Change Management Process

Version 1.0

Change Management Process

Version 1.0
August, 2005

Duquesne University Implementation Team

Change Management Process

Version 1.0

Disclaimer

This document and all materials contained herein are proprietary property of Duquesne University Implementation Team (DU-IT) project and as such are intended for the exclusive use of Duquesne University and any designated third-parties that Duquesne University sees fit to provide this information to for use in the implementation and support of DU-IT project requirements.

Duquesne University Implementation Team

Change Management Process

Version 1.0

Document Details
Version: Status: Document file name: Saved in: Pages (total): Maintaining Org. Unit: Initial Creation Date: Release Date: Document Ownership and Maintenance 1.0 Draft 82897820.doc 30 DU-IT Project Management Office (PMO) 10 July 2005 5 August 2005 As the process owners for this process the DU-IT PMO creates and maintains this document. Any changes to this process and this corresponding documentation must be approved by the DU-IT Project Director and Steering Committee prior to release.

Revision History
Version 1.0 Author T.P. Morgan Release Date N/A Change Description Draft release

Duquesne University Implementation Team

Change Management Process

Version 1.0

Table of Contents
PURPOSE.....................................................................................................................................................................1 KEY PROCESS OBJECTIVES.................................................................................................................................1 PROCESS SCOPE.......................................................................................................................................................1 PROCESS OVERVIEW..............................................................................................................................................1 THE CHANGE MANAGEMENT PROCESS..........................................................................................................2 CHANGE MANAGEMENT PROCEDURES (DETAILED)..................................................................................3 The Change Request Procedure.................................................................................................................................3 Purpose.................................................................................................................................................................3 Procedure..............................................................................................................................................................3 The Change Approval Procedure...............................................................................................................................4 Purpose.................................................................................................................................................................4 Procedure..............................................................................................................................................................4 EMERGENCY CHANGE REQUEST.......................................................................................................................6 The Emergency Change Process...............................................................................................................................7 Emergency Change Procedure...................................................................................................................................8 Purpose.................................................................................................................................................................8 Procedure..............................................................................................................................................................8 CHANGE MANAGEMENT FORMS.......................................................................................................................9 Change Request Form (Sample)..............................................................................................................................10 Change Control Log (Sample).................................................................................................................................12 Emergency Change Request Form (Sample)...........................................................................................................13 Emergency Change Control Log (Sample)..............................................................................................................14 APPENDICES............................................................................................................................................................15 Definitions/Key Terms............................................................................................................................................16 Roles and Responsibilities.......................................................................................................................................17 Change Reviewers Key Assignments......................................................................................................................18 Change Request Key Attributes...............................................................................................................................19 Emergency Change Request Key Attributes...........................................................................................................22 Emergency Change Control Log Key Attributes.....................................................................................................23 Change Control Board Meeting Sample Agenda.................................................................................................24 Change Type............................................................................................................................................................25 Change Status..........................................................................................................................................................26 Change Impact ........................................................................................................................................................27 Change Priorities.....................................................................................................................................................28 Priority/Impact Matrix.............................................................................................................................................29 Impact Analysis Criteria .........................................................................................................................................30

DU-IT Project

Change Management Process

Purpose

Version 1.0

To minimize disruptions in service to developer and users of the Duquesne University Implementation Team (DU-IT) technology infrastructure by managing change requests and their associated impacts/activities on DU-IT Infrastructure environment. For purposes of this process changes are defined as installs, modifications or deletions that alter the production infrastructure and operations environment.

Key Process Objectives Establish a common approach for requesting/documenting change requests/requirements Implement proper controls/sign-offs/authorizations for all change requests Describe the required communications/coordination points for properly processing changes Create an audit trail of all DU-IT Infrastructure requested and implemented changes

Process Scope This process shall be used by all parties requesting changes to/within DU-IT Infrastructure staging and production environments including (but not limited to) changes such as: Hardware changes System software changes (operating level) Application changes (e.g. functionality updates, web page additions/deletions, URL link additions/deletions, releases, etc.) Network changes Interface changes (other application, links, uploads/downloads, etc.) Database changes Operational and support procedures and documentation changes Version upgrades/enhancements/patches Planned/scheduled outages

