CHANGE MANAGEMENT POLICY

1. Overview

The purpose of this policy is to describe the responsibilities, policies, and procedures to be followed when any changes to the LEGISTIFY SERVICES PRIVATE LIMITED computer network are to be made.

The Change Control policy is designed to provide a managed and orderly method in which changes to the information technology environment are requested, tested and approved prior to installation or implementation. The purpose is not to question the rationale of a change, but to ensure that all elements are in place, there is no negative impact on the infrastructure, all the necessary parties are notified in advance and the schedule for implementation is coordinated with all other activities.

The Head of Information Technology must approve any exceptions to this policy in advance.

2. Definitions

Change: to transform, alter, or modify the operating environment or standard operating procedures that have a potential or significant impact on the stability, security and reliability of the infrastructure and impacts on the conducting of normal business operation. Plus any interruption in building environments that may also cause disruption to the network infrastructure.

Change Request: The official request for any critical change should be submitted via email to the VP of Information Technology. End users requests should be submitted via email to IT Help Desk where it can be routed to the appropriate member of the IT Department for review.

3. Scope

All employees, contractors, consultants, temporary and other workers at GREENYANA ENERGY PRIVATE LIMITED, including all personnel affiliated with third parties that may have access to network computer systems on behalf of LEGISTIFY SERVICES PRIVATE LIMITED must adhere to this policy.

Types of Changes

LEGISTIFY SERVICES PRIVATE LIMITEDhas divided the changes in four categories (Critical, High, Medium, and Low) which will have varied turnaround time depending upon the severity of change.

4. Definition of changes

Critical (P0): All emergencies and any unforeseen events to be categorised into critical changes which are not known in advance. Impact is high but probability is low.

High (p1): Firewall access changes, changes in software program codes, new changes in regulatory environment will be categorise into Critical changes. Impact is high but probability is low.

Medium (P2): Acquisition of new hardware/ software, Hardware and software upgrades. Impact is medium and probability is medium.

Low (P3): User Requests, Hardware and software changes, scheduled periodic maintenance. Impact is low but probability is high.

5. Change Management Process

Change Management provides a process to apply changes, upgrades, or modifications to the environment. This covers any and all changes to hardware, software or applications. It also includes modifications, additions or changes to the LAN/WAN, Network or Server hardware and software, or any other environmental components. The policy is in place to ensure that any change that affects one or all of the environments that Organization relies on to conduct normal business operations are protected.

Changes to the environment arise from many circumstances, such as:

The above list is not all-inclusive. Therefore any questions on whether a change can be made should be directed to the ISMS Manager.

Process

Change Management would typically comprise the raising and recording of changes, assessing the impact, cost, benefit and risk of proposed changes, developing business justification and obtaining approval, managing and coordinating change implementation, monitoring and reporting on implementation, reviewing and closing request for change.

Change management is responsible for managing change process involving:

Request for Change

Initial Approval

Disapproval of Change Request

If change is disapproved by any of the approver; then requestor has to discuss the issue with approver and have to raise the new CR if required.

Approval of Change Request of Hardware and/or Software

Once approved, change coordinator will prepare a change plan in Change Management Form [CM]. Change plan consists of following:

After preparing the complete change plan by filling Change Management Form [CM], change coordinator will propose the same plan to IT Manager for his final approval;

Approver being a final approval authority may approve or disapprove the change request after assessing the business need.

6. Emergencies

Emergencies exist only as a result of:

7. Scheduled or Planned Maintenance

Prior the commencement of any planned or scheduled maintenance, the “Scheduled Maintenance Change Form” must be completed and signed off by a supervising member of the IT Department. A copy of the completed form shall be kept under a new document name and number in under document type “IT Documents” for future reference.

8. Firewall Access Changes

A firewall change is defined as access to a specific system that by-passes the protection of one of the firm’s firewalls. Prior to any changes to the firewalls being made; the “Change Request Form” must be completed. The completed form shall be kept under a new document name and number in shared folder under document type “IT Documentation” for future reference. Any changes made to the firewalls must be recorded in the Change Log immediately upon completion of the modifications.

Changes to the firewalls will only approved when there is a demonstrated business reason to implement the changes in access.

Documentation of Changes

A Change Log shall be kept in a publicly accessible location for the entire IT Department to view. Every member of the IT Department, who is in a position to make changes to a system or network resource, will be required to place an entry in this form to document any changes being made without exception. Other members of the IT department are encouraged to review the log from time to time to keep abreast of the changes going on in the computer network.

Turnaround Time

Change Request Form

Change Management Form

Policy Revision History