chngMgmt

47
Change Management Process Version 1.0 Change Management Process Version 1.0 August, 2005 Duquesne University – Implementation Team

description

change management

Transcript of chngMgmt

Change Management Process Version 1.0

Change Management Process

Version 1.0

August, 2005

Duquesne University – Implementation Team

Change Management Process Version 1.0

Disclaimer

This document and all materials contained herein are proprietary property of Duquesne University –

Implementation Team (DU-IT) project and as such are intended for the exclusive use of Duquesne University and any designated third-parties that Duquesne University sees

fit to provide this information to for use in the implementation and support of DU-IT project requirements.

Duquesne University – Implementation Team

Change Management Process Version 1.0

Document Details

Version: 1.0Status: DraftDocument file name: document.docSaved in:Pages (total): 30

Maintaining Org. Unit: DU-IT Project Management Office (PMO)

Initial Creation Date: 10 July 2005Release Date: 5 August 2005

Document Ownership and Maintenance

As the process owners for this process the DU-IT PMO creates and maintains this document. Any changes to this process and this corresponding documentation must be approved by the DU-IT Project Director and Steering Committee prior to release.

Revision History

Version Author Release Date Change Description

1.0 T.P. Morgan N/A Draft release

Duquesne University – Implementation Team

Change Management Process Version 1.0

Table of Contents

PURPOSE................................................................................................................................................... 3

KEY PROCESS OBJECTIVES................................................................................................................... 3

PROCESS SCOPE...................................................................................................................................... 3

PROCESS OVERVIEW............................................................................................................................... 3

THE CHANGE MANAGEMENT PROCESS...............................................................................................2

CHANGE MANAGEMENT PROCEDURES (DETAILED)...........................................................................3

The Change Request Procedure.............................................................................................................3Purpose............................................................................................................................................... 3Procedure............................................................................................................................................ 3

The Change Approval Procedure............................................................................................................3Purpose............................................................................................................................................... 3Procedure............................................................................................................................................ 3

EMERGENCY CHANGE REQUEST...........................................................................................................3

The Emergency Change Process............................................................................................................3Emergency Change Procedure................................................................................................................3

Purpose............................................................................................................................................... 3Procedure............................................................................................................................................ 3

CHANGE MANAGEMENT FORMS............................................................................................................3

Change Request Form (Sample).............................................................................................................3Change Control Log (Sample)...............................................................................................................12Emergency Change Request Form (Sample)..........................................................................................3Emergency Change Control Log (Sample)..............................................................................................3

APPENDICES............................................................................................................................................. 3

Definitions/Key Terms.............................................................................................................................. 3Roles and Responsibilities....................................................................................................................... 3Change Reviewers Key Assignments......................................................................................................3Change Request Key Attributes...............................................................................................................3Emergency Change Request Key Attributes............................................................................................3Emergency Change Control Log Key Attributes......................................................................................3Change Control Board Meeting – Sample Agenda..................................................................................3Change Type........................................................................................................................................... 3Change Status......................................................................................................................................... 3Change Impact........................................................................................................................................ 3Change Priorities..................................................................................................................................... 3Prirority/Impact Matrix.............................................................................................................................. 3Impact Analysis Criteria........................................................................................................................... 3

DU-IT Project

Change Management Process Version 1.0

Purpose

To minimize disruptions in service to developer and users of the Duquesne University – Implementation Team (DU-IT) technology infrastructure by managing change requests and their associated impacts/activities on DU-IT Infrastructure environment. For purposes of this process changes are defined as installs, modifications or deletions that alter the production infrastructure and operations environment.

