Which of these is NOT a change management component?

Change management is a structured process for managing changes to IT systems. Key components of this process include the Request for Change (RFC), which is the formal proposal; the Approval step, where the change is reviewed and authorized by a Change Advisory Board (CAB) or other authority; and the Rollback plan, a contingency for reverting the system to its prior state if the change fails.

Governance is a broader concept referring to the overall management framework of policies, rules, and practices through which an organization is directed and controlled. While change management is subject to and part of IT governance, governance itself is not a specific component or step within the change management process.

A. Rollback: A rollback plan is a critical component of change management, ensuring that a failed change can be reversed to restore system stability.

C. Approval: This is a mandatory gate in the change management workflow, where changes are formally reviewed and authorized before implementation.

D. RFC: The Request for Change (RFC) is the formal document that initiates the change management process, detailing the proposed change.

1. (ISC)². (2022). Official (ISC)² Certified in Cybersecurity (CC) Study Guide. Wiley.

Domain 4: Security Operations

Objective 4.4: This section details the change management process

explicitly mentioning the need for formal requests (RFCs)

review and approval processes

and the importance of having a backout or rollback plan. It frames these as integral steps of the process.

2. National Institute of Standards and Technology (NIST). (2020). Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations.

Control CM-3 (Configuration Change Control): This control specifies that the change control process includes "review and approval... of proposed changes" and "documenting change decisions." This directly supports 'Approval' and 'RFC' as components. The broader context of configuration management also implies planning for failures

which includes rollback procedures.

3. Weill

P.

& Ross

J. W. (2004). IT Governance: How Top Performers Manage IT Decision Rights for Superior Results. Harvard Business School Press.

Chapter 1

"What is IT Governance?": This book defines IT governance as the framework specifying decision rights and accountability to encourage desirable behavior in the use of IT. This establishes governance as a high-level framework

distinct from the operational components of a specific process like change management.