What is a change advisory board?
A change advisory board, or CAB, is the group in a change management process that reviews proposed changes above a set risk level and decides whether they go ahead. It weighs each change's business reason against its risk, checks that testing and a backout plan are ready, and makes sure the timing doesn't collide with other work or busy business periods. The CAB approves changes. It does not carry them out, and it doesn't own them.
Who sits on a CAB
A typical CAB is chaired by the change manager and includes representatives from infrastructure, networking, applications, security and the service desk, plus the business units that depend on the affected systems. Many organizations collect routine approvals in the ticketing system and meet on a set schedule, often weekly, only for the high-risk items.
Security's seat on the board exists to ask the same questions of every change. Does it open new ports or grant new access? Does it disable or weaken a control, even temporarily? Does it change what gets logged? Does it add new software or a new vendor? Does it move regulated data or change compliance scope?
What the CAB reviews and decides
For each request for change, the board looks at the impact analysis, the risk rating, the test results, the backout plan, the proposed maintenance window and any conflict with other scheduled changes. It has four outcomes: approve, approve with conditions, defer until more information arrives, or reject.
Here is a typical conditional approval. A vendor needs ongoing access to a storage array's management interface, and the request is a firewall rule allowing the vendor's support network to reach the array on TCP 443. The CAB approves on three conditions: the source is limited to the vendor's one address range, the vendor's accounts use MFA and their sessions are logged, and the rule is reviewed every 90 days.
Standard, normal and emergency changes
Approval scales with risk. Standard changes are low risk and pre-approved, so they don't go to the CAB. A low-risk normal change may need only the change manager or a peer reviewer, while a high-risk change, such as replacing the core firewall pair, goes to the full board. An emergency change, such as patching a flaw attackers are already exploiting, goes to an emergency CAB (ECAB): the few people needed to decide quickly. The documentation is completed afterward, but the approval still happens.
CAB vs. change owner, implementer and requester
The requester asks for a change. The change owner is accountable for it from request to closure, including the go or no-go call during the maintenance window. The implementer performs the technical steps. The CAB approves. Keeping approval separate from implementation is a form of separation of duties: an engineer who can write, approve and deploy their own firewall rules could also hide a malicious one, and auditors look for that gap.
Change advisory board on the CompTIA Security+ exam
The CAB is part of SY0-801 objective 1.2, the change management scenario objective. Expect it as the approval step: a request that arrives without test results or a backout plan should be deferred, and an urgent fix goes through emergency approval rather than skipping approval. A common distractor has the CAB implement the fix, which confuses approving with doing. Another names the CAB when a scenario shows nobody making a decision during a failed change, or nobody following up on a temporary rule; that points to a missing change owner. The CAB also appears in A+ Core 2 (220-1202) objective 4.2.