# Change Management Policy

> **Template — adapt before use.** Replace `[bracketed]` placeholders and have an owner approve it. Not compliance advice.

| | |
|---|---|
| **Owner** | [Role] | **Approved** | [YYYY-MM-DD] | **Review** | Annual | **Version** | 1.0 |

Maps to: ISO 27001 A.8.32 · SOC 2 CC8.1 · PCI DSS Req 6.5.

## 1. Purpose & scope
Ensures changes to production systems and applications are authorized, tested, and traceable, minimizing the risk of disruption or security regression.

## 2. Change types
- **Standard** — pre-approved, low-risk, repeatable (e.g. routine deploys).
- **Normal** — requires review and approval before release.
- **Emergency** — expedited to resolve an incident; reviewed retroactively.

## 3. Requirements
- Every change has a record (ticket/PR) describing what, why, and rollback.
- Code changes are peer-reviewed before merge.
- Changes are tested in a non-production environment before release where feasible.
- Production deploys are approved by an authorized approver (separation of duties from the author for significant changes).
- A rollback plan exists for non-trivial changes.

## 4. Evidence
The change record, review/approval, and deployment log together form the audit evidence. Retain them per the retention schedule.

## 5. Emergency changes
May bypass pre-approval to restore service, but must be documented and reviewed within [2 business days].

## Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | [YYYY-MM-DD] | [Name] | Initial issue |