6.4.3 In the event that the regular change management procedures could not be followed due to an …

Requirement

In the event that the regular change management procedures could not be followed due to an emergency, the relevant entities shall document the result of the change and the explanation for why the procedures could not be followed.

Guidance

• Where appropriate, integrate the pullback scenario (55) into the change management procedures.
• Assess the risks from legacy systems and upgrade existing legacy systems to include security mitigating measures in case appropriate security cannot be achieved.
• Make sure that regular change control procedures that could not be followed due to an emergency change are applied immediately after the emergency change.

Examples of evidence

• Documentation with specific pullback plans.
• Logs and records of past change requests with details of (indicative, non-exhaustive list):
  • the change,
  • reason for emergency,
  • approval,
  • reason for delay,
  • follow up actions and
  • how to revert the system to a previous stage if the change fails.
• Logs and records from past legacy system upgrade that contain risk assessments and the reasoning for the change.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• ENISA -