# Does Cyber Crucible have a change management process?

**Short answer:** Yes. Production changes follow a documented change-management process with review, testing, and approval. Because the product operates at the kernel level, change discipline is treated as a security control rather than merely an engineering practice.

## What the process covers

Changes to application code, kernel drivers, server configurations, and supporting infrastructure move through defined lifecycle stages: security requirements are set at design; source is version-controlled and secrets are never embedded in cleartext; automated testing validates changes before promotion; and production changes receive formal review and approval. Segregation of duties is maintained, so the author of a change is not its sole approver. Server baselines follow approved configuration guides, and unused services are disabled where practical.

## Emergency and driver changes

Emergency changes use an expedited path that still requires authorization, targeted testing, and a post-implementation review. Windows kernel drivers undergo internal quality assurance and are submitted for Microsoft's Windows Hardware Compatibility Program (WHCP) certification before release — an independent, external check of the most privileged component.

## Framework alignment and the honest boundary

The process aligns to NIST SP 800-53 (CM family) and ISO/IEC 27001:2022 A.8.32. Cyber Crucible does not claim any certification. The detailed change-management procedure and supporting evidence are provided to reviewers under NDA.