Time to Contain

Change freeze

A change freeze is a period when changes to production are held, such as a quarter close or a major sale. A response platform needs a way to pause or restrict automated actions during one, or to require approval. A freeze that automation ignores defeats its purpose.

Definition

Ask whether rules and playbooks can be scheduled, expired or paused, and whether a freeze can raise the approval tier instead of stopping everything.

Time-limited rules are a related control: an exception that expires on its own cannot be forgotten.

Change freeze in Microsoft Sentinel's documentation

Microsoft Sentinel's documentation describes automation rules with an order number and an expiry date, so a rule can lapse on its own, which is a time limit though not a freeze calendar. vendor claim learn.microsoft.com, read

The example names a vendor and its own page. A vendor's use of Change freeze may differ from the definition above; the rubric uses the definition on this page.