{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"administrative","domain":"Secure Configuration & Change Management","type":"preventive"},"canonicalUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-02","description":"Manage changes to applications, databases, infrastructure, configurations, and procedures through a documented process in which changes are requested, analyzed for security and risk impact, authorized, tested, approved, and implemented by appropriate personnel. Require migration to production to be performed by individuals independent of development, and retain records evidencing each step. Define rollback plans and an emergency-change path with retrospective review and approval.","details":{"control_category":"administrative","control_type":"preventive","domain":"Secure Configuration & Change Management","guidance":[],"members":[{"control_id":"CM-3","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"CM-4","coverage":"full","framework":"nist-800-53","relationship":"superset_of"},{"control_id":"A.8.32","coverage":"full","framework":"iso-27001","relationship":"superset_of"},{"control_id":"CC8.1","coverage":"full","framework":"soc2","relationship":"superset_of"},{"control_id":"ITGC-CM","coverage":"full","framework":"sox","relationship":"superset_of"}],"statement":"Manage changes to applications, databases, infrastructure, configurations, and procedures through a documented process in which changes are requested, analyzed for security and risk impact, authorized, tested, approved, and implemented by appropriate personnel. Require migration to production to be performed by individuals independent of development, and retain records evidencing each step. Define rollback plans and an emergency-change path with retrospective review and approval.","title":"Authorize, test, and approve changes before production","unified_id":"UC-CONFIG-02"},"id":"uc:UC-CONFIG-02","mapUrl":"https://controlsmap.com/?v=1&node=uc%3AUC-CONFIG-02","sourceIds":["iso-27001","nist-800-53","soc2","sox"],"sourceUrl":null,"title":"UC-CONFIG-02 — Authorize, test, and approve changes before production","type":"unified"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f86873f61da0bbf5e24efe4d0073608987a883bd4a3135270076b5e005e256d","properties":{},"sourceDetailPath":"/data/v1/records/wf-d24-a9f3daf6.json","sourceId":"wf:D24","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:174fc3d890c086bdd045c5fff2832d7a8e0ffa43fc9503b71b1d79ce9b3c3124","properties":{},"sourceDetailPath":"/data/v1/records/wf-s5-a655abf2.json","sourceId":"wf:S5","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:21f887a1ab15146cb13b4b01c702289cdfd848c8f7bb2e67bcff81e073f524af","properties":{"control_id":"CM-3","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-3-ffa07140.json","targetId":"ctrl:nist-800-53:CM-3","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31bba5c22a2a5f37c88f8fd9fde19b93fa0dba136c0a76723313abd2158b9621","properties":{},"sourceDetailPath":"/data/v1/records/wf-c41-f5b6a3b6.json","sourceId":"wf:C41","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:43f1567b5887d1fa8d9380a632faafe3d4edf31d1160d3b278bdd6e23944dc3c","properties":{"rationale":"Gating changes through authorization and impact analysis prevents unauthorized changes that cause drift, though baseline monitoring is the operative control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/risk-config-poor-baseline-drift-2dd66324.json","targetId":"risk:config-poor-baseline-drift","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:526a33ed743f2c5b2a7ace2c31507db291b79af7981405f6183833f44cce7e43","properties":{},"sourceDetailPath":"/data/v1/records/wf-d05-2302db1f.json","sourceId":"wf:D05","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:665d86f3919e43b9ee8174131fd9e9ddd0bee870ce9e1aceb926e014ef1cedbb","properties":{"rationale":"Requiring test and approval before implementation directly mitigates releasing inadequately tested software.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/risk-vuln-inadequate-testing-scanning-ee33b888.json","targetId":"risk:vuln-inadequate-testing-scanning","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:82a9ad2e8b35c454fb2d7a0999e6d61498319ada3a0b3819cf4b49f470c05db7","properties":{},"sourceDetailPath":"/data/v1/records/wf-d40-de759eff.json","sourceId":"wf:D40","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b746704844a32ce3da334aa3bb3c92c52a59c320118c0ce5d8e906cf943e8916","properties":{"control_id":"A.8.32","coverage":"full","delta":null,"framework":"iso-27001","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2022"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/ctrl-iso-27001-a-8-32-b855772a.json","targetId":"ctrl:iso-27001:A.8.32","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:dbd69f416d26e446904bf1dedc40fc4a4141e437cc1108fb248a7083359bbe78","properties":{"control_id":"ITGC-CM","coverage":"full","delta":null,"framework":"sox","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"SOX §302/§404 (2002), PCAOB AS 2201"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/ctrl-sox-itgc-cm-5d415c42.json","targetId":"ctrl:sox:ITGC-CM","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e0dbfa652a28597344c5b673499f836c66223b83a9f624f49fda24d735377c11","properties":{"rationale":"Security/risk impact analysis and pre-production testing catch integration interface/config errors, though emergent AI behaviour is not caught by change testing.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/risk-ai-emergent-integration-risk-8490271c.json","targetId":"risk:ai-emergent-integration-risk","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e79d9f1085a08b2c0078623a74f182c38115a275ebe83946bc0562b90d697b66","properties":{"rationale":"The documented request->impact-analysis->authorize->test->approve->independent-migration process is the change-control defense itself.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/risk-config-weak-change-control-e7d90eaf.json","targetId":"risk:config-weak-change-control","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e9d64e6067d0b73a423e015b7587f1e938a4633344b2cd37f5081f0751840754","properties":{},"sourceDetailPath":"/data/v1/records/wf-a15-e859f6b8.json","sourceId":"wf:A15","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"tests"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f717c1e9afa1af5ea351fc0ee8ef634a471e9d5f75cecbe5fdab4d051333d405","properties":{"control_id":"CM-4","coverage":"full","delta":null,"framework":"nist-800-53","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"Rev. 5"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/ctrl-nist-800-53-cm-4-087a9c8a.json","targetId":"ctrl:nist-800-53:CM-4","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:fabab7d79d61fa4786d125223a5e61eb8061bedbdd845b7f9eaae877b4e9a322","properties":{"control_id":"CC8.1","coverage":"full","delta":null,"framework":"soc2","provenance":{"defaultConfidence":"medium","defaultStatus":"active","direction":"canonical_to_source","mapper":"coworkcanvas-compliance-graph","note":"Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.","reviewDate":"2026-09-07"},"relationship":"superset_of","source_version":"2017 TSC"},"sourceDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","sourceId":"uc:UC-CONFIG-02","targetDetailPath":"/data/v1/records/ctrl-soc2-cc8-1-2a7ddd54.json","targetId":"ctrl:soc2:CC8.1","type":"maps_to"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ffd295a7a0a0dd4cb931ab13ebe13e23a0e8bf6987977ce51d200f73c073fa99","properties":{},"sourceDetailPath":"/data/v1/records/wf-d06-c9616fb8.json","sourceId":"wf:D06","targetDetailPath":"/data/v1/records/uc-uc-config-02-175d55b0.json","targetId":"uc:UC-CONFIG-02","type":"tests"}],"schemaVersion":1}