Change and configuration management procedure

Change and configuration management procedure

CM-01 — Configuration policy

[Organisation] identifies and controls the configurations on which its systems and assurance decisions depend. Configuration items include source, build definitions, executable artefacts, infrastructure settings, data schemas, model and prompt versions, operational procedures and other items whose change affects required behaviour. The owner identifies which items are controlled and maintains their version, location, relationships and responsible person.

A baseline identifies the agreed configuration at a point in the life cycle. The baseline record states its scope, approving authority and evidence. A source revision, built artefact and deployed configuration are related but distinct records. The owner maintains the relationship so that a decision about one can be traced to the others without assuming they are identical.

CM-02 — Raise and analyse a change

The requester records the proposed outcome, reason, affected items and authorising need, defect or risk treatment. The request identifies expected changes in behaviour, access, data processing, dependencies and operation. The implementer or analyst assesses consequences for requirements, architecture, security, privacy, resilience, testing, support and existing assurance claims.

The analysis identifies implementation steps, verification, migration, deployment and recovery arrangements. It records alternatives and uncertainties material to the decision. Changes to information or irreversible state receive specific consideration of how errors would be corrected. Where rollback cannot restore the previous condition, the record describes the actual recovery or compensating action available.

CM-03 — Decide authority and conditions

The authority designated for the change scope reviews the request and evidence and records approval, rejection, request for more information or another authorised disposition. Approval identifies the scope, revision or work boundary, conditions and effective period. Risk decisions are made by the authority holding the relevant delegation and linked to the change record.

Standing authority may cover a defined class of repeatable changes. Its record identifies eligibility conditions, required evidence, permitted actions, monitoring and the circumstances requiring a separate decision. It is not inferred from the fact that similar work was approved previously. A change advisory group may provide advice or hold authority according to its charter; attendance or a vote does not establish powers not granted in that charter.

CM-04 — Implement and verify

The implementer confirms the approved scope and current baseline before execution. Implementation records identify the actual items changed, actor, time and relevant source or configuration version. Deviations that affect the decision basis are referred through the recorded authority arrangement. The implementer retains enough information for the reviewer to compare the approved intent with the completed change.

Verification checks the intended outcome, affected existing behaviour and relevant security or privacy properties. The evidence identifies the configuration tested. The owner updates architecture, requirements, operating instructions and inventories where needed. Completion of an implementation task is distinguished from authorisation to deploy the result.

CM-05 — Urgent changes

Urgent work follows the emergency authority recorded in [authority register]. The requester records the event, reason for urgency, affected scope, available evidence and consequences of delay. The authorised person records the decision and any conditions using the available communication channel. Where the normal repository is unavailable, the decision and action record is preserved through the continuity arrangement and reconciled afterwards.

The post-change review occurs at [recorded deadline or trigger]. It confirms what happened, whether the intended outcome was achieved, what verification remains and which temporary measures require closure. Urgency does not cause missing evidence to be represented as completed verification. Any departure from an adopted commitment is recorded with the appropriate exception or risk decision.

CM-06 — Reconcile configuration

The configuration owner compares the authorised baseline with the actual deployed or operating configuration at [schedule] and following relevant events. The review identifies unrecorded changes, missing items, stale versions and differences in permissions, dependencies or operational settings. Each discrepancy receives an owner and disposition.

An unrecorded change is investigated to establish its origin, authority and effect. The organisation records the decision on retaining, correcting or removing it. The record does not invent historical approval. Where the discrepancy affects a release, risk or assurance conclusion, the relevant authority receives the finding and decides whether the earlier conclusion remains valid.

CM-07 — Assurance

The assessor samples implemented changes and traces them to intent, authority, impact analysis and verification. The assessor also samples approved changes to determine whether the authorised result reached the operating configuration. Findings identify missing links, decisions outside delegation and unsupported claims of completion. The owner reports both process weaknesses and their effect on confidence in the current baseline.