Change Approval Process

This Change Approval Process provides a structured framework for evaluating, approving, and implementing changes to ICT systems and processes in compliance with the Digital Operational Resilience Act (DORA). It ensures that changes are managed in a controlled, secure, and efficient manner to mitigate risks and maintain operational resilience.

• Change Categories: Defines three types of changes—standard (routine), normal (requiring formal approval), and emergency (critical for immediate risks).
• Roles and Responsibilities: Establishes accountability for Change Requesters, Change Managers, the Change Advisory Board (CAB), IT Security Team, and stakeholders.
• Approval Steps: Includes risk assessments, impact analyses, scheduling, and post-implementation reviews to ensure alignment with organizational goals and compliance requirements.
• Emergency Change Protocol: Allows expedited approvals while maintaining documentation and a mandatory post-implementation review.

This process supports operational excellence by minimizing disruptions, ensuring compliance, and aligning ICT changes with regulatory and organizational objectives.