Process Overview Change request is documented and approved by business sponsor/management Change is forwarded to appropriate Change Manager(s) Change Manager(s) log change request and verify change completeness/accuracy Change reviewer(s) access to overall impact of the change request (time/resources etc) Change control board approves change request for implementation Change(s) are implemented on a scheduled basis as appropriate Rejected changes are re-worked or cancelled as appropriate Change status is updated/communicated at each step of the process

DU-IT Project

Page 1 of 30

Change Management Process

Version 1.0

The Change Management Process

C hange R e q u e s to r

C o m p le te o r u p d a te re q u e s t fo r change

No

C hange M anager

No V a li d a t e r e q u e s t in f o r m a t io n O K ? Yes U p d a te c h a n g e c o n tro l lo g A n a ly z e c h a n g e r e q u e s t tr e n d s a n d r e s u lt s

No

C hange R e v ie w e r

A n a ly z e im p a c t o f change

C o n firm c h a n g e p rio r ity , c h a n g e c a te g o r y a n d c h a n g e ty p e

OK ?

N o tif ic a t io n Y es No A ssess chang e r e q u e s t v a lid ity a n d im p a c t A p p ro v e ? Yes S c h e d u le s ta g in g and im p le m e n ta tio n R e v ie w s t a g in g te s t r e s u lts A p p ro v e ? R e v ie w im p le m e n t a t io n R e v ie w c h a n g e tr e n d s

C hange C o n tro l B o a rd

Yes

Change Im p le m e n t e r

C o n d u c t s t a g in g

C onduct im p le m e n ta tio n

DU-IT Project

Page 2 of 30

Change Management Process

Change Management Procedures (Detailed)

Version 1.0

The Change Request Procedure

Purpose This procedure describes how the specific requirements of a change are documented and assessed for impact, timing and resource purposes. As noted above, the details and status of the change request are recorded and reported to all affected organizations as needed throughout the process.

Procedure

1. The Change Request (CR) form is completed by any person requesting a change to the DUIT Infrastructure. 2. After appropriate business approvals/sign-offs have been acquired, the CR is forwarded to the appropriate Change Manager(s). 3. The Change Manager validates the CR for completeness and logs the CR information into the Change Control Log for tracking. Incomplete CRs are returned to the requestor for update and re-submission. 4. The Change Manager evaluates the nature of the request and makes preliminary assignments as to Change Type, Change Priority and Change Impact. 5. The CR is forwarded to the appropriate Change Reviewer(s) to assess the impact of the change. The Change Reviewer(s) represent an individual or a team depending on the scope, priority and impact of the request. Change Reviewers include designated subject matter experts and managers from application development, support, database and administrations operations as well as project level team members (both DU and third party vendors) as described in the Change Reviewer Key Assignments. 6. The Change Reviewer(s) evaluate the request and describe how the change impacts the infrastructure. In many cases, the original change requestor becomes part of the impact assessment process to provide additional input and guidance. In addition, the change reviewer(s) also validates the priority and change type. The Change Impact Criteria and Priority-Impact Matrix can be used as tools to assess the change. 7. Change Reviewer(s) respond within the timeframe specified by the Change Manager. Timeframe is dependent on the priority of the request. 8. The Change Reviewer(s) provide feedback to the Change Manager to update the Change Control Log and provide the status of the CR to the requestor.

DU-IT Project

Page 3 of 30

Change Management Process

The Change Approval Procedure

Version 1.0

Purpose This procedure establishes the Change Control Board (CCB) which is the foundation and structure for management review, coordination and final approval of all change requests. The procedure requires participation from all organizations using and supporting the DU-IT environment. The schedules and status of each change implementation are reported to all affected organizations as needed throughout the process.

