Deploying systems in a secure state is important. However, it's also essential to ensure that systems retain that same level of security. Change management helps *reduce unanticipated outages caused by unauthorised changes*. The **primary goal** of change management is to ensure that *changes do not cause outages*. Change management processes ensure that appropriate personnel review and approve changes before implementation and ensure that personnel test and document the changes. Changes often create unintended side effects that can cause outages. For example, an administrator can change one system to resolve a problem but unknowingly cause a problem in other systems. >[!note] >Organizations constantly seek the **best balance between security and usability**. There are instances when an organization makes conscious decisions to improve the performance or usability of a system by weakening security. However, change management helps ensure that an organization takes the time to evaluate the risk of weakening security and compare it to the benefits of increased usability. Unauthorised changes directly affect the A in the CIA triad—availability. However, *change management processes allow various IT experts to review proposed changes* for unintended side effects before implementing the changes. These processes also give administrators time to check their work in controlled environments before implementing changes in production environments. Additionally, some changes can weaken or reduce security. Imagine an organization isn't using an effective access control model to grant access to users. Administrators may not be able to keep up with the requests for additional access. Frustrated administrators may decide to add a group of users to an Administrators group within the network. Users will now have all the access they need, improving their ability to use the network, and they will no longer bother the administrators with access requests. However, granting administrator access in this way directly violates the least privilege principle and significantly weakens security. ### [[Change Management Process and Controls]]