Change Management Policy

by Whitney Myers

Purpose

The purpose of this policy is to provide guidance on the process of managing change across Zuar's critical systems and products.

Achieving Zuar's business goals requires continuous innovation and rapid improvements to its products and tools. Since any product development carries additional risk, it is imperative that Zuar follow a well-defined process to ensure that sufficient checks and balances are in place to mitigate this risk.

Scope

The policy covers changes to Zuar's production systems, as well as to related tools classified as Customer Confidential as per the Data Classification Policy.

Outside of the scope of this policy are changes such as:

  • Changes in development environments
  • Internal document updates
  • Routine IT changes such as fixing a computer or a printer
  • Management of user access to various systems, which is subject to the Access Control policy
  • Resolution of data or configuration issues for a particular customer as a result of a support ticket
  • Data changes resulting from the use of a established, special-purpose tools or user interfaces

Ownership

Engineering is responsible for implementing and maintaining this policy for critical systems housing Customer Confidential. For all other systems, this policy is maintained by Whitney Myers.

Policy Statement

Zuar performs changes on its production systems by following the Change Management Policy outlined in this document and related procedures.

Infrastructure-as-code

All infrastructure is managed as code and follows the standard code review process including approvals and automated testing.

Infrastructure-as-code is the process of configuring infrastructure through the use of scripts or declarative configuration files, as opposed to manual configuration via interactive configuration tools. Infrastructure code is stored in source control, alongside application code, enabling the same tracking, review and approval processes that are followed by application code.

This approach greatly decreases the risk of human error by creating repeatable processes, and improves development velocity, capacity management responsiveness, and Disaster Recovery due to fewer manual steps required to configure and provision systems.

Change Management Workflow

The Change Management documentation outlines the internal workflow for propagating application and infrastructure code changes to the production environment, including tracking, testing, reviewing and approving.

Zuar maintains a detailed change management procedure. The procedure describes the processes followed as changes ow from development to production, including:

  • How changes are developed within a development environment
  • How changes are tested, including unit, integration, end-to-end, manual, load, and acceptance testing
  • How changes are documented and communicated internally and externally
  • How changes are reviewed, including a feedback process leading to eventual approval
  • How changes are deployed
  • How changes are monitored post deployment and reverted if needed

To support the business goal of high development velocity at low risk, Zuar's change management procedure is maintained as a living document, and is continuously updated.

The documented change management procedure is maintained in Zuar's internal knowledge base. Following best practices, many aspects of the procedure are automated, and as such, do not require additional documentation aside from that which is already a part of their implementation.

By default, performing any step outlined in the change management workflow results in the creation of a log entry for auditing and improvement purposes. Such steps include test runs, the approval flow, and the execution of deployment commands.

Change Management Approvals

All application and infrastructure changes are reviewed by a separate technical resource and approved by authorized personnel before being delivered to the production environment.

Before any new code change is merged into the code base, it must be submitted for review as a pull/merge request. A detailed overview of the code review process is part of Zuar's internal development process documentation.

A code review is typically performed after any relevant automated tests have passed, to ensure that the reviewer's time is efficiently allocated.

Depending on the component being changed and the criticality of the change, a review may require approval from multiple individuals.

Emergency changes

During an active incident involving downtime, performance degradation, or a security issue, some workflow checks and reviews may be expedited in order to fast track the change and patch the ongoing issue. Any such incidents must be evaluated on a case-by-case basis, and require the explicit approval of the incident manager.

Commonly, any workflow steps skipped as a result of an emergency change must be completed retroactively once the incident has been resolved.

  • Infrastructure-as-code
  • Change Management Approvals
  • Change Management Workflow
  • SDLC - Separation of environments
  • SDLC - Security Reviews
  • Change Management Tooling
  • Agile Process