cab-change-template.md

CAB Change Request Template (Sanitized)

Template Owner: Vulnerability Management / Change Management
Last Updated: 2026-02-28
Use Case: Production remediation requiring CAB review/approval

---

1. Change Summary

• Change Title: [Example: Disable legacy TLS protocols on Windows servers]
• Change Type: [Standard / Normal / Emergency]
• Requested By: [Name / Team]
• Systems / Scope: [Asset group / environment]
• Planned Window: [Date + start/end time]
• Customer Impact: [None / Low / Medium / High] (explain)

2. Business Justification

• Security Driver: [Critical/High vulnerability, compliance, known exploitation, etc.]
• Risk if Not Implemented: [short statement]

3. Implementation Plan

3.1 Pre-change

• Confirm backups / snapshots (if applicable)
• Confirm maintenance window + comms sent
• Confirm access and tooling (scripts, credentials, admin approvals)

3.2 Change Steps

1. [Step 1…]
2. [Step 2…]
3. [Step 3…]

3.3 Validation Steps

• Service health checks (apps, ports, auth flows)
• Confirm system configuration changed as intended
• Run follow-up vulnerability scan / targeted validation

4. Rollback Plan

• Rollback Trigger: [What condition triggers rollback?]
• Rollback Steps:

1. [Rollback step…]
2. [Rollback step…]

• Post-rollback Validation: [How do we confirm restoration?]

5. Risk Assessment

• Likelihood of Impact: [Low/Medium/High]
• Blast Radius: [Single host / host group / service]
• Mitigations: [staging, canary rollout, monitoring, etc.]

6. Approvals

• Change Manager
• Service Owner
• Security / Vulnerability Management
• CAB Decision: Approved / Rejected / Deferred

7. Post-Implementation Notes

• Outcome: [Success / Partial / Failed]
• Issues Observed: [details]
• Evidence Attached: [links to sanitized logs/screenshots/scan proof]
• Rescan Result: [resolved / remaining findings / next steps]

---