Compliance 101: Change Control

A defined change management process will go a long way in ensuring that your company’s security environment addresses risk and is compliant in the long run.

Home » Industry Insights » Compliance 101: Change Control

Compliance 101: Change Control by Linda Nelson, Business Success Director

Understanding Change Controls

Change Control is a term describing the process of managing how changes are introduced into a controlled system. Having a defined change management process firmly in place will go a long way in making sure that your company’s security environment addresses risk and is compliant in the long run. Change control typically consists of at least the following five distinct phases:

Plan/Scope what prospective change(s) are to be made. This stage should outline (document) what change(s) are required, who will make the change, how the change will occur, when it will be made and how success will be verified.
Assess/Analyze what effects will the change(s) have. Risk assessment is a very important stage as making a change can potentially have a significant impact. All related areas should be accounted for.
Review/Approval of an approval process is usually required in any change control model. The impact of the change is considered in the context of the business and the appropriate ‘owner’ either rejects or authorizes the change(s).
Build/Test those responsible for actioning the change(s) should execute the change in a controlled manner (or environment) where it can be validated to ensure that the defined requirements are met and that no unforeseen issues occur. Implement the change(s) and the relevant stakeholder(s) review the desired outcome results.

When it comes to your security environment, these steps often include:

Approving changes before they are made.
Retaining documentation of approvals, including steps that involve self-monitoring and regular auditing of changes.
Preventative controls to ensure that planned security changes are tested for the creation of SoD conflicts or unacceptable critical access BEFORE access is granted.

ALLOut Tip

The reporting used for critical access and user reviews touched on in previous articles (learn more here) can support the monitoring and auditing steps required to identify risk and non-compliance. Security change reports can be used to put monitoring controls in place so as to ensure adherence to policies around access approvals. Additionally, using ALLOut tools to automate change control steps and manage information within our JDE system can reduce risk and simplify audits.

Cookie name	Default expiration time	Description
_ga	2 years	Used to distinguish users.
_gid	24 hours	Used to distinguish users.
_ga_<container-id>	2 years	Used to persist session state.
_gac_gb_<container-id>	90 days	Contains campaign related information. If you have linked your Google Analytics and Google Ads accounts, Google Ads website conversion tags will read this cookie unless you opt-out. Learn more.

visitor_id<accountid>	The visitor cookie includes a unique visitor ID and the unique identifier for your account. For example, the cookie name visitor_id12345 stores the visitor ID 1010101010. The account identifier, 12345, makes sure that the visitor is tracked on the correct Pardot account. The visitor value is the visitor_id in your Pardot account. This cookie is set for visitors by the Pardot tracking code.
pi_opt_in<accountid>	If Tracking Opt-in preferences is enabled, the pi_opt_in cookie is set with a `true` or `false` value when the visitor opts in or out of tracking. If a visitor opts in, the value is set to `true`, and the visitor is cookied and tracked. If the visitor opts out or ignores the opt-in banner, the opt-in cookie value is set to `false`. The visitor cookie is disabled, and the visitor is not tracked.
visitor_id<accountid>-hash	The visitor hash cookie contains the account ID and stores a unique hash. For example, the cookie name visitor_id12345-hash stores the hash “855c3697d9979e78ac404c4ba2c66533”, and the account ID is 12345. This cookie is a security measure to make sure that a malicious user can’t fake a visitor from Pardot and access corresponding prospect information.
lpv<accountid>	This LPV cookie is set to keep Pardot from tracking multiple page views on a single asset over a 30-minute session. For example, if a visitor reloads a landing page several times over a 30-minute period, this cookie keeps each reload from being tracked as a page view.
pardot	A session cookie named pardot is set in your browser while you’re logged in to Pardot as a user or when a visitor accesses a form, landing page, or page with Pardot tracking code. The cookie denotes an active session and isn’t used for tracking.

Cookie name	Default expiration time	Description
_ga	2 years	Used to distinguish users.
_gid	24 hours	Used to distinguish users.
_ga_<container-id>	2 years	Used to persist session state.
_gac_gb_<container-id>	90 days	Contains campaign related information. If you have linked your Google Analytics and Google Ads accounts, Google Ads website conversion tags will read this cookie unless you opt-out. Learn more.

visitor_id<accountid>	The visitor cookie includes a unique visitor ID and the unique identifier for your account. For example, the cookie name visitor_id12345 stores the visitor ID 1010101010. The account identifier, 12345, makes sure that the visitor is tracked on the correct Pardot account. The visitor value is the visitor_id in your Pardot account. This cookie is set for visitors by the Pardot tracking code.
pi_opt_in<accountid>	If Tracking Opt-in preferences is enabled, the pi_opt_in cookie is set with a `true` or `false` value when the visitor opts in or out of tracking. If a visitor opts in, the value is set to `true`, and the visitor is cookied and tracked. If the visitor opts out or ignores the opt-in banner, the opt-in cookie value is set to `false`. The visitor cookie is disabled, and the visitor is not tracked.
visitor_id<accountid>-hash	The visitor hash cookie contains the account ID and stores a unique hash. For example, the cookie name visitor_id12345-hash stores the hash “855c3697d9979e78ac404c4ba2c66533”, and the account ID is 12345. This cookie is a security measure to make sure that a malicious user can’t fake a visitor from Pardot and access corresponding prospect information.
lpv<accountid>	This LPV cookie is set to keep Pardot from tracking multiple page views on a single asset over a 30-minute session. For example, if a visitor reloads a landing page several times over a 30-minute period, this cookie keeps each reload from being tracked as a page view.
pardot	A session cookie named pardot is set in your browser while you’re logged in to Pardot as a user or when a visitor accesses a form, landing page, or page with Pardot tracking code. The cookie denotes an active session and isn’t used for tracking.