DEV-03—Policies for changes to information systems
>Control Description
Policies and instructions with technical and organisational safeguards for change management of system components of the cloud service within the scope of software deployment are documented, communicated and provided according to SP-01 with regard to the following aspects:
• Criteria for risk assessment, categorisation and prioritisation of changes and related requirements for the type and scope of testing to be performed, and necessary approvals for the development/implementation of the change and releases for deployment in the production environment by authorised personnel or system components;
• Requirements for the performance and documentation of tests;
• Requirements for segregation of duties during development, testing and release of changes;
• Requirements for the proper information of cloud customers about the type and scope of the change as well as the resulting obligations to cooperate in accordance with the contractual agreements;
• Requirements for the documentation of changes in system, operational and user documentation; and
• Requirements for the implementation and documentation of emergency changes that must comply with the same level of security as normal changes.
Additional criteria: -
Ask AI
Configure your API key to use AI features.