Identification and assesment of changes

In systematic cyber security work, the impact of significant changes must be assessed in advance and they must be executed in a controlled way. The consequences of unintentional changes must be assessed and efforts made to mitigate possible adverse effects.

Significant changes may include: changes in the organization, operating environment, business processes and data systems. Changes can be identified e.g. through management reviews and other cyber security work.

Inadequate change management is a common cause of incidents for digital services.

An organization shall document the change management process that must be followed whenever significant changes are made to developed digital services or other computing services that affect cyber security. The process includes requirements e.g. for the following:

• Defining and documenting the change
• Assessing the risks and defining the necessary control measures
• Other impact assessment of the change
• Testing and quality assurance
• Managed implementation of the change
• Updating a change log

The organization has to have rules for urgent emergencies when following the rules allows for deviating from standard change management procedures.

The rules should include references and comparisons to the normal change management procedures and for example needed evidence for the reason for deviation from normal procedure.

The organization has to have pre-planned means of detecting non-compliance with the change management procedure.

If a deviation from the change management procedure is detected, it should be addressed in accordance with the disruption management process.

The responsible person monitors significant changes in the supplier's operations that may affect the supplier relationship and service level, and thus require other measures. The following aspects are taken into account:

• direct changes to supplier agreements
• service content improvements, new technologies or the development of new services
• significant changes in operating methods (either related to cyber security or other activities)
• changes in the physical location of the data
• changes in the supply chain / subcontracting process