Change Management and Asset Protection
Key Takeaways
Subdomain 5.4 pairs asset lifecycle management with configuration and change management.
A change should be recorded and checked against the documented configuration before it is applied.
A planned change can still fail; the outline's change topic is about control, so keep records of each change.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 5.4, checked 2026-10-22.
Change Management in Asset Protection
Subdomain 5.4 names configuration and change management together with asset lifecycle management. Change management controls modifications to systems so that each one is recorded and checked against the documented configuration. The outline does not name a specific change procedure, so answer with the control concept.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.4, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Keeping the Record
A change record shows what changed, who approved it, and what the documented configuration was. Without that record, a later incident cannot be traced to the change that caused it.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 5.4: Asset lifecycle management (e.g., End Of Life (EOL) software and devices)
- 5.4: Configuration and change management
Common Traps
A common trap is making an undocumented change to fix an outage. Record the change against the documented configuration and route it through change management.
Why must a change be recorded against the documented configuration?
So that later review can show what changed and who approved it
So the change can skip review next time because the recorded configuration is already known to the team
So the asset no longer needs lifecycle management after the change has been logged in the register
So the configuration can be removed from the register once the change has been applied to the live server
A change answer should show how the change is recorded, approved, and checked against the documented configuration before and after it is applied. Keep the record with the configuration it describes.
Sections you finish are checked off in the contents.