# Change Management Policy - Source: https://support.icompaas.com/compliance/policy-docs/change-management-policy - Section: [Compliance](https://support.icompaas.com/compliance) › [Policy Documents](https://support.icompaas.com/compliance/policy-docs) › All policy documents - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Policy Document**·8 mapped controls ## What this policy is Defines how changes to production systems are proposed, reviewed, approved, deployed, and rolled back when needed. Covers code, configuration, infrastructure, and policy changes. ## Why every organization needs one Unmanaged change is the single largest cause of operational outages and an audit finding magnet. The policy is the procedural backbone for every CAB / pull-request workflow. ## What a competent Change Management Policy typically contains - Purpose and scope - Roles and responsibilities - Definitions - Change classification (standard, normal, emergency) - Approval matrix per class - Testing and rollback plan requirements - Post-implementation review - Review cadence (typically annual) and version control - Approval, sign-off and effective date ## How iCompaas tracks this policy The icompaas policy-doc producer manages this document through an 8-state lifecycle: `draft` → `generated` → `internal_qa` → `customer_review` → `in_review` → `approved` → `signed` (with `rejected` as a terminal side-state). The producer publishes a `policy_doc_change_management_policy_signed` compliance finding once at least one document of this kind reaches the `signed` state for the account being assessed; the finding then rolls up into every compliance framework that references this policy (see the table below). ## Compliance frameworks that reference this policy The icompaas [compliance controls library](https://support.icompaas.com/compliance) links every policy document to the controls in each framework that require, evidence, or otherwise rely on it. Below: every control across every framework in the iCompaas catalogue that names this policy as part of its evidence base. Each control links to its own dedicated page with auditor-view content + implementation guidance. | Framework | Control | Title | Component | | --- | --- | --- | --- | | ISO/IEC 27001:2022 | [A.5.22](https://support.icompaas.com/compliance/iso-27001-2022/a-5-22-monitoring-review-and-change-management-of-supplier-services) | [Monitoring, review and change management of supplier services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-22-monitoring-review-and-change-management-of-supplier-services) | Organizational controls | | ISO/IEC 27001:2022 | [A.8.9](https://support.icompaas.com/compliance/iso-27001-2022/a-8-9-configuration-management) | [Configuration management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-9-configuration-management) | Technological controls | | ISO/IEC 27001:2022 | [A.8.19](https://support.icompaas.com/compliance/iso-27001-2022/a-8-19-installation-of-software-on-operational-systems) | [Installation of software on operational systems](https://support.icompaas.com/compliance/iso-27001-2022/a-8-19-installation-of-software-on-operational-systems) | Technological controls | | ISO/IEC 27001:2022 | [A.8.26](https://support.icompaas.com/compliance/iso-27001-2022/a-8-26-application-security-requirements) | [Application security requirements](https://support.icompaas.com/compliance/iso-27001-2022/a-8-26-application-security-requirements) | Technological controls | | ISO/IEC 27001:2022 | [A.8.31](https://support.icompaas.com/compliance/iso-27001-2022/a-8-31-separation-of-development-test-and-production-environments) | [Separation of development, test and production environments](https://support.icompaas.com/compliance/iso-27001-2022/a-8-31-separation-of-development-test-and-production-environments) | Technological controls | | ISO/IEC 27001:2022 | [A.8.32](https://support.icompaas.com/compliance/iso-27001-2022/a-8-32-change-management) | [Change management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-32-change-management) | Technological controls | | ISO/IEC 27701:2025 | [A.1.3.5](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-5-modify-withdraw-consent) | [Modify/withdraw consent](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-5-modify-withdraw-consent) | Obligations to PII principals | | ISO/IEC 27701:2025 | [A.1.3.8](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-8-inform-third-parties) | [Inform third parties](https://support.icompaas.com/compliance/iso-27701-2025/a-1-3-8-inform-third-parties) | Obligations to PII principals | 8 controls across 2 frameworks reference this policy. ## About this page This article is part of the iCompaas [Policy Documents](https://support.icompaas.com/compliance/policy-docs) library — one page per signed-document type the icompaas policy-doc producer tracks for customer accounts. The article is intentionally framework-agnostic: a customer signing a policy of this kind gets the same regulatory benefit across every framework that references it. ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): SOC 2 auditors test that policies like this one exist, are approved, and are reviewed on schedule; the guide lists the full set. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 clause 5.2 and Annex A.5.1 require a documented, approved policy set; the guide shows how it fits the ISMS.