Page History

...

1. Change - The addition, modification or removal of approved, supported or base lined hardware, network, software, application, environment, system, desktop build or associated documentation of the production IT environment.
2. Production IT environment - system components used to provide information technology (IT) service to employees, faculty, patients, students, including but not limited to: server hardware and associated operating systems, virtual servers, software applications, virtual applications, networks, data storage, air-conditioning, power supply, server rooms, datacenters, networks, and workstations that are part of the University Environment. This includes IT environments managed by IRT, departments, colleges, and vendors.

V. REFERENCES

1. Change Management Procedures for IRT

VI. POLICY

1. General Principles:
   Change management refers to a formal process for making changes to IT services. The goal of change management is to increase awareness and understanding of proposed changes across an organization and ensure that all changes are made in a thoughtful way that minimizes negative impact to services and customers. Change management generally includes the following steps:
1. Planning: Plan the change, including the implementation design, scheduling, communication plan, testing plan and roll-back plan.
2. Evaluation: Evaluate the change, including determining the priority level of the service and the risk of the proposed change; determine the change type and the change process to use.
3. Review: Review Change Plan with peers and/or Change Advisory Board as appropriate to the change type.
4. Approval: Obtain approval of the Change Plan by management as needed.
5. Communication: Communicate about changes with the appropriate parties.
6. Implementation: Implement the change.
7. Documentation: Document the change and any review and approval information.
8. Post-change review (if necessary): Review the change with an eye to future improvement
   1. All changes to IT services must follow a standard process to ensure appropriate planning and execution
   2. Changes are categorized into four categories, each with different approval and notification requirements that are outlined in the Change Classification Matrix (Appendix A). In addition, all changes are assigned a priority based on the Change Priority definitions (Appendix B). 
   3. It is the responsibility of the CIO, Dean, and/or Vice President of the business unit or college to ensure that all areas under their direction have documented processes that meet minimum standards, are reviewed annually, and are communicated to staff. The CIO, Dean, and/or Vice President serves as Change Manager by default and is ultimately responsible for ensuring that changes are made in a manner appropriate to their impact on university operations.
2. Minimum Standards:
1. All changes must follow a process of planning, evaluation, review, approval, and documentation as referenced in the Change Management Procedure for IRT.
2. All changes deemed Normal Major must be presented to a Change Advisory Board (CAB) for input and advice (See Section D – Roles & Responsibilities"). Should a Change Manger (or designee) decide to act contrary to advice from the CAB, a written explanation must be submitted to the CAB and the Vice Provost for Information Services. In addition, before a change can be deemed a Standard Charge it must be presented to the CAB for input and advice.
3. All changes deemed Emergency must be presented to a Change Advisory Board (CAB) for input and advice unless time constraints require that changes be made prior to submission. In these cases, verbal approval must be given by the Change Manager. Submission to the Change Advisory Board for review must be done by the next scheduled meeting.
4. Documentation of all changes must be made in a Change Log that is stored in a common location so that coordination of changes across the organization can be managed appropriately
3.  Security Review and Approval:
1. In addition to the requirements above, all security changes must be reviewed and approved by the Information Security Office (ISO).
2. All firewall, ACL, and GPO changes must include a business justification for each change item

4. Roles & Responsibilities:

   Roles	Description/Responsibilities
   Change Advisory Board (CAB)	The Change Advisory Board is a group called together by the Change Coordinator to act in an advisory capacity to the Change Manager to all changes that are categorized as major or emergency (after triage). They also authorize changes as Standard Changes, if the qualifications are met. The CAB is made up or individuals within or outside IT who are relevant in the making the decisions on whether a change should be authorized. They are called together as required in order to ensure that changes are progress in a prompt and efficient manner.
   Change Advisory Board Members	• Review the list of scheduled changes• Attend a weekly meeting either in-person, by video or telephone conference.• Prepare for the weekly meeting by inviting representatives from business or user groups, technical support staff and vendors as necessary to resolve potential conflicts.• At the meeting, affirm acceptance of planned changes on behalf of the Department or state potential conflicts and work to resolve them. Stated positions will be required and recorded.
   Change Coordinator	The Change Coordinator will be the chairperson for the CAB. Responsible for the coordinating the flow of documentation/communication surrounding any changes to the IT production environment.
   Change Implementer/Change Implementation Team	The Change Implementer will usually be the technology subject matter expert who is responsible for implementing the change into production. If the change implementation needs external third party or supplier involvement this needs to be documented within the RFC form.
   Change Initiator	Anyone can initiate a change within the organization – however, consideration must be given to whether this should include all users. If users are to be allowed to raise changes this should be controlled through the service desk, this will ensure that only relevant and appropriate changes are raised.
   Change Owner	The Change Owner is the person who is responsible for the making the change happen, ensuring the change ticket is updated and marked as completed. This includes designing the change.
   Change Tester	Wherever possible with all changes the Change Tester should not be the Change Implementer. This is to ensure rigorous and error free testing.
   Internal Audit (IA)	Determine the effectiveness of internal controls, adherence with applicable laws and regulations, and reliability of financial reporting
   Change Manager	The role of the Change Manager in the change process is to authorize/approve all changes. The Change Manager also ensures that all activities to implement the change are undertaken in an appropriate manner and are documented and reviewed when completed.

5. Non-Compliance and Sanctions
   Violation of this policy may subject the violator to disciplinary actions, up to or including termination of employment or dismissal from a college, and may subject the violator to penalties stipulated in applicable state and federal statutes.

...