Change Control Process - Technician's Perspective

Introduction

Change control ensures that IT changes are documented, reviewed, and implemented properly. Technicians are responsible for executing the actual changes as per the change control plan.

Technician's Role in Change Control

Change control defines what needs to change, while the technician executes the change.

Example: A technician may update allow lists or deny lists to control which applications can run in an environment.

Allow List vs. Deny List

• Allow List: Only approved applications can run; everything else is blocked.
• Deny List: Any application can run except for those explicitly blocked.
• Example: Antivirus software operates like a deny list, blocking known malware.

Scope and Documentation

Change control has strict scope limitations. Technicians can only make changes explicitly approved by the change control board.

Managing Downtime in Change Control

• Many changes require downtime, which is scheduled during non-production hours (overnight or weekends).
• For 24/7 organizations, downtime may not be an option.
• Solution: Implement a primary-secondary system for seamless transitions.

System Reboots & Service Restarts

Some changes require a system reboot or service restart to apply changes.

Challenges with Legacy Systems

Legacy applications are outdated but still in use. These apps may:

• Lack developer support.
• Require special handling due to old OS dependencies.

Dependencies in Change Control

Some updates require multiple dependent updates before installation.

Example: Updating firewall management software may require updating all firewalls first.

Importance of Documentation

IT environments constantly evolve, making documentation essential.

• Updates should include network diagrams, IP changes, and application management procedures.

Version Control in Change Management

Version control helps IT teams track and revert changes when needed.

Key Takeaways

• Technicians execute change requests according to predefined scopes.
• Allow/Deny lists control application execution.
• Downtime planning is crucial to minimize disruptions.
• System reboots and service restarts are often needed.
• Legacy applications require special handling and documentation.
• Dependencies may add complexity to updates.
• Version control is critical for tracking and reversing changes.