Change management

[Wright, John M]

I’d like to suggest some kind of change management to my IT bosses.  Just some kind of procedure for airing proposed changes so that people know what’s coming.  Ideally, changes would be requested, approved, circulated in a weekly report, and possibly discussed in a short conference call.

 

My questions:

 

1. Any ideas on how to best pitch this?  I imagine the main objection will be that it adds one more chore/item to staff workload.  But I think it could save trouble/confusion in future.
2. Do you know of any good templates for a change request form or summary of weekly changes?

 

--

John Wright

IT Support Specialist

1800 Old Bluegrass Avenue, Louisville, KY 40215

502.708.9953

Please submit IT requests to Hazelwoo...@bluegrass.org

24 Hour Helpline 1.800.928.8000

  

CONFIDENTIALITY NOTICE: This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the named addressee, you should not disseminate, distribute, or copy this e-mail. If you are not the intended recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited.

 

[James Iversen]

If you choose to go with some form of service desk management software, don’t try to reinvent the wheel. Use as many default out of the box workflows the publisher provides. Otherwise, you’ll end up with something of a logistical nightmare. Ask me how I know. 

It’s like the ultimate cya when implemented correctly. Approvals, notifications, scheduling, planning, rollbacks, impact rating, etc. 

I think someone who comes up with a system you can marginally improve to tailor your environment needs will make a mint. The real magic is in the workflows. 

Sent from my iPhone

On Oct 30, 2025, at 8:22 AM, Wright, John M <John....@newvista.org> wrote:



I’d like to suggest some kind of change management to my IT bosses.  Just some kind of procedure for airing proposed changes so that people know what’s coming.  Ideally, changes would be requested, approved, circulated in a weekly report, and possibly discussed in a short conference call.

 

My questions:

 

1. Any ideas on how to best pitch this?  I imagine the main objection will be that it adds one more chore/item to staff workload.  But I think it could save trouble/confusion in future.
2. Do you know of any good templates for a change request form or summary of weekly changes?

 

--

John Wright

IT Support Specialist

<image001.png>

1800 Old Bluegrass Avenue, Louisville, KY 40215

502.708.9953

Please submit IT requests to Hazelwoo...@bluegrass.org

24 Hour Helpline 1.800.928.8000

<image002.png>

  

CONFIDENTIALITY NOTICE: This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the named addressee, you should not disseminate, distribute, or copy this e-mail. If you are not the intended recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited.

 

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SN7PR12MB6714DF77EA71A53DCE085DBB91FBA%40SN7PR12MB6714.namprd12.prod.outlook.com.

[Belanger, Xavier B]

Hi,

Question part 1: accountability, documentation, audit. You can explain that having a formal process to authorize changes should reduce the risk of outages, bugs and similar configuration issues. Of course, this is not 100% guarantee, but this should be better than most prior situations. I will also allow to have a clear calendar of what happened and when.

As for the documentation, since most professionals are not good a writing any, this could be used as a reference on what device or piece of code is doing and who's responsible for it. Again, not perfect, but better than nothing.

Last, if your organization is planning to be compliant with some kind of standard or regulation, there is usually a requirement for a change control process.

Question part 2: Here what could be in your form:

• Name of the change
• Scheduled Date
• Person implementing the change
• Person testing the change / confirming results
• People approving the changes (two minimum, three would be better, cannot be the person responsible for said change)
• Test results (if the change can be tested outside of production)

• Rollback strategy (what would need to be done in case something goes wrong. Backups anyone?)
• Expected impact (would that affect people only inside the organization, customers, third-parties, ...?)
• And then once the change is completed, a field to record the results.

There was a place where I've worked where someone at the management level was even asking for the entire change process to be included in the ticket (down to the commands to execute) "in case someone else would need to carry the change at the last minute". That was a good intention but probably a little overkill.

I would recommend looking at the "The Practice of System and Network Administration" book (https://the-sysadmin-book.com/). My old edition as a whole chapter about change management. (And it's a good book to have anyway!)

Hope this helps.

