Implementing CCM: The Change Management Process

The Cloud Controls Matrix (CCM) is a framework of controls (policies, procedures, and technical measures) that are essential for cloud computing security. It is created and updated by CSA and aligned to CSA best practices.

You can use CCM to systematically assess and guide the security of any cloud implementation. CCM also provides guidance on which actors within the cloud supply chain should implement which security controls. Both cloud service customers (CSCs) and cloud service providers (CSPs) use CCM in many ways.

CSCs use CCM to:

• Assess the cloud security posture of current or potential cloud vendors. If a cloud vendor isn’t transparent about their security controls, the risk of doing business with them can be quite high.
• Compare vendors’ level of compliance with relevant standards like ISO 27001.
• Clarify the security roles and responsibilities between themselves and the CSP.

CSPs use CCM to:

• Assess, establish, and maintain a robust and internationally accepted cloud security program. CCM helps solidify CSPs' positions as trusted and transparent providers of cloud services.
• Compare their strengths and weaknesses against those of other organizations.
• Document controls for multiple standards in one place. CSA has mapped the controls in CCM against several industry-accepted security standards, regulations, and control frameworks.

CCM contains 197 control objectives structured into 17 domains that cover all key aspects of cloud technology:

 

CCM Domains

 

Today we’re looking at implementing the fourth domain of CCM: Change Control and Configuration Management (CCC). The CCC domain consists of nine control specifications:

• Change Management Policy and Procedures
• Quality Testing
• Change Management Technology
• Unauthorized Change Protection
• Change Agreements
• Change Management Baseline
• Detection of Baseline Deviation
• Exception Management
• Change Restoration

The CCC domain focuses on mitigating the risks associated with configuration changes to information technology assets. The key directive of this domain is to adhere to a robust change management process—regardless of who manages the assets. Proper handling of modifications is essential to ensure that changes do not compromise the security and stability of cloud systems.

Both CSPs and CSCs utilize CCC controls. They must ensure that both sides configure and maintain a secure cloud environment in accordance with agreed upon service requirements. The CCC domain ensures that the appropriate change management authority, whether CSP or CSC, authorizes changes.

Below, learn how both CSPs and CSCs can implement effective change management processes and establish clear responsibilities between themselves.

 

Understanding the Control Specifications

The CCM contains nine CCC controls. 

 

Change Management Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for managing the risks associated with applying changes to organization assets, including application, systems, infrastructure, configuration, etc., regardless of whether the assets are managed internally or externally (i.e., outsourced). Review and update the policies and procedures at least annually.

Make sure everyone knows what they need to do regarding change management, and that everyone agrees on these requirements. 

 

Quality Testing

Follow a defined quality change control, approval and testing process with established baselines, testing, and release standards.

Make sure you test any changes before you release them. 

 

Change Management Technology

Manage the risks associated with applying changes to organization assets, including application, systems, infrastructure, configuration, etc., regardless of whether the assets are managed internally or externally (i.e., outsourced).

Make sure to assess the risk of change to the system prior to undertaking any changes.

 

Unauthorized Change Protection

Restrict the unauthorized addition, removal, update, and management of organization assets.

Make sure that only authorized people can make changes and that they can only make authorized changes.

 

Change Agreements

Include provisions limiting changes directly impacting CSCs owned environments/tenants to explicitly authorized requests within service level agreements between CSPs and CSCs.

Make sure to come to an agreement about what changes are going to happen and when.

 

Change Management Baseline

Establish change management baselines for all relevant authorized changes on organization assets.

Make sure that the configurations meet acceptable standards and receive approval prior to the change. 

 

Detection of Baseline Deviation

Implement detection measures with proactive notification in case of changes deviating from the established baseline.

Make sure you know when those changes have varied from what you were expecting.

 

Exception Management

Implement a procedure for the management of exceptions, including emergencies, in the change and configuration process. Align the procedure with the requirements of GRC-04: Policy Exception Process.

There will always be things that happen outside your expectations. Make sure you have the ability to make sudden agile changes.

 

Change Restoration

Define and implement a process to proactively roll back changes to a previous known good state in case of errors or security concerns.

Make sure you know what happens if a change fails and you need to return it to the previous state.

 

The Shared Security Responsibility Model

The CCM Implementation Guidelines provide detailed recommendations for each CCM control. This ensures that both CSPs and CSCs can navigate and apply the controls effectively. 

The shared security responsibility model within the CCM clarifies who should do what between the CSP and CSC. The model is crucial for ensuring that both parties understand their role in securing cloud environments. This reduces the risk of security breaches caused by misunderstandings.

Typically, the CSP is in charge of the underlying infrastructure and operating systems, up to the application layer. CSCs usually design the application configuration and implementation. As outlined above, the CSP and CSC need to establish change management baselines and undertake risk assessments. The CSC needs to know about changes before they happen so that they don't adversely affect the business. 

There must be an authorized and suitably skilled change control board. Change approvers must have the policies, procedures, risk assessment, and baselines established prior to starting production. You also must be able to spot when those baselines go away from what you're expecting. This is exception management. 

The shared security responsibility model is a great way of taking assumption out of the equation. In many cases of unmanaged change, downtime assumption is the issue. Team members will say to each other "I thought you were doing it," so that in the end, nobody did it. This is what causes many attacks and where things frequently go wrong. 

 

Example

Take the scenario of hosting a child’s birthday party outside. Small children will be chaotically running around everywhere. Unfortunately, you have an uncovered swimming pool. This dangerous situation doesn't mean that you can't host the party - you just need balance.

In this case, you need to balance having fun and being cautious. First, you acknowledge the environment. You agree on how to get the job done and eliminate surprises. The CCM gives us two controls to help with that: change agreements and unauthorized change protection.

Then you need to proceed from a stable, trusted, reliable source and use the right tools at the child’s party. You will keep an eye on the environment, make sure the adults can trust one another.

One of the most important elements is that you need to react as quickly as possible if there is an issue. If a child falls into the swimming pool and can't swim, you quickly grab the child, you bring them to safety, and you regain control. 

The world of information technology should operate the same way. As soon as we notice there's deviation or exception, we manage it. We already have procedures that allow us to respond quickly. 

 

Wrapping Up

Both CSPs and CSCs need to be proactive. They can't assume that the other entity will have everything under control.

Make sure to clarify, communicate, and set up agreements. Make sure you understand who's responsible for which areas. Leverage the CCM controls and test your own environment and posture. Make sure you refine and improve.

And make sure to download and review the Cloud Controls Matrix and CCM Implementation Guidelines. Explore these free resources and begin to develop successful change management strategies for your organization.

Learn more about implementing CCM by checking out the other blogs in this ongoing series. Be on the lookout for the next installation that covers the fifth domain: Cryptography, Encryption, and Key Management.