The importance of IT Change Management to the DR and BCP process

Presentation to Government Sector IT DR Forum
Presenter:
Paul Monk
Performance & Quality Assurance Manager
Fujitsu New Zealand
The importance of IT Change Management
to the DR and BCP process

Introduction
Paul Monk
Performance and Quality Assurance Manager (NZ)
Fujitsu New Zealand
Paul.Monk@nz.fujitsu.com
www.linkedin.com/in/paul-monk-a666352
Citrix Innovation Award for Partners Winner 2017
2 Copyright Fujitsu NZ 2018

Summary
 Theory
 IT Change Management best practise
 Lessons from continuous improvement of Processes
 Key Question for IT Change Management
 Keeping Production and DR/BC environments Synchronised
 What can go wrong
 Tips for DR Practitioners and Change Managers
 Possible interactions between Change and BCP processes
 IT Change Management function during DR
 Is your IT Change Management function resilient?
 Suggested Quality Measures

Theory
 IT Change Management (source: Wikipedia)
Change Management ensures that standardised methods and procedures are used
for efficient and prompt handling of all changes to control IT infrastructure, in order to
minimise the number and impact of any related incidents upon service.
Change Management (source: ITILv3 – Service Transition)
Ensures that:
 Standardised methods and procedures are used for efficient and prompt handling of
all changes
 All changes to service assets and configuration items are recorded in the
Configuration Management System
 Overall business risk is optimised.

Theory
 Business Continuity Planning (source: Wikipedia)
Business continuity planning is the process of creating systems of prevention and
recovery to deal with potential threats to a company. BCP is a subset of Risk
Management.
 IT Service Continuity Management (source: ITILv3 Service Design)
The goal of ITSCM is to support the overall Business Continuity Management process
by ensuring that the required IT technical and service facilities can be resumed within
required, and agreed, business timescales.

Theory
 Disaster Recovery (source: Wikipedia)
Disaster recovery (DR) involves a set of policies, tools and procedures to enable the
recovery or continuation of vital technology infrastructure and systems following a
natural or human-induced disaster.
Disaster recovery focuses on the IT or technology systems supporting critical business
functions, as opposed to business continuity, which involves keeping all essential
aspects of a business functioning despite significant disruptive events. Disaster
recovery is therefore a subset of business continuity.

IT Change Management Best Practise
It is good practise to have the following KPIs for this process:
 < 5% failed changes per month
 > 20% Standard changes implemented per month
 Zero unauthorised changes per month
 < 4 business hours for the outcome of Changes
 Zero Change window extensions requested after the Change Window ends
 CAB panel that understand relevant risks from Technical and Business perspective
 Formal induction of staff and third parties who participate in the Change process
Source: Fujitsu NZ data and experience(2014 – 2017), supported by ISO20000 certified processes and Fujitsu
Oceania quality review of data.

 IT Change Process scope must be easy to explain and enforce:
 O/S
 VM Guest or OVM
 Server Hardware
 SAN
 Chassis
 Switch
 Network
 Firewall
Test
(includes System Test, Pre-Prod)
Development
Production
(Includes Training, DR and
Production Data if not anonymised)
 Desktop Environment
 Application client side
 Application server side
 Middleware/Web Server
 Database
 O/S
 VM Guest or OVM
 Server Hardware
 SAN
 Chassis
 Switch
 Network
 Firewall
 O/S
 VM Guest or OVM
 Server Hardware
 SAN
 Chassis
 Switch
 Network
 Firewall
 Database
 Database

 As-a-Service maintenance activity can be recorded as an “Advisory Change”
Contributing Infrastructure
CustomerProduct
ServiceVeil
Engineer
Underlying Infrastructure Revealed Service
! Advisory Change
!
Normal
Change

 CAB meetings need the right inputs to make robust decisions
CAB Panel
Implementation
Plan
Approved
Design
Change
Owner
Supporting Information
Comms
Test Exit
report
Design and
Service Transition
panel
Forward
Schedule

 Right amount of due diligence is applied to the type of Change
ChangeFailureRisk
Due Diligence
Standard
Emergency
Urgent/Expedited
Non-Standard
Advisory
Release Management
can add more value here

