IT Change Management

All aspects of IT Change Requests are managed in ServiceNow

Per SLAC Change Management Policy, all changes to IT production systems need to be logged into ServiceNow.

Break/Fix is an incident, not a change request. An emergency reboot to restore service does not require a change request.

Changes to a project budget, schedule or scope need not be logged into ServiceNow. However, when the Project is ready to become a Production Service, a ServiceNow change request must be submitted.

Individual password changes do not need to be logged in Change Management. Any Service Account password change should be entered into Change Management as a Comprehensive Change.

Plan your request as well in advance of the change as possible. Submit your request after the stakeholder has approved.A week's notice is preferred.

If the Planned Start Date is within three business days, ServiceNow automatically categorizes it as an Emergency Change Request. Otherwise, it is a Comprehensive Change Request.

Any changes to a security modification need to be a comprehensive change to allow time for security review.

A comprehensive Change Request that has been approved by the CAB to be considered a Routine change. These require only manager approval and do not go through the CAB approval process. The list of approved Routine changes (see below) is periodically reviewed by the CAB.

• Monthly Windows Patching Desktop
• Monthly Windows Patching Servers
• Development Operations - Applications Development Bi-weekly Application Release
• Security update/remediation as a result of vulnerability scans
• Service Account Password Change
• Rack Location Change
• Load Balancer Configuration Change
• Firewall Rule Change
• System Secure Socket Layer (SSL) certificate updates
• Active Directory Schema Attributes Change - Additions / Edits / Deletions
• DoNotScan List Change - Additions / Edits / Deletions
• P2V Server Migration
• Monthly PeopleSoft Business Systems Windows Patching
• Minor changes to existing forms and workflows in numerous platforms

Change implementers must close all related workflow tasks. When all tasks are closed, the change request will be closed automatically.

Change Advisory Board meetings occur every Monday at 11:00AM on zoom.  Contact the CAB Chair, Kevin Purcell (kpurcell@slac.stanford.edu) for more information and/or invitation to the meeting.

• review all change requests
• assess a proposed change's potential impact
• enter work notes to delay approval, if needed
• approve/disapprove requests as appropriate
• participate in meetings
• resolve cases when multiple changes are scheduled for the same time
• engage subject matter experts to advise on requests

A majority is required to approve a change.

• check for completeness (security review, stakeholder approval, regulatory and security modifications, etc.)
• assess potential conflicts

Yes. The vote of the delegate can be captured in an ad hoc fashion with notes entered on the change request. You can also delegate authority through ServiceNow's delegation function.

The CAB is composed of voting and non-voting members drawn from the SLAC IT and across the Lab.

The original CAB membership was determined via nomination by the Change Management Implementation Team. Per the Change Management Policy: F.1.7, “The Chair of the CCB is responsible for determining the ultimate composition of the CCB”. Nominations for membership may submitted by an acting voting member of the CAB. Nominations will be voted upon by the CAB. If a majority of votes is received for the candidate, the nomination is submitted to the Chair for approval or disapproval. Voting and non-voting members are drawn from SLAC IT and across the Lab.

Change Owners are expected to close the Change Request once the Change has been implemented successfully in production. There is currently no guidance on how long one should wait before closing the Change Request. Typically most Change Requests are closed with a few days to a week after implementation.