ISO 27001:2022 Annex A Control 8.32

Change Management

Book a demo

data,center,programmer,using,digital,laptop,computer,,maintenance,it,specialist.

Changes to information systems, such as replacing a network device, creating a new database instance, or upgrading software, are often necessary to improve performance, reduce costs and increase efficiencies.

If not carried out correctly, changes to information processing facilities and systems may compromise the data stored or processed in them.

ISO 27001:2022 Annex A 8.32 examines how organisations can set up and execute change management procedures to monitor, examine and manage changes to the information processing facilities and systems.

Purpose of ISO 27001:2022 Annex A 8.32

ISO 27001:2022 Annex A Control 8.32 allows organisations to safeguard information assets whilst making changes to information processing systems and facilities. It does this by setting up, carrying out and managing change management rules and procedures.

Ownership of Annex A 8.32

Chief Information Security Officers, with the expertise of domain experts, should be responsible for designing and enforcing change control procedures that apply to all stages of the information system life cycle, in accordance with ISO 27001:2022 Annex A Control 8.32.

Say hello to ISO 27001 success

Get 81% of the work done for you and get certified faster with ISMS.online

Book your demo
img

General Guidance on ISO 27001:2022 Annex A 8.32 Compliance

All modifications to information systems, as well as the implementation of novel systems, should abide by an established set of regulations and procedures. The details of these changes must be explicitly stated and documented. Additionally, they must pass through assessment and quality assurance processes.

Organisations should allocate management duties to the most suitable management and stipulate the necessary procedures to guarantee all changes are in line with change control regulations and standards.

ISO 27001:2022 Annex A Control 8.32 enumerates nine components to be featured in the change management procedure:

  1. Organisations ought to map out and assess the potential effect of proposed modifications, considering all dependencies.
  2. Implement authorisation controls for changes. Ensure that all modifications are authorised by the appropriate personnel. Make sure that only authorised personnel have access to the system and that all changes are properly documented.
  3. Notify applicable inside and outside groups of the proposed alterations.
  4. Ensure adherence to ISO 27001:2022 Annex A 8.29 by developing and executing testing and acceptance tests for modifications.
  5. The implementation of the changes and their practical deployment will be taken care of.
  6. Establish emergency and contingency plans and procedures, including a fall-back procedure.
  7. Maintaining records of all alterations and linked activities, encompassing the 1-6 mentioned above.
  8. Ensuring compliance with Annex A 5.37 of ISO 27001:2022, operating documentation and user procedures are regularly reviewed and amended as necessary.
  9. ICT continuity plans and recovery and response procedures must be evaluated and updated to accommodate the modifications.

Organisations should strive to incorporate change control procedures for software and ICT infrastructure as much as possible.

Supplementary Guidance on Annex A 8.32

Changes in the production environment, e.g. operating systems and databases, may endanger application integrity and availability, specifically the transfer of software from development to production.

Organisations should be wary of the potential outcomes of altering software in their production environment. Unforeseen repercussions could arise, so caution should be exercised.

Organisations should run tests on ICT components in a safe, separate environment, away from development and production.

Organisations can gain more control over new software and safeguard the real-world data used for testing with patches and service packs, providing an extra layer of protection.

Changes and Differences from ISO 27001:2013

ISO 27001:2022 Annex A 8.32 replaces the four sections of ISO 27001:2013 Annex A 12.1.2, 14.2.2, 14.2.3, and 14.2.4.

In ISO 27001:2013, the change control procedures were more specified than they will be in 2022.

Three key distinctions can be identified between the two versions.

ISO 27001:2013 Version Was More Detailed in Terms of What ‘Change Procedure’ Should Entail

The ISO 27001:2022 and ISO 27001:2013 versions both state, in a non-exhaustive manner, what should be included in a change procedure.

The 2013 edition featured components not mentioned in the 2022 variant:

  • Identify and review security-critical code to address any weaknesses.
  • Organisations should maintain version control for all software changes.
  • Organisations should create and record a list of hardware and software components requiring alteration and updating.

The ISO 27001:2013 Version Addressed ‘Changes to Operating Platforms’

Annex A 14.2.3 of ISO 27001:2013 outlines ways in which organisations can reduce the negative impacts and disturbances on business operations that can come from changes to operating systems.

In comparison, ISO 27001:2022 does not feature any requirements for modifications.

ISO 27001:2013 Addressed ‘Changes to Software Packages’

Annex A 14.2.4, addressed to ‘Changes to Software Packages’ in ISO 27001:2013, this is not included in the ISO 27001:2022 version.

Table of All ISO 27001:2022 Annex A Controls

In the table below you’ll find more information on each individual ISO 27001:2022 Annex A Control.

