Documented process for approving, testing, and deploying changes to production systems.
Change Management governs how changes to production systems are proposed, reviewed, tested, approved, deployed, and verified. SOC 2 CC8.1 expects documented authorisation, segregation between developer and deployer, and evidence of testing.
Run a free ComplianceIQ audit against SOC 2 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.