testing and validation of changes, leading to unforeseen issues and potential security breaches.

Solution

Conduct thorough testing of all changes, including unit testing, integration testing, and user acceptance testing.

6. Communicate Changes

Challenge

Poor communication of changes to affected stakeholders, leading to confusion, resistance, and operational disruptions.

Solution

Develop and implement a robust communication plan, including regular updates, training sessions, and clear documentation.

7. Monitor and Review Changes

Challenge

Lack of ongoing monitoring and review of implemented changes, leading to potential deviations and performance degradation.

Solution

Conduct regular post-implementation reviews to assess the effectiveness of changes and identify any areas for improvement.

8. Document Changes

Challenge

Inadequate documentation of changes, leading to difficulties in tracking, auditing, and maintaining the ISMS.

Solution

Maintain a centralised change register, document all changes thoroughly, and ensure that all relevant documentation is updated accordingly.

9. Integrate Change Management with Other Processes

Challenge

Lack of integration between change management and other key processes, such as risk management, incident management, and internal audits.

Solution

Ensure that change management is seamlessly integrated with other key ISMS processes to ensure consistency and efficiency.

10. Continual Improvement

Challenge

Resistance to change and a lack of focus on continuous improvement within the change management process itself.

Solution

Regularly review and evaluate the effectiveness of the change management process, identify areas for improvement, and implement necessary adjustments.

Audit Checklist

Change Management ISO 27001 Annex A 8.32 Audit Checklist

1. Check if there is a Change Management Process

• Is there a documented ISO 27001 change management process with clear roles and responsibilities, documented procedures, and standardised forms. Walkthrough them to ensure what happens matches the documentation.
• Is there an ISO 27001 change management policy.

2. Get evidence of changes

• Have changes be identified.
• Is there evidence of regular risk assessments.
• Review internal audits for change.
• Review the management reviews for the inclusion of change.

3. Assess if there were Impact Assessments

• Assess the risk assessment methodology for change
• Review if the relevant stakeholders are involved in the impact assessment process.

4. Check if authorisations were obtained

• Walkthrough approval workflows.
• Review if delegation is at appropriate authority levels.
• Assess what approval system is used and walkthrough it to evidence authorisation.

5. Audit the implementation and test of changes

• Sample changes and conduct thorough review of testing of changes.
• Assess if it includes unit testing, integration testing, security testing and user acceptance testing.
• Gain evidence of back out and roll back planning.

6. Assess if changes were communicated

• Review the communication plan.
• Gain evidence of regular updates, training sessions, and clear documentation.
• Review meeting minutes for the inclusion of change such as change meetings, management reviews, risk reviews.

7. Audit the monitor and review of changes

• Seek evidence of post-implementation reviews.
• Do post-implementation reviews assess the effectiveness of changes and identify any areas for improvement.
• Walkthrough the success criteria applied to changes.

8. Review documented changes

• Asses documentation for changes and changes to that documentation.

9. Check how other processes integrate with Change Management

• Assess if and how change management is integrated with other key ISMS processes to ensure consistency and efficiency.

10. Assess if changes are subject to Continual Improvement

• Gain evidence of a regular review and evaluation of the effectiveness of the change management process
• Assess if it identified areas for improvement, and were necessary adjustments implemented.

ISO 27001 Change Management Policy

An ISO 27001 Change Management Policy defines your change management responsibilities, but not the specific procedures for carrying them out. Those procedures are outlined in your processes. The ISO 27001 Change Management Policy Template is a fully written and ready to go policy.

ISO 27001 Change Management Policy Example

Supplementary Guidance

You are going to make sure that you have documented change guidelines. These can be standard guidelines or industry best practice, and you likely already do this today, just make sure that this written down, communicated and available to those that need it.

Included in your change management will be consideration for the following:

• Planning of Change
• Impact Assessment of Change
• Risk Assessment of Change
• Communication of Change
• Test and Acceptance of Change
• Deployment Plans for Changes
• Back out/ rollback Procedures for failed changes
• Records of Change
• Updated Documentation as a result of change
• Updated Business Continuity and Disaster Recovery as a result of change

For change management you need documented roles, responsibilities, processes and procedures.

Change management is not overly complex although it can be a documentation overhead. Be sure to document everything and have evidence of past changes for the auditor to review.

ISO 27001 Change Management FAQ

ISO 27002:2022 Control 8.32

ISO 27002 Control 8.32 provides implementation guidance for Change Management.

Related ISO 27001 Controls

ISO 27001 Security Testing in Development and Acceptance: Annex A 8.29

ISO 27001 Assessment And Decision On Information Security Events: Annex A 5.25

ISO 27001 Protection of Information Systems During Audit Testing: Annex A 8.34

Further Reading

ISO 27001 Change Management Policy Beginner’s Guide

ISO 27001 Annex A 8.32 Attributes Table