ICT-Governance-Framework-Application

Change Management Plan

Document Information

• Document Title: Change Management Plan
• Version: 1.0
• Date: 2023-10-17
• Status: Draft
• Document Owner: ICT Governance Team

Table of Contents

1. Introduction
2. Change Management Approach
3. Change Management Roles and Responsibilities
4. Change Categories and Types
5. Change Management Process
6. Change Control Board
7. Change Impact Analysis
8. Change Implementation
9. Change Communication
10. Change Documentation
11. Appendices

Introduction

Purpose

This Change Management Plan establishes a structured approach for evaluating, approving, implementing, and documenting changes to the ICT Governance Framework Application. It ensures that changes are made in a controlled manner with appropriate oversight to minimize disruption and risk while enabling continuous improvement.

Scope

This plan applies to all changes affecting the ICT Governance Framework Application, including:

• Azure automation scripts and modules
• Infrastructure as Code (IaC) templates
• Governance policies and configurations
• Documentation and guidance materials
• User interfaces and dashboards
• Integration components
• Deployment and operational processes

Definitions

• Change: Any addition, modification, or removal of approved, supported, or baselined ICT Governance Framework components.
• Change Management: The process of requesting, analyzing, approving, implementing, and reviewing changes.
• Change Control Board (CCB): A group responsible for reviewing and approving changes.
• Emergency Change: A change that must be implemented immediately to resolve a critical issue.
• Change Request (CR): A formal request to alter some aspect of the ICT Governance Framework.
• Configuration Item (CI): Any component that needs to be managed to deliver the ICT Governance Framework.

Change Management Approach

Change Philosophy

The ICT Governance Framework Application employs a change management approach based on the following principles:

• Balance between control and agility
• Risk-based decision making
• Transparency in change processes
• Appropriate stakeholder involvement
• Continuous improvement through managed change
• Proper documentation and knowledge transfer

Change Management Methodology

The change management methodology incorporates elements from:

• ITIL Change Management practices
• DevOps change management principles
• Microsoft Azure change management best practices
• Organizational change management requirements
• Agile and iterative implementation approaches

Change Management Strategy

The change management strategy for the ICT Governance Framework Application will:

• Implement appropriate controls based on change risk and impact
• Leverage automation for change implementation where possible
• Promote standardization through templates and patterns
• Enable rapid response to critical issues
• Support continuous improvement through managed change
• Maintain proper governance and compliance
• Ensure proper communication to affected stakeholders

Change Management Roles and Responsibilities

Change Management Team

The Change Management Team provides oversight and governance for all change-related activities:

Role	Responsibilities
Change Manager	- Overall accountability for change management - Chair Change Control Board meetings - Resolve conflicts and issues - Report on change management metrics
Change Coordinator	- Process change requests - Schedule Change Control Board meetings - Track change status - Coordinate change implementation - Maintain change documentation
Configuration Manager	- Identify configuration items affected by changes - Ensure configuration updates - Maintain configuration management database - Verify configuration compliance

Extended Team Responsibilities

Role	Change Responsibilities
Project Manager	- Submit change requests - Assess change impact on project - Incorporate approved changes into project plans - Report on change status to stakeholders
Development Team	- Implement technical changes - Provide technical input on change requests - Perform impact analysis for technical changes - Test changes before implementation
Infrastructure Team	- Implement infrastructure changes - Assess impact on infrastructure components - Provide technical expertise on platform changes - Validate infrastructure changes
Quality Assurance	- Test changes prior to implementation - Verify changes meet quality standards - Validate that changes deliver expected outcomes - Identify quality issues related to changes
Stakeholders	- Submit change requests - Provide business justification for changes - Review and approve changes from business perspective - Provide feedback on implemented changes

Change Categories and Types

Change Categories

Changes will be categorized based on impact and risk:

Category	Description	Approval Requirements	Implementation Window
Standard	Pre-approved changes with well-understood impacts and established procedures	Pre-approved; Change Coordinator verification	Regular maintenance window
Minor	Low-risk changes with limited impact	Change Manager approval	Regular maintenance window
Significant	Moderate-risk changes with broader impact	Change Control Board approval	Scheduled maintenance window
Major	High-risk changes with significant impact	Change Control Board and Executive approval	Major maintenance window with notification
Emergency	Urgent changes needed to resolve critical issues	Emergency approval process; post-implementation review	Immediate with coordination

Change Types

The following change types will be managed within the ICT Governance Framework Application:

Change Type	Description	Examples
Policy Change	Changes to governance policies and standards	- Update to tagging requirements - Modified security standards - New compliance policies
Code Change	Changes to automation scripts and modules	- Bug fixes in PowerShell scripts - New automation features - Code refactoring
Infrastructure Change	Changes to infrastructure components	- Updates to Azure resource configurations - New infrastructure components - Resource decommissioning
Configuration Change	Changes to application settings and parameters	- Parameter value updates - Feature toggles - Environment configuration changes
Documentation Change	Changes to documentation and guidance	- Updated user guides - New technical documentation - Process documentation revisions
Process Change	Changes to operational processes and procedures	- Modified deployment procedures - New operational workflows - Updated support procedures

