6.5.1Changes to all system components are managed securely

Defined Approach Requirements:

Changes to all system components in the production environment are made according to established procedures that include:

- Reason for, and description of, the change.

- Documentation of security impact.

- Documented change approval by authorized parties.

- Testing to verify that the change does not adversely impact system security.

- For bespoke and custom software changes, all updates are tested for compliance with Requirement 6.2.4 before being deployed into production.

- Procedures to address failures and return to a secure state.

Defined Approach Testing Procedures:

6.5.1.a Examine documented change control procedures to verify procedures are defined for changes to all system components in the production environment to include all elements specified in this requirement.

6.5.1.b Examine recent changes to system components and trace those changes back to related change control documentation. For each change examined, verify the change is implemented in accordance with all elements specified in this requirement