Procedure

1. The Change Control Board (CCB) meets on a regular schedule to review new change requests and receive status updates on outstanding requests. The Change Manager is responsible for coordinating and chairing the meeting. 2. The Change Manager provides information from the Change Request form as well as the impact assessment input provided by the Change Reviewers to create a CCB Agenda for the meeting. 3. Changes are reviewed and validated as to Change Impact and Change Priority by the CCB. 4. Changes assessed with Minor Impact by the Change Reviewer(s) can be approved and scheduled for implementation by the Change Manager and do not require CCB approval. All such scheduled changes must be reported to the Board as part of the meeting. 5. The CCB reviews all other changes in detail, and discusses and evaluates each request as to purpose, reasons, impact, cost and benefits. Each Board member represents their department and provides guidance on the change requests. 6. The CCB also reviews multiple requests to coordinate implementations and package requests into a single release schedule (e.g. three applications areas requesting migration to a new version of a database). 7. All changes occur to the staging and production environments on a pre-defined schedule. The Change Control Board determines how to schedule the change within the pre-defined schedule based on other planned changes, estimates to complete the updates, testing and implementation and available resources. 8. The CCB approves or rejects the change request documenting reasons for the decision. Approved changes are scheduled for staging and production implementation. The Change Manager updates the Change Control Log and provides the final status to the requestor. 9. If the schedule changes (request delays or changes in priorities) the CCB review the impact and reschedules the change at the next CCB meeting. 10. Scheduled change requests are released to the staging platform and staging tests are performed per the implementation and test plans by the Change Implementer.

DU-IT Project

Page 4 of 30

Change Management Process

Version 1.0

Staging tests include, but are not limited to: installation scripts, data conversion, load/stress, rollback/recovery, fail-over, etc. The Change Implementer signs off on the results of the testing of each report. 11. Staging test results are reviewed with the CCB at the next CCB meeting. The results are reviewed by re-examining the impact assessments verifying that each impact has been tested for and/or verified by the Change Implementer(s). Successful staging test results are released for Production Implementation. The Change Manager updates the Change Control Log with the status. 12. Production Implementation results are reviewed with the CCB at the next CCB meeting. Successful Implementation results recorded in the Change Control Log. 13. On a periodic basis, the Change Manager produces a report to communicate all implementations to all involved groups through a standard distribution list. The Change Manager also reviews the Change Control Log and Change Request Forms to analyze for trends on type, frequency and size of changes.

DU-IT Project

Page 5 of 30

Change Management Process

Version 1.0

Emergency Change Request On occasion, changes of an emergency or critical nature may be required to quickly address production issues/outages. Emergencies usually occur as a result of problems and enter the Change Management process from a request from a Problem Manager. In the case of emergency changes a streamlined process is used to allow the fastest possible response while still maintaining the proper levels of approval, logging, monitoring, communication and closure of all change related activities.

DU-IT Project

Page 6 of 30

Version 1.0 Change Management Process

The Emergency Change Process

C hange R e q u e s to r

C o m p le te e m erg en c y re q u e s t fo r c h a n g e

No

C hange M anager

U p d a te c h a n g e c o n tro l lo g s ta tu s

C hange R e v ie w e r

A n a ly z e im p a c t o f change

C o n fir m c h a n g e p rio r ity , c h a n g e c a te g o ry a n d c h a n g e ty p e

OK

Yes

U p d a te c h a n g e lo g

C hange C o n tro l B o a rd

R ep o rt o n e m e rg e n c y

Change Im p le m e n to r

Im p le m e n t c h a n g e

DU-IT Project

Page 7 of 30

Change Management Process

Emergency Change Procedure

Version 1.0

Purpose The emergency change procedure supports the implementation of urgent fixes or updates to the staging or production platforms of the DU-IT infrastructure. Emergency changes follow a streamlined process that still provides for review, approval and logging of changes. To speed processing recovery, many details are captured after the fact.

Procedure 1. The Emergency Change Request (ECR) form is completed by any person requesting an emergency change to the DU-IT Infrastructure and is submitted to the Change Reviewer. 2. The Change Reviewer evaluates the nature of the request and evaluates the urgency using the definitions of Change Type, Change Impact and Change Priority. In many cases, the original change requestor becomes part of the impact assessment process to provide additional input and guidance. In most cases, the Change Reviewer for an ECR is the Change Requestors supervisor or an assigned resource within the DU-IT Infrastructure Group. 3. The Change Reviewer(s) also evaluates how the change impacts the infrastructure. The Change Reviewer may elect to involve other members of the Infrastructure Group or the wider CCB if the change is evaluated as Major Impact (multiple systems, etc.). 4. The Change Reviewer(s) approves the ECR and updates the ECR Log to record key information regarding the change. The ECR is forwarded to the Change Implementers for implementation. (Note: the Change Implementers may be the original Change Requestor). 5. The Change Implementor completes the change and provides information to the Change Reviewer to update and close out the ECR Log and Change Management documentation. 6. The Change Reviewer forwards the ECR log to the Change Manager for update to the Change Control Log. The Change Manager provides an update status to the CCB during the next scheduled CCB meeting.

