+Policies for changes to information systems

Policies for changes to information systems

Policies and instructions with technical and organisational safeguards for change management of system components of the cloud service within the scope of software deployment are documented, communicated and provided according to SP-01 with regard to the following aspects:
• Criteria for risk assessment, categorisation and prioritisation of changes and related requirements for the type and scope of testing to be performed, and necessary approvals for the development/implementation of the change and releases for deployment in the production environment by authorised personnel or system components;
• Requirements for the performance and documentation of tests;
• Requirements for segregation of duties during development, testing and release of changes;
• Requirements for the proper information of cloud customers about the type and scope of the change as well as the resulting obligations to cooperate in accordance with the contractual agreements;
• Requirements for the documentation of changes in system, operational and user documentation; and
• Requirements for the implementation and documentation of emergency changes that must comply with the same level of security as normal changes.
Additonal Criteria-
Supplementary Information - About the CriteriaChanges in the sense of the basic criterion are those that can lead to changes in the configuration, functionality or security of system components of the cloud service in the production environment. This includes changes to the infrastructure as well as to the source code.
If individual changes are combined in a new release, update, patch or comparable software object for the purpose of software provisioning, this software object is deemed to be a change within the meaning of the basic criterion, but not the individual changes contained therein.
Changes to the existing network configuration must also undergo a specified procedure, as they are necessary for effective segregation of cloud customers.
Personnel and system components receive authorisation to approve changes in accordance with the requirements for access and access authorisations (cf. IDM01) via a specified procedure (cf. IDM02).Relevant information includes descriptions of e.g. new functions.
The cloud customer's obligations to cooperate can define that, e.g. the cloud customer must carry out certain tests.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations