Change Management Process
A formal change management process: (1) Request: the change initiator submits a change request (CR) describing what is changing, why, and when. (2) Review: the change is reviewed by a CAB (Change Advisory Board) — a group of technical and business stakeholders. (3) Approval: the CAB approves or denies. (4) Implementation: the change is made during an approved maintenance window. (5) Verification: the change is tested and verified to work correctly. (6) Documentation: all records updated — diagrams, IP records, configurations backed up.
Change categories: Standard change — pre-approved, low-risk, routine (e.g., adding a user, resetting a password). Normal change — requires CAB review and approval — most network changes. Emergency change — urgent fix for a critical outage — expedited process with post-implementation review.
Rollback Plan and Risk Assessment
Every change must have a rollback plan — documented steps to reverse the change if it causes problems. A router configuration change rollback plan might be: copy backup config to running-config and reload. Without a rollback plan, a failed change can require hours of recovery instead of minutes.
Risk assessment: evaluate the impact of both implementing and not implementing the change. Consider: maintenance window timing, affected services, number of users impacted, testing in a lab environment first, and notification to affected stakeholders. Changes should be tested in a non-production environment before production deployment.