CHANGE MANAGEMENT POLICY
Legal name of the entity
Effective Date
Policy Owner Name or role (for example Head of Engineering) Basis
SOC 2 CC8 ISO/IEC 27001 change control This policy ensures changes to production systems are authorised, tested and reversible, reducing the risk of outage or security regression.
1. Purpose and scope
This policy applies across Legal name of the entity and is owned by Name or role (for example Head of Engineering) . It covers changes to infrastructure, software and configuration.
2. Change process
Standard changes follow these steps:
Request and record the change. Peer review the change. Test in a non-production environment. Obtain approval. Release with a rollback plan ready. Verify and document the outcome. 3. Controls in place
The organisation operates the following change controls:
Control In place Formal request and record No Peer review No Tested before release No Approval required No Rollback plan No Segregation of duties No
4. Emergency changes
Emergency change process
5. Review and approval
Reviewed [cycle]; approved by Name and designation on [date].
Approved by
Name and designation
______________________
Policy Owner
Name or role (for example Head of Engineering)
______________________