CC8 Security Required

Change Management

Complete guide to CC8 Change Management controls. Plain-English explanations, AICPA text, risk levels, and evidence tips for each control.

1 Controls
1 Critical
0 High
CC8.1 critical

Change Management Process

Plain English

Every production code change goes through a formal change management process: code review by a second person, automated testing, staging deployment, and documented approval before production release.

View official AICPA language

The entity authorizes, designs, develops or acquires, configures, documents, tests, approves, and implements changes to infrastructure, data, software, and procedures.

What auditors look for

GitHub/GitLab PR history showing required reviewers, CI/CD pipeline logs, staging environment configuration, deployment approval records

Track all 1 controls in your free checklist

Assign owners, collect evidence, and get your readiness score — no credit card required.

Start Free Today