General Security Concepts · Topic 4 of 7
Change Management and Security Impact
How change management protects security: the CAB, impact analysis, backout plans, fail forward, dependencies, documentation and version control.
- 5 min
- Change management reduces risk by requiring approval, testing and a recorded outcome.
- The CAB reviews and approves changes, using impact analysis, test results and the backout plan.
- A backout plan describes how to restore the previous state, and it is prepared before the change.
What it is
Change management is the controlled process for requesting, approving, testing and recording changes to systems, networks and applications.
Without it, a well meant change can open a firewall hole, break a service or hide an attack. The goal is to make changes predictable, reviewed and recoverable.
How it works
Business processes impacting security operations
A change request is judged by what it touches and how much it might break. The objective lists these items.
| Item | What it means |
|---|---|
| Change advisory board (CAB) | A group of technical and business representatives that reviews, approves or rejects changes |
| Approval process | The defined steps and named people who must agree before the change goes ahead |
| Ownership | One owner is accountable for the system and the change |
| Stakeholders | Everyone affected is informed or consulted |
| Impact analysis | Estimate what could go wrong, what it affects and how far it spreads |
| Test results | Evidence that the change works before it reaches production |
| Backout planning | Steps to return to the earlier state if the change fails |
| Fail forward | Fixing a failed change by applying a further correction instead of rolling back |
| Maintenance window | A planned period when disruption is acceptable |
| Standard operating procedures (SOPs) | Written methods so that the change is done the same way each time |
The CAB and the approval process
The CAB looks at the impact analysis, the test results and the backout plan before it decides. Low risk, routine changes are often pre approved as standard changes, while larger changes go to the full board.
The approval process gives a clear record of who agreed to what. That record matters for audits and for investigating an incident later.
Backout planning and fail forward
A backout plan is the rollback path, and it is written before the change starts, not after it fails. It might restore a saved configuration, reinstall the previous software version or restore from a backup.
Fail forward is the other choice. Instead of rolling back, the team keeps the change and fixes the problem with a further correction. It suits cases where rolling back is harder or riskier than a quick fix, but the decision and its limits should be agreed in advance.
Technical implications
Some changes carry direct security consequences.
| Implication | Example |
|---|---|
| Allow lists and deny lists | Adding an application or address to a list that permits or blocks it |
| Restricted activities | Limiting which actions are allowed during the change, and who may perform them |
| Downtime | A service outage that affects availability |
| Service restart | Restarting a service or system so that a change takes effect |
| Application restart | Closing and starting software, which can drop user sessions |
| Legacy applications | Old software that may break after a change and is hard to patch or test |
| Dependencies | Other systems that rely on the one being changed |
Dependencies are a frequent cause of surprise outages. A change to one server may affect every system that calls it, so the impact analysis should list them.
A new application that is not on the allow list will be blocked after deployment. Updating the list is part of the change, not an afterthought.
Documentation and version control
Documentation keeps the record accurate after a change. It covers updating diagrams and updating policies and procedures, so that the team and auditors can see the current state.
Version control tracks changes to code, scripts and configuration files. It shows who changed what and when, and it lets the team return to an earlier version.
How the exam asks about this
- "A patch is approved, but nobody wrote down how to undo it if it fails." -> The backout plan is missing.
- "After a firewall change, a payroll system that calls the changed server stops working." -> A dependency was missed in the impact analysis.
- "A rollback would take hours, so the team applies a quick corrective patch instead." -> Fail forward.
What to remember for the exam
- Change management reduces risk by requiring approval, testing and a recorded outcome.
- The CAB reviews and approves changes, using impact analysis, test results and the backout plan.
- A backout plan describes how to restore the previous state, and it is prepared before the change.
- Fail forward fixes a failed change with a further correction instead of a rollback.
- Changes happen in a maintenance window to limit business disruption.
- Dependencies, downtime and restarts are common technical effects to plan for.
- Allow lists and deny lists are changed through the same controlled process.
- Version control and updated diagrams and policies keep records accurate.
When a question asks what must exist before a change goes live, look for the approval, the test results and the backout plan.
Common mistakes
Skipping approval for "small" changes. A single firewall rule is a common source of security gaps. The process may be lighter for standard changes, but it still exists.
Writing the backout plan after a failure. A plan made under pressure is slower and riskier.
Forgetting stakeholders. A change that is secure but unannounced can still cause an outage for a team that depended on the old behavior.
Treating documentation as optional. An out of date network diagram leads to wrong decisions in the next incident.
Confusing fail forward with ignoring the failure. Fail forward is a planned fix, not leaving a broken change in place.
An emergency does not remove the need for control. If an urgent change is made with a shortened approval, record it and review it afterward.
Check yourself
What is the purpose of a backout plan?
It gives the steps to return to the previous working state if the change fails.
What does the change advisory board do?
It reviews proposed changes, using impact analysis and test results, and approves or rejects them.
What does version control add to change management?
It records who changed what and when, and allows a return to an earlier version.
Topic 4 of 7 in General Security Concepts
Test yourself on General Security Concepts
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.