Change and Configuration Management Policy

PurposeCopy Anchor Link

Establish a clear framework for managing changes and configurations in infrastructure and applications, ensuring proper planning, authorization, testing and documentation.

ObjectivesCopy Anchor Link

• Record, review and carry out changes consistently.
• Minimize risks to operations and customers.
• Maintain a complete audit trail.
• Establish and apply standard templates for secure configurations.
• Record and control all configurations.

ScopeCopy Anchor Link

Applies to all changes to infrastructure (Linux, AWS, databases, etc.) and application configurations (accounts, roles, authentication, etc.), as well as to the configuration management of hardware, software, services and networks. It includes all employees and contractors.

DefinitionsCopy Anchor Link

• Change: Adding, modifying or removing any Configuration Item (CI).
• Deliverable: Output of a process with value for a customer or interested party.

ResponsibilitiesCopy Anchor Link

• Change Analyst: Coordinates the change from start to closure, ensuring requirements are met.
• Change Manager: Oversees the daily execution of the process, manages critical changes and ensures the integrity of the process.

Change Management ProcessCopy Anchor Link

1. Record: Create a change record using the official form.
2. Review and Approve: Validation by security or management.
3. Classify:
   • Minor: Routine changes.
   • Major: Impact on customer data or facilities.
   • Emergency: Urgent change outside the standard process, documented retrospectively.
4. Assess Risk: Analyze the impact and associated risks.
5. Implement: Carry out according to the mitigation plan.
6. Verify and Communicate: Confirm effectiveness and notify interested parties.
7. Monitor and Review: Post-implementation review to validate results and document lessons.

Configuration ManagementCopy Anchor Link

• Maintain secure configuration templates and update them regularly.
• Minimize privileged access and disable unnecessary services.
• Keep configuration records with owner, date and version.

Impact on Business ContinuityCopy Anchor Link

• Changes can cause temporary disruptions and staff resistance.
• Communication or resource allocation problems can affect productivity.
• Identify and manage unforeseen problems to maintain continuity.

Resources for Implementing ChangesCopy Anchor Link

• Financial: Adequate budget and ROI assessment.
• Human: The necessary skill set and staff availability.
• Technological: Compatible infrastructure and system upgrades if necessary.

Impact on Roles and the BCMSCopy Anchor Link

• Changes can affect emergency teams, crisis communication and plan owners.
• IT staff may need role updates according to new systems and processes.

Monitoring and ReviewCopy Anchor Link

• Continuous oversight by management and information security.
• Configurations verified with automated tools and deviations corrected.
• Periodic review of change and configuration management practices to keep them effective and aligned with threats and organizational needs.