Proposed changes generally fall into one of these classifications:
These changes generally affect just one system, are easily identified as having low risk of negative impact, and often involve little work to implement. These changes are not subject to the same rigors in planning and upfront communication. Due to the low risk, cost, and impact of these changes, formal review is waived in favor of delivering the value of the change more quickly.
|Major||These changes may affect multiple systems, require business system downtime (even if just briefly), or substantially alter the behavior of the affected system(s). These changes are scheduled and reviewed in a weekly review meeting, as well as in some smaller team meetings, to ensure any potential negative ramifications are considered.|
|Urgent||Major changes sometimes have a compelling business reason that they should be implemented urgently. The urgency of these changes necessitates that they not wait until the typical weekly review before being implemented. Instead, ad hoc review is completed through proactive email and in-person communication to appropriate stakeholders and responsible parties.|
CIS uses Atlassian Jira to track all changes. To ensure proper tracking, any such ticket is given a Type of "Change" or "Upgrade/Patch." Accurate classification grants us quick visibility into both planned and recently completed changes. These changes are compiled in a Jira dashboard highlighting the following tickets:
All "Change" and "Upgrade/Patch" tickets with a Prod Change Date, Test Change Date, or Due Date within the next 30 days, as well as change tickets with none of these fields yet populated (i.e.: as yet unscheduled, but forthcoming).
- Upcoming changes to data center or perimeter firewall rules.
Completed Change and Upgrade/Patch tickets that have had a Test Change Date, Prod Change Date, Due Date or Resolution Date in the last 30 days.
Tuesday morning, a list of changes scheduled in the upcoming week is sent to all CIS staff.
Tuesday morning, all CIS staff invited to a meeting to review upcoming changes. All staff who are involved in changes coming in the next 8 days are expected to be present and participate. Any staff with questions or concerns based on the list sent earlier are encouraged to attend as well. The review meeting also serves as an opportunity to review recently completed changes that may have missed formal review (e.g. Minor or Urgent changes).
All CIS staff are expected to review the list of upcoming changes and raise up any conflicts, questions, or concerns regarding any of the items.
Staff responsible for executing changes are expected to participate in the review meeting.
The review meeting takes place the day prior to the weekly maintenance window and changes to planned maintenance activities are made as needed prior to commencement.
Additional details regarding specific aspects of the review process are documented internal to CIS: Change Management Review