Sincerely,

-- 
Xavier Belanger

IT Security Architect | CISSP | Office of Information Security

University of North Carolina Wilmington

 

---

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> on behalf of Wright, John M <John....@newvista.org>
Sent: Thursday, October 30, 2025 08:22
To: ntsys...@googlegroups.com <ntsys...@googlegroups.com>
Subject: [ntsysadmin] Change management

 

[This email originated from outside of UNCW]

--

[Erik Goldoff]

as far as pitching, a proper change control process

• shows business units that IT is collaborative, not isolated
• defines risk of current condition, risk and benefit of change
• documents sequence of changes over time
• prevents loss of 'institutional knowledge' with staff turnover
• shows proper due diligence
• isolates to single change at a time ideally
• provides dates and actions taken for compliance audits
• Keeps chain of command in the loop of critical activities
• prevents 'knee jerk' or 'on the fly' changes few know about

At a minimum, a change request should include 

• What change is being requested
• Why the change is being requested, ie what benefit
• Who the business stakeholders are, to be notified or decision authority
• who approved the change, or who/why declined
• When the change will take place (maintenance window or 'emergency')
• implementation plan - overview of how change will be made, to include referencing backup process
• validation plan - overview of how completed implementation can be proven successful
• backout plan - overview of how to revert to prior (unchanged) condition should implementation fail

This is off the top of my head before finishing my first cup of coffee, but I think this is a fairly comprehensive outline.  I hope it helps you develop your own process

Erik

--

[Logsdon, Eric]

As to it adding workload and slowing down the implementation process, I told my staff when they made that argument to me many years ago, that it was my job to slow down the implementation so we could make sure we were ready to implement. All members of the team (we didn’t have a change control committee) were encouraged to express any reservations during the change review. Sometimes late is better than broken.

 

--

Eric Logsdon

Product Manager

Cooperative Technologies, Inc.

(404) 315-4450 x110

ELog...@CooperativeTechnologies.com

http://CooperativeTechnologies.com

 

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CH2PPFC6B831EFC90898D4245116522B101C3FBA%40CH2PPFC6B831EFC.namprd06.prod.outlook.com.

[Wright, John M]

Thanks all for the suggestions.  I’ll digest this, and look at what we have already in place to implement a process.  I’ll also be taking a look at that sysadmin book.  It seems to cover everything in operations.

 

Incidentally, all this came to mind (not for the first time) when we recently had a sudden rollout of MDR agents that resulting in one particular application choking on the bone.  I didn’t suspect the cause at first because I didn’t know the agent was installed.

 

--

John Wright

IT Support Specialist

1800 Old Bluegrass Avenue, Louisville, KY 40215

502.708.9953

Please submit IT requests to Hazelwoo...@bluegrass.org

24 Hour Helpline 1.800.928.8000

  

CONFIDENTIALITY NOTICE: This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the named addressee, you should not disseminate, distribute, or copy this e-mail. If you are not the intended recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited.

 

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Erik Goldoff
Sent: Thursday, October 30, 2025 8:48 AM
To: ntsys...@googlegroups.com
Subject: Re: [ntsysadmin] Change management

 

EXTERNAL EMAIL - This email was sent by a person from outside your organization. Exercise caution when clicking links, opening attachments or taking further action, before validating its authenticity.

Secured by Check Point

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAGMVfXTBEtvYtqVV_4rh%3D%3DkHdpxCSVpaFv_deR%2BBku%3DGUT%3Dqtw%40mail.gmail.com.

[Erik Goldoff]

so you can also pitch a more formal change control process as part of the 'No Repeat Plan' for a previous business outage!

Erik

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SN7PR12MB6714235ACF43800990701B8291FBA%40SN7PR12MB6714.namprd12.prod.outlook.com.

[Kurt Buff]

Tom Limoncelli also broke out one of the chapters into a separate book on time management.

His stuff is excellent.

Kurt

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CH2PPFC6B831EFC90898D4245116522B101C3FBA%40CH2PPFC6B831EFC.namprd06.prod.outlook.com.

[Henry Awad]

I would add that having a change control process would prevent multiple changes that impact each other from taking place at the same time. It also provides different teams with awareness and the ability to highlight any indirect impact that the change might have on their systems/applications. 

