IT Examiner School eBook

Internal Use Only

Change Management • Procedures should ensure that modifications do not disrupt operations or degrade a system's performance or security. • Involves ensuring that all changes to products, services; and procedures are approved, documented, and implemented. • Management should establish change controls that address major, routine, & emergency software modifications and software patches. • Procedures that include detailed steps & techniques for backing out.

Internal Use Only

Types of Changes Can usually be implemented in the normal course of business. Should be formal & include procedures for: Routine Changes • Requesting • Evaluating • Approving • Testing • Installing • Documenting software modifications

Emergency Changes

Updates that are so important that they need to be implemented as soon as possible. Should be tested prior to implementation when possible. If not possible, backup files back-out procedures are critical. • Descriptions of a change • Reasons for implementing or rejecting a proposed change • Name of the individual who made the change • Copy of the changed code • Date and time a change was made • Post-change evaluations