CISA Change Management Controls 3 — Questions and Answers
Question 1: A change advisory board (CAB) is reviewing a proposed infrastructure change. The MOST important information the CAB needs is:
- The name of the developer who wrote the change
- The risk assessment and rollback plan (Correct answer)
- The number of previous successful changes by the team
- The estimated licensing cost of new components
Correct answer: The risk assessment and rollback plan
Risk assessment and rollback plan are essential for the CAB to make an informed approval decision and ensure recovery capability if the change fails.
Question 2: Which situation represents a segregation of duties violation in change management?
- A developer submits a change request and a separate team deploys it
- A developer writes the code, tests it, and promotes it to production (Correct answer)
- A CAB member who is also a business user approves a change
- An auditor reviews completed change logs
Correct answer: A developer writes the code, tests it, and promotes it to production
Allowing one developer to write, test, and deploy code eliminates the checks that detect errors or fraud before changes reach production.
Question 3: An organization uses automated deployment pipelines. What change management control is MOST critical to implement in this context?
- Replacing manual CAB approvals with speed-based auto-approvals
- Embedding approval gates and automated testing within the pipeline (Correct answer)
- Allowing developers to bypass pipelines for urgent fixes
- Eliminating rollback capabilities to reduce pipeline complexity
Correct answer: Embedding approval gates and automated testing within the pipeline
Automated pipelines must include programmatic approval gates and testing checkpoints to maintain change control discipline while preserving speed.
Question 4: When auditing change management, which metric BEST indicates that the process is effective?
- Total number of changes processed per month
- Percentage of changes that required rollback due to failures (Correct answer)
- Average time for CAB meetings
- Number of emergency changes approved
Correct answer: Percentage of changes that required rollback due to failures
A low change-failure/rollback rate indicates that changes are being adequately planned, tested, and reviewed before deployment.
Question 5: An IS auditor is assessing a SaaS vendor's change management process. The MOST important concern is:
- Whether the vendor uses the same CAB format as the client
- Whether the client has visibility into changes that may affect service levels (Correct answer)
- Whether the vendor allows clients to attend CAB meetings
- Whether the vendor uses open-source tools
Correct answer: Whether the client has visibility into changes that may affect service levels
Clients must receive advance notification of vendor changes that could affect availability, security, or functionality to manage their own risk exposure.
Question 6: What is the PURPOSE of a change freeze period in IT change management?
- To allow developers to catch up on documentation
- To prevent changes during high-risk periods such as peak business times or audits (Correct answer)
- To halt all IT operations for system maintenance
- To give the CAB time to review a backlog of requests
Correct answer: To prevent changes during high-risk periods such as peak business times or audits
Change freeze periods minimize the risk of introducing instability during critical business periods when system reliability is paramount.
Question 7: An auditor notices that change tickets are frequently closed as 'completed' before all post-implementation steps are documented. This PRIMARILY indicates:
- A training issue with end users
- Inadequate enforcement of change closure requirements (Correct answer)
- A sign that changes are being implemented successfully
- An over-reliance on automated testing
Correct answer: Inadequate enforcement of change closure requirements
Premature ticket closure suggests that process controls do not enforce completion of all required steps before a change is considered done, creating gaps in accountability.
CISA Change Management Controls 3
A change advisory board (CAB) is reviewing a proposed infrastructure change.
The MOST important information the CAB needs is: