Purpose and Scope
This information security policy defines how changes to information systems are planned and implemented This policy applies to the entire information security program at Shuffl (i.e. to all information and communications technology, as well as related documentation). All partners, employees, consultants contractors, part-time and temporary workers, service providers, and those employed by others to perform work for the organization, or who have been granted to the organization’s information and communications technology, must comply with this policy.
Background
This policy defines specific requirements to ensure that changes to systems and applications are properly planned, evaluated, reviewed, approved, communicated, implemented, documented, and reviewed, thereby ensuring the greatest probability of success. Where changes are not successful, this document provides mechanisms for conducting post-implementation review such that future mistakes and errors can be prevented.
Policy
Any changes to the security architecture or customer data handling of a system must be formally requested in writing and approved by Shuffl’s Managing Partner(s). The Managing Partner may assign the responsibility to an appropriate Lead.
All change requests must be documented.
All change requests must be prioritized in terms of benefits, urgency, effort required, and potential impacts to the organization’s operations.
All implemented changes must be communicated to relevant users.
Change management must be conducted according to the following procedure:
Planning: plan the change, including the implementation design, scheduling, and implementation of a communications plan, testing plan, and roll-back plan.
Evaluation: evaluate the change, including priority level of the service and risk that the proposed change introduces to the system; determine the change type and the specific step-by-step process to implement the change.
Review: review the change plan amongst the Managing Partners, Engineering Lead, and, if applicable, Business Unit Manager.
Approval: the Managing Partner must approve the change plan.
Communication: communicate the change to all users of the system.
Implementation: test and implement the change.
Documentation: record the change and any post-implementation issues.
Post-change review: conduct a post-implementation review to determine how the change is impacting the organization, either positively or negatively. Discuss and document any lessons learned.
Standard Controls Satisfied
TSC CC8.1, CC3.4