IT Asset Management - Configuration Management and Change Control

PURPOSE

To provide guidelines necessary to implement change management and change control practices.

In accordance with the COV ITRM 501-01, configuration management and change control practices must be in place so that changes to the IT environment do not compromise System Office and college security controls.

The Configuration Management and Change Control Standard are applicable to the System Office and all Colleges.

The change control process ensures that changes are authorized, coordinated and documented.

Requirement: Changes to all VCCS IT environments must be controlled on the basis of defined procedures. Defined procedures must include, at a minimum, a method of assessing and managing risks, authorization by appropriate management, and recording configuration and changes accurately.

Recommendation: The System Office and colleges should reference industry standard frameworks such as the IT Infrastructure Library (ITIL) (www.itil.co.uk) or Control Objectives for Information and related Technology (COBIT) (www.isaca.org), and others, to assist in the Configuration Management and Change Control processes.