Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?

Regulatory compliance refers to adherence to external laws and standards, but it does not itself define or enforce the internal process by which changes are reviewed and documented.

Peer review is a quality assurance technique for evaluating work products such as code or documents, not a formal process for controlling and recording system or policy changes.

Change management provides a structured workflow - including change request, impact assessment, approval, implementation, and post-change documentation - that prevents unauthorized or undocumented modifications to IT environments. This process directly addresses the requirement for controlled and traceable updates to configurations and policies. NIST SP 800-128 and ITIL frameworks both identify change management as the primary control for maintaining configuration integrity and auditability.

Penetration testing is an offensive security assessment used to discover vulnerabilities, not a control process for managing or documenting configuration and policy updates.