DU-IT Project

Page 8 of 30

Change Management Process

Version 1.0

Change Management Forms

DU-IT Project

Page 9 of 30

Change Management Process

Change Request Form (Sample)
Change Request No.: Change Description/ CR Filename: Project: Date: Telephone:

Version 1.0

Requested by:
Department/ location Description of the change: Change needed by (date): Reason for the change: Requestor Sign off: Approval of Request:

Change Impact Evaluation (use page 2 for details) Change Type

Change Priority

Application Hardware Network Operating System/Utilities Urgent High Medium Low

Database Procedures Security Schedule Outage Change Impact Minor Medium Major

Environment(s) Impacted: Estimated Resources: [cost or effort] CTS Internal: Resource requirements: (personnel , h/w, s/w ) Test Plan Description Rollback Description Change Request Status Comments: Change scheduled for (date): Implementation assigned to (names): CCB Sign off: Change Implementation Staging test results: Implementation test results: Date of Implementation Implementor Sign Off Change Approval or Rejection Accepted Rejected External:

Date

DU-IT Project

Page 10 of 30

Change Management Process

Version 1.0

Change Request Form (Sample) cont.

Change Impact Assessment

Component

Change Request No:

Change Reviewer Name Effort / Cost Impact description Test Description Test Performed Date

DU-IT Project

Page 11 of 30

Change Management Process

Version 1.0

Change Control Log (Sample)

Change Request Nbr

CR Filename

Requested By

Request Date

Department/ Location Telephone

Description of Change

Environment

Change Priority

Change Status

Date Change Scheduled Implementers

Staging Results Notes

Date Implementation Implemented Results Notes

DU-IT Project

Page 12 of 30

Change Management Process

Version 1.0

Emergency Change Request Form (Sample)

Change Request No.: Change Description/ CR Filename Project: Date: Telephone:

Requested by:
Department/ location Description of the change:

Reason for the change:

Requestor Sign off: Approval of Request: Change Type

Change Priority

Application Hardware Network Operating System/Utilities Urgent High Medium Low

Change Impact Evaluation Database

Procedures Security Outage/Schedule Change Impact

Minor

Medium Major

Environment(s) Impacted: Change Request Status Comments: Accepted Rejected

Change scheduled for (date): Implementation assigned to (names): Change Implementation Date of Implementation Implementor Sign Off

Date

DU-IT Project

Page 13 of 30

Change Management Process

Version 1.0

Emergency Change Control Log (Sample)

Change Request No.

ECR Filename

Requested By

Request Date

Department/ Location Telephone

Description of Environment Change

Change Priority

Change Status

Date Implemented

DU-IT Project

Page 14 of 30

Change Management Process

Version 1.0

Appendices

DU-IT Project

Page 15 of 30

Change Management Process

Version 1.0

Definitions/Key Terms

Change any modification to the staging and production DU-IT infrastructure including: Hardware changes System software changes (operating level) Application changes (e.g. functionality, web page additions/deletions, URL link additions/deletions, releases, content changes, etc.) Network changes Interface changes (other applications, links, uploads/downloads, etc.) Database changes Operational and support procedures and documentation changes Version upgrades/enhancements/patches Planned/scheduled outages DU-IT Infrastructure all hardware, network and software components for the common web infrastructure environment Emergency Change - an urgent request to correct a problem in the production environment Change Request a request to modify the production DU-IT environments. Change Control Log a record of all change requests and their current status, updated continuously throughout the process. Staging Tests application system and network tests to validate planned changes will perform as expected.

