Policy template

Change Management Policy template

This policy exists to ensure changes to information systems are assessed, approved, tested and recorded so they do not compromise security or availability. It applies to changes to infrastructure, applications, configurations and cloud services in production.

Create this policy

What the policy contains

Types of change
Planning and testing
Recording and review

Who is responsible

IT Manager
Change requesters
Change approvers
Information Security Manager

What you decide

Normal changes approved by
Emergency changes approved by
Changes are tested in a separate environment before production
Change freeze periods

References covered

ISO/IEC 27001 Annex A: control 8.9
ISO/IEC 27001 Annex A: control 8.31
ISO/IEC 27001 Annex A: control 8.32
GDPR: Art. 32 security of processing
NIS2: Art. 21(2)(e) security in network and information systems acquisition, development and maintenance

Other policy templates

IT Operations Policy
Asset Management Policy
Supplier Security Policy
Data Protection (Privacy) Policy
Data Retention Policy
Clear Desk & Clear Screen Policy