Change Management Policy Policy Owner Policy Approver(s) Storage Location Effective Date Next Review Date W. Jason Strutz (Manager, IT Infrastructure Management and Support) Jim Dohle (Director, IT Production Services) Editable: intranet.uillinois.edu/departments/library/IT/Policies/ Published: http://www.library.illinois.edu/administration/it/policies/ TBD TBD Purpose The University of Illinois Library is committed to ensuring reliable information technology services. In order to meet this objective, proposed changes to running production services must be carefully examined to determine the risks and benefits of making those changes versus keeping the service operating as-is. The goal of this policy is to define what services are subject to change management, the procedure for requesting changes, and guidelines for approving, denying, and scheduling change events. Services Governed by Change Management All changes that may affect production services should be formalized through the change management procedure. Examples include, but are not limited to: » » » » Firmware updates to production hardware Software updates to infrastructure components Software upgrades for production services, including commercial off the shelf software (COTS), Library-hosted 3rd party applications, and deployment of code changes to inhouse developed software Updates to IT-internal hardware, software, or services used to monitor and troubleshoot production services Services Excluded from Change Management Some changes need to be made quickly, or can be approved as a matter of course. Such changes are still subject to the System Maintenance policy. Examples include, but are not limited to: » » » » » Replacement and repair of failed hardware that is covered by manufacturer warranty or contracted support Routine operating system patching Changes mandated from the CITES Security Services that are run in a non-production environment, such as development, test, or sandbox servers Changes initiated, approved, implemented, and controlled by external vendors Procedure Determine impact and probability of identified risks Page 1 University of Illinois Library Determine stakeholders affected Fill out the form: https://intranet.uillinois.edu/departments/library/Change%20Requests/Forms/AllItems.asp x – it will be submitted to the IT managers mailing list IT manager (or designated appointee) will review and initiate follow up on change requests within 2 business days IT manager (or designated appointee) makes go / no go decision in consultation with affected service owners, and coordinates scheduling the change Approval and Scheduling Guidelines All changes incur some amount of risk, however unlikely. Change requests that do not acknowledge this fact have not been adequately thought through, and should not be approved or scheduled without further consideration. Consideration should be given to services and patrons that may be indirectly affected by the requested change. This procedure is not intended to make hard and fast decisions about changes. It is a communication tool to assist in approving and scheduling changes, given the tradeoffs between making or not making the change. The approval and scheduling decisions should be made by the owner(s) of the service(s); IT is responsible for stakeholder identification and communicating potential risks and benefits. All scheduling is subject to notification and other considerations outlined in the System Maintenance Policy. Revision History Version Change Author Page 2 University of Illinois Library Date of Change