All 93 controls · Technological controls
Control 8.32
Change management
What ISO/IEC 27002:2022 control 8.32 asks for, in our own words, with the five published attribute values, the evidence an auditor asks for and the gaps commonly found. ISO/IEC 27028 is the guidance that explains how to use these values.
What the control asks
Every change to information systems and processing facilities is to pass through the change management procedures. Purpose: keep information secure while changes are carried out. Guidance: introducing new systems or making major changes follows agreed rules and a formal path that documents, specifies, tests and quality-checks the change and manages its roll-out, with management responsibilities and procedures giving adequate control over every change. Change control procedures are documented and enforced so information stays confidential, intact and available from the first design work through every later round of maintenance, and procedures for ICT infrastructure and software are integrated wherever practical. They should cover planning and assessing the impact of changes, taking all dependencies into account; authorizing changes; informing relevant interested parties; testing changes and accepting the test results (8.29); implementing changes with deployment plans; emergency and contingency arrangements including fallback; keeping records of changes covering all of these; updating operating documentation (5.37) and user procedures as needed; and revising ICT continuity plans and the associated response and recovery steps (5.30) where required. Other information: poorly controlled change is a frequent cause of system and security failures, and moving software from development into operation can affect application integrity and availability; software changes affect production and the reverse; good practice is to test ICT components, including patches, service packs and other updates, in an environment separate from both production and development (8.31); production includes operating systems, databases and middleware, and the control covers application and infrastructure changes alike.
Purpose in the standard’s terms, in our words: Preserves information security when changes are executed.
Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Application security, System and network security; Protection.
The five attribute values
These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.
| Control type | Preventive |
|---|---|
| Information security properties | ConfidentialityIntegrityAvailability |
| Cybersecurity concepts | Protect |
| Operational capabilities | Application securitySystem and network security |
| Security domains | Protection |
Evidence an auditor asks for
The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.
- The documented change management procedure covering infrastructure and software, integrated where practical
- Change records showing impact and dependency assessment, authorization, stakeholder communication, testing and acceptance, deployment plan and fallback
- Emergency change records with retrospective review and approval
- Evidence that operating documentation, user procedures and ICT continuity plans were updated after changes
- Reconciliation of changes detected in production (for example from configuration monitoring) against approved change records
- Records of patches and updates tested in a segregated environment before deployment
Where audits commonly find gaps
- Changes are made directly in production without a change record
- Emergency changes are never reviewed after the fact
- Impact assessment ignores dependencies, causing unexpected outages
- Continuity plans and runbooks are not updated after infrastructure changes
What ISO/IEC 27028 changes for this control
It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It crosses 2 operational capabilities, so two teams share the work and the owner column matters. Its earlier numbering (12.1.2, 14.2.2) is kept in the register so an older audit file can still be traced.
The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.
Controls that share its values
Source for this page
- ISO/IEC 27002:2022, the control catalogue and Table A.1. The reference record of the 93 controls, their five attribute values, purpose, evidence and gaps. The published standard is at https://www.iso.org/standard/75652.html.
- ISO/IEC 27028, official record. Stage 60.00 under publication, edition 1, committee, abstract and the dated lifecycle. Retrieved 20 October 2026.
Retrieved 2026-10-20. The requirement above is our statement of the clause in our own words; the official text is linked so you can check it.
The attribute kit, USD 799 one off. The 109-row register with all five values, the evidence list, a dated plan and the extension worksheet, as PDF, CSV and XLSX.