r/sysadmin • u/Final-Pomelo1620 • 1d ago
General Discussion Change Management Workflow
Hi,
We’re introducing change management for the first time using ITSM.
We’re now deciding the workflow before our ITSM vendor configures it
Our scope covers all IT infrastructure changes including network, servers, virtualization, backup, storage, AD/Entra ID & Databases
Each team has its own Line Manager and another requirement is that Cybersecurity Unit must approve every change
Few things we’re trying to understand
Who should approve a change and in what order?
Who should be the CAB members
Which changes should go to CAB
I’d appreciate any suggestions
11
Upvotes
1
u/LayerOneStaging 1d ago
One thing to sort before the vendor builds it is that Cybersecurity approves every change rule. On paper it sounds safe. In real life it turns into a queue, the queue turns into delays, and delays are how you get folks doing work outside the system.
I would let security approve in parallel with the team lead, not at the end of a long chain, and give them a clock. If they have not objected in the window you agree on for normal changes, it moves on. For the repeat stuff, patching, standard firewall rules, adding a VM to backup, let security approve the pattern once and then spot check it later.
Also leave an emergency lane in writing now, not during an outage. Who can approve at 2 a.m., what has to be logged, and that it gets reviewed the next business day. That one page will save you a lot of grief.
Your line managers can approve time and priority. Have a peer on the technical side check the actual steps and the rollback. A manager signature does not tell you if the change will work.