What to Provide
An example ticket that tracks a change to your production software or infrastructure.
The evidence should demonstrate:
That the change was documented, tested, reviewed, and approved by authorized staff prior to release
When the change was released into the production environment
When and how the change was communicated to authorized internal users
Evidence Format
Screenshots or exported images in a common image file type (.jpg, .png, .pdf).
Additional Guidance
Your change management processes should require you to formally track all software and infrastructure changes to your in-scope production systems.
Though not required, you may find it useful to implement a ticketing system such as Jira or ServiceNow to capture these changes.
Before your Type 2, you should implement a process to easily differentiate between software and infrastructure changes, such as using different tags in tickets, or using a unique naming convention.
Whatever method you choose, ensure that your tracking system maintains a history of all production changes that you make and that it aligns with your documented Change Management Policy.
For the Future
During your Type 2 Audit, you will be expected to provide the change request tickets for a sample of software and infrastructure changes implemented in production during the observation period.
Related Articles
Associated Unified Control ID | Associated Framework Control |
CTRL-190 | LCL-53 |