Infrastructure Security · IS-Q04

Question: Are configuration changes controlled through a formal change-management process integrated with asset inventory (CMDB)?

  1. Objective — Why This Matters
    Untracked configuration changes cause outages and security regressions. Linking change control with asset data ensures traceability and accountability.

  2. Maturity Levels (0 – 5)

0 — Unaware
No change control; direct edits on production.
1 — Ad Hoc
Email-based approvals; incomplete records.
2 — Defined
Change requests logged; impact review performed.
3 — Managed
Linked to asset inventory (CMDB); post-change validation.
4 — Integrated
Automated approvals via workflow tools; metrics tracked.
5 — Optimized
Policy-as-code with continuous integration and rollback.
  1. How to Level Up
From → To Actions
0 → 2 Create change templates and approval matrix.
2 → 3 Integrate with asset registry (NetBox / CMDB).
3 → 4 Automate approvals and notifications.
4 → 5 Embed policy checks in GitOps workflow.

  1. People / Process / Technology Enablers
    People – Infra Ops, Change Manager.
    Process – CAB reviews, impact assessment, rollback testing.
    Technology – NetBox, ServiceDesk / Redmine / Jira Service Mgmt.

  2. Evidence Required
    Change tickets, approval logs, post-implementation validation.

  3. Metrics / KPIs
    • number of unauthorized changes detected
    • percentage of changes rolled back due to failure
    • average approval-to-implementation time

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
Inventory NetBox Source of truth for infrastructure assets.
Workflow Redmine / Odoo Helpdesk Change request tracking.
Automation Ansible / GitHub Actions Pre/post change tasks and validation.

  1. Common Pitfalls
    Shadow changes without records; skipping rollback tests.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.32 (Change management).
NIST CSF 2.0 PR.IP-3 / PR.MA-1.
CERT-In 2022 Documented change controls.
NIRMATA Scoring IS-Q04 ≥ Level 4 requires automated workflows and asset linkage.