PL-13_Enterprise Change Mangement Policy v 1.3.docx

ECSS - Enterprise Change Management

Enterprise Change Management Policy Version 1.3

1 Introduction

1.1 Purpose

The purpose of this document is to require the adherence to the Enterprise Change Management (ECM) Process by those implementing changes. This process enables beneficial changes to be made in the HHS environment in a controlled manner with minimal disruption to the IT Services used by State agencies.

This policy documents what actions are required for compliance and what disciplinary actions might occur if a person does not comply with this policy.

1.2 Objectives

The objective of this policy is to ensure that required change controls are in place and being followed so we can:

· Respond to the customer's changing business requirements while maximizing value and reducing incidents, disruption, and re-work.

· Respond to Program and IT requests for change that align the service with the Program needs.

· Ensure that changes are recorded and evaluated, and that authorized changes are prioritized, planned, communicated, tested, implemented, documented, and validated in a controlled manner.

· Coordinate multiple IT projects in order to avoid overlapping or conflicting tasks.

· Mitigate overall business risk.

1.3 Scope

The ECM policy applies to all Service Delivery teams within HHS that make changes to configuration items (CIs) in a production environment that impact multiple agencies or have the possibility of impacting multiple agencies. For the purposes of this document, a change will include the addition, modification to or removal of:

· Hardware

· Device drivers

· Firmware

· Middleware

· Operating System

· Application or Database software

· Network configurations

· Network infrastructure

· Facilities (e.g., electrical, UPS)

· Access infrastructure (e.g., Active Directory, DNS, etc.)

Some examples of Enterprise changes:

· Replacing a failing component on the VSS-WAN core layer switching equipment

· Changes to the HP Tipping Point Reputation score

· MS patching of HEMC servers

· OS upgrades to the ADFS platform

· New releases for the Enterprise Portal

· Blocking Dropbox at the Enterprise level

· Upgrading the current version of Remedy 2 Policy

2.1 Change Management Policy Requirements

In order to protect the HHS environment, all changes must be properly vetted in order to reduce any potential service disruptions.

The following are requirements that must be followed by those within scope of this policy:

1. The approved ECM Process must be followed at all times. The process is ITIL based and includes best practices designed to control and manage changes effectively.

2. All Requests for change (RFCs) must be recorded in the Remedy tool. All requests for change must be documented in the system of record whether they are approved or not.

3. No unauthorized changes will be made to the environment. It is a violation of this policy to introduce change that has not been properly evaluated nor approved.

4. Authorization for changes will come from the Change Advisory Board (CAB). In the event an emergency change is needed and service is currently down or severely degraded, the Service Owner may approve the change. An authoritative source must always give approval before a change can be implemented.

5. All RFCs will be evaluated, assessed for risk, impact, urgency and assigned a risk level. A thorough review of the change request is required to properly assign the level of risk.

6. All RFCs will have a test plan, be validated after implementation, and have a back out plan documented. Changes should be tested before and after implementation to ensure success. In the event the change fails, a plan to revert back to a pre-change state is required.

2.2 Compliance

Any person, subject to this policy who fails to comply with the provisions set forth and causes a negative impact to two or more of our agencies will be subject to disciplinary action up to and including termination for regular and temporary employees, termination of the contract in the case of contractors or consultants, and dismissal for interns and volunteers.

3 Definitions

Document History Revision History

Document Approvals

image1.png