Key Process Objectives

Establish a common approach for requesting/documenting change requests/requirements Implement proper controls/sign-off’s/authorizations for all change requests Describe the required communications/coordination points for properly processing changes Create an audit trail of all DU-IT Infrastructure requested and implemented changes

Process Scope

This process shall be used by all parties requesting changes to/within DU-IT Infrastructure staging and production environments including (but not limited to) changes such as:

Hardware changes System software changes (operating level) Application changes (e.g. functionality updates, web page additions/deletions, URL link

additions/deletions, releases, etc.) Network changes Interface changes (other application, links, uploads/downloads, etc.) Database changes Operational and support procedures and documentation changes Version upgrades/enhancements/patches Planned/scheduled outages

Process Overview

Change request is documented and approved by “business” sponsor/management Change is forwarded to appropriate Change Manager(s) Change Manager(s) log change request and verify change completeness/accuracy Change reviewer(s) access to overall impact of the change request (time/resources etc) Change control board approves change request for implementation Change(s) are implemented on a scheduled basis as appropriate Rejected changes are re-worked or cancelled as appropriate Change status is updated/communicated at each step of the process

DU-IT Project Page 1 of 30

Change Management Process Version 1.0

The Change Management Process

DU-IT Project Page 2 of 30

Change Management Process Version 1.0

Change Management Procedures (Detailed)

The Change Request Procedure

Purpose

This procedure describes how the specific requirements of a change are documented and assessed for impact, timing and resource purposes. As noted above, the details and status of the change request are recorded and reported to all affected organizations as needed throughout the process.

Procedure

1. The Change Request (CR) form is completed by any person requesting a change to the DU-IT Infrastructure.

2. After appropriate business approvals/sign-offs have been acquired, the CR is forwarded to the appropriate Change Manager(s).

3. The Change Manager validates the CR for completeness and logs the CR information into the Change Control Log for tracking. Incomplete CR’s are returned to the requestor for update and re-submission.

4. The Change Manager evaluates the nature of the request and makes preliminary assignments as to Change Type, Change Priority and Change Impact.

5. The CR is forwarded to the appropriate Change Reviewer(s) to assess the impact of the change. The Change Reviewer(s) represent an individual or a team depending on the scope, priority and impact of the request. Change Reviewers include designated subject matter experts and managers from application development, support, database and administrations operations as well as project level team members (both DU and third party vendors) as described in the Change Reviewer Key Assignments.

6. The Change Reviewer(s) evaluate the request and describe how the change impacts the infrastructure. In many cases, the original change requestor becomes part of the impact assessment process to provide additional input and guidance. In addition, the change reviewer(s) also validates the priority and change type. The Change Impact Criteria and Priority-Impact Matrix can be used as tools to assess the change.

7. Change Reviewer(s) respond within the timeframe specified by the Change Manager. Timeframe is dependent on the priority of the request.

8. The Change Reviewer(s) provide feedback to the Change Manager to update the Change Control Log and provide the status of the CR to the requestor.

DU-IT Project Page 3 of 30

Change Management Process Version 1.0

The Change Approval Procedure

Purpose

This procedure establishes the Change Control Board (CCB) which is the foundation and structure for management review, coordination and final approval of all change requests. The procedure requires participation from all organizations using and supporting the DU-IT environment. The schedules and status of each change implementation are reported to all affected organizations as needed throughout the process.

Procedure

1. The Change Control Board (CCB) meets on a regular schedule to review new change requests and receive status updates on outstanding requests. The Change Manager is responsible for coordinating and chairing the meeting.

2. The Change Manager provides information from the Change Request form as well as the impact assessment input provided by the Change Reviewers to create a CCB Agenda for the meeting.

3. Changes are reviewed and validated as to Change Impact and Change Priority by the CCB.

4. Changes assessed with Minor Impact by the Change Reviewer(s) can be approved and scheduled for implementation by the Change Manager and do not require CCB approval. All such scheduled changes must be reported to the Board as part of the meeting.

5. The CCB reviews all other changes in detail, and discusses and evaluates each request as to purpose, reasons, impact, cost and benefits. Each Board member represents their department and provides guidance on the change requests.

6. The CCB also reviews multiple requests to coordinate implementations and “package” requests into a single release schedule (e.g. three applications areas requesting migration to a new version of a database).

7. All changes occur to the staging and production environments on a pre-defined schedule. The Change Control Board determines how to schedule the change within the pre-defined schedule based on other planned changes, estimates to complete the updates, testing and implementation and available resources.

8. The CCB approves or rejects the change request documenting reasons for the decision. Approved changes are scheduled for staging and production implementation. The Change Manager updates the Change Control Log and provides the final status to the requestor.

