[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-32":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-32","Annex A 8.32","Change management",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Subject changes to information processing facilities and information systems to change management procedures.\n\n**In practice.** Changes are recorded, assessed for security and operational impact, authorised by appropriate people, tested and communicated before implementation, with fallback plans in place. Emergency changes follow a defined fast path and are reviewed afterwards. Automated pipelines can enforce much of this through peer review, approvals and deployment controls, as long as they are documented. Documentation and configuration records are updated after changes. Auditors sample changes and trace them from request through approval, testing and deployment.\n\n**Common gaps.** Infrastructure and cloud changes made through consoles or scripts often bypass the formal process. Emergency changes become the normal route, and post-implementation reviews and documentation updates are routinely skipped.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]