CM-4 Impact analyses
Requires changes to the system to be analysed for their potential security and privacy impact before they are implemented, so that the consequences of a change are understood while it can still be stopped or modified.
4
artefacts
0
held by a system
2
at each review
hard
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Impact analysis records attached to change requests before implementation · Cloud console / configuration management
- Evidence that the analysis considers privacy as well as security effects · Cloud console / configuration management
governing documentDocuments that govern the control
- Method or checklist used to assess security and privacy impact · Policy repository / GRC workspace
- Examples of changes rejected or modified because of the analysis · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Analysis performed after deployment as part of a review rather than beforehand
- Privacy impact never considered, only availability and security
- Standard or pre-approved changes exempted without an initial impact assessment of the category
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCM-3 Configuration change control · CM-5 Access restrictions for change