Mechanisms exist to include a cybersecurity and/or data privacy representative in the configuration change control review process.