By having a peer review the change control request provides a second set of eyes on the process to find any gaps or missing steps to minimize risk and down time.

Lastly, I would add the following to the change control process:

Start and end time of change

Start and end time of outage since not all changes require an outage

If it's a recurring change (like monthly patching on a regular schedule), it shouldn't require as many approvals but should still be included in the change control meeting for awareness especially if the change will take place outside the normal schedule (patching a zero day vulnerability much earlier than normal)

Henry

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CADy1Ce7wgvBakbp6wQWHvnwRjB%3DB357%3DfbS%2Be7JEhKi6SCrPWQ%40mail.gmail.com.

[Erik Goldoff]

I have to agree, because you are restating what I already posted earlier today 😉

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/CAGaCHK5qo3u-M%2B%3DSk57e1EFZGmCvOws2FQUw%3Dq3MPKkST6t2Xw%40mail.gmail.com.

[Heaton, Joseph@Wildlife]

I sent you an example of our blank OCAB (Operational Change Approval Board) request form.  We had a contractor years ago build an app in Sharepoint for us. Auto routing of information, layers of approval, etc.  Also puts it on a change calendar, so we can reference back to see what’s going on.

 

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Wright, John M
Sent: Thursday, October 30, 2025 6:29 AM
To: ntsys...@googlegroups.com
Subject: RE: [ntsysadmin] Change management

 

WARNING: This message is from an external source. Verify the sender and exercise caution when clicking links or opening attachments.

 

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SN7PR12MB6714235ACF43800990701B8291FBA%40SN7PR12MB6714.namprd12.prod.outlook.com.

[Wright, John M]

Thanks very much.  I’ll look for the form over today.  We have a Sharepoint server available so we might very well go that route for an application.

 

--

John Wright

IT Support Specialist

1800 Old Bluegrass Avenue, Louisville, KY 40215

502.708.9953

Please submit IT requests to Hazelwoo...@bluegrass.org

24 Hour Helpline 1.800.928.8000

  

CONFIDENTIALITY NOTICE: This message contains confidential information and is intended only for the individual(s) addressed in the message. If you are not the named addressee, you should not disseminate, distribute, or copy this e-mail. If you are not the intended recipient, you are notified that disclosing, distributing, or copying this e-mail is strictly prohibited.

 

From: 'Heaton, Joseph@Wildlife' via ntsysadmin <ntsys...@googlegroups.com>
Sent: Tuesday, November 4, 2025 5:38 PM
To: ntsys...@googlegroups.com
Subject: RE: [ntsysadmin] Change management

 

EXTERNAL EMAIL - This email was sent by a person from outside your organization. Exercise caution when clicking links, opening attachments or taking further action, before validating its authenticity.

Secured by Check Point

 

I sent you an example of our blank OCAB (Operational Change Approval Board) request form.  We had a contractor years ago build an app in Sharepoint for us. Auto routing of information, layers of approval, etc.  Also puts it on a change calendar, so we can reference back to see what’s going on.

 

From: ntsys...@googlegroups.com <ntsys...@googlegroups.com> On Behalf Of Wright, John M
Sent: Thursday, October 30, 2025 6:29 AM
To: ntsys...@googlegroups.com
Subject: RE: [ntsysadmin] Change management

 

WARNING: This message is from an external source. Verify the sender and exercise caution when clicking links or opening attachments.

 

Thanks all for the suggestions.  I’ll digest this, and look at what we have already in place to implement a process.  I’ll also be taking a look at that sysadmin book.  It seems to cover everything in operations.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SN7PR12MB6714235ACF43800990701B8291FBA%40SN7PR12MB6714.namprd12.prod.outlook.com.

--
You received this message because you are subscribed to the Google Groups "ntsysadmin" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ntsysadmin+...@googlegroups.com.

To view this discussion visit https://groups.google.com/d/msgid/ntsysadmin/SJ0PR09MB10727A918F217C53FB8E0F051AAC4A%40SJ0PR09MB10727.namprd09.prod.outlook.com.