Configuration change control involves the systematic proposal, justification, implementation, test/evaluation, review, and disposition of changes to information systems, including upgrades and modifications. Without system change control the potential exists that changes could be made to the information system that, either intentionally or unintentionally, degrade the security of the information system, subjecting it to a greater degree of risk.

This Systems Change Control Policy Template includes the following sections:

• Default policy statements that define what the enterprise must do.
• Default procedures that define how the enterprise must do it.
• Baseline recommendations to customize the template to individual enterprise requirements.

Use this and the related templates to build an efficient and effective enterprise Security Policy.