# Acme Corp IT Change Management Policy

All changes to production systems must follow this policy before implementation.

1. **Risk Assessment**: Every change must document the risk level (Low/Medium/High)
   and the potential impact on end users and business operations.

2. **Backout Plan**: A tested rollback procedure must be documented, including the
   maximum acceptable time to roll back.

3. **Testing**: Changes must be validated in a staging environment identical to
   production before deployment. Test results must be attached to the change record.

4. **CAB Approval**: Medium and High risk changes require sign-off from the Change
   Advisory Board at least 48 hours before the change window.

5. **Change Window**: Changes must be scheduled outside of business hours (before
   7am or after 7pm local time) and must not conflict with the published freeze
   calendar.

6. **Communication**: Affected end users must be notified at least 24 hours in
   advance. IT management must be copied on all change notifications.

7. **Post-Implementation Review**: Within 5 business days of implementation, the
   change owner must document whether the change met its success criteria.