How should change management processes be evaluated for cybersecurity relevance?

• A. Approvals optional
• B. Production changes only
• C. Governance over changes, with approvals, testing, backout plans, separation of duties, and documentation of emergency changes
• D. Change log completeness only

Answer: (C)