Free policy template SOC 2

Change Management Policy

How changes to code and infrastructure are proposed, reviewed, tested, and approved, one of the controls SOC 2 probes hardest.

Download the Markdown

Free and ungated, no email required. The full template is below and in the download. Authored in Keel's own words and mapped to SOC 2 by clause; replace the {{PLACEHOLDER}} tokens with your details.

How to use it

  1. Download the template. Grab the Markdown file, or copy the full text from this page.
  2. Fill in the placeholders. Replace every {{PLACEHOLDER}} token (company name, owner, approver, dates, version) with your details.
  3. Tailor it to how you operate. Adjust the statements so they describe what your organization actually does. A policy you do not follow is worse than none.
  4. Approve and publish. Have an accountable owner approve it, set an effective date and a review date, and share it where staff can find it.
  5. Keep it current. Review on the schedule you set (or when things change), and keep evidence that it is followed. In Keel this is tracked for you.

Related

Change Management Policy

Organization: {{COMPANY_LEGAL_NAME}} Document owner: {{POLICY_OWNER_ROLE}} Approved by: {{APPROVER_NAME}}, {{APPROVER_TITLE}} Version: {{VERSION}} · Effective: {{EFFECTIVE_DATE}} · Next review: {{REVIEW_DATE}} Classification: Internal


1. Purpose

This policy exists so that {{COMPANY_LEGAL_NAME}} ships code, infrastructure, and configuration changes safely and predictably. Disciplined change control protects {{DATA_TYPES}} in the workloads running on {{CRITICAL_SYSTEMS}} and keeps services stable for users across {{GEO_SCOPE}}.

2. Scope

The policy covers production systems, customer-facing services, shared libraries, and core infrastructure that run in {{CRITICAL_SYSTEMS}} or that can affect access to {{DATA_TYPES}}. It applies to the {{LOCATION}} workforce working from managed {{DEVICE_TYPES}}.

3. Policy statements

3.1 Change request and approval

Every change starts with a ticket that describes its scope, its risk, and a rollback plan. A peer review or manager approval is required before merge or deployment, commits and pipelines are linked back to the ticket, and ad-hoc changes directly in {{CRITICAL_SYSTEMS}} are not allowed. We record the approver, the date and time, and the supporting artifacts such as diffs and test results.

3.2 Testing and impact review

Changes are validated with unit and integration tests or a staging deployment wherever feasible. We assess the security impact of each change and add security tests for higher-risk work, especially anything that touches {{DATA_TYPES}} or {{CRITICAL_SYSTEMS}}. Test results and sign-offs are retained, and a release is blocked when tests fail.

3.3 Release scheduling and communication

Non-urgent releases are scheduled during low-traffic windows for users in {{GEO_SCOPE}}, and stakeholders receive at least 24 hours' notice of any expected downtime. We keep a release calendar with approved change windows.

3.4 Emergency changes

Emergency changes are permitted only to restore service or to fix a critical security flaw. They are flagged as emergencies, linked to the relevant incident, and documented retrospectively within 24 hours so they can be picked up at the next review.

3.5 Post-implementation review

After a change we confirm the success metrics and error budgets held, and we capture lessons learned in release notes or a short retrospective. Outcomes and action items are attached to the change record and tracked to completion.

3.6 Measuring compliance

Every production commit should have a linked, approved ticket, and we track and review the failed-change rate. For teams larger than {{EMPLOYEE_COUNT}} we widen sampling and add random checks of releases into {{CRITICAL_SYSTEMS}}.

3.7 Continual improvement

We analyse change-failure trends each quarter and refine our pipeline and testing approach, taking {{INDUSTRY}} needs and obligations affecting {{GEO_SCOPE}} into account.

4. Roles and responsibilities

Role Responsibility
Executive sponsor Accountable for the program; approves this policy
{{POLICY_OWNER_ROLE}} Maintains this policy and its procedures
Managers Enforce the policy within their teams
All personnel Comply; report issues promptly

5. Compliance and exceptions

Non-compliance may result in disciplinary action, and an unauthorised change triggers a rollback and disciplinary review. Exceptions follow the emergency-change path only and require documented risk acceptance by {{APPROVER_TITLE}}; they are time-limited and reviewed.

6. Review

This policy is reviewed at least annually and when significant change occurs.


Aligned to AICPA SOC 2 (Trust Services Criteria). {{COMPANY_LEGAL_NAME}} is not affiliated with or endorsed by the relevant standards body; full standard text is copyrighted and is not reproduced here.

This template is authored by Keel in its own words. Clause references to SOC 2 are factual identifiers; Keel is not affiliated with or endorsed by the standards bodies named. It is a starting point, not legal advice, review and adapt it for your organization.

Manage this policy in Keel

Keel ships this template in-product, fills the placeholders, maps it to your controls, and tracks approvals and reviews, so the policy stays live evidence, not a file in a drive. Start free.

Start free Browse all templates