ISC2 Governance, Risk and Compliance (CGRC) Practice Question

Signed and recorded change requests maintained in the organization's change management system document who proposed the change, the reason for it, the approvals obtained, and any testing or back-out plans. This satisfies NIST SP 800-53 CM-3/CM-4 requirements for documenting and authorizing configuration changes, giving the assessor direct evidence of a repeatable, enforced control. Syslog entries only show that changes occurred, not that they were approved. Backup reports demonstrate data-protection procedures, not change control. A current software inventory confirms what is installed but offers no assurance that installations followed an authorized process. Therefore, approved change request records best verify that configuration changes are properly reviewed and authorized.