Change management auditing
Missing image
Changemanagement.jpg
Changemanagement.jpg
A diagram of change management.
Information technology change management is aimed at limiting unauthorized changes and errors and disruption from changes. A change management control system sets out procedures to analyze, implement, and review changes to information technology infrastructure. As a result, change management is an important factor in the security of a system.
| Contents |
Weak Change Management Control Risks
- Security features turned off
- Malicious code distributed to users
- Loss or insecurity of sensitive data
- Financial report errors
Control Components
- Change management procedures are documented and followed
- Formal Process for requesting changes
- The request should be formal, written, and stored for reference.
- Change requests are prioritized
- All incoming change requests should be prioritized based on urgency, benefits, and ease of correction. This ensures that resources are utilized appropriately.
- Impact assessment
- Each change should be assessed for its impact to the system and on business processes. Documentation of this assessment should be stored with the request.
- Control of implementation
- Implementation of changes should be limited by automated and/or manual controls. Unauthorized changes should be periodically searched for.
- Emergency process
- Policies should clearly define what qualifies as an emergency change. Generally, these changes are restricted to errors that significantly affect functionality, business processes, or vulnerabilities. Emergency changes can override some controls, but not others. For instance, documentation can be prepared after the change, but authorization is still necessary.
- Documentation is updated
- Documentation (for developers and users) should be updated when changes to the system are implemented.
- Maintenance changes
- Maintenance tasks and changes should be logged and included in change management procedures.
- New software releases
- New software releases require additional controls including back ups, version control, and a more secure implementation.
- Software distribution
- A software distribution process tracks compliance with license agreements. Noncompliance can have disastrous financial and legal results.
- Approval
- All changes should be approved after consideration of resources, other changes in process, impact of the change, urgency, and stability of the system.
- Segregation of duties
- Initiation, approval, and implementation of changes should be performed by different personnel so that undesired changes are not made.
- Post-Implementation
- Procedures exist to monitor the effectiveness of the change management policies.
See also
External links
- International Organization for Standardization (ISO)
- Information Systems Audit and Control Association (ISACA)