| Source | Azure Portal | ||
| Display name | Microsoft Managed Control 1197 - Configuration Change Control | Test / Validate / Document Changes | ||
| Id | a20d2eaa-88e2-4907-96a2-8f3a05797e5c | ||
| Version | 1.0.0 Details on versioning |
||
| Category | Regulatory Compliance Microsoft Learn |
||
| Description | Microsoft implements this Configuration Management control | ||
| Additional metadata |
Name/Id: ACF1197 / Microsoft Managed Control 1197 Category: Configuration Management Title: Configuration Change Control | Test / Validate / Document Changes Ownership: Customer, Microsoft Description: The organization tests, validates, and documents changes to the information system before implementing the changes on the operational system. Requirements: Azure tests and validates proposed system changes prior to deployment, either in a separate test environment, or by removing a server from production, making changes, testing, and returning the server to production upon successful completion. When testing and validation is complete, results are documented in the relevant change tracking tool, either Azure DevOps or Incident Management (IcM) depending on the team. All code impacting work items are triaged before they are implemented. The triage process assesses the priority of the item and potential impact to customers. If an item is of a security nature, input from C+AI Security is sought. Assets have a set of runners which leverage information captured by Geneva Monitoring to run automated tests for checking the health of the components. Runners are configured to automatically generate alerts if any component health discrepancies are identified. This ensures recently deployed software should be propagated to more assets or rolled back as health indicators dictate. Testing procedures for changes are documented within change tickets. Configuration changes and associated approvals and documentation are all kept within tickets or RFC. Automation is built into the change management tool throughout the change lifecycle including documenting changes to the information system. |
||
| Mode | Indexed | ||
| Type | Static | ||
| Preview | False | ||
| Deprecated | False | ||
| Effect | Fixed audit |
||
| RBAC role(s) | none | ||
| Rule aliases | none | ||
| Rule resource types | IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups |
||
| Compliance | Not a Compliance control | ||
| Initiatives usage | none | ||
| History | none | ||
| JSON compare | n/a | ||
| JSON |
|