Know before you go to the Change Advisory Board

March 8, 2018

To lower the risk caused by changes into our environment, the Change Advisory Board (CAB) is asking Service Owners and those introducing changes to answer a standard set of questions about their change. The goal for our change management process is to find the right balance between expediency and risk.

  1. Has the change been tested and approved in a non-prod environment?
  2. Is the change scheduled during an agreed to maintenance window for the impacted Service?
  3. Is there a backout / mitigation plan in place in case the change is not successful?
  4. Are all participants of the Change process engaged and ready to deploy on the given day/time?
    1. Consider all involved party’s, including ITS staff, functional staff, vendors, etc.
  5. Are post-deployment plans in place to address potential issues as a result of the change?
    1. Knowledge Base articles
    2. Communications and escalation plans
    3. Monitoring
  6. Are communication plans in place to:
    1. Make impacted party’s aware of the change?
    2. Communicate to impacted party’s if the change is not successful?
    3. To communicate with involved party’s during the course of the change?
  7. What CI’s are impacted as a result of this change?
  8. What is the impact of this change on:
    1. Users?
    2. Downstream systems?
    3. The environment?
  9. Have the appropriate security checks been performed:
    1. If new application or a major change to an existing application, has there been an SDR?
    2. If Web Application or Hardware/OS, have the appropriate security scans taken place?
  10. If there is a modification that affects the DR Plan, has it been updated appropriately and tested?
  11. Administration:
    1. If this is a rolling plan change ticket, is the schedule attached to the ticket?
    2. Are configuration items identified in the Change ticket?
    3. Do you feel the calculated level of risk is correct? If no, request for an exception to be made
    4. If there will be an outage, it should be documented within the Change Plan. If it is not, you will be asked during CAB to update the documentation.

If you have questions, concerns, or suggestions for improving the change management processes, please reach out to a CAB representative.