Change Management Policy

Purpose

To outline the processes that Information Technology Services (ITS) will follow to minimize risks associated with changes when adding, modifying, or removing anything that could have an impact on university Information Technology Resources (ITRs). 

Scope

The policy covers all changes made by ITS staff to any ITR being used in a production environment at the university.  ITS staff may elect to follow this policy for any ITR being used in a non-production environment. 

Policy

Types of change 

All changes to ITRs will be classified as normal changes, standard changes, or emergency changes.  Each change type is defined in the appendix. 

Review Required for normal changes 

Changes must be initiated in ServiceNow.  Configuration Item and impacted business service are required fields.  Requesters should provide as much detail and information about the system and its impact as is reasonable for an approver to understand the scope.  Dates should be included.  The Assignment Group field should contain the group who will complete the change. The initiator must submit the change to request approval.  

The change record must be sent to members of the Change Approval group. The senior leader responsible for the affected system shall review and, if appropriate, document that approval in change the request record. 

Review not required for standard changes 

Standard changes do not require approval. 

Process for emergency changes 

By their nature, emergency changes are required to restore a service and do not wait for approval.  

Exceptions 

All exceptions to this policy require written approval from a member of the ITS Leadership Team. 

Appendix 

Definitions and Terms 

Information Technology Resources (ITRs) – This includes, but is not limited to, end-user computing devices, services, networks, email, software, printers, scanners, video distribution systems, telephone systems, fax systems, and other computer hardware and software, whether owned by the university or contracted by the university from a third party. 

Normal changes – Require approval from the Change Approval group. These changes can result in downtime to the broad user community. Changes that affect large systems or could impact multiple systems. Scheduled changes where the risk and/or impact is high.  

Standard changes – Do not require approval from the Change Approval group.  They have lower risks and impacts. They are often changes to minor systems used by fewer people.  They can also include changes in a controlled environment.  Server OS upgrades fall into this category unless they carry an unusual risk.  

Emergency changes –  changes that would normally require approval and performed to fix an outage or severely impacted service. 

Approval History 

Approved 11/14/2025