Change Management Process

Change Request Process

The standard change request process includes the following steps:

1. Change Identification
   • Identify need for change
   • Document initial change requirements
   • Determine change category and type
2. Change Request Submission
   • Complete Change Request form
   • Provide business justification
   • Include preliminary impact assessment
   • Submit to Change Coordinator
3. Initial Review
   • Change Coordinator reviews for completeness
   • Validates change category and type
   • Assigns for impact analysis if needed
   • Schedules for appropriate approval process
4. Impact Analysis
   • Technical teams assess impact
   • Security assessment if needed
   • Resource requirements determination
   • Risk assessment
   • Documentation of findings
5. Change Approval
   • Review by appropriate approval authority based on category
   • Discussion of impact analysis findings
   • Decision (approve, reject, defer, request more information)
   • Documentation of decision and rationale
6. Change Scheduling
   • Assignment of implementation resources
   • Scheduling within appropriate implementation window
   • Communication to affected stakeholders
   • Coordination with other scheduled changes
7. Change Implementation
   • Execute change according to implementation plan
   • Perform testing to validate change
   • Update configuration items
   • Document implementation details
8. Post-Implementation Review
   • Verify change effectiveness
   • Identify any issues or unintended consequences
   • Document lessons learned
   • Close change request

Emergency Change Process

For emergency changes, an expedited process will be followed:

1. Emergency Identification
   • Identify critical issue requiring immediate change
   • Notify Change Manager and key stakeholders
2. Emergency Approval
   • Obtain verbal or electronic approval from Change Manager
   • For high-impact changes, obtain approval from designated emergency approver
3. Controlled Implementation
   • Implement change with appropriate controls
   • Document actions taken
   • Validate effectiveness
4. Post-Implementation Documentation
   • Complete formal Change Request documentation
   • Conduct post-implementation review
   • Document lessons learned
   • Update affected configuration items
5. Emergency Change Review
   • Review emergency change at next CCB meeting
   • Determine if preventive measures are needed
   • Identify process improvements

Change Request Prioritization

Change requests will be prioritized based on the following criteria:

Priority	Description	Response Time	Implementation Timeframe
Critical	Urgent change needed to resolve service outage or security vulnerability	Immediate review	As soon as possible (24 hours)
High	Important change with significant business impact	Review within 1 business day	Within 1 week
Medium	Change with moderate business impact	Review within 3 business days	Within 2-4 weeks
Low	Change with minimal business impact	Review within 5 business days	Within 1-3 months

Change Control Board

CCB Structure

The Change Control Board (CCB) will consist of representatives from key stakeholder groups:

Role	Responsibility on CCB
Change Manager (Chair)	- Lead CCB meetings - Ensure proper review process - Break ties in voting if necessary
Technical Lead	- Evaluate technical feasibility - Assess technical risks - Provide technical expertise
Security Representative	- Assess security implications - Ensure security standards compliance - Identify security risks
Business Representative	- Evaluate business value - Represent business priorities - Assess business impact
Operations Representative	- Assess operational impact - Evaluate supportability - Identify operational risks
Quality Assurance Representative	- Assess quality implications - Ensure testing adequacy - Identify quality risks

CCB Meeting Schedule

• Standard CCB meetings will be held weekly
• Emergency CCB reviews will be conducted as needed
• Special CCB sessions may be scheduled for major changes

CCB Decision Making

The CCB will make decisions using the following approach:

• Consensus-based decision making when possible
• Formal voting when consensus cannot be reached
• Change Manager has tie-breaking authority
• Escalation to Executive Sponsor for unresolved conflicts

CCB Documentation

All CCB activities will be documented, including:

• Meeting agendas and minutes
• Change request reviews and decisions
• Action items and assignments
• Decision rationales
• Risk mitigation plans

Change Impact Analysis

Impact Assessment Areas

Change impact analysis will cover the following areas:

Area	Assessment Considerations
Technical	- Systems and components affected - Integration impacts - Performance implications - Technical dependencies
Operational	- Operational processes affected - Support requirements - Monitoring implications - Backup and recovery impacts
Security	- Security control impacts - Authentication/authorization changes - Vulnerability introduction - Compliance implications
Business	- Business process impacts - User experience changes - Business continuity implications - Value delivery assessment
Resource	- Implementation resource requirements - Training needs - Documentation updates - Cost implications
Schedule	- Implementation timeline - Deployment window requirements - Dependency on other changes - Critical path impact
Risk	- Implementation risks - Rollback complexity - Service disruption potential - Compliance risks

Impact Analysis Process

For each significant or major change, a structured impact analysis will be conducted:

1. Identify all systems and components potentially affected
2. Determine direct and indirect impacts for each component
3. Assess security implications and compliance impacts
4. Identify risks and develop mitigation strategies
5. Determine resource requirements for implementation
6. Document findings in Impact Analysis Report

Impact Analysis Tools and Techniques

The following tools and techniques will be used for impact analysis:

