Annex 7A: The central function for Change, Configuration and Release Management

A central Change, Configuration, and Release Management function will enable some organisations to implement control more efficiently and effectively. A central function may be responsible for managing Changes to hardware, software, and all items of documentation that are relevant to the running, support and maintenance of live systems.

The primary responsibilities of a central Change, Configuration, and Release Management function are to:

• produce and maintain the Change and Configuration Management plan, Configuration Management design and Release policy for the organisation
• implement consistent Change Management, Configuration Management and Release Management practices across the organisation
• identify CIs that need to be managed and controlled
• integrate the central function with interfaces to other service managers, projects, suppliers and customers
• ensure that the CMDB and DSL reflect the authorised state of the IT infrastructure and services
• maintain and control hardware standards, technical standards and master copies of documents
• provide supporting services, including registration and checking of Releases delivered from third parties
• distribute reports and management information on CIs (e.g. the extent to which Problems and errors are affecting which CIs; and on life-expiry dates, licence fee renewal dates and costs)
• ensure the Configuration Management system is aware and capable of coping with future workloads and growth (e.g. that adequate staff and resources are provided for Configuration Management)
• ensure that all staff are familiar with and operate the Configuration Management, Change Management and software distribution policies, processes and systems for their work
• define status accounting requirements to support other Service Management processes
• organise regular checks of the status of the CMDB and DSL against the installed systems; arrange configuration audits and process audits; monitor exceptions and implement corrective action
• make recommendations on strategy, policy and system design, including how to drive down the variant configurations and infrastructure complexity
• investigate major Problems caused by poor control, and identify remedial actions
• provide advice and guidance on infrastructure standards
• provide advice on where Release components should be located on the infrastructure
• communicate and advise projects on what to include in their Configuration Management and Release plans to ensure a successful transfer to the final service.

Setting up a Change, Configuration and Release Management function

The planning process for setting up an appropriate function could take anything from three to six months, from inception to the first phase of implementation. This period could be considerably longer if finance is not readily available or there are long lead times.

Experience has shown that it takes at least one month for staff in each area to complete training to the point where they can be effective. The support processes should not be implemented until staff are adequately trained. If staff try to take on control activities too soon, they may lose the cooperation of the other parts of the organisation by being perceived as a 'bottleneck'.

The planning and implementation of the central function involves several aspects:

Initial assessment

These control processes underpin a number of other processes, such as Problem Management, and the Service Desk. Plan to do an initial assessment of Service Management and support before and after introducing a process, in order to assess the benefits.

Planning a central function

Commitment from senior management is required to initiate a central function. A recommended approach is to integrate Change Management and Configuration Management and certain aspects of Release Management as a single function. The central function may also include handover and acceptance procedures for accepting CIs into Configuration Management.

Medium and large organisations will require dedicated resources to provide an adequate level of control. Large organisations may have local Configuration Managers with indirect reporting lines to the central configuration manager e.g. site Configuration Manager, or the software Configuration Manager for a major infrastructure programme.

Producing a Change and Configuration Management plan for a central function

The Configuration Management methodology should be defined in a Change and Configuration Management plan (C&CM plan) that includes:

• Configuration Management organisational roles and responsibilities
• architecture and design of the CMDB, DSL, Configuration Management tools and libraries
• Change Management, Configuration Management and Release Management policies and procedures.

The control processes between the interfaces should also be included, e.g. among projects, suppliers, and application teams and support teams. Projects and external suppliers should have a Configuration Management plan that defines the scope, configurations, procedures and interfaces to the IT services organisation.

