Change Management Regulatory Frameworks & Compliance 5

Question 1

A change manager at an energy company must comply with NERC CIP-010. What is the primary focus of this standard with respect to change management?

Accepted Answer

Configuration change management for BES cyber systems

Answer

NERC CIP-010 specifically addresses configuration change management and vulnerability management for Bulk Electric System (BES) cyber systems.

Question 2

Under the European Union's NIS2 Directive, critical infrastructure operators must include which element in their change management processes?

Accepted Answer

Cybersecurity risk assessments integrated into the change approval process

Answer

NIS2 requires essential and important entities to implement risk-based cybersecurity measures, including integrating security risk assessments into change management processes.

Question 3

What is 'change freeze' in a regulatory compliance context, and when is it typically imposed?

Accepted Answer

A defined period during which only emergency changes are permitted, often around high-risk business events

Answer

A change freeze is a planned period limiting changes to emergencies only, typically imposed around year-end financial reporting, audits, or other high-risk periods to reduce compliance risk.

Question 4

An internal auditor finds that change tickets lack post-implementation review (PIR) records. Which regulatory risk does this MOST directly create?

Accepted Answer

Inability to demonstrate that changes achieved their intended outcome and did not introduce new risks

Answer

Missing PIRs mean the organization cannot prove to regulators that changes were validated post-deployment, undermining the evidence of effective change control.

Question 5

A company's external auditor identifies a 'control deficiency' in the change management process. What distinguishes a 'significant deficiency' from a 'material weakness' under SOX?

Accepted Answer

A material weakness has a reasonable possibility of resulting in a material misstatement of financial statements; a significant deficiency is less severe

Answer

Under PCAOB standards applied to SOX audits, a material weakness carries a reasonable possibility of material financial misstatement, while a significant deficiency is important but less severe.

Change Management Practice Test

Change Management Practice Test

Change Management Regulatory Frameworks & Compliance 5