Table of contents
What is ISO 27001 Change Management?
ISO 27001 Annex A 8.32 Change Management is an ISO 27001 control that requires us to manage changes to both the information security management system (ISMS) and to the information processing facilities.
Purpose
ISO 27001 Annex A 8.32 is a preventive control to preserve information security when executing changes.
Definition
The ISO 27001 standard defines ISO 27001 Annex A 8.32 as:
Changes to information processing facilities and information systems should be subject to change management procedures.
ISO27001:2022 Annex A 8.32 Change Management
Implementation Guide
Change management can be a profession in it’s own right and this control is no substitute for that. What we are going to do is manage our changes to the information processing facilities for in-scope products and services and we are going to manage changes to the information security management system.
Here we take a look at what the standard is wanting and how to implement it.
DO IT YOURSELF
ISO 27001
Change Management Policy
The first step is to create, or download, your change management policy. The ISO 27001 Change Management Policy set’s out what you do for change management It does not set out how you do it, as how you do it is covered in your processes.
The ISO 27001 Change Management Policy Template is the quickest way to do this but you can also take a look and write it yourself.
You can view the example ISO 27001 Change Management Policy for more details.
You can ready the ISO 27001 Change Management Policy Ultimate Guide for more on the Change Management Policy.
You are going to make sure that you have documented change guidelines. These can be standard guidelines or industry best practice, and you likely already do this today, just make sure that this written down, communicated and available to those that need it.
You need documented roles, responsibilities, processes and procedures.
For more information be sure to read and comply with ISO 27001 Clause 6.3 Planning Of Changes – Ultimate Certification Guide 2023
What to include
Included in your change management will be consideration for the following:
- Planning of Change
- Impact Assessment of Change
- Risk Assessment of Change
- Communication of Change
- Test and Acceptance of Change
- Deployment Plans for Changes
- Back out/ rollback Procedures for failed changes
- Records of Change
- Updated Documentation as a result of change
- Updated Business Continuity and Disaster Recovery as a result of change
Conclusion
Change management is not overly complex although it can be a documentation overhead. Be sure to document everything and have evidence of past changes.