A C&CM plan describes the scope of the infrastructure to be controlled and how the processes should be implemented to achieve the agreed objectives. The plan should be regularly updated. It should reflect the current scope, objectives and processes and should include the objectives for the next six to twelve months. It should include:

• the scope and objectives of Configuration Management including the services and platforms that are to be controlled and to what level, as well as a list or diagram of the high-level CIs and their relationships, and the schedule for bringing assets and CIs under control.
• overall Configuration Management, Change Management and Release Management policy
• related policies, standards and processes
• the organisations responsible for Configuration Management and their interfaces to the central function (e.g. in-house teams, systems integrators, subcontractors and suppliers)
• relevant Configuration Management systems, their scope and key interfaces between them - systems that may comprise a mixture of repositories and libraries and should include the locations of
  • CMDB
  • DSL
  • software and document controlled libraries
• controlled environments within which CIs are manipulated
• links and interfaces to other Service Management systems
• tools to be used on each platform
• the schedule and procedures for performing Configuration Management activities:
  • configuration identification
  • control
  • status accounting
  • configuration audit
  • verification
• licence management
• targets to improve the control processes (efficiency and effectiveness)
• the retention period for CIs (where, depending on the CI type, there may be a predefined number of versions, or one version for a predetermined period of time retained).

Roles

The roles within the function should include Configuration Manager, Asset Manager, Change Manager, Change administrator, Release Manager and relevant Change Advisory Board(s).

The terms of reference, structure and escalation mechanisms for the Change Advisory Board(s) should be agreed. The Configuration Manager should attend the main Change Advisory Board(s).

Plan support tools

The central function should evaluate available support tools and instigate procurement of the selected tool and hardware on which to run the tools. This is a very important activity because the nature of the support tool(s) could heavily influence the operation of the central function.

Plan staffing and training

The disciplines require staff who will adopt a painstaking approach and pay due attention to detail. Central support staff are required, other than in very small installations. Consider the following factors when planning staff numbers:

• whether Configuration Management is to be responsible for projects as well as the IT infrastructure
• whether the group is also to be responsible for Change Management, Configuration Management and/or Release Management
• whether hardware/network installation and acceptance responsibilities are allocated to the group
• the size of the IT infrastructure, the level at which control is to be maintained, and hence the number of CIs to be controlled
• the number of staff performing control activities in other groups and projects
• the extent to which support tools are available
• the size, frequency and complexity of software Changes and Releases
• the number of Change Advisory Boards, attendance and frequency of meetings.

Change Management, Configuration Management and Release Management are usually on the critical path between projects, applications development and live operations. The central function may be involved in all Changes to live hardware, software and networks. Plan for enough trained staff to cover for annual leave and other absences. The minimum practical staffing level is two people - including the Configuration Manager - although, where appropriate, such as in very small organisations, one of these two could be a 'reserve'.

If Change Management, Configuration Management and Release Management activities are already being carried out within other groups, try to recruit staff from these groups into the central function, even if only on a temporary basis until new staff are trained. Where staff are not readily available, consider the use of consultants and contract staff to perform basic control activities until staff can be recruited and trained.

All staff who hand over (to IT Services), accept, install or Change any CIs should do so only if Change Management/Configuration Management authorisation has been given and the CMDB and DSL have been updated with details of the new CI(s) or Changes.

Consider the need for overtime or shift working. When urgent Releases or emergency fixes are required, Changes should always be subject to configuration control and should always be recorded in the CMDB. There are three options:

• provide staff at all hours
• make staff available on call
• delegate authority to someone who is available (e.g. Problem Management, or computer operations staff) - where adequate procedures and training will be required for the target staff - but not under any circumstances vendor or user staff.

Staff should be given a programme consisting of on-the-job training and formal training courses. There should be formal training in the Configuration Management discipline, and training should be given in the use of all support tools to be used. Staff should also be given a general understanding of the hardware, the software, the network and the telecommunications configuration over which they are to have control. Training should be given in other responsibilities as appropriate. It is, furthermore, useful to give staff an appreciation of the workings of the Problem Management and Service Desk systems and how Configuration Management assists these operations.

As soon as the support tools have been installed and are available for use, training staff in their use should be carried out. It may be possible to combine this training with the testing of the tools. Staff training in new procedures should be planned.