ISO 27001:2022 Organisational Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
Organisational ControlsAnnex A 5.1Annex A 5.1.1
Annex A 5.1.2
Policies for Information Security
Organisational ControlsAnnex A 5.2Annex A 6.1.1Information Security Roles and Responsibilities
Organisational ControlsAnnex A 5.3Annex A 6.1.2Segregation of Duties
Organisational ControlsAnnex A 5.4Annex A 7.2.1Management Responsibilities
Organisational ControlsAnnex A 5.5Annex A 6.1.3Contact With Authorities
Organisational ControlsAnnex A 5.6Annex A 6.1.4Contact With Special Interest Groups
Organisational ControlsAnnex A 5.7NEWThreat Intelligence
Organisational ControlsAnnex A 5.8Annex A 6.1.5
Annex A 14.1.1
Information Security in Project Management
Organisational ControlsAnnex A 5.9Annex A 8.1.1
Annex A 8.1.2
Inventory of Information and Other Associated Assets
Organisational ControlsAnnex A 5.10Annex A 8.1.3
Annex A 8.2.3
Acceptable Use of Information and Other Associated Assets
Organisational ControlsAnnex A 5.11Annex A 8.1.4Return of Assets
Organisational ControlsAnnex A 5.12Annex A 8.2.1Classification of Information
Organisational ControlsAnnex A 5.13Annex A 8.2.2Labelling of Information
Organisational ControlsAnnex A 5.14Annex A 13.2.1
Annex A 13.2.2
Annex A 13.2.3
Information Transfer
Organisational ControlsAnnex A 5.15Annex A 9.1.1
Annex A 9.1.2
Access Control
Organisational ControlsAnnex A 5.16Annex A 9.2.1Identity Management
Organisational ControlsAnnex A 5.17Annex A 9.2.4
Annex A 9.3.1
Annex A 9.4.3
Authentication Information
Organisational ControlsAnnex A 5.18Annex A 9.2.2
Annex A 9.2.5
Annex A 9.2.6
Access Rights
Organisational ControlsAnnex A 5.19Annex A 15.1.1Information Security in Supplier Relationships
Organisational ControlsAnnex A 5.20Annex A 15.1.2Addressing Information Security Within Supplier Agreements
Organisational ControlsAnnex A 5.21Annex A 15.1.3Managing Information Security in the ICT Supply Chain
Organisational ControlsAnnex A 5.22Annex A 15.2.1
Annex A 15.2.2
Monitoring, Review and Change Management of Supplier Services
Organisational ControlsAnnex A 5.23NEWInformation Security for Use of Cloud Services
Organisational ControlsAnnex A 5.24Annex A 16.1.1Information Security Incident Management Planning and Preparation
Organisational ControlsAnnex A 5.25Annex A 16.1.4Assessment and Decision on Information Security Events
Organisational ControlsAnnex A 5.26Annex A 16.1.5Response to Information Security Incidents
Organisational ControlsAnnex A 5.27Annex A 16.1.6Learning From Information Security Incidents
Organisational ControlsAnnex A 5.28Annex A 16.1.7Collection of Evidence
Organisational ControlsAnnex A 5.29Annex A 17.1.1
Annex A 17.1.2
Annex A 17.1.3
Information Security During Disruption
Organisational ControlsAnnex A 5.30NEWICT Readiness for Business Continuity
Organisational ControlsAnnex A 5.31Annex A 18.1.1
Annex A 18.1.5
Legal, Statutory, Regulatory and Contractual Requirements
Organisational ControlsAnnex A 5.32Annex A 18.1.2Intellectual Property Rights
Organisational ControlsAnnex A 5.33Annex A 18.1.3Protection of Records
Organisational ControlsAnnex A 5.34 Annex A 18.1.4Privacy and Protection of PII
Organisational ControlsAnnex A 5.35Annex A 18.2.1Independent Review of Information Security
Organisational ControlsAnnex A 5.36Annex A 18.2.2
Annex A 18.2.3
Compliance With Policies, Rules and Standards for Information Security
Organisational ControlsAnnex A 5.37Annex A 12.1.1Documented Operating Procedures

ISO 27001:2022 People Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
People ControlsAnnex A 6.1Annex A 7.1.1Screening
People ControlsAnnex A 6.2Annex A 7.1.2Terms and Conditions of Employment
People ControlsAnnex A 6.3Annex A 7.2.2Information Security Awareness, Education and Training
People ControlsAnnex A 6.4Annex A 7.2.3Disciplinary Process
People ControlsAnnex A 6.5Annex A 7.3.1Responsibilities After Termination or Change of Employment
People ControlsAnnex A 6.6Annex A 13.2.4Confidentiality or Non-Disclosure Agreements
People ControlsAnnex A 6.7Annex A 6.2.2Remote Working
People ControlsAnnex A 6.8Annex A 16.1.2
Annex A 16.1.3
Information Security Event Reporting

