Skip to main content
ISO/IEC 27001:2022 control 8.32 asks that changes to information processing facilities follow a change management process. Most organisations meet it with three kinds of change: standard changes that are pre-approved because they are low-risk and repeatable, normal changes that are approved one at a time, and emergency changes. Ankra records which kind each change is. When a change it makes to a cluster matches an entry in the standard-change catalogue below, the Audit Log entry is marked as a pre-approved standard change, with the catalogue entry and the reason it qualified. Every other change is a normal change, approved through your own process: a reviewed pull request on your GitOps repository, an approved AI plan, or a change ticket. Pre-approval is on for every organisation by default.

​
The standard-change catalogue

Each entry states what qualifies and how the change is reversed. A change that does not meet every part of the criteria is a normal change. Every change on this list writes an audit entry, including the ones Ankra makes on its own: those are recorded with the actor system and say what started them.

​
Security upgrades carry their reason

When you upgrade an add-on from a Security update available notice, Ankra looks up the advisories the new version fixes from its own advisory records. It does not rely on what the browser or CLI sent. The audit entry then names them, and so does the commit in your GitOps repository:
The repository history alone then answers why the change was made. An upgrade that fixes no recorded advisory, or that moves to a new major version, is recorded as a normal change.

​
Reading the audit trail

In a cluster’s Settings > Audit, an entry that qualified shows Pre-approved SC-01 (or the matching ID) beside its action. Hover over it to see the catalogue entry and why the change qualified, for example the versions and advisories of a security patch. The full record is in the entry’s details under change_classification:
The classification is decided when the entry is written, and catalogue_version names the catalogue it was decided against. A later change to the catalogue does not rewrite earlier entries. Entries without a classification are normal changes, or events that are not changes at all, such as sign-ins. Export the audit log to hand the record to an auditor.

​
Requiring approval for every change

If your change process does not allow pre-approved changes, an organisation admin can turn off Organisation settings > Security > Pre-approved standard changes. From then on, changes that match the catalogue are recorded as normal changes. Each entry still names the catalogue entry it matched, and its basis says your organisation requires approval. Turning the setting off or on is itself recorded in the audit log. Turning pre-approval off does not stop Ankra from making these changes. Autoscaling, power schedules and access expiry keep running as configured. If a change needs approval before it happens, make it through a reviewed pull request on your GitOps repository, or turn off the automation that makes it.