Why Change Management Matters
Uncontrolled changes are a leading cause of IT outages. Change management provides: documented approval process before changes are made, risk assessment to understand potential impact, rollback plan if the change causes problems, communication so stakeholders know what's changing and when, documentation for audit and future reference. ITIL (Information Technology Infrastructure Library): widely adopted framework for IT service management. ITIL Change Management defines types of changes and approval workflows. Even in small organizations without formal ITIL processes, the principles apply: document, test, approve, communicate, execute, verify, rollback if needed.
Types of Changes
Standard change: pre-approved, routine, low-risk, well-documented procedure. Examples: adding a new user account, replacing a standard workstation. No CAB approval needed — just follow the SOP. Normal change: requires planning, risk assessment, and CAB approval. Examples: OS upgrade, network reconfiguration, major application update. Emergency change: urgent change to restore service or address critical security vulnerability. Expedited approval process (e-mail or phone CAB approval instead of scheduled meeting). Examples: applying a zero-day security patch, restoring from backup after a disaster. Change categories by impact: Minor (low risk, single system or user), Major (high risk, affects multiple systems or many users), Significant (enterprise-wide or critical system impact).
Change Advisory Board (CAB)
CAB (Change Advisory Board): governance body that reviews and approves change requests. Members: IT management, representatives from affected business units, technical leads. Responsibilities: review submitted change requests, assess risk and impact, approve or reject, prioritize, schedule maintenance windows. Change request documentation for CAB: description of the change, reason/business justification, risk assessment (what could go wrong?), rollback plan (how to undo if it fails), testing plan, communication plan, scheduled maintenance window, implementation steps. Change freeze: period during which no changes are allowed (end of financial quarter, holiday season, major business events). Emergency changes require elevated justification during a change freeze.
Rollback Plans
Every change should have a documented rollback plan — how to undo the change if it causes problems. Pre-change checklist: take snapshots/backups before making the change, document current state (current configuration, version numbers), test the rollback procedure in a lab if possible. Common rollback methods: VM/server snapshot — revert to pre-change state. Configuration backup — restore config file from before the change. Uninstall application update, reinstall previous version. Roll back driver (Device Manager → Roll Back Driver). Restore from system backup (Windows System Restore, Time Machine). Rollback decision point: define ahead of time when you will pull the trigger on rollback (e.g., 'if service is not restored within 30 minutes, we rollback'). Post-change verification: test that the change achieved its goal and did not break anything else. Define specific test cases before the change window.