What is the focus of the testing requirement associated with change control procedures (6.4.5.3)?

• A. Back-out testing only
• B. Functionality testing to verify that the change does not adversely impact the security of the system
• C. Testing is optional for minor changes
• D. No testing requirement

Answer: (B)

Testing of changes that affect security controls focuses on validating that the change does not compromise security. After implementing a modification, you need to perform functional testing to confirm the change doesn’t introduce new vulnerabilities, weaken access controls, or disrupt security monitoring and logging. The goal is to ensure the security posture remains intact and that the change behaves safely in the live environment, not just that the system still operates.

Back-out testing alone is insufficient because it doesn’t demonstrate that the change itself preserves security properties. Saying testing is optional for minor changes or that there’s no testing requirement would ignore the need to verify security implications of any modification to security-relevant components.