Product
Pricing
Demo
Sign in
Policies
Security
System Change Policy

System Change Policy

Purpose and Scope

This information security policy defines how changes to information systems are planned and implemented.

This policy applies to the entire information security program at Userflow (i.e. to all information and communications technology, as well as related documentation).

All employees, contractors, part-time and temporary workers, service providers, and those employed by others to perform work for Userflow, or who have been granted to Userflow’s information and communications technology, must comply with this policy.

Background

This policy defines specific requirements to ensure that changes to systems and applications are properly planned, evaluated, reviewed, approved, communicated, implemented, documented, and reviewed, thereby ensuring the greatest probability of success. Where changes are not successful, this document provides mechanisms for conducting post-implementation review such that future mistakes and errors can be prevented.

Policy

  1. Any changes to the security architecture or customer data handling of a system must be formally requested in writing to Userflow’s Information Security Manager (ISM), and approved by the ISM and the Chief Information Officer (CIO).
  2. All change requests must be documented.
  3. All change requests must be prioritized in terms of benefits, urgency, effort required, and potential impacts to Userflow’s operations.
  4. All implemented changes must be communicated to relevant users.
  5. Change management must be conducted according to the following procedure:
    1. Planning: plan the change, including the implementation design, scheduling, and implementation of a communications plan, testing plan, and roll-back plan.
    2. Evaluation: evaluate the change, including priority level of the service and risk that the proposed change introduces to the system; determine the change type and the specific step-by-step process to implement the change.
    3. Review: review the change plan amongst the CIO, ISM, Engineering Lead, and, if applicable, Business Unit Manager.
    4. Approval: the CIO must approve the change plan.
    5. Communication: communicate the change to all users of the system.
    6. Implementation: test and implement the change.
    7. Documentation: record the change and any post-implementation issues.
    8. Post-change review: conduct a post-implementation review to determine how the change is impacting Userflow, either positively or negatively. Discuss and document any lessons learned.