SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure
SOC2-CC8.1 in SOC 2 (the AICPA 2017 Trust Services Criteria with the revised points of focus). All SOC 2 controls held. Open SOC 2 on the standards site.
The control as we hold it
CC8.1 Managing changes to procedures, software, data and infrastructure. Every change to procedures, software, data or infrastructure is authorised, designed or acquired, configured, documented, tested, approved and implemented. Points of focus: changes are managed across the system life cycle; they are authorised before development, designed and developed, documented, tracked before implementation, configured, tested, approved and deployed; the effect on objectives is evaluated through the life cycle; changes needed to remediate incidents are identified and started; a configuration baseline is maintained for IT and control systems; emergency changes follow their own authorise-test-approve.
Reviewed and closest counterparts in the other frameworks
Reviewed rows come from a released pair; a closest match is the nearest held text and is not a reviewed row.
HIPAA Security Rule
- 164.310(a)(2)(iv) Maintenance Records (Addressable) (closest match)
- 164.316(b)(2)(iii) Updates (Documentation) (closest match)
NIST SP 800-53 Rev 5
- NIST800-CA-9 CA-9 Internal System Connections (closest match)
- NIST800-CM-1 CM-1 Policy and Procedures (closest match)
- NIST800-CM-2 CM-2 Baseline Configuration (closest match)
- NIST800-CM-3 CM-3 Configuration Change Control (closest match)
- NIST800-CM-4 CM-4 Impact Analyses (closest match)
- NIST800-CM-5 CM-5 Access Restrictions for Change (closest match)
- NIST800-CM-6 CM-6 Configuration Settings (closest match)
- NIST800-CM-7 CM-7 Least Functionality (closest match)
What an auditor commonly asks for
General guidance for this control area (domain: CC - Common Criteria (Security)), in our words, not a statement of the standard and not binding on an assessor.
- the board or management oversight record
- the risk assessment and its treatment
- the access-review and change-approval records
- the monitoring, logging and incident records