9. If the schedule changes (request delays or changes in priorities) the CCB review the impact and reschedules the change at the next CCB meeting.

10. Scheduled change requests are released to the staging platform and staging tests are performed per the implementation and test plans by the Change Implementer.

DU-IT Project Page 4 of 30

Change Management Process Version 1.0

Staging tests include, but are not limited to: installation scripts, data conversion, load/stress, rollback/recovery, fail-over, etc. The Change Implementer signs off on the results of the testing of each report.

11. Staging test results are reviewed with the CCB at the next CCB meeting. The results are reviewed by re-examining the impact assessments verifying that each impact has been tested for and/or verified by the Change Implementer(s). Successful staging test results are released for Production Implementation. The Change Manager updates the Change Control Log with the status.

12. Production Implementation results are reviewed with the CCB at the next CCB meeting. Successful Implementation results recorded in the Change Control Log.

13. On a periodic basis, the Change Manager produces a report to communicate all implementations to all involved groups through a standard distribution list. The Change Manager also reviews the Change Control Log and Change Request Forms to analyze for trends on type, frequency and size of changes.

DU-IT Project Page 5 of 30

Change Management Process Version 1.0

Emergency Change Request

On occasion, changes of an “emergency” or critical nature may be required to quickly address production issues/outages. Emergencies usually occur as a result of problems and enter the Change Management process from a request from a Problem Manager.

In the case of emergency changes a streamlined process is used to allow the fastest possible response while still maintaining the proper levels of approval, logging, monitoring, communication and closure of all change related activities.

DU-IT Project Page 6 of 30

Version 1.0 Change Management Process

The Emergency Change Process

DU-IT Project Page 7 of 30

Change Management Process Version 1.0

Emergency Change Procedure

Purpose

The emergency change procedure supports the implementation of urgent fixes or updates to the staging or production platforms of the DU-IT infrastructure. Emergency changes follow a streamlined process that still provides for review, approval and logging of changes. To speed processing recovery, many details are captured after the fact.

Procedure

1. The Emergency Change Request (ECR) form is completed by any person requesting an emergency change to the DU-IT Infrastructure and is submitted to the Change Reviewer.

2. The Change Reviewer evaluates the nature of the request and evaluates the urgency using the definitions of Change Type, Change Impact and Change Priority. In many cases, the original change requestor becomes part of the impact assessment process to provide additional input and guidance. In most cases, the Change Reviewer for an ECR is the Change Requestor’s supervisor or an assigned resource within the DU-IT Infrastructure Group.

3. The Change Reviewer(s) also evaluates how the change impacts the infrastructure. The Change Reviewer may elect to involve other members of the Infrastructure Group or the wider CCB if the change is evaluated as Major Impact (multiple systems, etc.).

4. The Change Reviewer(s) approves the ECR and updates the ECR Log to record key information regarding the change. The ECR is forwarded to the Change Implementers for implementation. (Note: the Change Implementers may be the original Change Requestor).

5. The Change Implementor completes the change and provides information to the Change Reviewer to update and close out the ECR Log and Change Management documentation.

6. The Change Reviewer forwards the ECR log to the Change Manager for update to the Change Control Log. The Change Manager provides an update status to the CCB during the next scheduled CCB meeting.

DU-IT Project Page 8 of 30

Change Management Process Version 1.0

Change Management Forms

DU-IT Project Page 9 of 30

Change Management Process Version 1.0

Change Request Form (Sample)Change Description/ CR Filename:

Change Request No.: Project:Requested by: Date:

Department/ location Telephone:

Description of the change:

Change needed by (date):Reason for the change:

Requestor Sign off:Approval of Request:

Change Impact Evaluation (use page 2 for details)Change Type

Application DatabaseHardware ProceduresNetwork SecurityOperating System/Utilities

Schedule Outage

Change Priority

Urgent Change Impact

MinorHigh MediumMedium MajorLow

Environment(s) Impacted:

Estimated Resources: [cost or effort]

CTS Internal: External:

Resource requirements:(personnel , h/w, s/w )

Test Plan DescriptionRollback Description

Change Approval or Rejection

Change Request Status Accepted RejectedComments:Change scheduled for (date):Implementation assigned to (names):

CCB Sign off:Change Implementation

Staging test results:

Implementation test results:

Date of ImplementationImplementor Sign Off Date

DU-IT Project Page 10 of 30

Change Management Process Version 1.0

Change Request Form (Sample) cont .

