14.8.1All changes to the hardware, software, applications, databases, configuration, etc. must be subject to the formal change control procedures;
14.8.2Changes to the application systems must be carried out only in accordance with approved change request process and subject to a formal risk assessment process; and
14.8.3All changes must be tested under all possible scenarios before adding them into production.