change Access to alter the production environment is controlled, and access rights are only given to those people who are authorized to make changes. Prevents people who are not authorized to make a Change from having access to the production environment. Ensures that appropriate checks and balances are achieved. Decreases the risk of unauthorized Changes and potential disruption to the production environment All Changes require successful completion of testing before being implemented into the production environment when there is a test environment in place. At a minimum, validation in the production environment must occur when no test bed is available. Every change will have a test or validation plan in place. Ensures that any Changes are tested to being implemented into the production environment and any Emergency Change not tested prior to implementation requires risk analysis and approval. Reduces the likelihood for failed Changes and the subsequent cost to Customers for unplanned downtime. All Changes to the production environment will be made within agreed Change windows. Any exceptions will be agreed and communicated. To ensure that service downtime to implement changes is done during agreed and communicated timeframes. Reduces impact to the and allows them to plan their work according to communicated service outage windows. All changes that impact service capability will be assessed for performance and risk and resources needed to implement the Change. on the assessment, categorization will be used to identify the level of authorization required for a Change. To ensure that a Change is assigned a category. This will provide the information required to define the level of authorization. Provides increased customer availability and ensures proper authorization levels for changes Standard Changes must be implemented the accepted and established procedure. All Standard Changes will be recorded in the Change logging system.((add in glossary that budgetary approvals may still be required for standard changes)) Standard Change processes and associated Change workflows should be developed and communicated to ensure that such Changes are efficiently processed to support the organization’s business needs. Ensures efficient and prompt handling of Change requests. Improves customer service levels All Emergency Changes will be reviewed at the CAB in retrospect. Assessing the effectiveness of an Emergency Change. To ensure there is effective oversight and review of Emergency Changes and proper communication. Every Change will receive a post implementation review. All less than successful changes will receive a more Clarify the responsibility of the CAB to perform Post Implementation Review for Assures that all Changes are reviewed for learning opportunities they are
Reason For Change Link to any related prior or open RFC Perceived Impact (if change is made or not made) Output Change Record Metric Number of Change Records recorded per measurement period (e.g., weekly) compared to number of RFCs on file. Number of RFCs linked to prior RFCs 1.3 Examine The Change Record For Completeness Purpose To ensure that the Change Record is complete and practical. Requirement Statement When examining the Change Record, it is the responsibility of the Change Coordinator, Change Manager and Tier 1 to examine for completeness and practicality. Input Change Record Procedure or Work Instruction Steps Examine the Change Record for completeness and practicality Assure that it is in compliance with Standards and Requirements Remediate information in Change Record if required Update the Change Record Output Updated Change Record Metric D.1.4 Is the Change Request Rejected? Purpose Decide if the Change is practical determine if it should move forward. Decision Logic Yes – Go to 1.4 Inform Requester that Submission was Rejected No – Go to 1.3 Inform Requester that Submission was Accepted 1.5 Inform Requestor That Submission was Rejected Purpose To inform the Requestor that the RFC has been rejected. Requirement Statement When advising the Requestor of the outcome of their RFC, it is the responsibility of the Change Coordinator, Change Manager and Tier 1 to provide them with the required information. Input Change Record Procedure or Work Instruction Steps Contact the Requestor and inform them that their RFC has been rejected Note that an RFC will not be reopened. A new RFC must be submitted Update the Change Record Output Notification to Requestor Updated Change Record Metric Number of rejected RFCs 1.6 Inform Requestor That Submission was Accepted Purpose To inform the Requestor that the RFC has been accepted. Requirement When advising the Requestor of the outcome of their RFC, it is the responsibility of
Steps Output Change workflow and associated tasks, Implementation Plan, Testing Plan, Deployment Report Metric D.4.3 Is the Plan Acceptable? Purpose To ensure that the Plan produced for deploying the Change is acceptable. Decision Logic Yes – Go to Prepare for Build and Test Activities No – Return to Implementation Planning Activities D.4.4 Are Test Results Acceptable? Purpose To determine if the test results were acceptable. Decision Logic Yes – Go to 5.0 Deployment No – Return to and Test Activities 4.0 Build and Test Process RACI Matrix An authority matrix is a tool used to help understand which parties need to be involved in changes and their level of involvement. Process Activities Within Process 1 D.4.1 Does a workflow exist? A R R I I 4.2 Follow workflow A I I R R C C