Framework

ISO/IEC 27001:2022: what it asks of a production change

Annex A of ISO/IEC 27001:2022 carries change management (8.32), segregation of duties (5.3), secure development (8.25), separation of environments (8.31), access to source code (8.4), configuration management (8.9), software installation (8.19) and security testing (8.29).

Our statement of each clause, read against the copy we hold and cited to it; it is not the instrument's verbatim wording.

The findings it sits behind

8 clauses cited

Finding	Clause
No independent approval	ISO 27001 8.32
Approved after it shipped	ISO 27001 8.32
Automated author, no human approval	ISO 27001 8.25 · ISO 27001 8.4
Deployed their own change	ISO 27001 5.3 · ISO 27001 8.31
One person, three roles	ISO 27001 5.3
Emergency, no approval after	ISO 27001 8.32
Deployment with no matching change	ISO 27001 8.9 · ISO 27001 8.19
No ticket reference	ISO 27001 8.32
Approver not on the list	ISO 27001 5.3
No test evidence	ISO 27001 8.29

Every ISO/IEC 27001:2022 clause the checker cites

Run the specimen Check your own change log