Change management

Answer: Not necessarily. If the change is not in response to a demand from a system development process, it would be more proper to consider it under the control "A.12.1.2 Change management". For example, if a new version of an information system requires operational system upgrade, you can consider this change under the control A.14.2.2. On the other hand, if the server updated is related to a periodic release from the manufacturer, which has no impact on the systems installed in the server, then you should consider this change under control A.12.1.2.

This articles will provide you further explanation about change management:
- How to integrate ISO 27001 A.14 controls into the system/software development life cycle (SDLC) https://advisera.com/27001academy/how-to-integrate-iso-27001-controls-into-the-system-software-development-life-cycle-sdlc/
- How to manage changes in an ISMS according to ISO 27001 A.12.1.2 h ttps://advisera.com/27001academy/blog/2015/09/14/how-to-manage-changes-in-an-isms-according-to-iso-27001-a-12-1-2/

These materials will also help you regarding change management:
- Book Secure & Simple: A Small-Business Guide to Implementing ISO 27001 On Your Own https://advisera.com/books/secure-and-simple-a-small-business-guide-to-implementing-iso-27001-on-your-own/
- Free online training ISO 27001 Foundations Course https://advisera.com/training/iso-27001-foundations-course/