Which of the following ensures that updates to policies, procedures, and configurations are made in a controlled and documented fashion?

Regulatory compliance refers to adhering to laws and standards, not to the internal process of controlling how changes are made.

Peer review is a quality assurance technique for evaluating work, but it does not itself govern or document how changes are authorized and implemented.

Change management is a structured IT governance process that controls how updates to systems, policies, and configurations are requested, reviewed, approved, and recorded. It prevents unauthorized or uncoordinated changes that could introduce security gaps or operational failures. Without it, changes lack audit trails and accountability, which is a core security and compliance requirement.

Penetration testing is an offensive security assessment technique used to find vulnerabilities, not a process for controlling system or policy changes.