7.4. Change Control Process
Every ISD organization needs a change control process. Change control can be a very complex process, consisting of a formal review process, weekly change meetings, and several levels of approval processes. It can also be a simple tracking process that is completed after the change has taken place. Most organizations probably use some combination of the two. Below is a sample change control process.
7.4.1. Change Control
Establish a process to manage and track system change requests within the IT group, especially changes to the application servers and applications themselves. All system change requests are to be submitted to the help desk, which will function as both the control point and tracking point for all changes.
Complete the system change request with all related information explaining problem statement, details of change, backup requirements, testing process, implementation impacts, and execution date.
Submit new system change requests directly to the help desk.
The help desk will assign a number to the system change request and enter this into the change request tracking database.
The help desk will distribute the change control request to the affected customers. This will serve as notification of the change.
The help desk will generate periodic reports of all system change requests to the list activity.
Change notification request periods are based on the type of change:
7.4.2. Change Control List
Table 7-2 is used to determine what procedures/tasks need to be reported through the change control process for approval. There are different requirements for production and development environments. For the production environments, all procedures/tasks must go through change control except where noted "NOT REQ'D." In the development environment, only those procedures/tasks noted as "REQ'D" need to go through change control. All other items in the development environment do not need to follow the formal change control process.