u/Lrrr81

So here's an interesting question... the scope of your "Change management process"... is it only information systems or does it apply to other things?

I want to keep ours limited to the information system, as that's what it seems like CMMC requires and others are doing. My boss thinks it should extend to physical security (of facilities, not the info system), and documentation.