CCC-06 — Change Management Baseline

Every framework that asks this

Answer CCC-06 once and it typically satisfies the equivalent control elsewhere. Altitude and confidence vary — a domain-level anchor is a starting point to verify, not an audited equivalence.

Full provenance and NIST 800-53 mappings: the framework crosswalk.

What the reviewer is really checking

The reviewer wants to establish that no single person can push an unreviewed change to production and that every change leaves an audit trail. Behind 'Do you have a change management process?' are the real questions: Is peer review required before code merges, and is it enforced by tooling (protected branches, required approvals) or merely expected? Is there separation between who writes a change and who can deploy it to production, so the same person cannot author and release unilaterally? Is every production change logged with what changed, who approved it, when, and why, in a way that ties back to a ticket or pull request? How are emergency changes handled, since that is where controls usually get bypassed, and are they reviewed after the fact within a defined window? How do you manage configuration and infrastructure changes, not just application code, and can you detect drift from an approved baseline? The reviewer is testing for enforceable gates and an audit trail, because 'all changes are reviewed' with no separation of duties and no log is exactly the pattern that lets a rushed or malicious change through unnoticed.

What a truthful, defensible answer contains

A defensible answer describes the gates and the trail. State that changes require peer review and approval before merge, and say how that is enforced (for example branch protection requiring one or more approvals and passing checks). Describe the separation between development and deployment authority, and how production access to deploy is controlled. Explain how every change is logged and linked to a pull request or change ticket that records the what, who, when, and why, so any production change is reconstructable. Address emergency changes explicitly: the expedited approval path, who can invoke it, and the mandatory retrospective review within a stated window. Cover configuration and infrastructure-as-code changes under the same discipline, and whether you detect and reconcile drift from an approved baseline. The detail that survives review names the enforcement mechanism, not just the intention. If review is enforced for application code but weaker for infrastructure or emergency paths, disclose that rather than claiming uniform coverage you do not have.

Make it traceable

Tie the answer to inspectable artifacts. Point at the branch-protection or repository settings that require approvals, a sample of change tickets or pull requests showing reviewer, approval, and linked deployment, and the change-management policy defining the standard and emergency paths. Reference deployment logs that record who deployed what and when, and infrastructure-as-code pull requests for config changes. The Promise-to-Proof line is that 'all production changes are peer-reviewed and logged' resolves to a repository setting a reviewer can see is enforced, plus a change record, so the reviewer confirms the gate exists in tooling rather than trusting a described process.

Answer patterns that hold up

• State that changes require peer review and approval before merge and name how it is enforced in tooling.
• Describe the separation between who authors a change and who can deploy it to production.
• Explain how every change is logged and linked to a ticket or pull request recording what, who, when, and why.
• Describe the emergency-change path, who can invoke it, and the mandatory after-the-fact review window.
• State how configuration and infrastructure changes are governed and how drift from an approved baseline is detected.

Evidence that backs the answer

Red flags reviewers catch

• "All changes are reviewed" with no enforcement mechanism, audit trail, or separation of duties.
• No separation between the person who writes a change and the person who deploys it.
• No defined emergency-change path or no retrospective review of emergency changes.
• Change control described for application code but not for infrastructure or configuration.
• No ability to reconstruct what changed in production, when, and who approved it.

Sources

• CSA Cloud Controls Matrix v4 — Change Control & Configuration Management (CCC) domain
• NIST SP 800-53 Rev. 5 — CM (Configuration Management), incl. CM-3 configuration change control
• ISO/IEC 27001:2022 — A.8.32 Change management

Other Change Control and Configuration Management controls