Change management records

Detects change management records: change request/CAB wording with populated change fields (owner, CI, planned window, risk, approval) and change artefacts. Topic wording alone is discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the topic phrase alone is discovery-only; enforcement needs populated structure (a populated change field (change number, requester/owner/implementer, assignment group, CI/affected service, planned start/end, risk, approval) or a change artefact (ServiceNow CHG number, timestamp, internal hostname, IPv4)), and 85 needs two distinct structures plus independent change-control (implementation/backout/test plan, PIR, outage) evidence, so policies, blank forms and training text stay below 75.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Security of Critical Infrastructure Act 2018 (Cth)
Frameworks: ISO 27001, NIST CSF
Data categories: security
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:change\s+(?:request|record|ticket)|request\s+for\s+change|change\s+advisory\s+board|CAB\s+(?:approval|minutes|agenda)|emergency\s+change|normal\s+change|standard\s+change)\b

Corroborative evidence keywords

implementation plan, backout plan, rollback plan, test plan, post-implementation review, outage required, downtime, approved, peer review, business justification

Proximity: 300 characters

Should match

Raise a change request before touching the production firewall. — Discovery probe (65)
Change request Change number: CHG0031542 Change owner: J. Staffson — Medium-tier probe (75) - populated change fields
Normal change - certificate rotation Change number: CHG0031542 Configuration item: lb01.harbour.internal Planned start: 2026-09-12 06:30 Risk: Moderate Approval status: Approved by CAB Implementation plan attached; backout plan: restore previous certificate; outage required 10 minutes. — High-tier probe (85) - several change fields, artefacts and change-control context

Should not match

unrelated generic text — No relevant phrase context
placeholder value 12345 — Random text should not match
Policy statement: every normal change requires CAB approval and a backout plan. — Policy text
Change request template Change number: ________ Planned start: [insert] — Blank template
Course module 2: a request for change moves from assessment to CAB approval. — Training framing

Known false positives

ITIL training and change policies. Mitigation: Guidance/training framing is excluded; values must be populated.