Lessons from continuous improvement of processes
 Service Management processes need to evolve to meet new customer
requirements:
 Communication is always key
 Be curious about connected processes
 Lead the Process
 Shrinking to be Lean and Agile
 Educate those affected
 Remember the double-edged sword
 Cut too much away and you are left with risk-based decisions being made by unqualified or
unauthorised staff
 A controlled and auditable process will work with just enough paperwork and monitoring
Welcome the question Is
this in scope or not?
Improve throughput by 20% by running CAB
twice a week instead of once a week
Reduce admin by 20% by establishing
correct workflow size for the Change type
More Standard Changes means less deviation,
lowers risk and reduces CAB agenda

Key Question for IT Change Management
How does this IT Change affect BC and DR plans?
Example 1 – Upgrade to SharePoint
The DR plan should be tested to prove RTO is still feasible after the Change.
Example 2 – Setup of DR environment for Finance team
The DR plan should be tested to prove connectivity during DR from the secondary
location.

Keeping Production and DR/BC synchronised
How should we keep Production and DR/BC environments synchronised?
Simple:
 Configuration Management process to put environments into the CMDB as a service.
 Maintain a Technical Service Catalogue that includes environment as an attribute.
 Update the IT Change Management process to include:
 Environments a distinct part of the IT Change Process
 Impact Assessment that confirms environments the Change must be applied to
 CAB panel with quorum membership from the architecture team
 Implementation plans with a validation steps that check both Prod and DR/BC environments are in
sync, where relevant
 Maintain supporting documentation (Recovery plans, DR plans)
Complemented with:
 Investment in automation that reports on configuration differences between Environments.

What can go wrong
The consequence of lack of due diligence in our topic are many.
Here are some examples:
 Out of date BCP/DR plans
 DR plans with recovery steps in the wrong order
 Suppliers without feasible DR plans (check your third party SLAs)
 Missing DR plans where IT and business current production state has moved
 Lack of IT resources to implement all DR plans in required timeframe.
 Unclear or undocumented production state
 Lack of holistic architecture design that considers all aspects of BCP/DR

Tips for DR Practitioners
Some suggestions to start the conversation with your IT Change Manager:
 How much do you as Change Manager know about our BCP?
 What interaction exists between IT Change Management and BCP processes?
The common ground between IT Change Management and BCP/DR is:
 The need to capture and record the current production state
 BC/DR plans have similar information elements as an IT Change Implementation Plan.
Small steps to improve are always easier. Start small. 

Tips for IT Change Managers
Some suggestions to start the conversation with your BC co-ordinator:
Where to start?
1. Read your Organisation’s BC, IT Service Continuity and DR Plans
 Are they current and reflect production state?
 If not, provide feedback to the document owner
2. Ask for an invite to the next BC planning meeting to observe.
3. Decide with stakeholders what interaction IT Change Management should have
with the BCP process
4. Confirm the data needed to support these interactions from the IT Change process
and other Service Management processes (e.g. Configuration Management)

Possible interaction between Change and BCP processes
Risk Management
Business Continuity
Planning
(with ITSCM)
DR
IT Change Management Requests IT Change to
mitigate risks
Trigger update
to BIA and BCP
Update DR technical
environment to align with
Production
BIA
DR test BCP test
Change
record
Notify
through IT Change
Process?
Triggers updates to
risk records
Add to IT Change
schedule as information
only
Yes
Proactive Activities
BCP

Possible interaction between Change and BCP processes
Risk Management
Business Continuity
Planning
(with ITSCM)
IT Incident Management
Incident
record
Activate BC/DR Plan after
attempts to restore service
through:
• Technical escalation to L2
and L3 support
• IT Change confirmed as
cause
• IT Change Rollback
attemptedChange
record
Caused
Incident
Reactive Activities
Change
record
Technical steps
Post DR to resolve
residual issues
DR
Plan
BC
Plan

IT Change Management function during DR
IT Change Management usually takes a backseat during DR.
The value of including an experienced IT Change Manager in the BCP is:
 Process experience
 Key contacts they can draw from to get BCP activity done that was unforeseen
 Awareness of current Production state through observation.
 Holistic awareness about the IT environment and related processes.
Use that to your advantage!