Change Impact Assessment Change Request No:Component Change

Reviewer Name

Effort / Cost

Impact description Test Description

Test Performed

Date

DU-IT Project Page 11 of 30

Change Management Process Version 1.0

Change Control Log (Sample)

Change Request Nbr

CR Filename

Requested By

Request Date

Department/ Location

Telephone

Description of Change Environment

Change Priority

Change Status

Date Scheduled

Change Implementers

Staging Results Notes Date Implemented

Implementation Results Notes

DU-IT Project Page 12 of 30

Change Management Process Version 1.0

Emergency Change Request Form (Sample)Change Description/ CR Filename

Change Request No.: Project:Requested by: Date:

Department/ location Telephone:

Description of the change:

Reason for the change:

Requestor Sign off:Approval of Request:

Change Impact EvaluationChange Type

Application Database

Hardware ProceduresNetwork SecurityOperating System/Utilities

Outage/Schedule

Change Priority

Urgent Change Impact

Minor

High MediumMedium MajorLow

Environment(s) Impacted:

Change Request Status Accepted RejectedComments:

Change scheduled for (date):Implementation assigned to (names):

Change Implementation

Date of ImplementationImplementor Sign Off Date

DU-IT Project Page 13 of 30

Change Management Process Version 1.0

Emergency Change Control Log (Sample)

Change Request No.

ECR Filename

Requested By

Request Date Department/ Location Telephone

Description of Change

Environment Change Priority

Change Status Date Implemented

DU-IT Project Page 14 of 30

Change Management Process Version 1.0

Appendices

DU-IT Project Page 15 of 30

Change Management Process Version 1.0

Definitions/Key Terms

Change – any modification to the staging and production DU-IT infrastructure including: Hardware changes System software changes (operating level) Application changes (e.g. functionality, web page additions/deletions, URL link

additions/deletions, releases, content changes, etc.) Network changes Interface changes (other applications, links, uploads/downloads, etc.) Database changes Operational and support procedures and documentation changes Version upgrades/enhancements/patches Planned/scheduled outages

DU-IT Infrastructure – all hardware, network and software components for the common web infrastructure environment

Emergency Change - an urgent request to correct a problem in the production environment

Change Request – a request to modify the production DU-IT environments.

Change Control Log – a record of all change requests and their current status, updated continuously throughout the process.

Staging Tests – application system and network tests to validate planned changes will perform as expected.

DU-IT Project Page 16 of 30

Change Management Process Version 1.0

Roles and Responsibilities

Role ResponsibilitiesChange Requestor Initiates a request for change

Modifies a change request Acquires business/management approvals for change

Change Manager Monitors all change activities in the DU-IT Infrastructure environment

Receives request for change from change requestors Tracks changes to closure Receives, logs and allocates a priority, in

collaboration with the requestor to all CR’s Distributes CR’s to Change Reviewer for impact

assessment Schedules CR reviews for CCB meeting, issues

agenda and circulates CR’s to CCB members in advance of meetings to allow prior consideration

Chairs all CCB meetings Updates the Change Control Log with all progress,

including any actions taken to correct problems and/or to take opportunities to improve service quality

Reviews all implemented Changes to ensure that they have met their objectives. Refers back any changes that have been backed out or have failed

Closes CR’s Produces regular and accurate management reports Updates list of CCB members, Change Reviewers

and administrative formsChange Control Board Analyzes the change request for validity, feasibility

Accepts or Rejects a request for change Assigns the request for change to change reviewers

for impact analysis Assigns request to change implementor for

implementing accepted change requests Approves changes implementation

Change Reviewer Review requested changes Analyze the impact of implementing the requested

change Assess resource and timing requirements for change

Change Implementers Implement the approved change as requested Provide status of change implementation. Back out/roll back failed changes

DU-IT Project Page 17 of 30

Change Management Process Version 1.0

Change Reviewers Key Assignments

Change ReviewerComponent Name Location/PhoneServers – Linux (hardware/operating system/utilities)

