Which practices help minimize security risk during change management for a trusted agent?

• A. Implement changes without verification to speed response.
• B. Require formal approval, testing, and documentation of changes; maintain configuration baselines and audit trails.
• C. Avoid keeping baselines to save storage.
• D. Allow changes as long as users request them informally and no audit trails are kept.

Answer: (B)

Effective change management for trusted agents hinges on formal approval, thorough testing, and solid documentation of every change, along with keeping configuration baselines and audit trails. Formal approval ensures changes are authorized and assessed for security impact before they’re made. Testing helps catch security or compatibility issues in a controlled environment before deployment. Documentation creates a record of what was changed, why, and by whom, which supports accountability and future reviews. Maintaining configuration baselines provides a known-good reference to compare against and validate that changes haven’t drifted from a secure state, while audit trails offer traceability to detect and investigate any unauthorized or erroneous modifications. Together, these practices introduce checks, accountability, and traceability into the change process, minimizing risk.

Skipping verification, not maintaining baselines, or allowing informal requests with no audit trail all weaken security controls: changes can introduce vulnerabilities, drift can go unchecked, and there’s no clear record of who approved or implemented what.