6.4.1 The relevant entities shall apply change management procedures to control changes of network and …

Requirement

The relevant entities shall apply change management procedures to control changes of network and information systems. Where applicable, the procedures shall be consistent with the relevant entities’ general policies concerning change management.

Guidance

• Take into account industry-recognised and national standards when developing the change management procedures (54).
• Consider the following elements for the procedures (indicative, non-exhaustive list):
  • request for change,
  • risk assessment,
  • criteria for categorisation and prioritisation of changes:
    • associated requirements for the type and scope of the tests to be carried out and
    • the approvals to be obtained;
  • requirements for performing rollbacks; and
  • documentation of the changes and approval of changes.
• The change management procedures may allow different workflows depending on the criticality of the system, the scope of the change and the urgency (e.g. put in place an ‘emergency intervention workflow’).
• For each change, record the steps of the procedure followed.
• Review and approve changes following the change management procedures, prior to implementing them.
• Implement and test change management procedures to make sure that changes to networks and information systems are always done in a predefined way.
• Where appropriate, establish a change advisory board (CAB) to oversee and approve changes. The CAB should evaluate change requests based on risk, impact, resource requirements and alignment with business objectives.

Examples of evidence

• Documented change management procedures for network and information systems that are based on standards or good practices.
• For each relevant change, a record describing the steps and the result of the change.
• A system maintenance procedure that addresses:
  • purpose;
  • scope;
  • roles;
  • responsibilities;
  • management commitment, if applicable;
  • coordination among different organisational units; and
  • compliance.
• Logs that record the dates and outcomes of the periodic reviews of the change, repair and maintenance procedures.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -