Page Text: The Incident Response policy does not apply to Security Incidents, which are covered by the Information Security Manual section 502 : Incident Response and Escalation.
Types of Changes
The IS Change Management Policy defines three types of changes based on the ITIL framework for service delivery. These changes are:
1. Standard Change – A repeatable change that has been pre-authorized by the Change Authority by means of a documented procedure that controls risk and has predictable outcomes.
2. Normal Change – A change that is not an Emergency change or a Standard change. Normal changes follow the defined steps of the change management process. Low, Medium, or High priority is determined by Unit Directors or delegates.
a. Normal Low Changes must be reviewed and approved by the Unit Director or delegate as Change Authority.
b. Normal Medium Changes must be reviewed and approved by the Change Advisory Board as Change Authority.
c. Normal High changes must be approved by the IS Executive Team as Change Authority.
3. Emergency Change – A change that must be introduced as soon as possible due to likely negative service impacts. There may be fewer people involved in the change management process review, and the change assessment may involve fewer steps due to the urgent nature of the issue; however, any Emergency Change must still be authorized by a manager and reviewed by the Change Advisory Board retroactively.