2 cissp ® Official Study Guide Eighth Edition

Security Impact Analysis 
A change management process ensures that personnel can perform a security impact analy-
sis. Experts evaluate changes to identify any security impacts before personnel deploy the 
changes in a production environment. 
Change management controls provide a process to control, document, track, and audit 
all system changes. This includes changes to any aspect of a system, including hardware 
and software confi guration. Organizations implement change management processes 
through the lifecycle of any system. 
Common tasks within a change management process are as follows: 
1.
Request the change.
Once personnel identify desired changes, they request the change. 
Some organizations use internal websites, allowing personnel to submit change 
requests via a web page. The website automatically logs the request in a database, 
which allows personnel to track the changes. It also allows anyone to see the status of a 
change request. 
2.
Review the change.
Experts within the organization review the change. Personnel 
reviewing a change are typically from several different areas within the organization. 
In some cases, they may quickly complete the review and approve or reject the change. 
In other cases, the change may require approval at a formal change review board after 
extensive testing. 
3.
Approve/reject the change.
Based on the review, these experts then approve or reject 
the change. They also record the response in the change management documentation. 

---

722
Chapter 16 
■
Managing Security Operations
For example, if the organization uses an internal website, someone will document the 
results in the website’s database. In some cases, the change review board might require 
the creation of a rollback or back-out plan. This ensures that personnel can return the 
system to its original condition if the change results in a failure.