ISO 27001 Annex A 8.32 – Change Management

ISO 27001 Change Management

In this ultimate guide to ISO 27001 Annex A 8.32 Change Management you will learn

• What is ISO 27001 Change Management
• An Implementation Guide
• An Implementation Checklist
• An Audit Checklist

I am Stuart Barker, the ISO 27001 Ninja and author of the Ultimate ISO 27001 Toolkit.

With over 30 years industry experience I will show you what’s new, give you ISO 27001 templates, show you examples, do a walkthrough and show you how to implement it for ISO 27001 certification.

What is ISO 27001 Annex A 8.32

ISO 27001 Annex A 8.32 Change Management is an ISO 27001 Annex A control that requires organisations to manage changes to both the information security management system (ISMS) and to the information processing facilities.

Purpose

ISO 27001 Annex A 8.32 is a preventive control to preserve information security when executing changes.

Definition

ISO 27001 defines ISO 27001 Annex A 8.32 as:

Changes to information processing facilities and information systems should be subject to change management procedures.

ISO27001:2022 Annex A 8.32 Change Management

Ownership

In close collaboration with domain experts, the Information Security Officer is responsible for establishing and maintaining effective change management controls and procedures.

Implementation Guide

Change management can be a profession in it’s own right and this control is no substitute for that. What we are going to do is manage our changes to the information processing facilities for in-scope products and services and we are going to manage changes to the information security management system.

There are nine essential elements of a comprehensive Change Management procedure:

• Impact Assessment: Thoroughly assess and plan for the potential impact of all planned changes, considering all dependencies.
• Authorisation Controls: Implement robust authorisation controls for all proposed changes.
• Stakeholder Communication: Effectively communicate planned changes to all relevant internal and external stakeholders.
• Rigorous Testing: Establish and execute rigorous testing and acceptance testing processes for all changes.
• Implementation Strategy: Define a clear and detailed implementation strategy, including practical deployment procedures.
• Emergency and Contingency Planning: Develop and maintain comprehensive emergency and contingency plans, including a fallback procedure.
• Comprehensive Record Keeping: Maintain detailed records of all changes and related activities.
• Documentation Updates: Review and update all relevant operating documentation and user procedures to reflect the changes.
• ICT Continuity Plan Review: Review and revise all ICT continuity plans, recovery, and response procedures to accommodate the changes.

Implementation Checklist

Change Management ISO 27001 Annex A 8.32 Implementation Checklist

Define Change Management Process:

Challenge: Lack of a clear and documented process, leading to inconsistencies and confusion.

Solution: Develop a comprehensive change management process with clear roles and responsibilities, documented procedures, and standardised forms.

Identify and Assess Changes:

Challenge: Difficulty in identifying all potential changes impacting the ISMS.

Solution: Implement a proactive change identification process, such as regular risk assessments, internal audits, and management reviews.

Conduct Impact Assessments:

Challenge: Inaccurate or incomplete impact assessments, leading to inadequate risk mitigation measures.

Solution: Utilise a standardised risk assessment methodology and involve relevant stakeholders in the impact assessment process.

Obtain Authorisations:

Challenge: Delays and bottlenecks in obtaining necessary approvals for changes.

Solution: Establish clear approval workflows, delegate appropriate authority levels, and utilise electronic approval systems to streamline the process.

Implement and Test Changes:

Challenge: Inadequate testing and validation of changes, leading to unforeseen issues and potential security breaches.

Solution: Conduct thorough testing of all changes, including unit testing, integration testing, and user acceptance testing.

Communicate Changes:

Challenge: Poor communication of changes to affected stakeholders, leading to confusion, resistance, and operational disruptions.

Solution: Develop and implement a robust communication plan, including regular updates, training sessions, and clear documentation.

Monitor and Review Changes:

Challenge: Lack of ongoing monitoring and review of implemented changes, leading to potential deviations and performance degradation.

Solution: Conduct regular post-implementation reviews to assess the effectiveness of changes and identify any areas for improvement.

Document Changes:

Challenge: Inadequate documentation of changes, leading to difficulties in tracking, auditing, and maintaining the ISMS.

Solution: Maintain a centralised change register, document all changes thoroughly, and ensure that all relevant documentation is updated accordingly.

