ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The change management process requires an initial security impact analysis comparing the proposed modification with the system's current, approved security and privacy baselines. This analysis identifies how the new operating system could affect confidentiality, integrity, availability, and compliance obligations, enabling decision-makers to judge risk before authorizing further activity. Updating the system security plan, scheduling deployment, or moving code into a development environment are all necessary tasks, but they come after the impact of the change has been formally assessed and the change has been approved. Starting testing or planning rollout without first completing the impact analysis would bypass a critical control and could expose the organization to unmanaged risk.