Change Management

Introduction

We talk a lot about a critical concept - Change Management, and then we do not do it. We need to make sure we have a standardized process that we use before we change anything about our environment and then make sure that we go through that process and get approvals before we make those changes.

Reality

In the real world, what we do is we tend to discuss it and then keep doing what we have always done. We have got the policies in place. We have called defined procedures, but we do not abide by them. Thus, in the end, change management becomes what we do rather than what we say. Even in those environments where we have policies and standards that we do not follow, the good news is that we have standard practices because people repeatedly tend to do the same thing. Therefore, there is a way that changes get implemented. It might just not line up with our documentation.

Why is it important?

Following the procedure is becoming more critical now with the cloud because we can quickly deploy a lot. It is crucial to have policies and procedures to ensure that we are only implementing what we need and implementing it in the way it should be implemented. Therefore, change management and change approval become essential.

Change management

When it comes to change management, we need to have the concept of a change committee, even if it is not what we traditionally think of as a change committee. Change committee means there is always this group of multiple people that look at every change and decide whether or not it should be approved.

• The reality is we need the expert in our organization on a particular domain to be the one to approve or reject changes. That is wonderful if the organization is large enough to have aboard. However, if it is not, an organization can still have the concept of a board, somebody who has the knowledge and expertise to know how our change will impact the system. That is the key, and the change committee or individual should fill that role.

Approval process criteria

There should be a defined approval process.

• How do we approve a significant change? For that matter, what is a significant change that should be part of defining this approval process?
• When is something big enough to warrant going through the approval process, going before the board, and deciding whether we should make a change or not? Changing the IP address of a device would not qualify in most environments, but switching from one operating system to another and then running a similar application on top of the new operating system would be eligible. So we have to define what that scope of change is and where it warrants going through the process.
• Then, we need documentation. Now, the documentation could be in a formal Change Management Database (CMDB) or simply a spreadsheet.