Change Management SOP
All changes that will have a significant impact on any mission critical systems, PVAMU network or a system stores sensitive/controlled/ mission critical data must be approved by the change committee. This includes the following but it not limited to:
- Application/database code change, application/database patches
- Server updates and upgrades that will take the system offline
- Installing new network appliance or servers
- Network device upgrades, patches or configuration changes
- Scheduled outages
- New software/system installation that will impact multiple users
Each change must have the appropriate risk level as determined by the change initiator and or ITS.
Emergency Changes will have documentation stating why the implemented change was an emergency. (An emergency change is a change that must meet a business or security need and must be implemented before the change committee meets.)
Change implementer must communicate the change updates and possible impact to all users that may be impacted by the change
Change State and Status
Changes can be in 4 states – Canceled, closed, in-progress, open. The status of change will be open until the change is approved and it goes to In-Progress
A change status can be, Approved/Rejected/Pending
- Approved – the change has been successfully approved for production implementation by the change committee
- Rejected – the change has been rejected by the committee and will not be allowed to move forward unless a risk exception is submitted
- Pending – the committee requires more information before making a decision
General Change Procedure
- If possible, all changes should be implemented in a test environment, tested and signed off by the information owner before submitting any changes
- Once approved by the information owner, download the change management form from https://www.pvamu.edu/its/forms/
- Submit forms to the change coordinator (Information Security Analyst – Mr. Henry Rose) by 5:00 pm on Friday the week of change – Change Management request can be submitted any time before the Monday for the week of change.
- Change coordinator will invite requester to change management meeting held on Tuesday at 10:30 pm-11:30 pm, via WebEx.
- If disapproved by the committee notify the information owner, if more information is needed, the change will be marked as pending
- If approved, document the change approval in the change log and notify change initiator of the approval.
- Change initiator will schedule the change during a normal change window, emergency changes are scheduled on an as needed schedule.
- The information owner will verify the success of the change and provide feedback to ORIM and ITS
- Communication will be sent out to all impacted information owners notifying them of the change
- In case of an emergency change, change initiator will implement the change and submit documentation* to the change management committee for approval at a later date.
- The information owner will verify the success of the change and provide feedback to the change committee
- The change manager will ensure that all changes are documented
*All changes submitted should also include and codes/packages that will be
implemented in the production environment by ITS
Banner Change Procedure
UAP: The change management procedure is the implementation of UAP 29.01.03.PO.17 and can be viewed at https://www.pvamu.edu/sites/policies/uap/29.01.03.P0.17.pdf
Scope: This SOP applies to all Banner changes inclusive of maintenance and patching on the campus of Prairie View A&M University. Changes made to non-production and DRP systems are outside the scope of this procedure.
Due date: All change forms must be submitted to Banner System Owner by 5:00 p.m. Friday prior to the Change Management Meeting which is held every Tuesday.
All documentation related to the change should be kept in a manner compliant with audit specifications. These documents can also be viewed to analyze the changes for possible improvements to the business process or for root cause analysis of the change. The review process will also aid in identifying which changes can be classified as task and implemented through a ticket.
Banner Change Procedure
- If possible, all changes should be implemented in the test environment, tested and signed off by the information owner/requestor before submitting any changes.
- Once approved by the information owner/requestor, download the change management forms from https://www.pvamu.edu/its/forms/.
- Change initiator will submit the change request form to ITS to be vetted.
- Once approved, ITS will submit forms to Banner System Owner prior to the Change Management Meeting.
- Upon approval to move forward, the Banner System Owner will file the requests in Laserfiche and email the change coordinator the changes before the change committee meets.
- The change coordinator will send out a meeting agenda before the meeting inviting the change committee members, ITS and the change initiator if necessary.
- If disapproved by the committee, notify the change initiator; if more information is needed, the change will be marked as pending.
- If approved, document the change approval in the change log and notify ITS of the approval. The Banner Owner will change the status to “Approved” in Laserfiche.
- ITS will schedule the change during a normal change window based upon the urgency of the change and the impact of the change.
- ITS will provide change documentation* and implement the change.
- Upon Implementation, ITS will update Laserfiche to “Processed” notify Banner Manager and the change initiator of change success.
- The change initiator will verify the success of the change and provide feedback to OIRM and ITS.
- Communication will be sent out to all Banner information owners notifying them of the change.
- In case of an emergency change, ITS will implement the change and submit documentation* to the change management committee for approval at a later date.
- The change initiator /ITS will verify the success of the change and provide feedback to the change committee.
- The change coordinator will ensure that all changes are documented.
- *All changes submitted should also include and codes/packages that will be
implemented in the production environment by ITS.