ISO 27001:2022 Physical Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
Physical ControlsAnnex A 7.1Annex A 11.1.1Physical Security Perimeters
Physical ControlsAnnex A 7.2Annex A 11.1.2
Annex A 11.1.6
Physical Entry
Physical ControlsAnnex A 7.3Annex A 11.1.3Securing Offices, Rooms and Facilities
Physical ControlsAnnex A 7.4NEWPhysical Security Monitoring
Physical ControlsAnnex A 7.5Annex A 11.1.4Protecting Against Physical and Environmental Threats
Physical ControlsAnnex A 7.6Annex A 11.1.5Working In Secure Areas
Physical ControlsAnnex A 7.7Annex A 11.2.9Clear Desk and Clear Screen
Physical ControlsAnnex A 7.8Annex A 11.2.1Equipment Siting and Protection
Physical ControlsAnnex A 7.9Annex A 11.2.6Security of Assets Off-Premises
Physical ControlsAnnex A 7.10Annex A 8.3.1
Annex A 8.3.2
Annex A 8.3.3
Annex A 11.2.5
Storage Media
Physical ControlsAnnex A 7.11Annex A 11.2.2Supporting Utilities
Physical ControlsAnnex A 7.12Annex A 11.2.3Cabling Security
Physical ControlsAnnex A 7.13Annex A 11.2.4Equipment Maintenance
Physical ControlsAnnex A 7.14Annex A 11.2.7Secure Disposal or Re-Use of Equipment

ISO 27001:2022 Technological Controls

Annex A Control TypeISO/IEC 27001:2022 Annex A IdentifierISO/IEC 27001:2013 Annex A IdentifierAnnex A Name
Technological ControlsAnnex A 8.1Annex A 6.2.1
Annex A 11.2.8
User Endpoint Devices
Technological ControlsAnnex A 8.2Annex A 9.2.3Privileged Access Rights
Technological ControlsAnnex A 8.3Annex A 9.4.1Information Access Restriction
Technological ControlsAnnex A 8.4Annex A 9.4.5Access to Source Code
Technological ControlsAnnex A 8.5Annex A 9.4.2Secure Authentication
Technological ControlsAnnex A 8.6Annex A 12.1.3Capacity Management
Technological ControlsAnnex A 8.7Annex A 12.2.1Protection Against Malware
Technological ControlsAnnex A 8.8Annex A 12.6.1
Annex A 18.2.3
Management of Technical Vulnerabilities
Technological ControlsAnnex A 8.9NEWConfiguration Management
Technological ControlsAnnex A 8.10NEWInformation Deletion
Technological ControlsAnnex A 8.11NEWData Masking
Technological ControlsAnnex A 8.12NEWData Leakage Prevention
Technological ControlsAnnex A 8.13Annex A 12.3.1Information Backup
Technological ControlsAnnex A 8.14Annex A 17.2.1Redundancy of Information Processing Facilities
Technological ControlsAnnex A 8.15Annex A 12.4.1
Annex A 12.4.2
Annex A 12.4.3
Logging
Technological ControlsAnnex A 8.16NEWMonitoring Activities
Technological ControlsAnnex A 8.17Annex A 12.4.4Clock Synchronization
Technological ControlsAnnex A 8.18Annex A 9.4.4Use of Privileged Utility Programs
Technological ControlsAnnex A 8.19Annex A 12.5.1
Annex A 12.6.2
Installation of Software on Operational Systems
Technological ControlsAnnex A 8.20Annex A 13.1.1Networks Security
Technological ControlsAnnex A 8.21Annex A 13.1.2Security of Network Services
Technological ControlsAnnex A 8.22Annex A 13.1.3Segregation of Networks
Technological ControlsAnnex A 8.23NEWWeb filtering
Technological ControlsAnnex A 8.24Annex A 10.1.1
Annex A 10.1.2
Use of Cryptography
Technological ControlsAnnex A 8.25Annex A 14.2.1Secure Development Life Cycle
Technological ControlsAnnex A 8.26Annex A 14.1.2
Annex A 14.1.3
Application Security Requirements
Technological ControlsAnnex A 8.27Annex A 14.2.5Secure System Architecture and Engineering Principles
Technological ControlsAnnex A 8.28NEWSecure Coding
Technological ControlsAnnex A 8.29Annex A 14.2.8
Annex A 14.2.9
Security Testing in Development and Acceptance
Technological ControlsAnnex A 8.30Annex A 14.2.7Outsourced Development
Technological ControlsAnnex A 8.31Annex A 12.1.4
Annex A 14.2.6
Separation of Development, Test and Production Environments
Technological ControlsAnnex A 8.32Annex A 12.1.2
Annex A 14.2.2
Annex A 14.2.3
Annex A 14.2.4
Change Management
Technological ControlsAnnex A 8.33Annex A 14.3.1Test Information
Technological ControlsAnnex A 8.34Annex A 12.7.1Protection of Information Systems During Audit Testing

How ISMS.online Help

Our cloud platform offers a strong structure of information security measures, enabling you to tick off your ISMS process as you progress, guaranteeing it meets the ISO 27000k criteria.

ISMS.online can help you attain certification efficiently and with minimal resources. When employed correctly, it can be a great asset in achieving this goal.

Contact us now to schedule a demonstration.

See ISMS.online
in action

Book a tailored hands-on session
based on your needs and goals
Book your demo

Achieve your first ISO 27001

Download our free guide to fast and sustainable certification

Explore ISMS.online's platform with a self-guided tour - Start Now