Do you have a change control process in place?

Yes.

Change management is an essential part of our Software Development Lifecycle and Operation Procedures. It is implemented on various levels:

Planning

Functional changes and product improvements are being explicitly planned as part of the iterative development cycle. Changes are reviewed and approved by Senior Product and Engineering Management.

Design

Key architecture and functional changes require review by the Architecture Committee, which ensures that security and reliability are not impacted and that there is no disruption to customers.

Implementation

Code changes, excluding trivial ones, require mandatory peer code review.

Delivery

The staged delivery process (with development, integration, staging, and production steps and environments) includes a set of validation steps:

• Manual validation for functional validness and completeness
• Automated validation for regression testing (including unit, functional, and end-to-end tests)
• Dynamic Application Security Testing (DAST)

Operation

The Operation Team follows the common protocols of Change Management, similar to the Engineering Team. Infrastructure and configuration changes are described by the code and follow all the planning, review, and staging approaches above.

Incident handling is organized as an explicit and managed process, with documentation, reporting, and postmortem flows.

The policies above are implemented by tightly integrated version control, CI/CD platform, monitoring, and task tracking systems.