Policy Register
Every policy type · Operations and technology

Change management procedure

How changes to systems are requested, assessed, approved, tested, deployed and rolled back, and who may approve an emergency change.

How the register reads it

Also calledchange control, release management
FamilyOperations and technology
Document typeProcedure. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected ownerThe head of IT operations.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whenISO 27001 is ticked and no line resolves to it (DORA requires it too, inside a parent document, so it does not list it separately).
TemplateChange management policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.32 Change management

Put changes to facilities and systems through change management procedures.

What the ISO 27002 guidance expects the document to say: Requires change management procedures to govern changes made to information systems and to the facilities that process information. Older source material adds that changes should be controlled by formal, documented and enforced procedures, with risk assessed as part of the process.

Evidence an auditor accepts: The change management procedure covering the types of change, the authorisation required and the route for emergency change; change records for the period, showing risk and security impact assessment, testing evidence, approval and implementation record; evidence of segregation between the person requesting, approving and implementing a change
Common gap: missing formal approval
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 9 Protection and prevention

Financial entities shall continuously monitor and control the security and functioning of ICT systems and tools, and minimise ICT risk through appropriate ICT security policies, procedures, protocols and tools ensuring resilience, continuity and availability, and preserving confidentiality, integrity and authenticity of data (incl access management, encryption, secure configuration, network security).

Evidence an auditor accepts: ICT security policies and protective controls (access, encryption, configuration, network); evidence preserving CIA of data
Common gap: Weak or absent protective controls
Source: DORA (Regulation (EU) 2022/2554)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Certificate management policy · Cloud security policy