Change Management Controls Flashcards
7 cards from real CISA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Change Management Controls flashcards as text
An organization categorizes changes as standard, normal, and emergency. What is the defining characteristic of a standard change?
Answer: It is pre-approved because it follows a documented, low-risk procedure
Standard changes have been pre-assessed as low-risk with established procedures, allowing them to proceed without repeated full CAB review.
During an audit, an IS auditor finds that developers have read access to production data for troubleshooting. What control would BEST mitigate the associated risk?
Answer: Restricting developers to anonymized or masked production data copies
Providing masked or anonymized data copies allows troubleshooting while protecting sensitive production data from unnecessary exposure.
A rollback plan for a database schema change should PRIMARILY include:
Answer: Steps to restore the previous schema and validate data integrity
A database rollback plan must define precise steps to revert the schema and verify that data has not been corrupted during restoration.
Which of the following BEST describes the relationship between change management and patch management?
Answer: Patches are a type of change and should follow the change management process
Patches modify system behavior and therefore represent changes that should be assessed, tested, approved, and documented through the standard change management process.
An IS auditor is reviewing change management controls at a financial institution. The HIGHEST risk finding would be:
Answer: Developers can deploy to production without operations team involvement
Developer access to production deployment eliminates the separation of duties between development and operations, a critical control in regulated environments.
What is the PRIMARY purpose of version control in change management?
Answer: To maintain a history of changes and enable recovery to previous states
Version control provides an audit trail of all code changes and the ability to roll back to any prior state, supporting both accountability and recovery.
When auditing change management in an agile development environment, an IS auditor should EXPECT to find:
Answer: Lightweight change controls integrated into sprint processes
Agile environments require change controls that are lean enough to support rapid iteration while still managing risk, typically embedded within sprint ceremonies.