N.4.15 Controlled implementation of changes
Control Overview
This control mandates that the organization establishes, implements, and enforces a formalized Change Management process for all network modifications, software updates, and information system reconfigurations. To prevent security incidents caused by poorly planned adjustments, every change request must undergo a mandatory risk and impact analysis targeting its effects on the availability, integrity, and confidentiality (CIA triad) of information assets. This process governs the entire system lifecycle—from initial development through emergency hotfixes to final decommissioning—and requires strict authorization workflows and post-implementation reviews.
Applicability Note: This control is fully applicable to the anDREa platform and serves as the primary operational governor safeguarding our codebase, multi-tenant cloud fabric, and continuous deployment streams.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement operates within our ISO/IEC 27001-based ISMS, structurally embedding change governance into our automated software delivery pipelines.
anDREa enforces a rigorous Development, Testing, Acceptance, and Production (DTAP) architectural model. Change management is not an isolated administrative task but is natively bound to our Secure Development Lifecycle (SDLC). To eliminate the risk of unreviewed code or configurations entering the live environment, anDREa enforces absolute Role-Based Access Control (RBAC) boundaries: internal developers possess no direct write or administrative access to the live production environment. All changes must progress sequentially through designated code quality gates, automated testing suites, and formal authorization workflows, with final code promotion executed exclusively via cryptographically secured deployment pipelines.
For critical edge cases, our framework includes a dedicated Emergency Change Handling Procedure that allows for rapid security patching while mandating an immediate post-implementation review to evaluate and document security effects.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.08.32 - Change management | Mandates that changes to information processing facilities and systems are subject to formal configuration and lifecycle control procedures. |
| ISO/IEC 27001 | A.05.37 - Documented operating procedures | Mandates that operational changes, system dependencies, and deployment protocols are explicitly written down and followed. |
| ISO/IEC 27001 | A.08.25 - Secure development life cycle, A.08.29 - Security testing in development and acceptance | Governs the technical rules for secure application development and enforces mandatory security testing during acceptance stages. |
| Pipeline Governance | CI/CD Configuration & Quality Gates | System deployment definitions (such as GitHub Actions rules) proving that direct-to-production pushes are blocked and require multi-party approval. |
| Risk Assessments | Change Impact Assessment Templates | Formal engineering evaluation records proving that every change request is explicitly analyzed for impact against availability, integrity, and confidentiality. |
| Emergency Operations | Emergency Hotfix & Rollback Runbooks | The specific operational procedure governing how urgent security patches are safely applied, approved out-of-band, and forensically reviewed. |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Multi-environment isolation (DTAP), automated deployment pipelines, formal CIA impact reviews, and emergency patch workflows are fully operationalized and auditable.
- Continuous Improvement (NIS 2 Alignment): To optimize your tracking posture for upcoming supervisory audits, update your project management tool/ticketing system templates to include an explicit "NIS 2 Essential Service Impact" metadata tag. This will allow engineering teams to easily flag and prioritize changes that carry downstream risks to the platform's core compliance commitments.