To establish a standard for assessing impact and change and requests for change.
This standard applies to assessment of priority and impact under the Change Management Policy.
Emergency Change – Emergency Changes are implemented quickly to avoid major impact to business and/or to resolve a severe incident. Additionally, since they must be implemented as quickly as possible, emergency changes typically involve greater risk.
Normal Change – A change that is neither pre-authorized nor emergency.
Request for Change – A broadly-defined term that describes the overall process of requesting a change. The Request for Change contains different components dependent on the nature and type of change discussed. Alternative terms are: change request or change form.
Risk – A situation involving exposure to danger.
Impact – The level to which university operations are affected.
Impact assessment serves as another way to ensure proper vetting of change requests. The process is informational in nature for the CAB to understand the significance of the change requested.
Impact Assessment is utilized for emergency and normal changes. Risk is utilized in two areas in requests for change: Priority and Risk Impact.
For the priority of a change request, risk is separated into three levels: low, medium, and high. Risk is determined by the best effort of the change owner in regards to how disruptive implementing the change may be to the University environment.
Impact assessment provides additional information for the CAB to understand the significance of the change requested. A score is calculated based on a 4-point scale: low (1 point), medium (2 points), high (3 points), and major (4 points). This calculation is based on a series of four questions, an affirmative answer to any question adds one point to the impact analysis level. The questions are:
- Not during normal maintenance window?
- Requires service outage?
- Mission or Business critical?
- Information Security Related?
Will contain links to other policies, standards, guidelines and/or procedures that impact, clarify, or implement this policy.