DU-IT Project

Page 16 of 30

Change Management Process

Version 1.0

Roles and Responsibilities Role Change Requestor Responsibilities Initiates a request for change Modifies a change request Acquires business/management approvals for change Monitors all change activities in the DU-IT Infrastructure environment Receives request for change from change requestors Tracks changes to closure Receives, logs and allocates a priority, in collaboration with the requestor to all CRs Distributes CRs to Change Reviewer for impact assessment Schedules CR reviews for CCB meeting, issues agenda and circulates CRs to CCB members in advance of meetings to allow prior consideration Chairs all CCB meetings Updates the Change Control Log with all progress, including any actions taken to correct problems and/or to take opportunities to improve service quality Reviews all implemented Changes to ensure that they have met their objectives. Refers back any changes that have been backed out or have failed Closes CRs Produces regular and accurate management reports Updates list of CCB members, Change Reviewers and administrative forms Analyzes the change request for validity, feasibility Accepts or Rejects a request for change Assigns the request for change to change reviewers for impact analysis Assigns request to change implementor for implementing accepted change requests Approves changes implementation Review requested changes Analyze the impact of implementing the requested change Assess resource and timing requirements for change Implement the approved change as requested Provide status of change implementation. Back out/roll back failed changes

Change Manager

Change Control Board

Change Reviewer

Change Implementers

DU-IT Project

Page 17 of 30

Change Management Process

Version 1.0

Change Reviewers Key Assignments

Component Servers Linux (hardware/operating system/utilities) Servers Unix (hardware/operating system/utilities) Servers Windows (hardware/operating system/utilities) Storage Area Network Networking LAN Networking WAN Networking Routers/Hubs Security - Software Updates Security - Firewall Security Authentication (LDAP) Database (Oracle) Database (SQL Server) Content Management Tools Middleware Tools Application Server - Oracle Application Portal Application Banner Application Adirondack

Change Reviewer Name Sheryl Reinhard

Location/Phone X4263

Sheryl Reinhard / Matt Madill Dale Joseph/Emery Secosky Dale Joseph Hank McCarthy Hank McCarthy Hank McCarthy Greg A. Jerry Emery Secosky Jeff Fine Greg A. Jerry Dale Joseph Greg A. Jerry Greg A. Jerry Paul Allison Paul Allison Paul Allison

X4263 / X5205

X4790 / X4454

X4790 X4789 X4789 X4789 X 5395 X4454 X4621 X5395 X4790 X5395 X5395 X6056 X6056 X6056

DU-IT Project

Page 18 of 30

Change Management Process

Version 1.0

Change Request Key Attributes Change Description A sequential number assigned to record change Name of the project under which CR is being requested (if applicable) Name of person requesting change Submission date of CR Department/location/telephone of change requestor Detailed text describing nature of change Date by which change needs to be implemented (if applicable) Detailed text describing reasons and benefits to making the change Change Assessment Assessment as to what components and how the change impacts the existing staging and production infrastructure (detailed) Assessment of the urgency of the request to evaluate scheduling and resource assignment. Logical names/tables of servers/networks being impacted by change Estimates as to the effort and/or cost required (both internal and external) to prepare and implement the change into the staging and production infrastructure Description of the test plan to validate changes in the staging and production infrastructure Description of the plan to restore the environment to pre-change status in the event the change fails Detailed list of impact of change on production environment Change Approvals Status of the CR (Open, Reviewed, Scheduled, Approved, Implemented, Failed) Reasons (if any) from Change Control Board as to status Dates for staging and production implementation Name of person/department assigned to manage change implementation Approval of representative of Change Control Board

Change Request Number (CR) Project Requested by Date Department/location telephone Description of change Change needed by (date) Reason for change Change requestor signature Approval signature Change Impacts Change Priority Environment Impacted Estimated Resources

Testing Plan Rollback Plan Description of Change Components Change Status Comments Date Scheduled Change Implementers CCB Signoff

DU-IT Project

Page 19 of 30

Change Management Process

Version 1.0

Staging Results Implementation Results Implementation sign off

Change Implementation Description of staging results/date of completion Description of production implementation results/date of completion

DU-IT Project

Page 20 of 30

Change Management Process

Change Control Log Key Attributes Change Request Number Requested by Request Date Department/location telephone Description of change Environment Impacted Reason for change Change Priority Change Status Date Scheduled Change Implementers Staging Results Date Implemented

Version 1.0

Change Control Log A sequential number assigned to record change Name of person requesting change Submission date of CR Department/location/telephone of change requestor Detailed text describing nature of change Logical names/tables of servers/networks being impacted by change Detailed text describing reasons and benefits to making the change Assessment of the urgency of the request to evaluate scheduling and resource assignment. Status of the CR (Open, Reviewed, Approved, Scheduled, Implemented, Failed) Dates for staging and production implementation Name of person/department assigned to manage change implementation Description of staging results/date of completion Description of production implementation results/date of completion

