Change Advisory Board (CAB)

A representative group of managers and select staff who are responsible for monitoring the change management process, and collaborating on its continuous improvement. The CAB is also responsible for vetting policy and process changes, as well as vetting “Pre- Authorized” change requests prior to being submitted to the CAB/EC for final approval.

ECAB

An executive group (directors) responsible for the review and approval of policy changes. This group is also responsible for approving additions to the list of changes.

Division of IT Staff and Agents

Responsible for administering changes in accordance with this change management policy. The staff or team who is leading a change effort, is responsible for:

• planning and coordinating the change,
• engaging affected DoIT groups and other stakeholders to assess the change impact,
• obtaining appropriate customer or governance approvals,
• representing the change at the weekly Change Management review meeting,
• administering any necessary communications for the change.

Division of IT Managers

Responsible for making sure their team(s) follow the change management processes, including the coordination/approval of changes with customers, stakeholders, and peer groups. Managers must also work with their teams to monitor the change management schedule for possible impacts, and must have adequate representation to discuss upcoming and recently completed changes at the weekly meeting.

Division of IT Directors and Associate Directors

Responsible for approving “Emergency” change requests for their team(s). Directors are also responsible for serving on the CAB/EC.

Classification

Definition / Process

Standard

Definition:

No or low-risk changes that are carried out regularly and only needs approval once. Standard changes should follow their respective standard operating procedures to capture any necessary information about those changes.

New standard changes must be submitted to the CAB and CAB/EC for review and approval. Once approved, it must be logged in the Change Management application and discussed at the next Change Management meeting to serve as communication that future changes of this nature are pre-authorized. It is to provide updates and ensure everything is successful.

Process Overview:

Standard Changes need to be submitted but do not have to go through CAB except for the first change.

Minor

Definition:

Low risk changes that have no or low impact to services that are not critical and thus only need minimal review

Examples:

• Routine application code promotion (not upgrades or significant changes)
• Targeted customer approved maintenance (e.g. customer-specific applications, building/closet specific network maintenance, etc.)

Process Overview:

Minor changes must be logged in the Change Management application. These changes are approved by the requestor’s direct supervisor.

Major

Definition:

Moderate to high-risk changes that will have a significant impact to services and require review, communication, and coordination. These must be approved by CAB.

Examples:

• High Impact
• Critical Services with any downtime or many user
• Non-critical service with a downtime of more than 4 hours, impacts entire units or areas, or impacts more than 50 users

Process Overview:

Major change requests must be logged in the Change Management application 2 weeks prior to the date of the change and reviewed in the Change Management meetings prior to the change and administered in an appropriate maintenance window.