+OPS.3.1.A12 Change Management [Organisation] (S)

OPS.3.1.A12 Change Management [Organisation] (S)

There SHOULD be policies for making changes to IT components, software, and configuration data. When making changes, the relevant security aspects SHOULD also be considered. All changes MUST be planned, tested, approved, and documented. How and to what extent the changes are documented SHOULD be agreed with outsourcing customers. The documentation SHOULD be made available to outsourcing customers. Fallback solutions SHOULD be developed before changes are carried out. In the event of major security-relevant changes, the information security management department of the outsourcing organisation in question SHOULD already be involved in advance.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems