What is change management in security?
D4 · Operations · CompTIA Security+ SY0-701Change management is a formal process for controlling changes to IT systems and infrastructure — ensuring changes are properly requested, reviewed, approved, tested, implemented, and documented to minimize the risk of unintended security impacts or outages.
Change management process: request → review/impact assessment → approval (CAB — Change Advisory Board) → test (in non-production) → implement → verify → document → rollback plan if needed.
Change management process: request → review/impact assessment → approval (CAB — Change Advisory Board) → test (in non-production) → implement → verify → document → rollback plan if needed.
Many security breaches are caused by unauthorized or poorly tested changes. Change management provides an audit trail and prevents unauthorized modifications. Emergency changes still require documentation after the fact. The CAB (Change Advisory Board) approves significant changes. Configuration management tracks the current state of systems.