IT Governance and Change Management
Purpose: The purpose of this policy is to establish a governance and change management framework for information technology at Colorado College. It ensures that IT decisions are transparent, strategically aligned, and include stakeholder input, while technology changes are implemented in a controlled, secure, and auditable manner. Scope: This policy applies to all IT-related requests, projects, and changes affecting Colorado College systems, applications, infrastructure, or services. It applies to ITS staff, faculty, students, contractors, and third parties whose actions may impact institutional technology.
Scope
All financial and administrative policies involving community members across campus, including volunteers are within the scope of this policy. If there is a variance between departmental expectations and the common approach described through college policy, the college will look to the campus community, including volunteers to support the spirit and the objectives of college policy. Unless specifically mentioned in a college policy, the college’s Board of Trustees are governed by their Bylaws.
Policy
Policy Statement:Colorado College will govern technology investments, projects, and operational changes through formal governance processes and structured change management. All IT changes must be reviewed, approved, and documented according to this policy to reduce risk and ensure compliance.
1. IT Governance
- The Colorado College Digital Transformation Operational Group (DTOG) provides governance over technology strategy and investments.
- Subcommittees include IT Governance (includes Tech Adoption), ERP Modernization, Data Governance, and Generative AI Oversight.
- ERP development, customization, etc. Goes through the ERP Modernization subcommittee
- Requests must be submitted through the governance intake process
- The Triage group reviews requests for completeness and routes them to the appropriate governance body.
- Governance groups score requests using approved rubrics (e.g., student impact, cost, vendor reputation, alignment).
- Final prioritization decisions are escalated to executive leadership.
New technology solutions (for example: applications, cloud systems, point of sale terminals) or modifications of existing technology solutions that are purchased or licensed for Colorado College users (if you click agree on a license agreement) must be approved by the Office of Information Technology (ITS) via the tech adoption procedure.
2. Change Management governed by the CCB
Software Governed by This Policy
The word “change” applies to new, modified, and decommissioned software, servers, applications, and data. See the CCB webpage for more information about changes: Change Control Board (CCB) - Colorado College
This policy is applied to all administrative software that is maintained by the ITS: division; this includes vendor-supplied software, as well as in-house developed software. This policy does not cover those software installations that are administered or maintained by non-IT departments.
3. Banner Application Change Tracking
Banner is the interface the college uses to access its enterprise database. ITS: uses issue management software as a tool for Banner change tracking. Users submit an issue ticket when they need IT support for any Banner changes including application, access, or production data changes.
The issue ticket generates a notification to the user submitting the Banner change request, and the ticket is assigned to the appropriate department/person assigned to the change.
The evidence of requirements, clarification, change inventory, testing, and user signoff are stored in the issue management software ticket.
Network Systems and Services Scheduled Maintenance
ITS: must patch and update equipment regularly to protect Colorado College's IT environment according to the IT Risk and Patch Vulnerability Management Policy. Although we strive to minimize the impact on users, we also occasionally need vendor support during maintenance cycles. Not all vendors are available 24/7, and some 24/7 support contracts are prohibitively expensive.
As a result, we have created a schedule with three types of maintenance windows that may include system outages.
For more specific details about the maintenance windows, including dates, please see the ITS Maintenance Information webpage.
4. Change Documentation
All changes must be kept on file for a minimum of 18 months and include:
• Description and purpose.
• Risk and impact analysis.
• Testing and backout plan.
• Implementation schedule.
• Approvals from CCB or designated authority.
5. Enforcement & Exceptions
- Unauthorized technology implementations or production changes are prohibited.
- Violations may result in suspension of accounts, reversal of changes, and /or disciplinary action.
- Exceptions must be documented with compensating controls.
Procedures
The Change Control Board, appointed by the Chief Information Officer/Vice President of Information Technology, is responsible for enforcing IT Change Management Policy. The applicable definitions and procedures are available at: https://www.coloradocollege.edu/offices/its/policies/ccb.html
The Tech Adoption process including definitions, procedures, and a link to initiate a ticket is available at: https://www.coloradocollege.edu/offices/its/tech-adoption.html
- Submit requests via ServiceDesk Plus or equivalent intake process.
- Triage team reviews and routes to appropriate governance group.
- Governance groups score and prioritize requests.
- CCB reviews change requests and approves based on risk and schedule.
- Emergency changes documented within 24 hours and reviewed by CAB retrospectively.
Review & Update
This policy will be reviewed regularly.
Definitions
- Governance: Structured decision-making process for IT investments and priorities.
- DTOG: Digital Transformation Operational Group, Colorado College’s IT governance framework.
- CCB (Change Control Board): Group responsible for reviewing and approving production system changes.
- Standard Change: Pre-approved, low-risk, repeatable change.