Change Advisory Board (CAB) Policy
Approved by the CPPC 10/3/2024
Purpose
The Change Advisory Board (CAB) provides oversight and recommendations for IT changes to ensure that they are properly reviewed, authorized, and aligned with business requests and objectives. The CAB aims to minimize risk and disruption while facilitating the smooth implementation of necessary IT changes to Reed’s shared networked environment.
Scope
This policy applies to all proposed changes to IT systems, services, infrastructure, and applications that may impact operations, performance, or security.
Responsibilities
- CAB Members: Review, evaluate, and provide recommendations on proposed changes.
- Change Requester: Submit detailed change requests with relevant information.
- CAB Chair: Facilitate meetings, ensure compliance with policy, and escalate critical issues when necessary.
Change Classification
Changes are classified into three categories:
- Standard Changes: Pre-approved, low-risk changes that do not require CAB review.
- Normal Changes: Require full CAB review and approval.
- Emergency Changes: Critical changes needed to resolve major incidents, requiring expedited CAB review.
Process
- Submission: Change requests must be submitted with sufficient details, including risk assessment, testing plans, and rollback strategies.
- Review: CAB meets regularly to review normal and emergency change requests. Standard changes are handled through an automated workflow.
- Approval: The CAB recommends approval, denial, or additional action before implementation.
- Post-Implementation Review: CAB conducts a review of major changes to assess their success and identify any issues.
Meetings
CAB meetings will occur on a regular schedule (e.g., bi-weekly) or on an ad-hoc basis for emergency changes.
Compliance
All changes must comply with organizational policies, security standards, and compliance and regulatory requirements.
Policy Review
This policy will be reviewed annually or as required by business needs.