ISO 27001 Annex A 8.32 Change management procedures for information systems
What it says
Changes to information processing facilities and information systems shall be subject to change management procedures.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all system changes follow a formal, approved process to prevent issues.
Change management is about having a plan for updating or modifying your computer systems in a way that keeps everything working smoothly. Without it, you might accidentally disrupt your business or expose sensitive information to risks. Think of it like making sure you have a proper plan in place before rearranging an office: it prevents chaos.
Free. Save your status, tasks and notes.
Why it matters
Uncontrolled system changes can cause outages, introduce vulnerabilities, and lead to unplanned downtime, negatively impacting business operations.
How to implement
The IT manager should set up a formal change management process.
They can do this by creating a checklist that includes planning, assessing the impact, obtaining authorisation, testing, and communicating changes. Following the ISO 27002:2022 guidelines ensures all potential risks are managed.
The executive team needs to assign responsibility for approving changes.
This means choosing someone who understands both the business and technical sides to review every planned change and give the green light if it meets all security and operational requirements.
IT staff should document each step in the change management process.
By keeping detailed records of what changes were made, who approved them, and any testing results, you create a clear trail. This documentation helps ensure consistency and can protect against future issues if something goes wrong.
Operations personnel need to communicate upcoming changes to everyone in the organisation.
They should send out emails or hold meetings to explain upcoming changes, how they could affect work, and what the timeline is.
The IT department should integrate all change management procedures with existing IT policies.
This involves ensuring change management aligns with broader IT and cyber security frameworks like the ASD Essential Eight and ensures business continuity plans are updated as per ISO standards.
Keep it running
Review change logs weekly; ensure IT and security assess risk and obtain approvals before implementing changes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the change log or change management documentation.
Look at
Check that the log includes entries for planning, authorisation, testing, communication, and implementation steps.
Good evidence
A complete and organised log with no missing sections, proving each step was followed and recorded.
- Check 2 of 5What an auditor asks for
Ask for
Request records of change management meetings or communications.
Look at
Look for meeting minutes or emails that confirm changes were discussed and communicated to relevant parties.
Good evidence
Detailed records showing that each change was clearly communicated and that all stakeholders were informed ahead of implementation.
- Check 3 of 5What an auditor asks for
Ask for
Ask for test results documentation for implemented changes.
Look at
Verify that tests were conducted before changes went live and that results were analysed.
Good evidence
Comprehensive test result documents showing that potential impacts were evaluated and confirmed successful before deployment.
- Check 4 of 5What an auditor asks for
Ask for
Request the authorisation records for recent changes.
Look at
Verify that each entry includes a clear authorisation signature or record from management.
Good evidence
All changes have a designated approver's sign-off, showing the decision-making process was appropriately followed.
- Check 5 of 5What an auditor asks for
Ask for
Demand evidence of updated operational documentation.
Look at
Check if updates reflect recent system changes and align with the implementation guidelines.
Good evidence
Updated guides or manuals that align with the most recent system changes, demonstrating that users have the latest instructions.
Mappings
Closest match in ASD Information Security Manual: ISM-0597, Consult ASD before changing CDS connectivity, which this control covers in full and more.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.6.
Annex A 6.2.6 requires the organisation to define and document ongoing AI system operation requirements, including how updates and repairs will be handled. Annex A 8.32 requires changes to information systems to follow formal change management procedures, which will govern how AI system updates, patches, model revisions and configuration changes are executed. Annex A 6.2.6 is AI-operations focused (including monitoring and support), while Annex A 8.32 is broader and applies to all information systems changes, not specifically AI operational performance and support requirements.
ASD Information Security Manual: 14 mappings
This control is broader than ISM-0597.
ISM-0597 requires that when an organisation plans, designs, implements or introduces additional connectivity to cross domain systems (CDSs), ASD is consulted and any ASD directions are complied with. Annex A 8.32 requires that changes to information systems are controlled through defined change management procedures, which would govern how CDS connectivity changes are proposed, assessed, approved and implemented. ISM-0597 is a specific, high-assurance escalation/consultation requirement for a particular class of system change, whereas Annex A 8.32 is a general change-control framework for all system changes.
This control is broader than ISM-1419.
ISM-1419 requires that software development and modification occur only in development environments, preventing ad-hoc production changes. Annex A 8.32 requires formal change management procedures for changes to information systems, which includes authorisation, assessment, implementation and review. ISM-1419 is one concrete constraint that can sit within a broader change management framework required by Annex A 8.32.
This control is broader than ISM-1944.
ISM-1944 requires implementing a specific configuration change to AD CS (removing EDITF_ATTRIBUTESUBJECTALTNAME2) to reduce certificate issuance abuse. Annex A 8.32 requires that changes to information systems are controlled through formal change management procedures, which would govern how this CA flag change is requested, tested, approved and rolled out. ISM-1944 defines the required end-state for one security setting, while Annex A 8.32 governs the process for making and controlling such changes across all systems.
This control is broader than ISM-1948.
