SOC 2 Controls CC8: Change Management

{{snapshot}}

SOC 2 CC8 at a glance

• SOC 2 CC8 is the Change Management criterion, covered by a single control, CC8.1.
• CC8.1 requires a controlled process to authorise, design, test, approve and deploy changes to infrastructure, data, software and procedures.
• It also requires baseline configurations, an emergency-change process, and protection of confidential and personal information during changes.

{{/snapshot}}

CC8.1

SOC 2 CC8.1 requires that your organisation organises, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives.

CC8.1 highlights the following points of focus:

Manages Changes Throughout the System Life Cycle

Your organisation should apply and use a process for managing system changes throughout the life cycle of your system and its elements, including infrastructure, data, software, and procedures. This will support system availability and processing integrity.

Identifies and Evaluates System Changes

Any objectives impacted by system changes should be identified, and the modified system's ability to meet your organisation’s objectives should be assessed throughout the system development life cycle.

Detects Changes in Infrastructure, Data, Software, and Procedures Required to Resolve Incidents

Changes in infrastructure, data, software, and procedures required to remediate incidents to continue to meet your organisation’s objectives should be identified, and the change process should be initiated upon detection.

Creates Baseline Configuration of IT Technology

A standard configuration of IT and control systems should be created and preserved.

Provides for Changes Necessary in Emergency Situations

A process should be established for authorising, devising, testing, approving, and applying changes required in emergency situations (such as changes that need to be implemented within a critical time frame).

Protects Confidential Information

To meet confidentiality objectives, the organisation should safeguard confidential information during system design, development, testing, application, and change processes.

Protects Personal Information

Your organisation should protect personal information during system design, development, testing, implementation, and change processes to meet privacy objectives.

{{snapshot}}

What Hicomply recommends

Change management is where a SOC 2 audit is most often let down: the control exists but the evidence is scattered across tickets, pull requests and chat threads. Wire your change log into the systems that already record those approvals so every change is captured once — Hicomply’s platform is built to collect that evidence automatically.

{{/snapshot}}