CISA aspirants should be aware of the following aspect of change, configuration, and patch management for the exam.
Change management process
A change management process is used to change hardware, install software, and configure various network devices. A change management process includes approval, testing, scheduling, and rollback arrangements.
While implementing a change, all relevant personnel should be kept informed and specific approval should be obtained from the relevant information asset owners.
To carry out changes, it is always advisable to use individual IDs rather than generic or shared IDs. Individual IDs help to establish accountability for any transaction.
For every change, transaction logs should be maintained. A transaction log is used as an audit trail for further investigation. A log should contain details such as date, time, user ID, terminal, and other relevant details of the transaction.
One of the...
