| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
IT Change, Configuration & Patch Management
This episode of the ISACA Certified Information Systems Auditor (CISA) exam prep series covers IT change, configuration, and patch management. It explains how disciplined change control prevents production outages, what patch management requires in practice, how software releases are categorised and deployed, and what the operations team does to keep infrastructure running safely day to day.
What this episode covers
- Change control process — moving changes safely from test through quality to production, with the operations team guarding the final step.
- Change procedure requirements — communication, documentation, test approval, conversion sign-off, legal review, and rollback planning.
- Three change categories — emergency, major, and minor, each governed by its own procedure.
- Patch management — acquiring, testing, and installing patches, with backup-first and non-critical-system testing as safeguards.
- Release types — major, minor, and emergency releases, the delta release concept, and the requirement for a contingency back-out plan.
- Operations team duties — the daily tasks, required documentation, and the auditor review checklist for operations facilities.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
What is change control and how do changes move to production?
Change control governs how changes move safely toward the live production environment. A change starts in the test environment where work is done, moves to a quality environment for thorough testing, and then reaches production. The operations team typically guards that final step and often gives the last approval before anything goes live, covering hardware changes, application releases, patches, and network configuration adjustments.
What does patch management involve and what precautions are needed?
Patch management means acquiring, testing, and installing code changes that keep software current and address security risk. The tasks include tracking which patches exist, deciding which fit the organisation’s systems, installing them properly, testing after installation, and documenting everything. A patch can sometimes cause more trouble than it fixes, so the recommended practice is to back up first and test on non-critical systems before rolling out to production.
What are the three types of software release?
A major release brings significant new functionality and supersedes earlier minor releases. A minor release carries small fixes that cannot wait for the next major release. An emergency release is a rushed fix for a critical failure and should be rare, because limited testing raises the risk of introducing new errors. Every release must have contingency plans prepared before deployment so that if something breaks, the change can be completely backed out.
What is the operations team responsible for day to day?
The operations team runs and manages the entire infrastructure, including systems, applications, and data. Its daily tasks include running and watching scheduled jobs, ensuring backups happen, monitoring for unauthorised access to sensitive data, checking that operating procedures are followed, participating in disaster recovery tests, monitoring performance and capacity, and helping with troubleshooting and incidents. All of this work must be supported by solid documentation covering procedures, monitoring steps, error detection, escalation, and backup and recovery.
📚 Master the ISACA CISA Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISACA CISA certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in IT Change, Configuration & Patch Management.