ID.RA-07 says changes and exceptions are managed, assessed for risk impact, recorded, and tracked. For a small company that means two lists with owners: a record of significant changes and why they were approved, and a record of policy exceptions with an expiry date. If a change or an exception can happen without leaving a trace, the outcome is not met.
What good looks like
Production changes go through a lightweight review. Exceptions, such as a developer needing standing admin access or a system that cannot take MFA, are written down with the risk, the compensating control, and the date they will be reviewed.
NIST's examples ask for formal documentation, review, testing, and approval of changes and exceptions. They also ask you to document the risks of making or not making a change, and to provide rollback guidance. Accepted risks tied to future actions should be reviewed periodically.
How to implement it
- Use your existing pull request and ticket flow as the change record. Require a reviewer and a short risk note on changes to production, identity, or network settings.
- Keep an exceptions register with fields for requester, system, risk, compensating control, approver, and expiry.
- Make every exception expire. Renewal requires a fresh decision.
- Write a rollback line into any change that carries risk.
- Review open exceptions monthly and accepted risks quarterly.
Evidence to collect
- Sample change records with reviewer, risk note, and rollback plan
- The exceptions register with expiry dates
- Records of exception renewals or closures
Common gaps
- Exceptions granted in chat and never recorded
- No expiry, so temporary becomes permanent
- Emergency changes skip review and are never reviewed afterward
Quick check
Do we need a change advisory board?
Not for a small company. Peer review plus a recorded risk note for high impact changes is a reasonable starting point. Add formality as size and risk grow.
Sources
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 2024), Appendix A, CSF Core: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 landing page: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
The CSF is voluntary guidance. There is no CSF certification, so nothing here makes a company "CSF certified". You describe your own practices against the outcomes.
