TechKnowSurge
CompTIA Security+ 1.3 ISC2 CISSP 7.9 NIST 800-53 CM-3 NIST CSF ID.RA-07 NIST NICE K1287 NIST 800-53 CM-4 NIST 800-53 CM-9 ISC2 CISSP 7.3 NIST CSF PR.PS-01 NIST 800-53 CM-5 NIST CSF GV.RR-02 NIST CSF ID.IM-03 NIST NICE K1294
InteractiveSecurityFree

Change Management Step Sequencer

Order one change through its lifecycle — Request, Review, Approval, Testing, Implementation, Verification, Documentation, Closure — and say what each step produces.

Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

Change management is usually met as a list of eight words in a row — request, review, approval, testing, implementation, verification, documentation, closure — and a student who can recite that list still cannot say what has to already exist before any one of those steps can begin, or what each of them actually leaves behind. Closing that gap is what this set is for, and it is why no card opens with its step name. Each card describes the work and ends with what that step produces, so the vocabulary is attached to the behaviour rather than standing in for it. The chronology here is causal rather than conventional, and three constraints do most of the work. The first is that nothing is touched before somebody with the authority to say yes has said it. That single rule sorts the first five steps on its own: the request exists to create a written, owned, trackable proposal, because an undocumented change is not a small change but an invisible one; the review exists to turn that proposal into an understood one, assessing technical risk, business impact, the backout plan's actual executability, and the schedule conflicts with other work already booked against the same systems; and the approval is the moment a named accountable role fixes the scope, the schedule and the window. The requester almost never approves their own change, and that is separation of duties rather than bureaucracy — the reviewer's job is to find the cost that lands on somebody else, which is exactly what the person who wants the change is least placed to see. Approval is also what makes "unapproved change" a meaningful phrase: anything the work does beyond what was authorized is one, including the tempting "while I'm in here" fix that nobody thinks to look at when something breaks a week later. Standing pre-approval for a defined low-risk change type is not a way around this step; it is this step, decided once in advance instead of every time. The second constraint is that you rehearse before you perform. Testing comes before implementation because the environment that can be broken safely has to be used before the one that cannot, and because the rehearsal produces something implementation needs: the runbook — the ordered steps, the commands, the checks, the go/no-go points — so the person doing the work inside a maintenance window at 2am is following a script that has already succeeded once. Testing here is not only "does it do the thing"; it is also does the dependent service still work, does the monitoring still see what it saw before, and does the backout genuinely restore the previous state when it is executed rather than merely described. Implementation is then deliberately unglamorous: notify the stakeholders, take the pre-change backup so the backout has something to restore from, open the authorized window, follow the runbook as written, note deviations instead of improvising them, and honour the go/no-go points — a failed check partway through means executing the backout and rescheduling, not pushing on in the hope it settles. The third constraint is that a change is not finished when the work stops. Verification is a separate step from implementation because the work being done is not the same as the work having worked: the vulnerability actually closed, the capability actually available, the metric actually moved, and — the half students forget — nothing that was working before is now broken. That means watching the logs and monitoring for adverse effects across a defined observation period rather than a glance, and asking the affected users rather than reading silence as success. It is also the last moment at which backing out is cheap, because the window and the people are still there. Documentation follows because the environment has changed and every record describing it is now wrong until corrected: the diagrams, the configuration baselines, the CMDB entries for the affected configuration items, the runbooks and standard operating procedures, the version-controlled configuration, and the change record itself completed with what was actually done, which is regularly not identical to what was proposed. Documentation that lags is what turns a routine change into an outage six months later, because the review step of every future change reads exactly these records to assess dependencies and impact — and it is what the auditor asks for and what the responder reads first at 3am. Closure is then a review rather than a filing action: the change is confirmed complete and successful, or recorded honestly as failed, partial or backed out, because a process that only records successes measures nothing; the post-implementation review asks whether the risk and duration estimates matched reality and what should be done differently; and the metrics that come out of it — change success rate, emergency change rate, changes causing incidents — are what decide whether a change type earns standing pre-approval or more scrutiny next time. The set also answers the question students reliably ask at this point, which is what happens when there is no time for any of this. An emergency or hotfix change compresses the sequence; it does not delete steps from it. Review and approval shrink to an emergency authorization by a smaller group — often an emergency CAB convened in minutes, sometimes a single on-call authority acting under a pre-agreed policy — but somebody who is not the implementer still says yes, and the fact that they did is recorded. Testing shrinks to whatever can honestly be done in the time available, which is usually a smoke test and a confirmed backout rather than a full staging run, and the risk of that reduction is accepted explicitly rather than pretended away. Implementation and verification do not compress at all: the whole reason for the hurry is an effect somebody needs, so confirming that effect arrived is the point of the exercise. And documentation and closure are deferred, not skipped — completed retroactively, usually within a stated window, and reviewed harder than a normal change precisely because so much of the front of the process was traded away. The honest summary for a student is that an emergency change is more paperwork than a normal one, not less; the paperwork simply arrives afterwards. All 8 cards are presented on every run rather than sampled: this is the naturally finite domain the pool guideline makes an exception for — a lifecycle with a step removed is not a shorter version of the same object, it is a broken chain, and the chain is the entire skill being assessed. This pairs best with the module's own sequence — run it after Change Management (pspo-12-0020) and alongside Evaluation and Implementation (pspo-12-0040) and Monitoring, Documentation, and Closure (pspo-12-0050), so that the steps the cards separate are ones the student has already seen taught together.

