The ICT change management procedures under DORA Article 9(4)(e) must, for every change to software, hardware, firmware, systems or security parameters, verify that security requirements are met; keep the approval function independent of those requesting and implementing changes; set roles so changes are specified, planned, transitioned, tested and quality assured in a controlled way; document and communicate purpose, scope, timeline and expected outcomes; set fall-back, abort and recovery procedures and responsibilities; provide safeguarded handling of emergency changes and their later documentation, re-evaluation and approval (including workarounds and patches); and assess the impact of each change on existing security measures and whether new measures are needed. After significant changes CCPs and CSDs must test their systems under simulated stress, involving their members, users and linked infrastructures as appropriate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.