Production configuration changes must be reviewed on a cycle

Control Statement: The organisation must review changes to production configuration on a defined cycle, with a named owner.

Description: This control requires the review, not the storage. Creatio records what changed and who changed it; this asks whether anybody looks, how often, and who is accountable for looking.

Where changes reach production through a deployment pipeline, reviewing the pipeline satisfies this control for the changes that go through it — provided changes made directly in production are reviewed too.

Rationale: An unreviewed change history detects nothing. It supports an investigation once somebody already suspects a problem, which means it is useful precisely as often as somebody happens to suspect one. Creatio implementations are especially exposed here: they are commonly modified directly in production by a mix of internal administrators and partner consultants, and the only thing standing between that and an unaccountable instance is somebody reading the list.

Audit Procedure:

1. Confirm a review of production configuration changes takes place on a defined cycle.
2. Confirm it has a named accountable owner.
3. Confirm the review covers changes made directly in production, not only those deployed.
4. Sample recent changes and confirm each was covered by a review.

Remediation:

1. Define the cycle and assign an owner.
2. Start from the elements changed most recently — the index can tell you how many there were.
3. Record each review outcome in the system of record.
4. Where the volume makes review impractical, that is itself the finding: reduce direct production change rather than abandoning the review.

Default Value: Creatio records configuration changes and provides no review, attestation or notification over them.