What you'll learn

Aligned to

CompTIA Security+
1.3 Explain the importance of change management processes and the impact to security.
ISC2 CISSP
7.9 Understand and participate in change management processes
7.3 Perform Configuration Management (CM)
NIST 800-53
CM-3 Configuration Change Control
CM-4 Impact Analyses
CM-9 Configuration Management Plan
CM-5 Access Restrictions for Change
NIST CSF
ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
PR.PS-01 Configuration management practices are established and applied.
GV.RR-02 Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.
ID.IM-03 Improvements are identified from execution of operational processes, procedures, and activities.
NIST NICE
K1287 Knowledge of change management processes
K1294 Knowledge of change management policies and procedures

Key terms

Change Management
A structured process for requesting, reviewing, approving, and documenting changes to IT systems or organizational procedures. Change management reduces security risk by ensuring modifications are tested and authorized before deployment.
Change Control
The subprocess within configuration or change management that governs how changes are reviewed, approved, and implemented in a controlled manner.
Change Control Process
The formal sequence of phases — request, planning, evaluation, implementation, monitoring, and closure — used to manage changes to a system or network in a controlled manner.
Change Request
A formal submission from a user, customer, or stakeholder initiating the process to make a change within an IT environment.
Change Advisory Board
CAB
A group that reviews and evaluates proposed changes to ensure they are appropriate for the environment and comply with organizational policies and procedures.
Change Control Document
A record that captures the details, approval, implementation steps, and final status of a change throughout the change management process.
Change Closure
The final step of the change management process in which documentation is finalized and the originating change request or ticket is officially closed.
Backout Plan
A documented procedure for reversing a change if implementation is unsuccessful, restoring the system to its previous state.
Rollback Plan
A documented strategy for reverting a system to its previous state if a patch or change causes problems or instability.
Maintenance Window
A scheduled period defined in an SLA during which planned system maintenance may occur and brief outages are expected and permitted.
Staging Environment
A pre-production environment that mirrors production, used to test code and configurations before they are released to end users.
Adverse Effects Monitoring
The observation of a system after a change is implemented to detect any unintended negative impacts on performance or availability.
Configuration Management
The process of tracking and controlling changes to hardware, software, and documentation throughout a system's lifecycle.
Configuration Management Database
CMDB
A Configuration Management Database is a repository that stores information about hardware and software assets and their relationships, supporting security operations by providing authoritative asset inventory for vulnerability management and incident response.
Baseline
A documented set of minimum security standards or performance metrics used as a reference point.
Risk Assessment
The process of identifying, analyzing, and evaluating risks to determine their potential impact.
Risk Impact
A rating that estimates the potential severity of harm if a risk event occurs, often scaled from negligible to severe.
Business Impact Analysis
BIA
A process that identifies and evaluates the effects of disruptions to critical business functions to prioritize recovery efforts and resource allocation.
Stakeholder
An individual or group with an interest in or affected by an organization's operations, including internal staff, executives, clients, vendors, and partners.
Runbook
A detailed, step-by-step set of instructions used to guide responders through a specific incident response task or scenario.
Standard Operating Procedures
SOP
Documented step-by-step instructions that define how routine tasks and processes should be consistently carried out within an organization.
Live Environment Test
A test of incident response procedures conducted directly within the production environment to validate real-world effectiveness.
Patch Validation
The phase of patch management that verifies patches have been successfully applied to all target systems and confirms systems are functioning as expected.
Retesting
A follow-up assessment performed by a penetration tester after a vulnerability has been remediated, confirming that the fix is effective and the vulnerability no longer exists.
Separation of Duties
SoD
Separation of Duties is a security control principle requiring that critical or sensitive tasks be divided among multiple individuals to prevent fraud, collusion, and unauthorized actions by any single person.
Version Control
A system that tracks and manages changes to configurations or code over time, enabling accountability and the ability to roll back to earlier versions.
Sandbox
A sandbox is an isolated, controlled execution environment used to run untrusted code or files and observe their behavior, preventing potentially malicious activity from affecting the host system or network.
Service Level Agreement
SLA
A formal commitment between a provider and customer that guarantees a defined level of service uptime, including terms for compensation if the standard is not met.
Security Policy
A formal document that defines an organization's security goals, rules, and responsibilities.
Audit
A formal and systematic examination of an organization's systems, policies, and procedures to verify that security controls are in place, functioning as intended, and meeting applicable compliance requirements.
Post-Incident Review
A follow-up phase after an incident is resolved in which teams analyze root causes, evaluate response effectiveness, and implement improvements to reduce future recurrence.
Risk Acceptance
A risk response strategy that acknowledges a risk and proceeds without additional mitigation because the benefits outweigh the potential harm.
Technical Debt
The accumulated burden of outdated systems, legacy code, or deferred improvements that must still be maintained while transitioning to newer automated solutions.
Patch Management
The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.
Automation
The use of software or scripts to perform IT processes and tasks without manual intervention, streamlining workflows such as change control and infrastructure deployment.

Topics

Interactive Ordering

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →