Changes to administrator access are typically not subject to the traditional change control process, as they often pertain to user access management rather than modifications to the production environment's infrastructure or applications. Administrator access changes involve granting, altering, or revoking administrative privileges to systems, which is managed through access control policies and procedures rather than through change control. Change control processes are primarily concerned with changes to the network, systems, and applications that could affect the production environment's stability, security, and functionality.
In contrast, managing administrative access is part of identity and access management (IAM), which focuses on ensuring that only authorized individuals have access to specific levels of information and system functionality.
References:
* Access control and identity management best practices, such as those outlined in NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems and Organizations), emphasize the separation of duties and least privilege principles, which guide the management of administrator access changes.
* Resources like "Access Control Systems and Methodology" from ISC's CISSP Common Body of Knowledge provide guidelines on effectively managing access to prevent unauthorized access and maintain system security.