6.4.3 In the event that the regular change management procedures could not be followed due to an …

Requirement

In the event that the regular change management procedures could not be followed due to an emergency, the relevant entities shall document the result of the change and the explanation for why the procedures could not be followed.

Guidance

• Where appropriate, integrate the pullback scenario (55) into the change management procedures.
• Assess the risks from legacy systems and upgrade existing legacy systems to include security mitigating measures in case appropriate security cannot be achieved.
• Make sure that regular change control procedures that could not be followed due to an emergency change are applied immediately after the emergency change.

Examples of evidence

• Documentation with specific pullback plans.
• Logs and records of past change requests with details of (indicative, non-exhaustive list):
  • the change,
  • reason for emergency,
  • approval,
  • reason for delay,
  • follow up actions and
  • how to revert the system to a previous stage if the change fails.
• Logs and records from past legacy system upgrade that contain risk assessments and the reasoning for the change.

1. Visão geral

1.1 Referências

1.2 Requisitos identificados

1.3 Regulamentos relacionados

2. Requisitos identificados

3. Regulamentos relacionados

Pedidos ligados

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.