Exam CISM topic 1 question 677 discussion

develop manager should not involve to operational environment.

C it is.

C - skip necessary checks can increase the risk of introducing vulnerabilities or unauthorized changes into the production environment.

Users are not notified of scheduled system changes is the change management procedure that is MOST likely to cause concern to the information security manager. When users are not notified of scheduled system changes, they may be caught off guard by the changes and may not be able to prepare for them. This can lead to disruption to business operations and can also increase the risk of security incidents. The development manager migrates programs into production: This is a normal part of the change management process. The development manager is responsible for developing and testing new programs and for migrating them into production once they have been tested and approved.

Option C

C. The development manager migrates programs into production.

In an effective change management process, there should be a clear separation of duties and responsibilities between development and production environments. Allowing the development manager to directly migrate programs into production can bypass necessary security controls, increase the risk of unauthorized changes, and potentially compromise the integrity and availability of the production environment. Hence Option C

A. Users are not notified of scheduled system changes.