Change control processes are designed to manage modifications to the production environment to minimize risk and service disruption. They apply to changes in hardware, software, and configurations. However, routine, low-risk, and frequently performed operational tasks, often categorized as "standard changes" or "service requests," are typically pre-approved and do not require individual review by a change advisory board (CAB). A user password reset falls into this category; it is a standard, proceduralized task handled by service desk or automated systems under Identity and Access Management (IAM) controls, not infrastructure change control.

A) Applying a critical security patch: This is an emergency change that, while expedited, must still be documented and follow a formal change control process.

B) Modifying a firewall rule: This directly alters the security posture and network configuration of the production environment and requires strict change control.

D) Deploying a new version of an application: This is a significant change to the production environment that carries inherent risk and must go through formal change control.

1. University of Washington, IT Connect. (n.d.). Change Management. Defines a "Standard Change" as a pre-authorized change that is low risk and follows a documented process, distinguishing it from normal or emergency changes that require CAB authorization. User password resets are a classic example of a standard change or service request.

2. The Shared Assessments Program. (2023). Standardized Information Gathering (SIG) Questionnaire. Domain H ("Change Management") focuses on controls for changes to applications, systems, and network components, not routine user access administration tasks.