Control detail

Change advisory board approval

ctl-012 · PREVENTIVE · CONTINUOUS

ctl-012

Production changes to critical systems require CAB approval.

Key control
Type
PREVENTIVE
Automation
SEMI_AUTOMATED
Frequency
CONTINUOUS
Owner
Core Systems Engineering

Control Design Assessment (CDA)

Procedures evaluating whether the control is designed adequately.

  1. 1.Read the change-management procedure and confirm CAB approval is required before production changes to critical systems.PR.PS-06
  2. 2.Confirm the change tooling enforces an approval gate rather than relying on manual discipline.

Control Operating Effectiveness (COE)

Procedures evaluating whether the control operated over the testing period.

  1. 1.Select 25 production changes and confirm each has documented CAB approval prior to deployment.
  2. 2.Confirm emergency changes followed the defined retrospective-approval path.PR.PS-06
  3. 3.Verify no sampled change was deployed while its approval was still pending or rejected.

Linked risks

  • Core platform obsolescencemitigation 2
  • Change management failuremitigation 3

Framework mappings & latest test

CCC-01CCC-04
Latest test:PASS2026-03-25