Integrate Change Management with Other Processes:

Challenge: Lack of integration between change management and other key processes, such as risk management, incident management, and internal audits.

Solution: Ensure that change management is seamlessly integrated with other key ISMS processes to ensure consistency and efficiency.

Continual Improvement:

Challenge: Resistance to change and a lack of focus on continuous improvement within the change management process itself.

Solution: Regularly review and evaluate the effectiveness of the change management process, identify areas for improvement, and implement necessary adjustments.

By addressing these challenges and implementing effective solutions, organisations can establish a robust change management process that supports the ongoing effectiveness and improvement of their ISO 27001compliant ISMS.

Audit Checklist

Change Management ISO 27001 Annex A 8.32 Audit Checklist

Is there a Change Management Process

• Is there a documented ISO 27001 change management process with clear roles and responsibilities, documented procedures, and standardised forms. Walkthrough them to ensure what happens matches the documentation.
• Is there an ISO 27001 change management policy.

Is there evidences of changes

• Have changes be identified.
• Is there evidence of regular risk assessments.
• Review internal audits for change.
• Review the management reviews for the inclusion of change.

Were there Impact Assessments

• Assess the risk assessment methodology for change
• Review if the relevant stakeholders are involved in the impact assessment process.

Are Authorisations Obtained

• Walkthrough approval workflows.
• Review if delegation is at appropriate authority levels.
• Assess what approval system is used and walkthrough it to evidence authorisation.

Audit the Implementation and Test of Changes

• Sample changes and conduct thorough review of testing of changes.
• Assess if it includes unit testing, integration testing, security testing and user acceptance testing.
• Gain evidence of back out and roll back planning.

Are Changes Communicated

• Review the communication plan.
• Gain evidence of regular updates, training sessions, and clear documentation.
• Review meeting minutes for the inclusion of change such as change meetings, management reviews, risk reviews.

Is there Monitor and Review of Changes

• Seek evidence of post-implementation reviews.
• Do post-implementation reviews assess the effectiveness of changes and identify any areas for improvement.
• Walkthrough the success criteria applied to changes.

Are Changes Documented

• Asses documentation for changes and changes to that documentation.

Do Other Processes Integrate with Change Management

• Assess if and how change management is integrated with other key ISMS processes to ensure consistency and efficiency.

Is Change Subject to Continual Improvement:

• Gain evidence of a regular review and evaluation of the effectiveness of the change management process
• Assess if it identified areas for improvement, and were necessary adjustments implemented.

ISO 27001 Change Management Policy

An ISO 27001 Change Management Policy defines your change management responsibilities, but not the specific procedures for carrying them out. Those procedures are outlined in your processes. The ISO 27001 Change Management Policy Template is a fully written and ready to go policy.

ISO 27001 Change Management Policy Example

Supplementary Guidance

You are going to make sure that you have documented change guidelines. These can be standard guidelines or industry best practice, and you likely already do this today, just make sure that this written down, communicated and available to those that need it.

Included in your change management will be consideration for the following:

• Planning of Change
• Impact Assessment of Change
• Risk Assessment of Change
• Communication of Change
• Test and Acceptance of Change
• Deployment Plans for Changes
• Back out/ rollback Procedures for failed changes
• Records of Change
• Updated Documentation as a result of change
• Updated Business Continuity and Disaster Recovery as a result of change

For change management you need documented roles, responsibilities, processes and procedures.

Change management is not overly complex although it can be a documentation overhead. Be sure to document everything and have evidence of past changes for the auditor to review.

FAQ

ISO 27001 Templates

Implementing ISO 27001 can be a significant undertaking and incur significant ISO 27001 Costs. To streamline the process and potentially save valuable time and resources, consider utilising pre-written ISO 27001 templates. This ISO 27001 Toolkit offers a comprehensive set of resources specifically designed for those seeking to achieve ISO 27001 certification independently. With this toolkit, you can potentially build your Information Security Management System (ISMS) within a week and be ready for certification within 30 days.

ISO 27002:2022 Control 8.32

ISO 27002 Control 8.32 provides implementation guidance for Change Management.

ISO 27001 Annex A 8.32 Attributes Table