Many disruptions in IT operations are not caused by defective hardware but by changes: an update, a modified firewall rule or a new configuration. Change management ensures that such interventions are planned deliberately, checked for risks and documented in a traceable way. It is a core process of IT service management.
The goal is not to slow down changes but to make them predictable. When a disruption occurs, a well-maintained change log also quickly shows what changed shortly before, which shortens troubleshooting.
How does change management work?
A typical process has five steps:
- Request: The change is described: what, why and which systems are affected.
- Assessment: Risk, impact, dependencies and effort are estimated. This includes a fallback plan.
- Approval: Depending on the risk, a responsible person or a committee, the Change Advisory Board, decides.
- Implementation: usually in an agreed maintenance window, with tests before and after the change.
- Closure: Check the result, update the documentation, record lessons learned.
Changes are usually divided into three types. Standard changes are low-risk, recurring and pre-approved, for example installing monthly updates according to a fixed procedure. Normal changes go through the full process. Emergency changes are implemented quickly for acute problems and fully documented afterwards.
Typical examples
- The switch of the email infrastructure to Exchange Online is carried out with a schedule, employee communication and a fallback plan.
- A change to firewall rules that affects several sites is coordinated with everyone involved in advance.
- A security update for an actively exploited vulnerability is installed at short notice as an emergency change, coordinated with patch management.
What companies should keep in mind
- Match the effort to the risk: simplify routine changes as standard changes so that the process is not bypassed.
- Keep a tested fallback plan ready for every major change.
- Evaluate failed changes: if problems pile up with certain types of changes, the assessment must become more precise.
- Inform affected people in good time, especially when downtime is expected.
- Update the IT documentation after every change.
How it differs
The term change management also refers to organizational change management, that is, guiding people through restructuring. In IT, however, it means the process described here. Newer ITIL versions also call it change enablement.
View GRID.patch