The identities that change production configuration must be inventoried

Control Statement: The organisation must maintain an inventory of the identities that have changed production configuration, with the access each holds and why.

Description: This control requires a record of who can and does change the configuration of the production instance — internal staff, partner consultants, and any deployment identity — reviewed on a defined cycle.

Rationale: The number is usually smaller than people expect and the names are usually a surprise. A partner consultant who left the project two years ago frequently still resolves as the last author of something load-bearing, and nobody notices because nobody has ever listed the set. The inventory is also the only way to answer the question that follows an incident — who else could have done this — without reconstructing it from the configuration under time pressure.

Audit Procedure:

1. Confirm an inventory of change identities exists in the system of record.
2. Compare it against the identities that actually appear as modifiers of custom configuration.
3. Confirm each entry records what the identity is, whose it is, and why it has access.
4. Confirm the last review falls within the defined cycle.

Remediation:

1. List the identities that appear as modifiers of the configuration the organisation owns.
2. For each, record whose it is and why it has access.
3. Remove access for identities that no longer need it.
4. Set a review cycle and record who owns it.

Default Value: Creatio provides no inventory of who changes configuration and no review mechanism over it.