Monetary Authority of Singapore Technology Risk Management Guidelines 7.5: 7.5 Change Management

The FI should ensure changes to information assets are assessed, tested, reviewed and approved before implementation: a risk and impact analysis covering security and effects on other assets; adequate testing in a test environment with approved test plans and signed-off results before production; a change advisory board of business and IT stakeholders to approve and prioritise changes on stability and security grounds; a backup before the change and a rollback plan; defined procedures and authorisers for urgent or emergency changes; and logging of activities performed during the change.