Map one security control into an existing change process

applied · 60 min · Objective 1.3

Task

Apply objective 1.3: take a security control and implement it INSIDE the change process rather than beside it, and show what the parallel-process version would have cost.

Steps

  1. Write lab/change-process.md describing the existing process: states, who approves, what a standard change is, and what an emergency change is.
  2. Pick one security control -- security impact assessment on change is the clearest -- and write lab/control-in-process.md specifying the field added to the change record, who completes it, and what makes a change fail it.
  3. Classify routine security patching as a STANDARD change in your process, and write down the criteria that qualify a patch for it.
  4. Write the RACI rows for the new control and append them to lab/raci.csv from the earlier lab.
  5. Write lab/parallel-cost.md naming three concrete costs of the alternative -- a separate security approval queue -- in reconciliation, lead time and sources of truth.

Verify

grep -Eci 'standard change|pre-authorised|pre-authorized' lab/change-process.md
grep -Eci 'field|assessment|criteria' lab/control-in-process.md
grep -c . lab/parallel-cost.md
awk -F, 'NR>1 {n++} END {print n" raci row(s) now"}' lab/raci.csv

A standard-change definition present, criteria written, three costs named, and the RACI grown. If your control required a new approval body, re-read the lesson: the point is to add a criterion to a process people already use.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.