CISA Change Management Controls 4 — Questions and Answers
Question 1: An organization categorizes changes as standard, normal, and emergency. What is the defining characteristic of a standard change?
- It requires full CAB approval every time
- It is pre-approved because it follows a documented, low-risk procedure (Correct answer)
- It is initiated only by senior management
- It bypasses testing due to time constraints
Correct answer: It is pre-approved because it follows a documented, low-risk procedure
Standard changes have been pre-assessed as low-risk with established procedures, allowing them to proceed without repeated full CAB review.
Question 2: During an audit, an IS auditor finds that developers have read access to production data for troubleshooting. What control would BEST mitigate the associated risk?
- Logging all developer access to production data
- Restricting developers to anonymized or masked production data copies (Correct answer)
- Requiring CAB approval before each access event
- Eliminating production access and using synthetic data only in all environments
Correct answer: Restricting developers to anonymized or masked production data copies
Providing masked or anonymized data copies allows troubleshooting while protecting sensitive production data from unnecessary exposure.
Question 3: A rollback plan for a database schema change should PRIMARILY include:
- The contact list of all affected stakeholders
- Steps to restore the previous schema and validate data integrity (Correct answer)
- Approval signatures from all CAB members
- A timeline for when the change will be re-attempted
Correct answer: Steps to restore the previous schema and validate data integrity
A database rollback plan must define precise steps to revert the schema and verify that data has not been corrupted during restoration.
Question 4: Which of the following BEST describes the relationship between change management and patch management?
- Patch management is an entirely separate process with no overlap
- Patches are a type of change and should follow the change management process (Correct answer)
- Patch management supersedes change management for security fixes
- Change management controls do not apply to vendor-supplied patches
Correct answer: Patches are a type of change and should follow the change management process
Patches modify system behavior and therefore represent changes that should be assessed, tested, approved, and documented through the standard change management process.
Question 5: An IS auditor is reviewing change management controls at a financial institution. The HIGHEST risk finding would be:
- Some minor changes are processed without full CAB sign-off
- Developers can deploy to production without operations team involvement (Correct answer)
- Change windows occasionally extend past scheduled times
- CAB meetings occur weekly instead of bi-weekly
Correct answer: Developers can deploy to production without operations team involvement
Developer access to production deployment eliminates the separation of duties between development and operations, a critical control in regulated environments.
Question 6: What is the PRIMARY purpose of version control in change management?
- To track developer productivity metrics
- To maintain a history of changes and enable recovery to previous states (Correct answer)
- To automate the change approval process
- To prevent users from accessing multiple application versions
Correct answer: To maintain a history of changes and enable recovery to previous states
Version control provides an audit trail of all code changes and the ability to roll back to any prior state, supporting both accountability and recovery.
Question 7: When auditing change management in an agile development environment, an IS auditor should EXPECT to find:
- No formal change controls because agile is incompatible with ITIL
- Lightweight change controls integrated into sprint processes (Correct answer)
- Longer approval cycles to compensate for faster development
- Emergency change procedures used for every sprint release
Correct answer: Lightweight change controls integrated into sprint processes
Agile environments require change controls that are lean enough to support rapid iteration while still managing risk, typically embedded within sprint ceremonies.
CISA Change Management Controls 4
An organization categorizes changes as standard, normal, and emergency.
What is the defining characteristic of a standard change?