Which of the following best describes a typical risk mitigated by change management in security operations?

• A. Unapproved changes causing outages.
• B. Changes that increase risk.
• C. Untracked hardware purchases.
• D. Standardizes approvals, testing, and rollback procedures to minimize risk to security controls and outages.

Answer: (D)

Change management in security operations is about controlling how changes are requested, approved, tested, and rolled back so they don’t introduce new weaknesses or cause outages. The key is establishing a repeatable, auditable process that reduces risk to security controls and system availability. By requiring formal approvals, thorough testing, and clear rollback plans, you can catch issues before they impact security posture and recover quickly if something goes wrong. This is why standardized approvals, testing, and rollback procedures to minimize risk to security controls and outages best describe the mitigated risk.

Unapproved changes and lack of tracking point to problems change management aims to prevent, but they don’t describe the protective process itself.