GRCLibrary.ai

Procedure

OT Change Management Procedure

This procedure defines change management for Operational Technology (OT) environments. It extends the general change management and configuration control procedure (operations/procedure-change-management-and-configuration-control.md) with OT-specific requirements: extended change windows aligned with production-maintenance schedules, mandatory vendor coordination for vendor-controlled systems, regression testing for safety-critical functions, and integration with safety-management of change (MOC) under IEC 61511 where the change affects Safety Instrumented Systems.

Type
Procedure
Version
1.0.8
Date
2026-10-04
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Operations: Operational Technology
Review frequency
Annual and following any material OT change-induced incident or change to IEC 62443 / IEC 61511 / NIST SP 800-82
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Roles
  • 4. Guiding principles
  • 5. Change categories
  • 6. Change request
  • 7. Risk assessment
  • 8. Testing
  • 9. Approval
  • 10. Implementation
  • 11. Verification
  • 12. Backout
  • 13. Documentation and audit trail
  • 14. Metrics
  • 15. Framework alignment

Frameworks it maps to

Related documents