ISM-1948 requires CA Certificate Manager approval before using AD CS certificate templates that permit requester-supplied Subject Alternative Names (SANs). Annex A 8.32 requires that changes to information systems (including configuration of identity and PKI components) follow formal change management procedures. ISM-1948 is a specific, security-critical approval gate for one AD CS configuration risk, whereas Annex A 8.32 is broader and covers change control across all systems and changes.
This control partially meets ISM-0042.
ISM-0042 requires organisations to establish and maintain comprehensive system administration processes and procedures, including controlled operational changes. Annex A 8.32 specifically requires change management procedures for information systems, which is one defined component of effective administration governed by ISM-0042. Annex A 8.32 is narrower and focused on governing changes, whereas ISM-0042 also covers routine administration practices such as standard operating tasks, maintenance activities and procedural consistency across operations.
This control partially meets ISM-0912.
Annex A 8.32 requires that changes to information systems are governed by change management procedures to control risk and prevent unintended impacts. ISM-0912 directly addresses this by mandating a change and configuration management plan covering baselines, routine vs urgent changes, request/tracking/documentation, consultation, approvals, notifications, and procedures before/during/after changes. ISM-0912 is more prescriptive and comprehensive about the content and workflow of change management than Annex A 8.32, making the primary control a subset of the candidate's broader requirement.
This control partially overlaps ISM-0300.
ISM-0300 requires an explicit approval mechanism (ASD) and prescribed processes/timeframes before implementing patches or mitigations on high assurance IT equipment. ISO/IEC 27001:2022 Annex A 8.32 requires changes to information systems to follow change management procedures, which would include controlled approval and implementation of patches. The overlap is in governing patching as a controlled change, but ISM-0300 is specifically about ASD approval for high assurance equipment, while Annex A 8.32 is a general organisational change control requirement.
This control partially overlaps ISM-1079.
ISM-1079 requires ASD approval before performing maintenance or repairs on high assurance IT equipment. This overlaps with Annex A 8.32 (Change management procedures for information systems) because repairs and maintenance on high assurance equipment commonly involve changes that should be formally assessed and authorised prior to execution. The key difference is that ISM-1079 mandates a specific external authorisation (ASD) for a specific class of assets, while Annex A 8.32 is broader change governance across information systems and does not inherently require ASD involvement nor is it limited to maintenance/repair activities.
- ISM-1211System administration performed under change and configuration management planPartially overlaps
This control partially overlaps ISM-1211.
Annex A 8.32 requires organisations to subject system changes to defined change management procedures. ISM-1211 specifically requires system administrators to perform administration activities in accordance with the system's change and configuration management plan, directly reinforcing adherence to change control for admin-initiated changes. ISM-1211 focuses on administrator behaviour and compliance to an existing plan, whereas Annex A 8.32 is broader and expects the organisation to establish and apply the change management process for all relevant changes, not only admin tasks.
This control partially overlaps ISM-1598.
ISM-1598 requires verifying, after maintenance, that IT equipment retains its approved configuration and has not been changed without authorisation. Annex A 8.32 requires changes to information systems to be controlled via change management procedures, which reduces the likelihood of unauthorised or undocumented post-maintenance changes. They overlap in controlling and detecting configuration changes, but Annex A 8.32 focuses on governing and approving change, while ISM-1598 focuses on post-activity inspection to confirm the end state.
This control supports ISM-1143.
Annex A 8.32 establishes the need for change management for system changes. ISM-1143 provides support by focusing on patch management, a key aspect of system changes that adheres to Annex A 8.32's procedural requirements.
This control depends on ISM-1816.
ISM-1816 is concerned with preventing unauthorised changes to the authoritative software source to maintain integrity. Annex A 8.32 supports this by requiring formal change management for information systems, ensuring that changes to software sources are authorised and traceable. Annex A 8.32 addresses general process governance, whereas ISM-1816 focuses specifically on software source integrity.
This control depends on ISM-2025.
ISM-2025 requires using an issue tracking tool to link development tasks to security decisions and change/feature requests. This supports ISO/IEC 27001:2022 Annex A 8.32 by enabling consistent recording, review and traceability of information system changes via tickets that capture rationale, impact and approvals. Annex A 8.32 is broader because it requires formal change management procedures beyond tooling, whereas ISM-2025 is a specific tooling/traceability expectation.
This control depends on ISM-2161.
ISM-2161 requires routine and event-driven verification that network device firmware and running configuration match an approved baseline. ISO/IEC 27001:2022 Annex A 8.32 requires changes to information systems to follow change management procedures, including control and validation of changes. Baseline verification in ISM-2161 provides a practical detective check that can confirm change outcomes and detect unauthorised changes outside the change process.
ASD Essentials for enterprise IT: 1 mapping
This control depends on IT.PRO-05.3.
IT.PRO-05.3 requires all administrative or management actions that modify systems, configurations or controls to be recorded with the associated user, timestamp and target. This record of the changes actually made supports Annex A 8.32 by allowing changes to be reconciled against approved change management procedures and unauthorised changes to be detected. Annex A 8.32 governs the change process itself, while IT.PRO-05.3 provides the audit trail of changes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 27001 training
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.