Information Services

Divisional Change Management Policy

In effect: January 1, 2018

Scope of Change Management

Change Management refers to a formal process for making changes to IT systems. The goal of

● Planning: Plan the change, including the implementation design, schedule,

communication plan, test plan, and roll back plan.

● Evaluation: Evaluate the change, including determining the risk based in priority level of

service and the nature of the proposed change, determining the change type and the

change process to use.

● Review: Review change plan with peers and/or Change Advisory Board as appropriate

to the change type.

● Approval: Obtain approval of change by management or other appropriate change

authority as determined by change type.

● Communication: Communicate about changes with the appropriate parties (targeted or

This divisional policy applies to all changes to architectures, tools and IT Services provided by

OSU Information Services. Modifications made to non-production systems (such as testing

environments with no impact on production IT Services) are outside the scope of this policy.

Policy

All Changes to IT services must follow a structured process to ensure appropriate planning and

execution.

Minimum Standards

1. All Changes must follow a process of planning, evaluation, review, approval, and

documentation. See “Appendix D – Process Examples” for default approaches.

2. Unit Directors serve as default Change Authorities (CA) for changes within their units

and have the authority to determine change type and risk level. If in doubt, a higher level

of risk should be assumed and additional review and approval should be sought.

3. All Standard Changes must have documented procedures in place that have been

approved by the Unit Director or delegate.

an Incident according to the Incident Response Policy.

8. Documentation of Normal Medium, Normal High, and Emergency Changes must be

made in a Process log that is stored in a common location so that coordination of

changes across the organization can be managed appropriately. Low risk Normal and

Standard Changes must be logged in a manner that can be audited for process

improvement and root cause diagnosis as part of Problem Management.

9. All changes are elevated one Change Type priority level during Critical Operations

Windows (see definitions).

Appendix A – Types of Changes and Definitions

Types of Changes

2. Normal Change – A change that is not an Emergency change or a Standard change.

Normal changes follow the defined steps of the change management process. Low,

Medium, or High priority is determined by Unit Directors or delegates according to the

Risk Assessment Instrument included as Appendix B.

a. Normal Low Changes must be reviewed and approved by the Unit Director or

delegate as Change Authority.

b. Normal Medium Changes must be reviewed and approved by the Change

Advisory Board as Change Authority.

c. Normal High changes must be approved by the IT Executive Team as Change

Authority.

Definitions

Definitions adapted from Information Technology Infrastructure Library (ITIL). See

http://en.wikipedia.org/wiki/Information_Technology_Infrastructure_Library.

Change - The addition, modification or removal of approved, supported or baselined hardware,

network, software, application, environment, system, or associated documentation.

Change Advisory Board - A group of people that support the assessment, prioritization,

authorization, and scheduling of changes.

the change.

Change History - Auditable information that records, for example, what was done, when it was

done, by whom and why.

Change Log - Auditable log of who, what, why, and when for all changes. This may be system

specific as certain systems have the ability to automatically log changes in this manner.

Change Management - Process of controlling changes to the infrastructure or any aspect of

services, in a controlled manner, enabling approved changes with minimum disruption.

Core Service - A service that users directly consume and the organization receives value from.

Critical Operations Windows – Finals week starting on the Monday of that week for each

quarter, first two days of classes for each quarter, graduation weekend starting on the Friday of

Impact - Determined by potential disruption to users, departments, colleges and the

organization as a whole. User means approximately 10 or less individuals.

Peer - Another IT professional that can review a change and understand the technical elements

involved.

Process Log - A central repository of Changes that documents the process followed for a

particular change. The purpose of the process log is to ensure that high impact changes have

been carefully considered and to serve as a basis for process improvement when changes do

not go as planned.

Urgency – How quickly a change must be implemented to maintain stated service level

agreement (SLA). Low can wait until the next scheduled CAB meeting, Medium cannot, and

High needs to be done ASAP.

Appendix B - Risk Assessment

Risk and Change Type Matrix for Normal and Emergency Changes

How to use this matrix:

standardized process)

For example: A High Urgency change to a service that would impact the organization would be

considered an Emergency Change. A Medium Urgency change to a service that would impact a

department would be a Normal Medium change. A Low Urgency change to a service that would

impact Users would be a Normal Low change.

Low Urgency

Med Urgency

Impact - Organization

Normal Medium

Normal High

Appendix C - Change Management Roles

• Normal Medium, Normal High, and Emergency changes are logged in the Process Log

• The Process Log contains

o Test Plan and testing results

o Risk assessment documentation

o Communication Plan