Operations and Business Resilience · Topic 4 of 8
Incident, Problem, Change and Patch Management
Incident versus problem management, root cause analysis, change control and emergency changes, configuration baselines and patch management.
- 3 min
- Includes a diagram
- Incident management restores service; problem management removes causes.
- Every change needs request, assessment, approval, testing and a back-out plan.
- Emergency changes are approved and reviewed after the fact.
What it is
Incident management restores normal service as quickly as possible after an interruption. Problem management finds and removes the root causes of incidents so they do not recur. Change management makes sure changes to production are assessed, approved, tested and recorded. Configuration and patch management keep systems in a known, secure state.
How it works
Incidents and problems
| Incident management | Problem management | |
|---|---|---|
| Goal | Restore service fast | Remove the underlying cause |
| Trigger | A user report or alert | Repeated incidents or a major incident |
| Output | Workaround or fix, ticket closed | Root cause analysis, known error, permanent fix through change management |
Incidents are logged, classified, prioritized by impact and urgency, escalated when needed and closed with user confirmation. Trend analysis of incident records points to problems worth investigating.
Change management
| Control | Purpose |
|---|---|
| Formal request | Every change is recorded with its reason |
| Impact and risk assessment | Effects on systems, security and users are considered |
| Approval | By the change owner or change advisory board (CAB), according to risk |
| Testing | In a non-production environment |
| Segregation | Developers do not implement their own changes in production |
| Back-out plan | A way to reverse a failed change |
| Post-implementation review | The change worked and caused no incidents |
Emergency changes
Urgent fixes may skip normal approval to restore service, but they must still be logged, approved after the fact by an authorized person, documented and reviewed promptly. A large share of changes marked "emergency" is a sign the process is being bypassed.
Finding unauthorized changes
The auditor can compare what changed in production (from system logs, file integrity monitoring or version history) with approved change records. Changes in production with no matching ticket are unauthorized.
Configuration management
Systems are built to approved baselines (secure configurations). Configuration drift is detected by scanning or monitoring and corrected through change management.
Patch management
- Track vendor patches and vulnerability announcements for all assets in the inventory.
- Assess relevance and severity; prioritize critical and exploited vulnerabilities.
- Test patches before wide deployment, especially on critical systems.
- Deploy within defined time frames.
- Verify installation with scans and report compliance.
- Handle systems that cannot be patched with compensating controls and risk acceptance.
The best evidence that all changes were authorized is a reconciliation of changes actually made in production to approved change tickets, not a review of the tickets alone.
How the exam asks about this
- "Recurring outages are fixed by restarting the server each time." Problem management should find the root cause.
- "Emergency changes make up 40 percent of all changes." The normal process is being bypassed; investigate.
- "How can the auditor detect unauthorized changes?" Compare production change logs with approved change records.
What to remember for the exam
- Incident management restores service; problem management removes causes.
- Every change needs request, assessment, approval, testing and a back-out plan.
- Emergency changes are approved and reviewed after the fact.
- Reconcile actual changes to approved tickets.
- Patch on a risk basis, test first, verify by scanning.
A developer who can move code into production can bypass every other change control. Separate development from production deployment.
Common mistakes
Closing incidents without addressing repeats. That is where problem management starts.
Testing only the ticket population. Unauthorized changes have no ticket.
Treating emergency changes as permanent exemptions.
Check yourself
What is the main goal of problem management?
To identify and remove the root causes of incidents.
How should emergency changes be controlled?
Logged and documented, approved by an authorized person after the fact and reviewed promptly.
What evidence best shows that only authorized changes were made?
A reconciliation of changes made in production to approved change records.
Topic 4 of 8 in Operations and Business Resilience
Test yourself on Operations and Business Resilience
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.