risk
Absent or weak change-control procedures
Changes to systems, software, hardware, or configurations without formal approval and testing (including unauthorized or poorly tested hardware/config changes) introduce new vulnerabilities, instability, or failed releases.
Record JSON · Open in map · Data retrieval guide
Catalog revision: f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Secure Configuration & Change Management
- Secure Development (SDLC) & Application Security
- taxonomy
- iso-27005-vulnerability
- inherent_rating
- medium
Details
- risk_id
- config-weak-change-control
- category
- cyber_security
- likelihood
- medium
- impact
- medium
- inherent_rating
- medium
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
Source
No record-specific source URL is provided.
Connections
- UC-SDLC-07 — Approve, test, and accept changes before production release mitigates Absent or weak change-control procedures
- strength
- primary
- rationale
- Authorizing, impact-assessing and acceptance-testing every change before implementation directly prevents unapproved/untested changes.
- UC-SDLC-06 — Maintain configuration control over systems and code mitigates Absent or weak change-control procedures
- strength
- primary
- rationale
- Implementing only approved changes and tracking the integrity of changes to configuration items directly prevent unauthorized/untested changes.
- UC-CONFIG-09 — Document configuration management policy, plan, and procedures mitigates Absent or weak change-control procedures
- strength
- related
- rationale
- Documenting configuration-management processes and roles enables disciplined change control, but executing change management is the operative defense.
- UC-SDLC-01 — Follow a secure development lifecycle with approval gates mitigates Absent or weak change-control procedures
- strength
- related
- rationale
- SDLC approval gates requiring significant changes be tested/approved before production contribute to change discipline, but the operative change controls are the dedicated UC-07 and UC-06 (approved-changes-only).
- UC-ACCESS-16 — Authorize, test, and approve changes and development mitigates Absent or weak change-control procedures
- strength
- primary
- rationale
- The authorize->test->approve->independent-migration gate IS the change-control process, directly preventing unapproved or untested changes.
- UC-CONFIG-02 — Authorize, test, and approve changes before production mitigates Absent or weak change-control procedures
- strength
- primary
- rationale
- The documented request->impact-analysis->authorize->test->approve->independent-migration process is the change-control defense itself.
- UC-CONFIG-03 — Separate environments and protect production data in testing mitigates Absent or weak change-control procedures
- strength
- related
- rationale
- Separating environments and restricting production changes to authorized personnel supports change control, but the request-test-approve process (UC-CONFIG-02) is the operative defense against unapproved or untested changes.