Zum Hauptinhalt springen
CENEDRIL WIKI
DE
Starter Kit · Register

Change Log

Updated on 2 min Reviewed by: Cenedril-Redaktion
A.8.32 ISO 27001ITIL

The change log records every planned and executed change to IT systems, configurations, and infrastructure. Without this documentation, the most important question after a security incident goes unanswered: what changed recently?

ISO 27001 Control A.8.32 requires structured change management. Changes to information processing facilities and systems must follow a defined process — with risk assessment, approval, implementation, and post-implementation review.

What does it contain?

The CSV template covers the change process from request to closure:

  • Change ID and title — unique identifier and clear description
  • Category — standard change, normal change, emergency change
  • Requester and date — who requested the change?
  • Affected systems — link to the asset register
  • Risk assessment — what impact does the change have on information security?
  • Approver and approval date — who authorised the change?
  • Implementation date and implementer — who carried it out, when?
  • Rollback plan — how can the change be reversed?
  • Outcome — successful, partially successful, rolled back

How to use it

Document before implementation. Every planned change is recorded in the log before it is carried out. The entry describes what is changing, why, which systems are affected, and what risk is involved. Implementation may only begin after formal approval.

Implementation and post-review. After implementation, verify whether the change achieved the desired result and no unexpected side effects occurred. The outcome is documented in the log. Failed changes are rolled back — the rollback plan from the request phase comes into play.

Correlation with incidents. During a security incident, the change log is one of the first sources reviewed. Is there a temporal correlation between a recent change and the incident? This connection requires complete documentation.

Register Template

Change Log

.csv · EN.csv · DE
IDTitleTypeCategoryRequesterOwnerSystemsRiskImpactRollback PlanPlanned StartPlanned EndCAB DateCAB DecisionActual ResultClosure Date
CHG-2026-001Upgrade Veeam backup server to v12.1NormalInfrastructureIT OperationsMarkus SchulzAST-008MediumBackup window extended by 2hRestore from snapshot2026-03-15 22:002026-03-15 04:002026-03-11ApprovedSuccess2026-03-16
CHG-2026-002Deploy FIDO2 keys to admin accounts (phase 1)NormalSecurityISOAnna WeberAll admin accountsLowAdmin login flow changeRevert policy + keep TOTP2026-04-05 18:002026-04-05 20:002026-04-01ApprovedSuccess2026-04-06
CHG-2026-003Emergency FortiOS patch (CVE-2025-32756)EmergencySecurityIT OperationsMarkus SchulzAST-010High5 min outage during failoverRoll back firmware2025-05-14 02:002025-05-14 02:30Post-approved 2025-05-14ApprovedSuccess2025-05-14
CHG-2026-004Rotate VPN pre-shared keyStandardSecurityIT OperationsIT OperationsAST-011LowNone (rolling)N/A2026-04-01 20:002026-04-01 20:30Pre-approved (standard)ApprovedSuccess2026-04-01
CHG-2026-005Add new VLAN for IoT devicesNormalNetworkFacilitiesMarkus SchulzAST-010LowNoneRemove VLAN2026-03-20 19:002026-03-20 21:002026-03-18ApprovedSuccess2026-03-20
CHG-2026-006Migrate file server to new storageNormalInfrastructureIT OperationsMarkus SchulzAST-004High4h downtimeRevert DNS to old server2026-05-10 22:002026-05-11 02:002026-05-06ApprovedPlanned
CHG-2026-007Enable S3 public-access block account-wideNormalSecurityISOAnna WeberAST-012LowNone (bucket already private)Revert setting2026-03-18 16:002026-03-18 16:152026-03-18ApprovedSuccess2026-03-18
CHG-2026-008Update Acceptable Use Policy v2.1StandardPolicyISOAnna WeberDocument systemLowNoneRevert to v2.02026-02-01 09:002026-02-01 09:30Pre-approved (standard)ApprovedSuccess2026-02-01
CHG-2026-009Deploy new EDR agent to fleetNormalSecurityIT OperationsMarkus SchulzAST-006MediumPossible performance hitUninstall via MDM2026-04-18 18:002026-04-18 22:002026-04-15ApprovedIn progress
CHG-2026-010Install quarterly patches Q2StandardSecurityIT OperationsIT OperationsAST-004 AST-005 AST-006MediumReboot requiredRollback patch via WSUS2026-04-10 22:002026-04-11 04:00Pre-approved (standard)ApprovedSuccess2026-04-11

Sources

ISO 27001 Controls Covered

A.8.32 Change management

Frequently asked questions

Which changes belong in the log?

All changes that could affect information security: software updates, configuration changes, network changes, new systems, decommissions, data migrations, access right modifications. Standard changes (e.g. routine low-risk patches) can be pre-approved and documented in a simplified form.

Do I need a formal Change Advisory Board?

ISO 27001 does not require a formal CAB. The standard requires documented approval by an authorised person. In small organisations, a defined approval process with clear responsibilities is sufficient. From about 50 IT systems onward, a regular CAB meeting pays off for coordinated release management.

What about emergency changes?

Emergency changes may bypass the regular approval process — but must be documented and approved retroactively. The log includes a dedicated field for this. A high frequency of emergency changes is a warning sign that should be raised in the management review.