Change management and the CISSP

When an organization modifies any of its information resources — whether software, hardware, networks, system documentation or operating procedures — these changes need careful management through a predefined control process. This structured approach ensures transitions occur systematically, with clear accountability and minimal disruption to business operations. 

Change management is a comprehensive process that defines specific responsibilities and authority levels for all staff involved. With the increasing complexity of modern IT environments, including cloud services, containerized applications and automated deployment pipelines, effective change management has become more critical than ever. 

For more exam tips, get our free CISSP exam tips and tricks ebook, or watch our free one-hour CISSP exam tips course with an instructor whose students have a 95% pass rate. 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Types of change

Organizations typically deal with four main types of change, each requiring different levels of oversight and urgency: 

• Emergency change: Requires immediate evaluation and implementation following a disaster or security incident. These changes bypass normal approval chains but still need documentation and post-implementation review. 
• Standard change: Low-risk modifications with documented procedures and pre-approved pathways. Examples include routine password resets or approved software updates. 
• Major change: High-risk modifications with potential financial impact requiring comprehensive review and senior management approval. This might include upgrading core business applications or implementing new security architectures. 
• Normal change: Significant but routine modifications to services or infrastructure requiring change advisory board review but following standard processes. 

Change management roles and responsibilities

The effectiveness of change management depends on clearly defined roles and responsibilities: 

• Change requestor: The person or department initiating the change. They must clearly document the business needs and desired outcomes. 
• Change manager: Oversees the entire change management process. They coordinate between teams, lead the review board and ensure proper execution of changes. 
• Change review board: A group of stakeholders from different business units who review and approve changes. The board evaluates risks, impacts and resource requirements. 
• Technical teams: Depending on the organization's structure, these may include: 
  • Change developers who design technical solutions 
  • Change implementers who execute approved changes 
  • Change controllers who monitor and verify changes 
  • Change schedulers who coordinate timing and resources 

Change management process

The change management process encompasses all steps, from initial request through final implementation and review. Each phase includes specific controls, verifications and documentation requirements to ensure changes meet business needs while maintaining security. Many of these steps in modern organizations integrate with automated tools and development pipelines, but the fundamental controls and oversight remain essential. A well-structured process helps organizations balance the need for rapid changes with risk management and security requirements. 

Request and documentation 

Any change request must be submitted through a standardized and central system. Modern organizations typically use IT Service Management (ITSM) platforms that integrate with development and operations tools. The request documentation should include: 

• Change description: 
  • Detailed explanation of the proposed modification 
  • Technical specifications 
  • Systems and services affected 
  • Dependencies and potential impacts 
  • Resource requirements 
• Business case: 
  • Justification for the change 
  • Expected benefits 
  • Cost analysis 
  • Risk assessment 
  • Alignment with business objectives 
• Implementation details: 
  • Step-by-step execution plan 
  • Timeline and milestones 
  • Resource assignments 
  • Testing procedures 
  • Rollback procedures 
  • Success criteria 

Configuration management 

Configuration management is an integral part of the change process that includes: 

• Initial assessment: 
  • Current system configurations 
  • Proposed modifications 
  • Impact on existing settings 
  • Security baselines 
  • Compliance requirements 
• Change controls: 
  • Operating system modifications 
  • Application updates 
  • Network configuration changes 
  • Security protocol updates 
  • Account management modifications 
  • Firewall rule changes 
• Documentation requirements: 
  • Configuration item details 
  • Version control information 
  • Change history 
  • Technical specifications 
  • Security parameters 

Security impact analysis 

Before implementing any change, organizations must review security documentation and assess risk: 

• Risk assessment: 
  • Vulnerability introduction 
  • Threat analysis 
  • Impact on existing controls 
  • Compliance implications 
  • Data protection considerations 
• Control evaluation: 
  • Current security measures 
  • Required modifications 
  • New control requirements 
  • Integration with existing security architecture 
  • Monitoring capabilities 
• Compliance review: 
  • Regulatory requirements 
  • Industry standards 
  • Internal policies 
  • Security baselines 
  • Audit considerations 

Testing 

Before implementing any change, testing must be performed in a controlled environment that reflects operational conditions: 

• Test environment requirements: 
  • Closed system isolated from production 
  • Representative of actual operating conditions 
  • Appropriate security controls 
  • Data privacy protections 
  • Monitoring capabilities 
• Testing procedures: 
  • Functionality verification 
  • Security control testing 
  • Performance assessment 
  • Integration testing 
  • User acceptance testing 
  • Rollback procedure verification 
• Test documentation: 
  • Test plans and scenarios 
  • Results documentation 
  • Issue tracking 
  • Resolution procedures 
  • Sign-off requirements 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Implementation 

