Changes on project-managed applications or database should undergo the change control process as documented.

Changes on project-managed applications or database should undergo the change control process as documented.
A . True
B . False

Answer: A

Explanation:

Changes on project-managed applications or database should undergo the change control process as documented, because this is a requirement of ISO/IEC 27001:2022 clause 12.1.2, which states that “the organization shall define and apply a change management process for changes to systems and applications within the scope of the information security management system”. The change management process should ensure that changes are recorded, assessed, authorized, prioritized, planned, tested, implemented, documented and reviewed in a controlled manner.

Reference: [CQI & IRCA Certified ISO/IEC 27001:2022 Lead Auditor Training Course], [ISO/IEC 27001:2022 Information technology ― Security techniques ― Information security management systems ― Requirements]