Sheryl Reinhard X4263

Servers – Unix (hardware/operating system/utilities)

Sheryl Reinhard / Matt Madill

X4263 / X5205

Servers – Windows(hardware/operating system/utilities)

Dale Joseph/Emery Secosky

X4790 / X4454

Storage Area Network Dale Joseph X4790Networking – LAN Hank McCarthy X4789Networking – WAN Hank McCarthy X4789

Networking – Routers/Hubs Hank McCarthy X4789Security - Software Updates Greg A. Jerry X 5395Security - Firewall Emery Secosky X4454Security – Authentication (LDAP)

Jeff Fine X4621

Database (Oracle) Greg A. Jerry X5395Database (SQL Server) Dale Joseph X4790Content Management ToolsMiddleware Tools Greg A. Jerry X5395Application Server - Oracle Greg A. Jerry X5395Application – Portal Paul Allison X6056Application – Banner Paul Allison X6056Application – Adirondack Paul Allison X6056

DU-IT Project Page 18 of 30

Change Management Process Version 1.0

Change Request Key Attributes

Change DescriptionChange Request Number (CR)

A sequential number assigned to record change

Project Name of the project under which CR is being requested (if applicable)

Requested by Name of person requesting changeDate Submission date of CR Department/location telephone

Department/location/telephone of change requestor

Description of change Detailed text describing nature of changeChange needed by (date) Date by which change needs to be implemented

(if applicable)Reason for change Detailed text describing reasons and benefits to

making the changeChange requestor signatureApproval signature

Change AssessmentChange Impacts Assessment as to what components and how the

change impacts the existing staging and production infrastructure (detailed)

Change Priority Assessment of the urgency of the request to evaluate scheduling and resource assignment.

Environment Impacted Logical names/tables of servers/networks being impacted by change

Estimated Resources Estimates as to the effort and/or cost required (both internal and external) to prepare and implement the change into the staging and production infrastructure

Testing Plan Description of the test plan to validate changes in the staging and production infrastructure

Rollback Plan Description of the plan to restore the environment to pre-change status in the event the change fails

Description of Change Components

Detailed list of impact of change on production environmentChange Approvals

Change Status Status of the CR (Open, Reviewed, Scheduled, Approved, Implemented, Failed)

Comments Reasons (if any) from Change Control Board as to status

Date Scheduled Dates for staging and production implementation Change Implementers Name of person/department assigned to manage

change implementationCCB Signoff Approval of representative of Change Control

Board

DU-IT Project Page 19 of 30

Change Management Process Version 1.0

Change ImplementationStaging Results Description of staging results/date of completionImplementation Results Description of production implementation

results/date of completionImplementation sign off

DU-IT Project Page 20 of 30

Change Management Process Version 1.0

Change Control Log Key Attributes

Change Control LogChange Request Number A sequential number assigned to record changeRequested by Name of person requesting changeRequest Date Submission date of CR Department/location telephone

Department/location/telephone of change requestor

Description of change Detailed text describing nature of changeEnvironment Impacted Logical names/tables of servers/networks being

impacted by changeReason for change Detailed text describing reasons and benefits to

making the changeChange Priority Assessment of the urgency of the request to

evaluate scheduling and resource assignment.Change Status Status of the CR (Open, Reviewed, Approved,

Scheduled, Implemented, Failed)Date Scheduled Dates for staging and production implementation Change Implementers Name of person/department assigned to manage

change implementationStaging Results Description of staging results/date of completionDate Implemented Description of production implementation

results/date of completion

DU-IT Project Page 21 of 30

Change Management Process Version 1.0

Emergency Change Request Key Attributes

Change DescriptionEmergency Change Request Number (ECR)

A sequential number assigned to record change (logged by the Change Manager after the fact)

Project Name of the project under which CR is being requested (if applicable)

Requested by Name of person requesting changeDate Submission date of CR Department/location telephone

