2 cissp ® Official Study Guide Eighth Edition

4.
Test the change.
Once the change is approved, it should be tested, preferably on a non-
production server. Testing helps verify that the change doesn’t cause an unanticipated 
problem.
5.
Schedule and implement the change.
The change is scheduled so that it can be imple-
mented with the least impact on the system and the system’s customer. This may 
require scheduling the change during off-duty or nonpeak hours.
6.
Document the change.
The last step is the documentation of the change to ensure that 
all interested parties are aware of it. This often requires a change in the configuration 
management documentation. If an unrelated disaster requires administrators to rebuild 
the system, the change management documentation provides them with the informa-
tion on the change. This ensures that they can return the system to the state it was in 
before the change.
There may be instances when an emergency change is required. For example, if an attack 
or malware infection takes one or more systems down, an administrator may need to make 
changes to a system or network to contain the incident. In this situation, the administra-
tor still needs to document the changes. This ensures that the change review board can 
review the change for potential problems. Additionally, documenting the emergency change 
ensures that the affected system will include the new configuration if it needs to be rebuilt.
When the change management process is enforced, it creates documentation for all 
changes to a system. This provides a trail of information if personnel need to reverse the 
change. If personnel need to implement the same change on other systems, the documenta-
tion also provides a road map or procedure to follow.
Change management control is a mandatory element for some security assurance 
requirements (SARs) in the ISO Common Criteria. However, change management controls 
are implemented in many organizations that don’t require compliance with ISO Common 
Criteria. It improves the security of an environment by protecting against unauthorized 
changes resulting in unintentional losses.
Versioning
Versioning typically refers to version control used in software configuration management. 
A labeling or numbering system differentiates between different software sets and con-
figurations across multiple machines or at different points in time on a single machine. For 
example, the first version of an application may be labeled as 1.0. The first minor update 
would be labeled as 1.1, and the first major update would be 2.0. This helps keep track of 
changes over time to deployed software.
Although most established software developers recognize the importance of version-
ing and revision control with applications, many new web developers don’t recognize its 

---

Managing Patches and Reducing Vulnerabilities 
723
importance. These web developers have learned some excellent skills they use to create 
awesome websites but don’t always recognize the importance of underlying principles such 
as versioning control. If they don’t control changes through some type of versioning control 
system, they can implement a change that effectively breaks the website.