Certified: The Security+ Prepcast

In this episode, we are introducing the concept of change management and why it matters in cybersecurity. Change management is the process of controlling how modifications are made to information systems, networks, and technology infrastructure. It is a structured way to ensure that changes are planned, tested, approved, and tracked, all with the goal of avoiding disruption or creating new vulnerabilities.
The importance of change management in cybersecurity cannot be overstated. Every change to a system—whether it is a software update, a configuration adjustment, or a new hardware installation—introduces potential risks. Without proper oversight, even a small change can lead to downtime, open a security hole, or break critical functionality. Change management provides the structure needed to minimize these risks while allowing systems to evolve and improve.
Strong change management contributes to a healthier overall security posture. Security posture refers to an organization’s readiness and ability to protect itself from cyber threats. When change is handled carelessly, it weakens that posture. But when change is documented, reviewed, and approved through formal processes, the organization gains confidence that systems are stable, secure, and operating as expected.
Another major benefit of change management is its ability to prevent security incidents. Many breaches occur not because of a sophisticated attacker, but because someone made a change without thinking through the consequences. For example, disabling a firewall rule temporarily or deploying an untested update can open the door to attack. Change management forces decision-makers to ask the right questions before moving forward—what is the risk, who needs to know, and how will we recover if something goes wrong?
Let’s break down the core concepts and terminology used in change management. One of the most fundamental pieces is the approval process. Before any significant change is made, it must go through an approval cycle. This means that someone other than the person proposing the change must review and approve it. That separation of duties helps prevent mistakes and ensures that all potential impacts are considered.
Ownership is another key concept. Every change must have an owner—someone who is responsible for making sure the change is carried out properly, documented accurately, and reviewed after completion. The owner is accountable for both the process and the results.
Stakeholders are the people or teams affected by the change. This can include system administrators, help desk staff, business units, or end users. Good change management means notifying all relevant stakeholders before a change is made. That way, everyone knows what to expect, and people can prepare for temporary disruptions or new procedures.
A secure change management process also clearly defines roles and responsibilities. There is usually a change requestor—the person or team who needs the change. There is a change manager or change control board who reviews requests, approves or denies them, and ensures that all steps are followed. There may also be testers, implementers, and reviewers involved at different stages. This clarity helps prevent confusion, duplication of effort, and missed steps.
In the real world, effective change management makes a measurable difference. Consider a scenario where a large company needs to upgrade its virtual private network gateway. Without change management, the administrator might apply the update late at night without notifying users or testing for compatibility. If the update fails, remote workers might be locked out of critical systems the next day, causing lost productivity and emergency troubleshooting.
With change management in place, the same company would handle the upgrade very differently. A change request would be submitted and reviewed. Compatibility testing would take place in a staging environment. A communication plan would notify users in advance. The upgrade would be scheduled during a maintenance window, and a backout plan would be created in case something went wrong. After the upgrade, logs would be reviewed and users would report on any issues. This structured approach reduces surprises, minimizes risk, and ensures accountability.
Another example comes from a healthcare provider updating electronic medical records software. In this case, change management ensured that patient data remained intact, compliance standards were met, and system downtime was minimized. Nurses and doctors were informed about interface changes in advance, and extra support staff were available during the rollout. As a result, the transition was smooth and security remained intact.
As you prepare for the Security Plus exam, make sure you understand the goals and structure of a secure change management process. Be able to explain why change management is essential in reducing risk and improving security posture. Know the key roles—such as change requestor, owner, and stakeholder—and the steps in the process, including approval, testing, communication, and documentation. The exam may present a scenario where a poorly managed change leads to an incident, and you will need to identify what part of the process was missing or ignored.