Department/location/telephone of change requestor

Description of change Detailed text describing nature of changeReason for change Detailed text describing reasons and benefits to

making the changeChange requestor sign off Approval of request

Change AssessmentChange Impacts Assessment as to what components and how the

change impacts the existing staging and production infrastructure

Change Priority Always set to UrgentEnvironment Impacted Logical names/tables of servers/networks being

impacted by changeChange Approvals

Change Request Status of the CR (Accepted, Rejected)Comments Reasons (if any) from Change Control Board as to

statusDate Scheduled Dates for staging and production implementation Change Implementers Name of person/department assigned to manage

change implementationCCB Signoff Approval of representative of Change Control

Board

DU-IT Project Page 22 of 30

Change Management Process Version 1.0

Emergency Change Control Log Key Attributes

Emergency Change Control LogChange Request Number A sequential number assigned to record change

(start with E)Requested by Name of person requesting changeRequest Date Submission date of CR Environment Impacted Logical names/tables of servers/networks being

impacted by changeDepartment/location telephone

Department/location/telephone of change requestor

Description of change Detailed text describing nature of changeChange Priority Assessment of the urgency of the request to

evaluate scheduling and resource assignment.Change Status Status of the CR (Open, Implemented, Failed)Date Implemented Description of production implementation

results/date of completion

DU-IT Project Page 23 of 30

Change Management Process Version 1.0

Change Control Board Meeting – Sample Agenda

Introduction/Roll Call

Review past meeting minutes

Emergency Change Requests installed in productionReview Emergency Change Control Log

Minor Impact Changes installed in productionReview Change Control Log

Status updates to open Change RequestsReview Change Control LogUpdate Staging and Implementation Schedules if needed

New Change RequestsReview Change RequestDiscuss ImpactApprove/Reject

Open topics

Action Item Assignments

Close Meeting

DU-IT Project Page 24 of 30

Change Management Process Version 1.0

Change Type

Change Type Application Changes made to application systems, including

new implementations or functional updates, application development tools and utilities, location/directory changes, interfaces to other applications, updates to web site pages, URL links, etc.

Operating System Upgrades, migrations, installation, de-installs of system level software – (operating system, utilities, middleware, tools) and configurations (servers, disk arrays, etc.) that impact the operational environment.

Database Upgrades, migrations, installation, de-install of database software and database utilities as well as database configurations changes configurations (servers, disk arrays, etc.) that impact the operational environment.

Procedures Changes/updates to processing schedule and sequences (including runbooks), scripts for back ups, batch processes, etc. Documentation updates that require notification and distribution to other groups.

Security Changes/updates to security authorization and authentication to forms, processes and documents and just deal with impact analysis. Changes/updates to the data center or university firewalls.

Scheduled Outages Changes/Updates to planned events (e.g. system maintenance, backup times)

DU-IT Project Page 25 of 30

Change Management Process Version 1.0

Change Status

Change StatusOpen Initial status upon completing forms and

submitting to Change ManagerReviewed Updated status after reviewers have assessed

change and provided feedback (prior to CCB decision)

Approved Updated status after CCB has discussed change and approved/scheduled change for implementation

Rejected Updated status after CCB has discussed change and denied the request

Failed Updated status after change implementation has been attempted and failed

Implemented Updated status after changed implementation has been successful

Closed Updated status after change has been reviewed for closure by the CCB.

DU-IT Project Page 26 of 30

Change Management Process Version 1.0

Change Impact

Change ImpactMinor Impact Changes are typically updates to individual or non-

mission critical applications such as the introduction of new features such as new web pages or web links Minimal resources are required for testing in the staging environment and implementation into production.

The Change Manager has the authority to approve and release these changes for staging and implementation. Changes must be recorded in the Change Control Log and reported to the CCB.

Medium Impact Changes affect more than one system or application and/ or significant resources are required for staging testing and implementation.The change request must be scheduled for discussion at the next CCB meeting. Prior to the meeting the Change Request and the impact analysis must be circulated to the CCB, and possibly a wider audience if deemed necessary by the Change Manager or the CCB members, for additional impact and resource assessment.

Changes of this category are typically updates or implementation of important systems or major server or network components.

Major Impact Changes are updates or installations of central systems such as the upgrade of an operating system release, major changes in the network or the migration to a new user domain environment. Large amounts of resources are required for staging testing and/or implementation.