The implementation phase requires careful coordination and precise execution: 

• Pre-implementation checks: 
  • Resource availability confirmation 
  • Stakeholder notifications 
  • Backup verification 
  • System state documentation 
  • Security control readiness 
• Execution procedures: 
  • Step-by-step implementation 
  • Progress monitoring 
  • Security control verification 
  • Performance tracking 
  • User impact assessment 
• Success criteria validation: 
  • Functionality verification 
  • Security control effectiveness 
  • Performance metrics 
  • User acceptance 
  • Compliance requirements 

Documentation and records 

Throughout the change process, maintaining comprehensive documentation is crucial: 

• Change records: 
  • Request details 
  • Approval documentation 
  • Implementation procedures 
  • Configuration changes 
  • Security modifications 
  • Test results 
• Version control: 
  • Software versions 
  • Configuration versions 
  • Documentation updates 
  • Security baseline modifications 
  • Rollback points 
• Audit trail: 
  • Change authorizations 
  • Implementation steps 
  • Verification procedures 
  • Security assessments 
  • Compliance checks 

Communication requirements 

Effective communication underpins successful change management. Organizations must establish clear channels for sharing change-related information with all stakeholders throughout the process. This includes not only technical teams but also business units, end users and external partners who may be affected by the changes. 

The change policy and related procedures should be readily available to all concerned personnel. When a change is planned, affected parties need timely notifications that outline the scope, timing and potential impacts. During implementation, status updates keep stakeholders informed of progress and any issues that arise. 

Training requirements often emerge from significant changes, particularly when introducing new systems or procedures. The change management team must coordinate with training departments to ensure users understand the modifications and can work effectively with updated systems. 

Inventory management 

A comprehensive and current inventory of information resources provides the foundation for effective change management. Organizations should maintain detailed records of all assets that might be affected by or involved in changes. This includes not only physical hardware but also software licenses, network components and security tools. 

An up-to-date inventory allows for effective reporting, tracking and auditing of changes. Each resource should be documented with specific details to ensure accountability, such as serial numbers, license information, manufacturer details and physical location. This detailed tracking becomes particularly important during audits and when assessing the scope of potential changes. 

The inventory should also reflect support contracts, maintenance schedules and security configurations. This information helps change managers understand dependencies and maintain appropriate security baselines throughout the change process. 

Changes in cloud and modern environments 

Modern IT environments present unique challenges for change management. Cloud services introduce shared responsibility models where changes might affect multiple organizations or require coordination with service providers. Change managers must understand their organization's responsibilities versus their cloud providers' responsibilities and ensure changes align with both parties' security requirements. 

Automated deployment pipelines have transformed how many organizations implement changes. While CI/CD processes can speed up deployments and reduce human error, they require careful integration with change management procedures. Security scanning, automated testing, and rollback capabilities must be built into these pipelines while proper oversight and documentation are maintained. 

These modern environments also introduce new security considerations. Multi-tenant impacts need assessment, and compliance requirements must be maintained across cloud and hybrid infrastructures. Change managers must adapt traditional processes to account for these new paradigms while maintaining control and security. 

Best practices for sustainable change management 

Change management success relies heavily on proper planning and documentation. Organizations must develop comprehensive change management plans that define roles, responsibilities, processes and policies. These plans should detail how to implement changes at every level, from resource configuration to security baselines. 

Change controls must account for both technical and human elements. Written standards and procedures support consistent change implementation, while clear documentation helps team members understand their roles and responsibilities. Regular reviews and updates of these procedures ensure they remain relevant as technology and business needs evolve. 

As technology environments become more complex, the importance of effective change management grows. Cloud services, automated deployments and interconnected systems mean changes can have far-reaching impacts. Regular tracking and post-implementation reviews help organizations continuously improve their change management processes while maintaining security throughout system lifecycles. 

Earn your CISSP, guaranteed!

Get live, expert CISSP training from anywhere. Enroll now to claim your Exam Pass Guarantee!

Get Pricing

Want to learn more about change management and other CISSP exam domains?  

• Download our CISSP exam tips ebook for proven study strategies and exam insights. For hands-on CISSP training and exam preparation, check out our comprehensive CISSP Boot Camp. 
• To explore how CISSP certification fits into your career path, download our cybersecurity certifications and skills roadmap. You can also visit our CISSP training hub for additional resources and information about the certification process. 
• For more insights into cybersecurity career opportunities and salary expectations, download our cybersecurity salary guide.