verifiedISO/IEC 27001:2022
ISO 27001 Annex A 8.32Change management procedures for information systems
Official control statement
Changes to information processing facilities and information systems shall be subject to change management procedures.
verifiedISO/IEC 27001:2022Annex A 8.32
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Ensure all system changes follow a formal, approved process to prevent issues.
Technological controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
Change management is about having a plan for updating or modifying your computer systems in a way that keeps everything working smoothly. Without it, you might accidentally disrupt your business or expose sensitive information to risks. Think of it like making sure you have a proper plan in place before rearranging an office - it prevents chaos.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Technological controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Uncontrolled system changes can cause outages, introduce vulnerabilities, and lead to unplanned downtime, negatively impacting business operations.
settings
Operational notes
Review change logs weekly; ensure IT and security assess risk and obtain approvals before implementing changes.
02 - Implement
build
Implementation tips
- The IT manager should set up a formal change management process. They can do this by creating a checklist that includes planning, assessing the impact, obtaining authorisation, testing, and communicating changes. Following the ISO 27002:2022 guidelines ensures all potential risks are managed.
- The executive team needs to assign responsibility for approving changes. This means choosing someone who understands both the business and technical sides to review every planned change and give the green light if it meets all security and operational requirements.
- IT staff should document each step in the change management process. By keeping detailed records of what changes were made, who approved them, and any testing results, you create a clear trail. This documentation helps ensure consistency and can protect against future issues if something goes wrong.
- Operations personnel need to communicate upcoming changes to everyone in the organisation. They should send out emails or hold meetings to explain upcoming changes, how they could affect work, and what the timeline is.
- The IT department should integrate all change management procedures with existing IT policies. This involves ensuring change management aligns with broader IT and cyber security frameworks like the ASD Essential Eight and ensures business continuity plans are updated as per ISO standards.
03 - Audit
fact_check
Audit / evidence tips
- AskRequest the change log or change management documentation.Look atCheck that the log includes entries for planning, authorisation, testing, communication, and implementation steps.GoodA complete and organised log with no missing sections, proving each step was followed and recorded.
- AskRequest records of change management meetings or communications.Look atLook for meeting minutes or emails that confirm changes were discussed and communicated to relevant parties.GoodDetailed records showing that each change was clearly communicated and that all stakeholders were informed ahead of implementation.
- AskAsk for test results documentation for implemented changes.Look atVerify that tests were conducted before changes went live and that results were analysed.GoodComprehensive test result documents showing that potential impacts were evaluated and confirmed successful before deployment.
- AskRequest the authorisation records for recent changes.Look atVerify that each entry includes a clear authorisation signature or record from management.GoodAll changes have a designated approver's sign-off, showing the decision-making process was appropriately followed.
- AskDemand evidence of updated operational documentation.Look atCheck if updates reflect recent system changes and align with the implementation guidelines.GoodUpdated guides or manuals that align with the most recent system changes, demonstrating that users have the latest instructions.
04 - Mappings
link
Cross-framework mappings
How Annex A 8.32 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 42001
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| Annex A 6.2.6 | Annex A 6.2.6 requires the organisation to define and document ongoing AI system operation requirements, including how updates and repair... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(4)expand_less | ||
| ISM-0597 | ISM-0597 requires that when an organisation plans, designs, implements or introduces additional connectivity to cross domain systems (CDS... | |
| ISM-1419 | ISM-1419 requires that software development and modification occur only in development environments, preventing ad-hoc production changes | |
| ISM-1944 | ISM-1944 requires implementing a specific configuration change to AD CS (removing EDITF_ATTRIBUTESUBJECTALTNAME2) to reduce certificate i... | |
| ISM-1948 | ISM-1948 requires CA Certificate Manager approval before using AD CS certificate templates that permit requester-supplied Subject Alterna... | |
layersPartially meets(2)expand_less | ||
| ISM-0042 | ISM-0042 requires organisations to establish and maintain comprehensive system administration processes and procedures, including control... | |
| ISM-0912 | Annex A 8.32 requires that changes to information systems are governed by change management procedures to control risk and prevent uninte... | |
sync_altPartially overlaps(4)expand_less | ||
| ISM-0300 | ISM-0300 requires an explicit approval mechanism (ASD) and prescribed processes/timeframes before implementing patches or mitigations on ... | |
| ISM-1079 | ISM-1079 requires ASD approval before performing maintenance or repairs on high assurance IT equipment | |
| ISM-1211 | Annex A 8.32 requires organisations to subject system changes to defined change management procedures | |
| ISM-1598 | ISM-1598 requires verifying, after maintenance, that IT equipment retains its approved configuration and has not been changed without aut... | |
handshakeSupports(1)expand_less | ||
| ISM-1143 | Annex A 8.32 establishes the need for change management for system changes | |
extensionDepends on(3)expand_less | ||
| ISM-1816 | ISM-1816 is concerned with preventing unauthorised changes to the authoritative software source to maintain integrity | |
| ISM-2025 | ISM-2025 requires using an issue tracking tool to link development tasks to security decisions and change/feature requests | |
| ISM-2161 | ISM-2161 requires routine and event-driven verification that network device firmware and running configuration match an approved baseline | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Technological controls
Annex A 8.29
Security testing in development and acceptance
Annex A 8.30
Management of Outsourced System Development
Annex A 8.31
Separation of Development, Test, and Production Environments
Annex A 8.33
Test Information Selection and Protection
Annex A 8.34
Protection of information systems during audits
Annex A 8.1
Protection of User Endpoint Devices
See all Technological controls controls, or browse the full ISO 27001 library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.