This System Change Policy covers the planning and implementation of changes to information systems and applies to the entire information security program at the Netspective Communications LLC, including technology and documentation. All personnel, including employees, contractors, and service providers, must comply with this policy. [FII-SCF-004-CHG-02]
-
To make any changes to a system’s security architecture or customer data handling, a written request must be submitted to the Project Manager of the organization and approved by both the Project Manager and the Chief Executive Officer (CEO).
-
All requests for changes must be documented using Git tickets.
-
The prioritization of change requests must be based on the benefits, urgency, required effort, and potential impact on the organization’s operations.
-
Any changes made must be communicated to the relevant users.
-
Change management must follow this procedure:
-
Planning: Plan the change, including designing the implementation, creating a schedule, and developing a communication plan, testing plan, and roll-back plan.
-
Evaluation: Evaluate the change, considering the service’s priority level, and any risks the proposed change could introduce to the system. Determine the change type and the specific steps to implement the change.
-
Review: Review the change plan with the CEO, Project Manager, and Engineering Lead.
-
Approval: The CEO/Project Manager must approve the change plan.
-
Communication: Communicate the change to all users of the system.
-
Implementation: Test and implement the change.
-
Documentation: Record the change and any post-implementation issues.
-
Post-change review: Conduct a post-implementation review to determine the change’s impact on the organization, positively or negatively. Discuss and document any lessons learned.
Change Management Ticket
-