Every change request is evaluated for its effect on business processes and I&T services and for whether it would harm the operational environment or bring unacceptable risk, and changes are logged, prioritised, categorised, assessed, authorised, planned and scheduled: process owners and IT raise formal change requests for processes, infrastructure, systems or applications, all changes come only through change management, and requests are pre-screened to spot standard changes; requests are categorised (business process, operating systems, infrastructure, applications, networks, packaged software) and linked to the configuration items they affect; priority is set by business and technical requirements, resources, and legal, regulatory and contractual reasons; each change is formally approved, as fits the case, by process owners, by service managers and by technical IT stakeholders, and frequent low-risk changes are pre-approved as standard changes; approved changes are planned and scheduled; each request is assessed in a structured way, analysing the effect on processes, infrastructure, systems, applications, continuity plans and service providers so every affected component is found; and the effect of contracted providers on change management is taken into account, including how their processes are integrated with the enterprise's own.
This control maps to 3 controls across 3 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 3 it maps to, and the evidence behind each claim, over MCP and REST.