Change management questions in a vendor questionnaire
Change management questions ask whether production changes are tracked and reversible, including the urgent ones made at night. Version control and tickets are usually enough.
What the client wants to know
The client wants to know that a change that breaks things can be traced to who made it and undone, and that the emergency exception does not become a back door. A short, concrete description of your pull request or ticket flow answers all three questions.
The 3 questions as clients phrase them
The kit covers 3 questions in this area. The wording varies between questionnaires, the control behind it does not.
- Do you have a change management process for production systems?
- Can changes to production be rolled back?
- How are emergency changes handled?
What a good answer contains
- Tracking: every production change is recorded in a ticket or pull request, with a short description, the person who made it and the date.
- Rollback: changes live in version control or the provider's history, so a change can be reverted to the previous version.
- Emergency changes: recorded like every other change, so they can be reviewed and rolled back afterwards.
Watch out for
If some system has no history at all, say which one and that version control or change history is being set up. Do not generalise from your best repository.
Controls behind these answers
These are the controls the free Security Overview builder asks about for this area. Each line is the statement you can make once the control is in place, followed by the fix step if it is not.
- Development: Every change to production is tracked in a ticket or pull request and can be rolled back. If not yet: Make every production change go through a ticket or pull request, and keep version history so a change can be reverted.
Example: how a prepared answer opens
Question: How are emergency changes handled?
Emergency changes are recorded in a ticket or pull request like every other change, so they can be reviewed and rolled back.
This is the first sentence only. In the kit the full answer is built from your profile, with an honest variant for each control you do not have yet.
Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.