This requirement exists to plan release scope, timing, dependencies, resources, communications, and readiness before deployment and to ensure operational services are managed consistently, reliably, and with appropriate control.
Define and document the process for plan release scope, timing, dependencies, resources, communications, and readiness before deployment. Establish accountable owners, inputs and outputs, approval or validation points, operating criteria, schedules or thresholds where applicable, exception handling, monitoring, reporting, review, and evidence requirements. Integrate the process with change, incident, risk, asset, security, and service-management processes where relevant.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.9-3.4 – Release Management |
India
Guideline
|
vLatest | View → |
| RBI-CSF | RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set... Clause: 7) Patch/Vulnerability & Change Management – 7.3 Robust configuration/change management with integrity of changes |
India
Regulation
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.4 PR.IP: Information Protection Processes and Procedures |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 9(4)(e) – ICT change management: recording, testing, assessing, approving, implementing and verifying changes |
EU
Regulation
|
vCurrent | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: PR.PS – Platform Security | PR.PS-02 – Software is maintained, replaced, and removed commensurate with risk ID.RA – Risk Assessment | ID.RA-07 – Changes and exceptions are managed, assessed for risk impact, recorded, and tracked |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.5 – CONFIGURATION MANAGEMENT; CM-3 – CONFIGURATION CHANGE CONTROL |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 25(1) – Data protection by design and by default; Article 32(1)(d) – Testing, assessing and evaluating security measures |
EU
Regulation
|
vCurrent | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC8.1 – Change Management – The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures to meet its objectives. |
AICPA
Audit Framework
|
vLatest | View → |