2.3.3. Documentation and Version Control

💡 First Principle: If a change isn't documented, it effectively didn't happen — at least for compliance, troubleshooting, and auditing purposes. Documentation turns tribal knowledge into organizational knowledge. When the only person who knows how the firewall rules are structured leaves the company, documentation is the difference between continuity and crisis.

Updating diagrams — network diagrams, architecture documents, and data flow maps must reflect the current environment. Outdated diagrams create security blind spots — you can't protect what you don't know exists. When a new subnet is added but the network diagram isn't updated, vulnerability scanners may miss it, firewall rules may not cover it, and incident responders won't know it's there. Diagrams should be treated as living documents updated with every significant change.

Updating policies/procedures — when systems change, governing policies must be updated too. A procedure referencing a decommissioned system creates false confidence. If your incident response plan says "isolate the system by disabling the port on switch X" but switch X was replaced six months ago, the procedure fails when it matters most. Policy reviews should be triggered by infrastructure changes, not just annual schedules.

Version control — tracks changes to documents, configurations, and code over time. It provides:

• Accountability — who changed what, when, and why (commit messages)
• Reversibility — roll back to any known-good state if a change causes problems
• Traceability — connect each change to its authorization (change ticket, approval)
• Audit trail — demonstrate compliance with change management policies

In security, version control on infrastructure-as-code templates enables detecting configuration drift — comparing the current state to the approved state. Version control on firewall rules tracks every modification and who authorized it. Version control on security policies provides evidence of governance for auditors.

⚠️ Exam Trap: Version control isn't just for developers. The exam tests it for security policies, network configurations, and infrastructure-as-code. Any question about tracking who changed a configuration and when points to version control.