Emergency change

A change whose urgency does not allow the usual route: a vulnerability being exploited, a fault taking down a service, an update released outside the cycle.

§97 of Directive 364 requires defined procedures for assessing, approving and promoting to production changes that cannot follow the regular change-management process, and requires naming the authorised approver.

What separates an emergency route from a bypass

An emergency route is still a route. It has a named approver — not "we called someone" — a record created as it happens, and a requirement to complete the documentation within a stated period afterwards.

The signal that it is not working is quantitative: when most changes go through as emergencies, what is broken is the normal process, not the emergency one.