Changes and testing. Except in emergencies, avoid changing Critical Systems without first planning, testing, and documenting the change, unless the change is routine (e.g. adding a user, changing a password, updating inventory and prices). For major systemic changes or those which can impact the security or availability of your Critical Systems, planned changes should be escalated for approval by high-ranking managers other than the planners of those changes. Implement planned changes in your production systems only after they have been thoroughly tested in a non production environment. Conduct all such testing under the supervision of the your risk management department or others in your company with particular responsibility for its losses.
Changes and testing. Except in emergencies, avoid changing Critical Systems without first planning, testing, and documenting the change,
