CHG

Change Management

20 controls

Manage changes to Technology Assets, Applications, Services and Data (TAASD) through an authorized, risk-based process that evaluates, implements and validates changes before and after deployment.

SCF #	Control Name	Weight	NIST CSF	Frameworks
CHG-01	Change Management Policy	10 — Critical	Govern	1
CHG-02	Change Management Program	10 — Critical	Protect	92
CHG-03	Configuration Change Control	8 — High	Protect	79
CHG-04	Prohibition Of Changes	10 — Critical	Protect	34
CHG-04.1	Access Restriction For Change	8 — High	Protect	61
CHG-04.2	Role-Based Permissions To Implement Changes	6 — Medium	Protect	49
CHG-04.3	Dual Authorization for Changes To Critical / Sensitive Technology Assets, Applications and/or Services (TAAS)	6 — Medium	Protect	30
CHG-04.4	Dual Approval For High-Impact Environments	9 — Critical	Protect	2
CHG-05	Security, Compliance & Resilience Representative for Asset Lifecycle Changes	7 — High	Protect	28
CHG-06	Security Impact Analysis for Changes	9 — Critical	Protect	63
CHG-07	Test, Validate & Document Changes	9 — Critical	Protect	65
CHG-08	Stakeholder Notification of Changes	9 — Critical	Protect	38
CHG-09	Control Functionality Verification	9 — Critical	Protect	43
CHG-09.1	Report Verification Results	5 — Medium	Identify	7
CHG-10	Emergency Changes	9 — Critical	Protect	8
CHG-10.1	Documenting Emergency Changes	7 — High	Protect	2
CHG-11	Post Configuration Change Reviews	3 — Low	Detect	24
CHG-11.1	Automated Security Response	5 — Medium	Protect	8
CHG-12	Unauthorized Software Installation Alerts	8 — High	Protect	25
CHG-13	Signed Components	3 — Low	Protect	15

The Secure Controls Framework (SCF) is maintained by SCF Council. Use of SCF content is subject to the SCF Terms & Conditions.

Change Management

Manage SCF Controls in SCF Connect