Change Control

Objective: 

This Business Policy defines requirements for system change management for SF State owned information technology systems, network resources and applications.

Statement: 

Purpose and scope

This Policy defines requirements for system change management for San Francisco State University-owned information technology systems, network resources (such as switches, routers and firewalls) and applications.

Policy:

All information technology systems, network resources and applications owned by San Francisco State University will be administered according to a documented and management approved change control process.

Changes made to information technology systems, network resources and applications will be documented in a change management system, reviewed and have documented approval by a designated change control authority as defined in the SF State change control guidelines before being put into production.

A selective review of configuration changes will be performed periodically to verify accountability and identify misconfigured information technology systems, network resources and applications.

References:

Configuration and patch management implementation Guidelines
CSU configuration management information security policy