All production changes—including, but not limited to, software deployment, network infrastructure changes, and access control authorization updates—are invoked through an approved change management process.
We fully document production changes, including requestor, date/time of change, actions taken, and results. We also fully test changes for usability, security, and impact prior to implementation.
Production changes include a rollback or roll forward plan to correct the change in the event of failure. We maintain audit logs of all updates to operational program libraries.