Chapter 11: Security Operations - Configuration Management

There are 6 steps to the change control process as stated in the study guide.

1. Request for a change to take place - Person requesting the change should construct the change idea and present it to the party responsible for approving and implementing changes.

2. Approval of the change - Benefits of the change should be presented to the approving party and also show the potential problems that the change could cause. The approving party might make the requestor go back and do more research or development of the change be approval takes place.

3. Documentation of the change - If a change gets approved, all the appropriate information about the change should be entered into a change log. As the change develops, updates should be made to the individual record in the change log.

4. Tested and presented - Testing is necessary to uncover any unforeseen negative affects of the change. In the step, if it is a big change, a change control committee might be brought in to weigh the positives and negatives of the change and get another opinion on the change before company wide implementation occurs.

5. Implementation - Once all of the previous steps have been satisfied, it is time to put the change into action. An implementation schedule and milestones should be set up in order to keep the implementation organized.

6. Report change to management - A final report should be submitted to management that gives a summary of the implementation and the status of the change that is now in production.