OPS-01 · Secure Operations
Change management
Changes to production are requested, reviewed, tested and recorded, with emergency changes reconciled afterwards.
4frameworks fully address it
3partially
1leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC8.1
- ISO 27001FullA.8.32
- NIST CSFFullPR.PS-01
- PCI DSSFull6.5.1
- HIPAAPartial164.308(a)(8) Through periodic evaluation.
- GDPRAbsent Not addressed; change discipline is implied only through security of processing.
- EU AI ActPartialArt. 43(4) Substantial modification triggers reassessment.
- NIST AI RMFPartialMANAGE 4.1 Post-deployment monitoring of changes.
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Change records, approvals, emergency change log.
?Why it exists
Undocumented change is the most common cause of unexplained outage.
For a smaller organizationPull request review plus a release note is enough.