ISC Change Management · Updated November 2026
Why Should Developers Not Move Their Own Code Into Production?
Controlled change management separates creating, testing, approving, and deploying changes.
Development environment
Changes are created or configured in development rather than directly in the live system.
Testing environment
Changes are tested for functionality, security, regression effects, and user acceptance before production.
Approval
Appropriate management or system owners approve changes before deployment.
Production
Production is the live environment, so access to modify it should be restricted.
Emergency changes
Emergency changes may use accelerated procedures but still require appropriate documentation, review, and follow-up approval.
The takeaway
One person should not freely create, approve, test, and deploy the same production change.
Related Summit guides
FAQ
Why separate development and production?
To reduce unauthorized or untested changes.
Do emergency changes need controls?
Yes.
Is user acceptance testing the same as developer testing?
No.