• Configuration management database queries
• Architecture and dependency diagrams
• Technical reviews with subject matter experts
• Risk assessment matrices
• Testing in development/test environments
• Historical change data analysis
• What-if scenarios and simulations

Change Implementation

Implementation Planning

For approved changes, an implementation plan will be developed including:

• Detailed implementation steps
• Resource assignments
• Timeline and schedule
• Testing approach
• Verification criteria
• Rollback procedures
• Communication plan

Change Testing

Changes will be tested prior to implementation:

• Unit testing of code changes
• Integration testing for component interactions
• Security testing for security-impacting changes
• Performance testing for performance-critical changes
• User acceptance testing for user-facing changes

Implementation Approaches

The following implementation approaches may be used based on change characteristics:

Approach	Description	When to Use
Direct Implementation	Implement change directly in production	- Low-risk changes - Standard changes - Configuration updates
Phased Implementation	Implement change in stages	- Complex changes - Changes with user impact - Broad scope changes
Parallel Implementation	Operate old and new systems in parallel	- Critical system changes - High-risk changes - Changes needing verification
Pilot Implementation	Implement for limited scope first	- User-impacting changes - Changes needing validation - Changes with uncertain impact

Rollback Planning

All changes will include rollback procedures:

• Detailed rollback steps
• Trigger criteria for rollback decision
• Required resources and permissions
• Estimated rollback time
• Validation checks after rollback
• Communication procedures for rollback

Change Communication

Stakeholder Communication

Change communication will be tailored to stakeholder needs:

Stakeholder Group	Communication Needs	Communication Methods
Executive Leadership	- Strategic impact - High-level status - Risk overview	- Executive summaries - Dashboard reports - Quarterly reviews
Technical Teams	- Technical details - Implementation requirements - Dependencies	- Technical specifications - Implementation plans - Technical briefings
Operations Team	- Operational impact - Support requirements - Monitoring changes	- Operational procedures - Support documentation - Handover sessions
End Users	- Functionality changes - User experience impact - Schedule awareness	- User announcements - Training materials - User guides
Compliance Team	- Compliance impact - Documentation updates - Audit implications	- Compliance assessments - Documentation reviews - Compliance briefings

Communication Timing

Communication will be provided at key points in the change lifecycle:

• Initial notification of approved changes
• Schedule confirmation prior to implementation
• Reminders before major changes
• Status updates during implementation
• Completion notification
• Post-implementation follow-up

Communication Templates

Standardized templates will be used for change communications:

• Change Announcement Template
• Implementation Schedule Notice
• Change Completion Report
• Issue Notification Template
• Rollback Notification Template

Change Documentation

Required Documentation

The following documentation will be maintained for changes:

Document	Purpose	Required For
Change Request	Document change details and justification	All changes
Impact Analysis Report	Document change impacts and risks	Significant and Major changes
Implementation Plan	Detail implementation approach and steps	All changes except Standard
Test Plan and Results	Document testing approach and outcomes	All changes except Standard
Technical Specification	Detail technical aspects of the change	Code and Infrastructure changes
User Documentation	Explain changes from user perspective	User-impacting changes
Post-Implementation Report	Document implementation results and lessons	All changes
Configuration Update Record	Document configuration changes	All changes affecting CIs

Document Management

Change documentation will be:

• Stored in a centralized repository
• Version controlled
• Linked to related configuration items
• Searchable and retrievable
• Retained according to retention policies
• Accessible to authorized stakeholders

Change Tracking

Changes will be tracked using a change management system that records:

• Change request details and status
• Approval decisions and dates
• Implementation details and dates
• Related documentation links
• Configuration items affected
• Associated issues or incidents
• Post-implementation review results

Appendices

Appendix A: Change Management Process Flowcharts

Standard Change Process

[Change Identification] → [Change Request Submission] → [Initial Review] → [Impact Analysis] → [Change Approval] → [Change Scheduling] → [Change Implementation] → [Post-Implementation Review]

Emergency Change Process

[Emergency Identification] → [Emergency Approval] → [Controlled Implementation] → [Post-Implementation Documentation] → [Emergency Change Review]

Appendix B: Templates

Change Request Template

• Request ID
• Requester information
• Change title and description
• Business justification
• Change category and type
• Requested implementation date
• Systems and components affected
• Initial impact assessment
• Resource requirements
• Testing approach
• Rollback plan
• Approvals

Impact Analysis Template

• Change reference
• Systems and components analysis
• Technical impact assessment
• Operational impact assessment
• Security impact assessment
• Business impact assessment
• Resource requirements
• Schedule constraints
• Risk assessment
• Recommendations

Post-Implementation Review Template

• Change reference
• Implementation summary
• Achievement of objectives
• Issues encountered
• Unplanned impacts
• Effectiveness of testing
• Effectiveness of rollback plan
• Lessons learned
• Follow-up actions

Appendix C: Change Management Policies

• Change Request Policy
• Emergency Change Policy
• Change Approval Authority Matrix
• Change Implementation Policy
• Change Communication Policy
• Configuration Management Policy
• Change Documentation Standards

This site is open source. Improve this page.