Change Management Policy

Change Classification & Approval

All changes to production systems, infrastructure, or applications must go through the Change Advisory Board (CAB) approval process before implementation.

Standard changes (pre-approved, low risk) must be logged in the Change Management system within 24 hours of implementation.

Non-standard changes require a completed Change Request form submitted at least 5 business days before the planned implementation date.

Emergency changes must receive approval from the CISO or CTO within 2 hours; the change request must be retroactively completed within 24 hours.

Change Planning & Testing

All changes must include a documented rollback plan that has been reviewed and approved before the change is executed.

All production changes must be tested in a staging environment that mirrors production before CAB submission.

Change success metrics must be defined in the Change Request and verified within 24 hours of implementation.

Change Windows & Freeze Periods

Change windows for production systems are restricted to Tuesday–Thursday, 10 PM–4 AM local time unless emergency approval is obtained.

Change freeze periods apply during the last 5 business days of each calendar quarter; no non-emergency changes are permitted during freeze periods.

Post-Implementation Review

Post-implementation reviews are required for all Severity 1 and Severity 2 changes and must be completed within 48 hours of implementation.

Changes to FDA-validated systems (MasterControl QMS, device firmware deployment pipeline) require Quality Assurance sign-off in addition to CAB approval.

Software changes to FDA-cleared device firmware must follow SOP-SW-002 and may require regulatory assessment per FDA-COMP-001.

Change Classification Matrix

Change Advisory Board (CAB) Members

Recent Production Changes (2026 Q1 Log)