Explain why a security plan is necessary and provide details of when the security plan ought to be updated and reviewed?

Explain why change management and change configuration are vitally important and how would these affect the security plan?

Please answer both questions in essay form, add in-text citation and references at the end