DU-IT Project

Page 21 of 30

Change Management Process

Version 1.0

Emergency Change Request Key Attributes Change Description Emergency Change Request A sequential number assigned to record change Number (ECR) (logged by the Change Manager after the fact) Project Name of the project under which CR is being requested (if applicable) Requested by Name of person requesting change Date Submission date of CR Department/location Department/location/telephone of change telephone requestor Description of change Detailed text describing nature of change Reason for change Detailed text describing reasons and benefits to making the change Change requestor sign off Approval of request Change Assessment Change Impacts Assessment as to what components and how the change impacts the existing staging and production infrastructure Change Priority Always set to Urgent Environment Impacted Logical names/tables of servers/networks being impacted by change Change Approvals Change Request Status of the CR (Accepted, Rejected) Comments Reasons (if any) from Change Control Board as to status Date Scheduled Dates for staging and production implementation Change Implementers Name of person/department assigned to manage change implementation CCB Signoff Approval of representative of Change Control Board

DU-IT Project

Page 22 of 30

Change Management Process

Version 1.0

Emergency Change Control Log Key Attributes Emergency Change Control Log Change Request Number A sequential number assigned to record change (start with E) Requested by Name of person requesting change Request Date Submission date of CR Environment Impacted Logical names/tables of servers/networks being impacted by change Department/location Department/location/telephone of change telephone requestor Description of change Detailed text describing nature of change Change Priority Assessment of the urgency of the request to evaluate scheduling and resource assignment. Change Status Status of the CR (Open, Implemented, Failed) Date Implemented Description of production implementation results/date of completion

DU-IT Project

Page 23 of 30

Change Management Process

Version 1.0

Change Control Board Meeting Sample Agenda Introduction/Roll Call Review past meeting minutes Emergency Change Requests installed in production Review Emergency Change Control Log Minor Impact Changes installed in production Review Change Control Log Status updates to open Change Requests Review Change Control Log Update Staging and Implementation Schedules if needed New Change Requests Review Change Request Discuss Impact Approve/Reject Open topics Action Item Assignments Close Meeting

DU-IT Project

Page 24 of 30

Change Management Process

Version 1.0

Change Type Change Type Changes made to application systems, including new implementations or functional updates, application development tools and utilities, location/directory changes, interfaces to other applications, updates to web site pages, URL links, etc. Upgrades, migrations, installation, de-installs of system level software (operating system, utilities, middleware, tools) and configurations (servers, disk arrays, etc.) that impact the operational environment. Upgrades, migrations, installation, de-install of database software and database utilities as well as database configurations changes configurations (servers, disk arrays, etc.) that impact the operational environment. Changes/updates to processing schedule and sequences (including runbooks), scripts for back ups, batch processes, etc. Documentation updates that require notification and distribution to other groups. Changes/updates to security authorization and authentication to forms, processes and documents and just deal with impact analysis. Changes/updates to the data center or university firewalls. Changes/Updates to planned events (e.g. system maintenance, backup times)

Application

Operating System

Database

Procedures

Security

Scheduled Outages

DU-IT Project

Page 25 of 30

Change Management Process

Version 1.0

Change Status Change Status Initial status upon completing forms and submitting to Change Manager Updated status after reviewers have assessed change and provided feedback (prior to CCB decision) Updated status after CCB has discussed change and approved/scheduled change for implementation Updated status after CCB has discussed change and denied the request Updated status after change implementation has been attempted and failed Updated status after changed implementation has been successful Updated status after change has been reviewed for closure by the CCB.

Open Reviewed Approved Rejected Failed Implemented Closed

DU-IT Project

Page 26 of 30

Change Management Process

Version 1.0

Change Impact Change Impact Changes are typically updates to individual or nonmission critical applications such as the introduction of new features such as new web pages or web links Minimal resources are required for testing in the staging environment and implementation into production. The Change Manager has the authority to approve and release these changes for staging and implementation. Changes must be recorded in the Change Control Log and reported to the CCB. Changes affect more than one system or application and/ or significant resources are required for staging testing and implementation. The change request must be scheduled for discussion at the next CCB meeting. Prior to the meeting the Change Request and the impact analysis must be circulated to the CCB, and possibly a wider audience if deemed necessary by the Change Manager or the CCB members, for additional impact and resource assessment. Changes of this category are typically updates or implementation of important systems or major server or network components. Changes are updates or installations of central systems such as the upgrade of an operating system release, major changes in the network or the migration to a new user domain environment. Large amounts of resources are required for staging testing and/or implementation. Tests in the staging environment cover not only the direct impacted system(s) but also the complete infrastructure. Detailed information including the impact analysis must be distributed to all relevant groups. Partial information must be delivered to additional groups such as suppliers or vendors, in particular if they are needed in case of an unsuccessful installation or problems during the installation. Customers should be informed timely if services (e. g. DUIT Project services) are not available for a time.

