Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?

Regulatory compliance refers to adherence to external laws and standards, not a formal internal process for controlling and documenting how changes are made.

Peer review is a quality assurance activity where colleagues evaluate work, but it does not itself constitute a structured process for controlling, approving, and documenting system or policy changes.

Change management provides a structured, controlled workflow for requesting, evaluating, approving, and recording changes to IT systems and policies, ensuring full traceability and accountability. It prevents unauthorized or undocumented modifications that could introduce security vulnerabilities or create compliance gaps.

Penetration testing is a security assessment technique that simulates attacks to identify vulnerabilities, not a process for managing controlled and documented updates to configurations or policies.