Which of the following Change Control & Configuration Management production environment specific control should they implement in this scenario?

CCM: A hypothetical start-up company called "ABC" provides a cloud based IT management solution. They are growing rapidly and therefore need to put controls in place in order to manage any changes in their production environment.

Which of the following Change Control & Configuration Management production environment specific control should they implement in this scenario?
A . Policies and procedures shall be established for managing the risks associated with applying changes to business-critical or customer (tenant)-impacting (physical and virtual) applications and system-
system interface (API) designs and configurations, infrastructure network and systems components.
B. Policies and procedures shall be established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or
managed user end-point devices (e.g. issued workstations, laptops, and mobile devices) and IT infrastructure network and systems components.
C. All cloud-based services used by the company’s mobile devices or BYOD shall be pre-approved for usage and the storage of company business data.
D. None of the above

View Answer

Answer: A