Minor Impact

Medium Impact

Major Impact

DU-IT Project

Page 27 of 30

Change Management Process

Version 1.0

Change Priorities Change Priorities Causes loss of service or severe usability problems to a large number of users, or some equally serious problem. Immediate action is required. Resources are allocated immediately to implement authorized change. Typical situations are virus attacks, server security violations from outside the enterprise (through internet/ firewall) or crashes of mission critical systems. Implementation in the production environment has priority against all other scheduled and pending activities of the required staff. The implemented change must still be logged by the change manager and reported to the CCB. Severely affects some users or impacts a large number of users. Typically given the highest priority when being considered by the CCB for staging and implementation scheduling. Typical situations for this level of priority are the preventive protection (e. g. against new viruses) or fixing poorly developed and installed mission critical systems. All information of the change request form has to be delivered and tests in the staging environment have to be performed. The CCB may evaluate scheduling of the change outside of the next scheduled release or upgrade. No severe impact but does require resources for both staging and implementation. Typically is assigned for scheduled maintenance changes and/or functionality improvements to applications. Preventive fixes or improvements on the IT infrastructure (e. g. required capacity improvements notified through monitoring processes) are typically allocated in this level. No special resources are required for integration testing and deployment. A change is justified and necessary but can wait until the next scheduled release or upgrade. To be allocated resources as schedules permit. Changes in this level are planned through the defined update cycle for software releases and hardware upgrades or the implementation plans of new services

Priority 1 Emergency

Priority 2 - High Priority :

Priority 3 - Medium Priority

Priority 4 - Low Priority

DU-IT Project

Page 28 of 30

Change Management Process

Priority/Impact Matrix

Version 1.0

Priority Impact

Emergency
Allocate resources when available (usually same day) Install change per emergency process Schedule changes as needed (usually same day fix) Allocate resources as soon as available (usually same day) Implement change per emergency change process Install change per emergency process Re-prioritize schedules and resources as soon as possible (usually immediately) Immediately notify impacted groups and management Implement change per emergency process

High
Assess impact and resource availability Re-prioritize schedules and resources for next available installation Schedule as needed within other change priorities Assess impact and resource availability Re-prioritize schedules and resources for next available schedule installation Assess impact and resource availability Re-prioritize schedules and resources if needed Evaluate need for CCB to authorize non-scheduled change

Medium
Assess impact and resource availability Group change requests together into releases Schedule normally

Low
Group change requests together into releases Schedule normally

Minor

Medium

Assess impact and resource availability Group change requests together into releases Schedule normally Assess impact and resource availability Group change requests (functionally or technically) together into releases Schedule normally

Look to group change requests together into releases Schedule normally

Major

Look to group change requests together into releases Schedule normally

DU-IT Project

Page 29 of 30

Change Management Process

Version 1.0

Impact Analysis Criteria Analysis Criteria Assessment Impact to applications running in the infrastructure environment Assess statements as to regulatory or mandated requirements cost reduction potential revenue generation potential improvement of business processes improvement to technology infrastructure (efficiency, effectiveness) Impact to existing contingency or disaster recovery plans Cost and effort /resource estimates required to implement the change Other projects or change requests which depend upon this request and/or are required for successful implementation Implications on infrastructure performance and capacity of change Implications of failure of the change based on size and scope of the request Implications for user or system security Sufficiency of the technical information available to assess the change Level of urgency should be implemented in immediately, near term, long term, etc.. Impact on users of the applications and/or infrastructure

Impacted Area Applications and Interfaces Business Benefits

Contingency/Disas ter Recovery Cost/Effort Estimates Interdependencies Performance and Capacity Risk Security Technical information Urgency of request User organizations

DU-IT Project

Page 30 of 30