A.8.32 Audit Checklist

When to use this

Use this checklist when auditing change management for information systems and information processing facilities.

Related controls

• A.8.32 Change Management
• A.8.32 Audit Evidence Pack

Audit checklist

• Change procedure exists.
• Scope includes systems, infrastructure, code, networks, and environments.
• Security impact is assessed.
• Approval is risk-based.
• Testing is evidenced.
• Rollback/failback is planned.
• Implementation is logged.
• Release records identify included changes.
• Emergency changes are reviewed.
• Documentation and configuration records are updated.

Sampling record