Every ISD organization needs a change control process. Change control can be a very complex process, consisting of a formal review process, weekly change meetings, and several levels of approval processes. It can also be a simple tracking process that is completed after the change has taken place. Most organizations probably use some combination of the two. Below is a sample change control process.
Establish a process to manage and track system change requests within the IT group , especially changes to the application servers and applications themselves . All system change requests are to be submitted to the help desk, which will function as both the control point and tracking point for all changes.
Complete the system change request with all related information explaining problem statement, details of change, backup requirements, testing process, implementation impacts, and execution date.
Submit new system change requests directly to the help desk.
The help desk will assign a number to the system change request and enter this into the change request tracking database.
The help desk will distribute the change control request to the affected customers. This will serve as notification of the change.
The help desk will generate periodic reports of all system change requests to the list activity.
Change notification request periods are based on the type of change:
Major Projects ”
Two weeks prior to change date.
Nonemergency ”
Five days prior to change date.
Emergency Fix ”
Submitted within 24 hours after the fix has been implemented.
Table 7-2 is used to determine what procedures/ tasks need to be reported through the change control process for approval. There are different requirements for production and development environments. For the production environments, all procedures/tasks must go through change control except where noted "NOT REQ'D." In the development environment, only those procedures/tasks noted as "REQ'D" need to go through change control. All other items in the development environment do not need to follow the formal change control process.
Procedure/Task | Production | Development |
---|---|---|
application account add/change/delete | NOT REQ'D | |
application mail changes | NOT REQ'D | |
application patches (vendor software) | ||
application software installation | ||
application upgrades | ||
backups unscheduled requests | ||
concurrent manager add/delete | ||
database account add/change/delete | NOT REQ'D | |
database creation | ||
database expansion | ||
database exports (special) | ||
database exports (standard) | NOT REQ'D | |
database gzip start/stop | ||
database gzips (not through cron ” manual runs) | ||
database imports | ||
database indexes rebuild | NOT REQ'D | |
database moves | ||
database ongoing purging | NOT REQ'D | |
database purges special/initial | ||
database start/stop | ||
database table defrag | NOT REQ'D | |
database tuning | ||
hardware repairs | REQ'D | |
hardware upgrades | REQ'D | |
links adds/ drops | ||
modify /etc/system file | ||
modify alarms | REQ'D | |
modify automounts | ||
modify backup/gzip schedules | ||
modify crontab - application | ||
modify crontab - dba | NOT REQ'D | |
modify crontab - system | ||
modify init.ora | ||
modify log purges | ||
modify oracle listeners/tnsnames | ||
modify purge scripts | ||
modify UNIX scripts | ||
monitor tools add/change/delete | ||
network changes | REQ'D | |
new plants/factories | ||
OS tuning | REQ'D | |
OS upgrades | REQ'D | |
paging add/change/delete | NOT REQ'D | |
PE installation | ||
PE patches | ||
printer add/change/delete | ||
printer jobs cancellation | NOT REQ'D | |
printer start/stop | NOT REQ'D | |
reboot servers | ||
refresh brando application software | REQ'D | |
system maintenance | ||
tape creation (special) | REQ'D | |
tape creation (standard) | NOT REQ'D | |
UNIX account add/change/delete | NOT REQ'D | |
UNIX mail changes | NOT REQ'D |