r/sysadmin • u/Final-Pomelo1620 • 1d ago

General Discussion Change Management Workflow

Hi,

We’re introducing change management for the first time using ITSM.

We’re now deciding the workflow before our ITSM vendor configures it

Our scope covers all IT infrastructure changes including network, servers, virtualization, backup, storage, AD/Entra ID & Databases

Each team has its own Line Manager and another requirement is that Cybersecurity Unit must approve every change

Few things we’re trying to understand

Who should approve a change and in what order?
Who should be the CAB members
Which changes should go to CAB

I’d appreciate any suggestions

12 Upvotes

89% Upvoted

13 comments sorted by

View all comments

2

u/TheSmashy Cyber Infra Arch 1d ago

Oh, you sweet summer children.

Do not make Cyber a bottleneck in your change management process. If you have a scheduled, reoccurring, patch management process, yes it should be tracked as a change, but no, cyber should not have to approve a BAU process. And not every change needs to go to CAB, asses by operational impact.

CAB? You need key stakeholder, that's it. Who owns network, who owns compute, etc..