Tests in the staging environment cover not only the direct impacted system(s) but also the complete infrastructure. Detailed information including the impact analysis must be distributed to all relevant groups. Partial information must be delivered to additional groups such as suppliers or vendors, in particular if they are needed in case of an unsuccessful installation or problems during the installation.

Customers should be informed timely if services (e. g. DU-IT Project services) are not available for a time.

DU-IT Project Page 27 of 30

Change Management Process Version 1.0

Change Priorities

Change PrioritiesPriority 1 - Emergency

Causes loss of service or severe usability problems to a large number of users, or some equally serious problem. Immediate action is required. Resources are allocated immediately to implement authorized change. Typical situations are virus attacks, server security violations from outside the enterprise (through internet/ firewall) or crashes of mission critical systems. Implementation in the production environment has priority against all other scheduled and pending activities of the required staff. The implemented change must still be logged by the change manager and reported to the CCB.

Priority 2 - High Priority :

Severely affects some users or impacts a large number of users. Typically given the highest priority when being considered by the CCB for staging and implementation scheduling. Typical situations for this level of priority are the preventive protection (e. g. against new viruses) or fixing poorly developed and installed mission critical systems. All information of the change request form has to be delivered and tests in the staging environment have to be performed. The CCB may evaluate scheduling of the change outside of the next scheduled release or upgrade.

Priority 3 - Medium Priority

No severe impact but does require resources for both staging and implementation. Typically is assigned for scheduled maintenance changes and/or functionality improvements to applications. Preventive fixes or improvements on the IT infrastructure (e. g. required capacity improvements notified through monitoring processes) are typically allocated in this level. No special resources are required for integration testing and deployment.

Priority 4 - Low Priority

A change is justified and necessary but can wait until the next scheduled release or upgrade. To be allocated resources as schedules permit.Changes in this level are planned through the defined update cycle for software releases and hardware upgrades or the implementation plans of new services

DU-IT Project Page 28 of 30

Change Management Process Version 1.0

Priority/Impact Matrix

Priority

ImpactEmergency High Medium Low

Minor

Allocate resources when available (usually same day)

Install change per emergency process

Schedule changes as needed (usually same day fix)

Assess impact and resource availability

Re-prioritize schedules and resources for next available installation

Schedule as needed within other change priorities

Assess impact and resource availability

Group change requests together into releases

Schedule normally

Group change requests together into releases

Schedule normally

Medium

Allocate resources as soon as available (usually same day)

Implement change per emergency change process

Install change per emergency process

Assess impact and resource availability

Re-prioritize schedules and resources for next available schedule installation

Assess impact and resource availability

Group change requests together into releases

Schedule normally

Look to group change requests together into releases

Schedule normally

Major

Re-prioritize schedules and resources as soon as possible (usually immediately)

Immediately notify impacted groups and management

Implement change per emergency process

Assess impact and resource availability

Re-prioritize schedules and resources if needed

Evaluate need for CCB to authorize non-scheduled change

Assess impact and resource availability

Group change requests (functionally or technically) together into releases

Schedule normally

Look to group change requests together into releases

Schedule normally

DU-IT Project Page 29 of 30

Change Management Process Version 1.0

Impact Analysis Criteria

Analysis CriteriaImpacted Area Assessment

Applications and Interfaces

Impact to applications running in the infrastructure environment

Business Benefits Assess statements as to – regulatory or mandated requirements– cost reduction potential– revenue generation potential– improvement of business processes– improvement to technology infrastructure

(efficiency, effectiveness)Contingency/Disaster Recovery

Impact to existing contingency or disaster recovery plans

Cost/Effort Estimates

Cost and effort /resource estimates required to implement the change

Interdependencies Other projects or change requests which depend upon this request and/or are required for successful implementation

Performance and Capacity

Implications on infrastructure performance and capacity of change

Risk Implications of failure of the change based on size and scope of the request

Security Implications for user or system securityTechnical information

Sufficiency of the technical information available to assess the change

Urgency of request

Level of urgency – should be implemented in immediately, near term, long term, etc..

User organizations Impact on users of the applications and/or infrastructure

DU-IT Project Page 30 of 30