Which principle does NIST say change management must address so that changes reach production only after being tested and approved?

Answer: B. Separation of duties

SP 800-100 states organisations must ensure management is aware of proposed changes, verify a thorough review and approval process is in place, and that separation of duties must be addressed to ensure changes are implemented only after being tested and approved.

Source: NIST SP 800-100 (NIST) — Sec. 14.2 CM Roles and Responsibilities