What is ISO27001 Change Management?

ISO27001 Annex A 8.32 Change Management is an ISO27001 control that requires us to manage changes to both the information security management system (ISMS) and to the information processing facilities.

Purpose

ISO27001 Annex A 8.32 is a preventive control to preserve information security when executing changes.

Definition

The ISO27001 standard defines ISO27001 Annex A 8.32 as:

Changes to information processing facilities and information systems should be subject to change management procedures.

ISO27001:2022 Annex A ISO27001 Annex A 8.32 Change Management

Implementation Guide

Change management can be a profession in it’s own right and this control is no substitute for that. What we are going to do is manage our changes to the information processing facilities for in-scope products and services and we are going to manage changes to the information security management system.

Here we take a look at what the standard is wanting and how to implement it.

DO IT YOURSELF ISO27001

STOP SPANKING £10,000s

Change Management Policy

The first step is to create, or download, your change management policy. The ISO27001 Change Management Policy set’s out what you do for change management It does not set out how you do it, as how you do it is covered in your processes.

The ISO27001 Template is the quickest way to do this but you can also take a look and write it yourself.

ISO 27001 Change Management Policy Template
ISO 27001 Change Management Policy Example 1
ISO 27001 Change Management Policy Example 2
ISO 27001 Change Management Policy Example 3

You can view the example ISO27001 Change Management Policy for more details.

You can ready the ISO 27001 Change Management Policy Ultimate Guide for more on the Change Management Policy.

You are going to make sure that you have documented change guidelines. These can be standard guidelines or industry best practice, and you likely already do this today, just make sure that this written down, communicated and available to those that need it.

You need documented roles, responsibilities, processes and procedures.

For more information be sure to read and comply with ISO 27001 Clause 6.3 Planning Of Changes – Ultimate Certification Guide 2023

What to include

Included in your change management will be consideration for the following:

  • Planning of Change
  • Impact Assessment of Change
  • Risk Assessment of Change
  • Communication of Change
  • Test and Acceptance of Change
  • Deployment Plans for Changes
  • Back out/ rollback Procedures for failed changes
  • Records of Change
  • Updated Documentation as a result of change
  • Updated Business Continuity and Disaster Recovery as a result of change

Conclusion

Change management is not overly complex although it can be a documentation overhead. Be sure to document everything and have evidence of past changes.