Is your IT Change Management function resilient?
 What is your BC / ITSCM plan if your IT Change Management tool is down?
 Paper based solution using forms to enable retrospective updates.
 Retrieve CAB agenda and minutes that include approved copies of Plans.
 Retrieve Forward Schedule reports that identify what was approved.
 What happens when the IT Change Manager is on Annual Leave?
 Change Freeze time
 Change Analyst, Infrastructure/Operations Manager who has completed training.
 Do you have a succession plan for your IT Change Manager?
 Change Analyst who is training up.
 Problem Manager who wants to move into this area
 Are all your daily, weekly, monthly procedures documented?
 They are and under version control

Quality Measure Checklist
If you answer “Yes” to the below questions this means your IT Change Management process is
adding value to your organisations BCP:
 Is the BCP/DR infrastructure treated as in scope for the IT Change process?
 Does your IT Change Management impact assessment check if:
 BC/DR Plans need to be updated?
 BCP/DR infrastructure need to be updated to align with Change to Production environment?
 Does the BCP/DR co-ordinator attending your CAB meeting?
 Does your template for Architecture Design cover a BCP/DR environment section?
 Does your Technical Service Catalogue and CMDB recognise infrastructure for BCP/DR?

Quality Measure Checklist
Organisations can reduce some BCP and DR costs by building up resilience and
monitoring capacity growth using current technology:
Are your servers all now virtual and highly available?
Capacity monitored and proactive IT Change raised to ensure head-room?
Have you virtualised your databases?
Are your virtual servers and/or storage managed with built-in DR to secondary
site?
Is your data secured by a vendor with their Data Centre ISO Standard certified
ISO Standard Reference Description
ISO27001 Security Management System
ISO9001 Quality Management System
ISO20000 Service Management System

Audience Participation Exercise
Considering interactions between IT Change Management and BC/DR at your
Organisation ….
 What is working well?
 What is not working?
 Your challenges?
 What quality measures you have used?

Conclusion
IT Change Management is important to BCP and DR processes.
Other effective Service Management processes/disciplines needed to support IT
Change Management and BC/DR processes. Refer to ITIL v3 books for further details.
Start the discussion between IT Change Management and BCP process owners at
your organisation and I am confident you will find it very useful.
Ref: https://www.axelos.com/best-practice-solutions/itil/what-is-itil

Questions

Document Control
Attribute Value
Document Name The importance of IT Change Management to DR and BCP process
Confidentiality Uncontrolled
Document Status Final
Version Number 1.5
Summary This presentation is for Government Sector IT DR Forum presentation
Author Monk, Paul
Owner Monk, Paul
Version Date 3/5/2018
Date of Next Review N/A
Target Audience Participants of GSITDR Forum
Distribution As required.
Internal Repository M:Improvements2018Change Management presentation to GSITDR forum
Customer Repository N/A
Version Date Name Comments
0.1 12/2/2018 Paul Monk Initial Draft
0.2 9/3/2018 Paul Monk After input from GSITDR stakeholders.
0.3 12/3/2018 Paul Monk Rearranged sequence of animation on slide 12.
0.4 14/3/2018 Paul Monk Updated slide 19 on suggestion from Steve M. Updated theme and added footer.
0.5 28/3/2018 Paul Monk After feedback from Fujitsu Oceania BCP Co-ordinator
0.6 4/4/2018 Paul Monk After feedback from Fujitsu NZ Change Management team leader.
1.0 11/4/2018 Paul Monk After review feedback from GSITDR forum representatives.
1.1 11/4/2018 Paul Monk Removed video and slide related to Stats NZ story at request by Katie.
1.2 12/4/2018 Paul Monk After input from Fujitsu architect.
1.3 16/4/2018 Paul Monk After input from Fujitsu internal presentation
1.4 18/4/2018 Paul Monk After input from Pradeep Navalker
1.5 3/5/2018 Paul Monk Added image credit for TaiChi Sword image, slide#12.
Document Control Table
Change History

The importance of IT Change Management to the DR and BCP process

More Related Content

What's hot (7)

Similar to The importance of IT Change Management to the DR and BCP process (20)

Recently uploaded (20)

The importance of IT Change Management to the DR and BCP process