TechKnowSurge
ISC2 CISSP 7.9 CompTIA Security+ 1.3 NIST 800-53 CM-3 NIST CSF ID.RA-07 CompTIA SecurityX 1.3 NIST CSF GV.RM-04
TechKnowSurge Catalog Videos Configuration and Change Management
VideoSecurityFree

Configuration and Change Management

Change management is a structured process for controlling and implementing changes within an IT environment to reduce errors, minimize downtime, and improve stakeholder communication. A properly scaled change management framework helps organizations maintain consistency and quality while keeping workflows efficient.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Change management is a structured discipline for controlling how changes are planned, approved, and deployed within an organization. By establishing a documented process, teams create consistency in how work gets done, which over time drives improvements in efficiency and quality. Key benefits include better communication with stakeholders, greater preparedness among affected users, and a measurable reduction in errors, downtime, and post-change incidents. Despite these advantages, change management regularly meets resistance. Teams subject to the process often perceive it as slowing them down and limiting their ability to respond quickly — a concern that has real merit if the process is poorly calibrated. A common pattern is that departments want the benefits of change management applied to others while resisting it for themselves, viewing it as an impediment to their own agility. The key to successful adoption is rightsizing the process to match the organization. A small, fast-moving team needs a lighter framework than a large enterprise, but even minimal structure — a change request, a brief planning phase, and some form of review — delivers significant risk reduction. The review step can range from a single approver checking accuracy to a formal Change Advisory Board evaluating complex or high-impact changes. The standard change management lifecycle moves through change request, planning, evaluation, implementation, monitoring, and closure, with consistent communication and documentation required at every stage. When implemented at the right scale, the process stops acting as a barrier and instead becomes a driver of operational stability and business momentum.

What you'll learn

What's covered

Change Management

Aligned to

ISC2 CISSP
7.9 Understand and participate in change management processes
CompTIA Security+
1.3 Explain the importance of change management processes and the impact to security
NIST 800-53
CM-3 Configuration Change Control
NIST CSF
ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked.
GV.RM-04 Strategic direction that describes appropriate risk response options is established and communicated.
CompTIA SecurityX
1.3 Explain the importance of risk management for an enterprise

Key terms

Change Management
A structured process for requesting, reviewing, approving, and documenting changes to IT systems or organizational procedures. Change management reduces security risk by ensuring modifications are tested and authorized before deployment.
Change Advisory Board
CAB
A group that reviews and evaluates proposed changes to ensure they are appropriate for the environment and comply with organizational policies and procedures.
Change Request
A formal submission from a user, customer, or stakeholder initiating the process to make a change within an IT environment.
Configuration Management
The process of tracking and controlling changes to hardware, software, and documentation throughout a system's lifecycle.

Topics

Change Management Change Advisory Board It Governance Itil Configuration Management Risk Management

Transcript

One of the best things that I've found that you can do for your company is implement change management, controlling the amount of change that happens within your organization. So let's take a look at what change management is all about.

What change management is, and what it buys you

Change management is putting a process into place to make sure that we're making changes correctly within our environment. By having a documented process for change management, we start creating consistency, and then we can make improvements over time. There's an efficiency that happens with all of this, and a quality that happens with all of this.

Some of the benefits that I've really found with change management is we end up communicating better to our stakeholders, preparing them for the changes and making sure that our users are prepared for whatever changes are going to affect them. Another thing that I've found that really has helped with change management is that we make a lot less errors, and we have a lot less downtime, and we have a lot less issues after we roll out those changes.

The downside and the objections

Change management does have a downside though. As we're implementing change management processes and procedures, we're changing people's workflow. Not only is this a change in how they have to operate, but it can be seen as putting up barriers to how agile we can be and how quickly we can make changes within our environment. To a certain degree that is true.

What I've found is that there are some objections that come up when you start implementing change management. I've even had these myself when I've implemented change management within my team — I had a lot of concerns about how much it was going to slow their work and how agile we could be. I've seen this also when setting out change management processes for other departments. What I've noticed is they want the benefits of other departments having change management, so make sure that communication and these less issues that happen, but they don't necessarily want change management put on themselves, because it impedes their workflow.

Ultimately we need to get back to the benefits of what change management has and how it actually propels businesses forward rather than hinders business. After I've implemented change management within my teams, I've noticed a huge improvement.

Ultimately that comes back to rightsizing your processes and procedures for change management to the size of your team and the size of your company. That is, we don't want to get really process heavy for a small agile company, but then again we also want to put some processes into place to make sure that we are eliminating as many issues as possible and communicating things correctly.

The general change management process

Here's the general process of change management.

  • It starts with a change request: some customer, user or stakeholder makes a request.
  • Then it goes into the planning phase, of what this request means and how we're going to roll this out.
  • Then we get into the evaluation, where somebody double checks the change to make sure that it's going to be proper for the environment and not going to cause any issues, and follows all of our policies and procedures. This could be as simple as just a single person that's checking things over to make sure it's accurate. It could be something like code review, before changes go out to the code and get deployed. Or it could be something as more complex as a full CAB, a change advisory board — and a change advisory board would then discuss this and make sure that it's a proper change.
  • Then once it's approved, it goes through the implementation process.
  • We monitor to make sure it has the effect that we wanted it to.
  • And then we have the change closure, where we close out our paperwork and make sure the communication has happened and finish things off.

All during each one of these phases, we make sure the proper communication and documentation is happening.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →