2 cissp ® Official Study Guide Eighth Edition

Request Control
The request control process provides an organized framework within 
which users can request modifications, managers can conduct cost/benefit analysis, and 
developers can prioritize tasks.
Change Control
The change control process is used by developers to re-create the situ-
ation encountered by the user and analyze the appropriate changes to remedy the situa-
tion. It also provides an organized framework within which multiple developers can create 
and test a solution prior to rolling it out into a production environment. Change control 

---

Introducing Systems Development Controls 
889
includes conforming to quality control restrictions, developing tools for update or change 
deployment, properly documenting any coded changes, and restricting the effects of new 
code to minimize diminishment of security.
Release Control
Once the changes are finalized, they must be approved for release 
through the release control procedure. An essential step of the release control process is to 
double-check and ensure that any code inserted as a programming aid during the change 
process (such as debugging code and/or back doors) is removed before releasing the new 
software to production. Release control should also include acceptance testing to ensure 
that any alterations to end-user work tasks are understood and functional.
In addition to the change management process, security administrators should be 
aware of the importance of configuration management. This process is used to control the 
version(s) of software used throughout an organization and formally track and control 
changes to the software configuration. It has four main components:
Configuration Identification
During the configuration identification process, administra-
tors document the configuration of covered software products throughout the organization.