A.12.5.1 Change control procedures

ISO27001 has controls for change management in relation to IT applications and infrastructure, to ensure that changes to systems do not introduce new risks.

Control and verify changes so there is no impact on security. A common problem is the short time usually available to develop and deploy applications. This leads to a number of short cuts to quickly deploy the applications. These, in turn, result in a number of vulnerabilities that can go unidentified. These vulnerabilities remain in the systems thereafter and usually get identified and reported only during application audits. Adherence to this control ensures that changes will not compromise application security.