What does the change management process entail?

Obtaining information security management approval may be one procedural step in some organizations, but it is not the defining or comprehensive description of what change management entails as a process.

Maintaining the integrity of the application is a broader security objective and a desired outcome, not a specific activity that defines the change management process itself.

Obtaining feedback before implementation may be part of a change advisory board (CAB) review, but it is not the primary or defining element that characterizes what change management entails.

Change management entails identifying vulnerabilities as part of evaluating the risk and impact of proposed changes to systems or applications. By identifying vulnerabilities, organizations can determine whether a change is necessary to remediate a security weakness and assess what new risks the change itself might introduce, making it a foundational step in the process.