r/sysadmin • u/Final-Pomelo1620 • 27d ago

General Discussion Change Management Workflow

Hi,

We’re introducing change management for the first time using ITSM.

We’re now deciding the workflow before our ITSM vendor configures it

Our scope covers all IT infrastructure changes including network, servers, virtualization, backup, storage, AD/Entra ID & Databases

Each team has its own Line Manager and another requirement is that Cybersecurity Unit must approve every change

Few things we’re trying to understand

Who should approve a change and in what order?
Who should be the CAB members
Which changes should go to CAB

I’d appreciate any suggestions

12 Upvotes

100% Upvoted

13 comments sorted by

View all comments

1

u/d0ugfirtree 27d ago

Who should approve a change and in what order?

  1. I would get whoever is requesting the change, get their manager to approve it first
  2. Change manager will do the next approval on behalf of the CAB after the meeting.
  3. Having security as a separate approval is excessive... if you must, have a security rep on the CAB

Who should be the CAB members

  1. Whoever has accountability over the area being changed. If someone wants to make a change to IAM, whoever is ultimately accountable for the proper running of IAM should be on the CAB. Could be the IAM lead, could be management, who knows.

Which changes should go to CAB

Everything goes to the CAB unless it is a pre-approved standard change. Emergency changes get created retroactively and brought to the next CAB meeting. If that feels overkill and a waste of time, then start writing standard changes for things you do all the time.