Compliance
Change control becomes defensible when a reviewer can trace a production decision from request through approval, implementation, and exception handling.
Compliance coverage treats the change record as evidence, not as paperwork generated after the fact. An auditor is usually trying to establish whether a control operated consistently, whether the people approving a change had appropriate authority, and whether the organization can explain departures from its procedure. A ticket with a closed status does not answer those questions by itself. The useful record ties the change to its affected system, stated risk, testing, approvers, execution evidence, and any emergency rationale.
SOX ITGCs, SOC 2 Trust Services Criteria, PCI DSS, DORA, and NIS2 do not create one interchangeable checklist. They place different emphasis on access, resilience, incident handling, third parties, and governance. The common work is translating those expectations into a change process that matches the organization actually operating the services. That includes segregation of duties where it matters, approval paths that cannot be rewritten after execution, and retention of evidence that survives a tool migration or staff turnover.
Emergency changes expose the difference between a documented control and an operationally usable one. A patch or mitigation may need action before the ordinary meeting cadence, but urgency does not eliminate accountability. The record should show who accepted the risk, why the normal path could not be used, what was tested, and what follow-up review occurred. The same discipline applies when a supplier maintenance event or a regulatory reporting clock changes priorities. Good documentation explains the decision under the conditions that existed then, rather than reconstructing a cleaner version later.
This section is for teams aligning ITSM workflow with assurance work without pretending that a product configuration alone creates compliance. It explores the questions that surface during control walkthroughs: who can request, approve, deploy, and close; which evidence is system-generated; how exceptions are reviewed; and whether the stated process works for a real production incident.
Who this section is for
- IT control owners — Control-to-workflow mappings that make approval and evidence requirements operational.
- Internal audit teams — Concrete review questions for testing whether change controls actually operated.
- Compliance leaders — Context for translating overlapping obligations without flattening their distinct requirements.
Questions this section answers
- What change evidence satisfies an auditor without duplicating the implementation record?
- How can segregation of duties work during an urgent production fix?
- Which workflow controls demonstrate that approvals were timely and authorized?
- How should DORA or NIS2 obligations influence emergency-change documentation?
Start here
-
SOC 2 Change Management Controls and Real Audit Questions
It frames change management through the specific questions reviewers use when they test a control instead of merely reading a policy.
-
SOX Change Control Checklist Mapped to Your ITSM Workflow
It links financial-reporting controls to the records and workflow decisions an ITSM process needs to retain.
-
DORA Change Management Checklist for Resilience Teams
It applies a resilience-focused regulatory lens to the operational decisions change managers make before and after implementation.
How this section is reported
Our compliance reporting reads standards and regulatory material alongside the evidence generated by real ITSM workflows. We do not treat a framework name as proof of a working control. Articles distinguish stated requirements from reasonable implementation choices and pay particular attention to exceptions, approvals, access boundaries, and audit trails. When an issue involves a regulator or formal assurance scope, readers should validate application with their own counsel and assurance professionals.
All Compliance coverage
- Compliance
The Compensating Controls Register Auditors Accept
You deferred a control and promised a compensating one. Here is the register entry that PCI, SOC 2, and NIST assessors sign off on instead of flagging.
- Compliance
Risk-Based Patching: How to Defend It to an Auditor
You skipped a Critical CVSS because EPSS said low-risk. Here is the evidence trail that keeps a PCI, SOC 2, or SOX auditor satisfied.
- Compliance
NIS2 Incident Reporting: A 24/72/1-Month CAB Runbook
NIS2 Article 23 gives you 24 hours, 72 hours, and one month to report a significant incident. A CAB runbook for hitting all three deadlines.
- Compliance
CISA BOD 26-04: Risk-Based Patch Deadlines for CABs
CISA BOD 26-04 replaces the flat 14-day KEV clock with 3, 14, and 60-day risk-based deadlines. What change managers and CABs must rebuild by December.
- Compliance
DORA Change Management Checklist for Resilience Teams
What DORA requires from IT change managers: Articles 9, 12, 17, and 24-27 mapped to a practical CAB checklist, plus a 90-day compliance plan.
- Compliance
SOC 2 Change Management Controls and Real Audit Questions
SOC 2 change management under CC8.1, CC7.1, and CC6: what auditors actually ask, what evidence to keep, and where automation falls short.
- Compliance
SOX Change Control Checklist Mapped to Your ITSM Workflow
What SOX §404 and ITGC actually require for IT change control, mapped field-by-field to ServiceNow and Jira Service Management tickets.