CHG-04.3: Dual Authorization for Change

There is no evidence of a capability to enforce a two-pers on rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).

C|P-CMM1 is N/A, since a structured process is required to enforce a two-pers on rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).

C|P-CMM2 is N/A, since a well-defined process is required to enforce a two-pers on rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).

Change Management (CHG) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist: o Exists to govern changes to systems, applications and services to ensure their stability, reliability and predictability. o Reviews RFC for cybersecurity and data privacy ramifications. o Notifies stakeholders to ensure awareness of the impact of proposed changes.

• An IT Asset Management (ITAM) function, or similar function, ensures compliance with requirements for asset management.
• ITAM leverages a Configuration Management Database (CMDB), or similar tool, as the authoritative source of IT assets.
• Logical Access Control (LAC) is governed to limit the ability of non-administrators from making configuration changes to systems, applications and services.
• A formal Change Management (CM) program ensures that no unauthorized changes are made, that all changes are documented, that services are not disrupted and that resources are used efficiently.
• The CM function has formally defined roles and associated responsibilities.
• Changes are tracked through a centralized technology solution to submit, review, approve and assign Requests for Change (RFC).
• A Change Advisory Board (CAB), or similar function:
• IT personnel use dedicated development/test/staging environments to deploy and evaluate changes, wherever technically possible.
• Critical systems are configured to use dual authorization mechanisms requiring the approval of two authorized individuals in order to execute a change.

See C|P-CMM3. There are no defined C|P-CMM4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to enforce a two-pers on rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to enforce a two-pers on rule for implementing changes to critical Technology Assets, Applications and/or Services (TAAS).