SCSM Change Management Controls based on Business Impact Analysis

Author by Nathan Lasnoski

I was recently asked to configure a control around inserting business impacts of changes.  These impacts are based on content which might be abstract, such as it requiring a "disaster recovery" or a "HIPPA" review.  I started with looking for ways to gather information automatically, but quickly found that many of the controls needed to be manually set.   I then looked to where I might set them.  In most companies we start with "Business Services", since they represent "what IT delivers to the business" and they are the aggregation point for all work items.  If you'd like more information on using business services, check this out:   In most change processes we are adding a business service to the change request, since that is what is being changed.  For instance, here is a screen shot of a self-service change request through the self-service portal: I thought that modifying the service class would be a nice way to add a value capturing qualifying information associated with the change, since I've already related the change request to the business service.  That said, I can't do that, since the service class is abstract.  An abstract class cannot be extended, so I needed to find another way.  If you try to extend an abstract class you'll get an error, so don't try it.   I decided to make a new configuration item class, called "Change_Control" which would define different sorts of controls I could apply to particular objects, such as business services.  I would then be able to find those change controls and determine different actions in Orchestrator based on them.  This is an example of my custom class: I then sealed the management pack, imported it into my Service Manager instance, restarted the console and proceeded to create a view in the configuration items area for my custom change controls.  I created a change control for a sample replication entity (in this case "Double Take").  It could just as easily be FIPS, HIPPA, Hyper-V Replica, or any other technology that might need an additional control. I opened my business service an linked the change control to my business service.  I could also link the change control directly to a server or application object within the business service.  For instance, if you created a control called "log shipping" you could link it to the SQL database.  Now, of course, if you could bring this information in via an automated detection you'd have a much cleaner solution.  I'll note that the number one way to fail at configuration management is to manage configurations manually, so beware of what you create and need to perform manual processes around. In my change request I have linked the business service and as a result I can apply work processes based upon the relationship.  This can be done through either Service Manager natively or through Orchestrator.  I would typically perform this through Orchestrator since it is easy to expand iteratively later.  In the example below you can see that I am pulling a related change control class from the retrieved change record. I hope this helps people out when creating complex approvals in change management.   Cheers!   Nathan Lasnoski


Nathan Lasnoski

Chief Technology Officer