Change management plan

A change management plan describes how change requests are submitted, evaluated, approved or rejected, implemented, and tracked. It defines decision rights, thresholds, and communication rules to control impacts to scope, schedule, cost, and quality.

Key Points

  • Defines the end-to-end process for requesting, assessing, approving, implementing, and closing changes.
  • Specifies roles, authority levels, and when a change control board (CCB) is required.
  • Aligns with baselines and configuration management so product and project information stay consistent.
  • Establishes categorization, prioritization, and evaluation criteria to guide decisions.
  • Requires a change log and communication approach to ensure transparency and traceability.
  • Includes paths for normal, minor, and urgent changes to balance control and agility.

Purpose

The change management plan provides a predictable way to handle change while protecting value delivery. It clarifies who decides, what is required for analysis, and how outcomes are communicated.

  • Prevent uncontrolled scope growth and rework.
  • Increase transparency and stakeholder alignment.
  • Speed up decisions with clear thresholds and workflows.
  • Ensure approved changes are implemented and verified.

Typical Sections

  • Governance and roles (requester, project manager, product owner, CCB, sponsor).
  • Change categories and thresholds (minor, major, emergency) with decision authority.
  • Submission requirements and templates (required data fields and channels).
  • Workflow and status states from intake to closure.
  • Evaluation criteria and impact analysis guidance (scope, schedule, cost, quality, risk, benefits).
  • Approval rules, service levels, and escalation path.
  • Implementation, verification, and documentation requirements.
  • Change log management and configuration management linkage.
  • Communication, reporting, and audit/records retention.
  • Metrics and continuous improvement approach.
  • Tailoring and exceptions policy.

How to Create

  • Review organizational policies, compliance needs, and governance standards.
  • Identify stakeholders and confirm the CCB composition and authority.
  • Define change categories, thresholds, and turnaround targets for reviews.
  • Design the workflow, roles and responsibilities, and status states.
  • Set submission templates and required data fields for a complete request.
  • Establish impact analysis guidance and prioritization criteria.
  • Document approval rules, signatures, and escalation steps.
  • Plan how changes will be logged, reported, archived, and linked to baselines/backlogs.
  • Define communication rules, stakeholder notifications, and meeting cadence.
  • Agree on metrics (cycle time, approval rate) and feedback loops.
  • Validate the plan with key stakeholders and obtain formal approval.
  • Publish the plan and train the team on using it.

How to Use

  • Collect change requests through the defined channel using the standard template.
  • Screen requests for completeness and classify by category and priority.
  • Perform impact analysis and record results in the change log.
  • Route to the correct decision authority (PM, product owner, or CCB) per thresholds.
  • Communicate decisions, update the plan/baselines or backlog, and adjust work as needed.
  • Verify implementation, record outcomes, and close the request with lessons learned.
  • Monitor metrics and refine the process based on performance and feedback.

Maintenance Cadence

  • Initial setup during planning and before establishing the first baselines.
  • Review at phase gates, major releases, or when governance or risk profile changes.
  • Monthly check of process metrics to tune thresholds, SLAs, or CCB cadence.
  • Immediate updates after audits, significant issues, or organizational policy changes.
  • Archive and transition procedures to operations at project closure.

Example

  • Workflow: Submit request - PM screens - Impact analysis by SMEs - CCB decision within 5 business days - If approved, update baselines/backlog and assign implementation owner - Post-implementation review - Close and archive.
  • Thresholds: Minor (no baseline impact, under USD 5,000 or 2 days) - PM approval; Major (baseline impact or exceeds thresholds) - CCB approval; Emergency (safety/compliance) - sponsor or CCB chair expedited approval within 24 hours with retrospective review.
  • Required fields: Rationale, affected items, benefits, risks, impact on scope/schedule/cost/quality, alternatives, dependencies, acceptance criteria.
  • Metrics: Average cycle time, approval rate, percentage of emergency changes, percentage implemented without rework.

PMP Example Question

During planning, the team expects many external changes. What should the project manager do to proactively control the impact on scope, schedule, and cost?

  1. Ask the team to reject new requests until execution is complete.
  2. Increase contingency and track changes informally in status meetings.
  3. Establish a change management plan with roles, thresholds, and a defined workflow.
  4. Let the sponsor decide each change on a case-by-case basis without formal criteria.

Correct Answer: C — Establish a change management plan with roles, thresholds, and a defined workflow.

Explanation: A documented change management plan sets clear decision rights, criteria, and process to manage changes proactively. The other options are ad hoc or incomplete.

ICS/OT Cybersecurity Fundamentals — Security Built for Industrial Systems

Industrial control systems cannot be secured like ordinary IT. A forced reboot, aggressive scan, or incompatible patch can interrupt production and create real safety consequences. Effective OT security begins with understanding the systems, constraints, and risks unique to industrial environments.

This course gives IT professionals, engineers, operators, and security practitioners a practical foundation in ICS threats, zone and conduit design, risk assessment, passive asset visibility, and vendor evaluation. You will learn how IEC 62443, NIST CSF, and MITRE ATT&CK for ICS apply where availability and safety come first.

Eight reconstructed incidents—including Stuxnet, Triton, Ukraine 2015, Colonial Pipeline, and PIPEDREAM—show how attackers move through OT environments, what they target, and which defenses could have changed the outcome.

Watch the course preview, then build the vocabulary, frameworks, and judgment needed to take credible first steps in ICS/OT cybersecurity.

Explore the Course


ICS/OT Cybersecurity Fundamentals course preview

Launch your career!

HK School of Management and Technology offers training in project management, job-search strategies, and career growth. Practical skills, tools, and guidance you can apply right away. Covered by Udemy's 30-day refund policy.

Learn More