4.1.2. Life-cycle and Change Management

Life-cycle Management:

• EOL (End-of-Life): Product no longer sold
• EOS (End-of-Support): No more patches, updates, or vendor support
• Decommissioning: Secure retirement of old equipment (data wiping, physical destruction)

Software/Firmware Management:

• Security patches and bug fixes
• Operating system updates
• Firmware updates (device-specific embedded software)

Change Management Process:

1. Request: Document proposed change and business justification
2. Impact assessment: What might break? What's the rollback plan?
3. Approval: CAB (Change Advisory Board) or authorized approver
4. Implementation: During maintenance window with rollback prepared
5. Verification: Confirm change worked as expected
6. Documentation: Update diagrams, configs, procedures

Emergency Changes: When a change cannot wait for the normal CAB cycle—e.g., blocking an actively exploited zero-day—an expedited emergency process applies: authorization from designated approvers (or an emergency CAB), immediate implementation, documentation completed retroactively, and a post-implementation review. Bypassing change control altogether, even for a "minor" change, removes the review and rollback safety net.