Introduction:
Change is the only constant in the world of technology, and managing it effectively is crucial for organizations to thrive. In large enterprises, the Change Advisory Board (CAB) plays a pivotal role in overseeing and approving changes, ensuring stability, and minimizing risks. However, as the software development landscape evolves, there is a growing need to embrace Continuous Integration/Continuous Deployment (CI/CD) methodologies that prioritize speed and agility. This article delves into the benefits of CAB and CI/CD, explores why organizations are increasingly adopting CI/CD, and highlights the necessity of bridging the gap between these two change management methodologies.
The Role of CAB in Big Enterprises:
In large enterprises, the CAB acts as a governance body responsible for evaluating and approving changes before they are implemented. By bringing together stakeholders from various departments, including IT, operations, and business units, CAB ensures that changes align with organizational goals, minimize risks, and maintain stability. CAB provides a structured and controlled environment for change management, enabling organizations to mitigate potential disruptions and ensure compliance with regulatory requirements. Another benefits of the CAB is tracking and auditing that is required by many compliancy protocols like Sarbanes-Oxley Act (SOX) that requires publicly traded companies doing business in the U.S. to establish financial reporting standards, including safeguarding data, tracking attempted breaches, logging electronic records for auditing, and proving compliance.
CI/CD: The Agile Alternative:
In contrast to the stringent control mechanisms of CAB, CI/CD represents a different paradigm. It revolves around automating and streamlining the software delivery pipeline, allowing for rapid and frequent code deployments. CI/CD breaks down the traditional silos between business, development, testing, and operations, enabling teams to deliver software updates continuously and efficiently. It fosters a culture of collaboration, innovation, and speed, ultimately enhancing an organization’s agility and time-to-market. CICD is also an integral part of some of the more modern software development methodologies like Agile and SAFe.
The Shift to CI/CD and Its Advantages:
Organizations are increasingly gravitating towards CI/CD due to the numerous advantages it offers. Firstly, CI/CD reduces the time and effort required to release software updates, leading to faster innovation and quicker response to market demands. Secondly, it enhances the quality of software through automated testing and continuous feedback loops, minimizing the risk of bugs and errors. Additionally, CI/CD promotes collaboration among cross-functional teams, fostering a culture of shared responsibility and knowledge sharing.
Bridging the Gap: The Need for Integration:
While CAB and CI/CD represent two opposite ends of the change management spectrum, it is crucial to find a way to bridge the gap between them. Organizations need a hybrid approach that combines the control and governance aspects of CAB with the agility and efficiency of CI/CD. By doing so, they can strike a balance between managing risks, ensuring compliance, and delivering software updates rapidly. So, the million dollar question is can ITIL and CAB Accommodate CICD without major surgery to its definitions and processes. I think it can.
Delving deeper in ITIL
So, before we attempt to bridge this gap, we really need to delve deeper into ITIL processes and definitions in an attempt to understand its spirit. Our objective is to preserve the spirit of ITIL and its change management processes while changing its implementation mechanism.
ITIL follows the common-sense doctrine that states that each change must be evaluated primarily in terms of both its risk and the value to the business. So, the best way to enable a low-ceremony change management process is to reduce the risk of each change and increase its value.
ITIL also defines three types of changes. Standard changes, pattern changes and an emergency change. Each type corresponds to different levels of risk, impact, and control. When considering the integration of CI/CD and CAB, it is worth noting that CI/CD aligns closely with the concept of pattern changes, emphasizing the need to adapt change management practices accordingly.
Pattern Changes and CI/CD:
A pattern change, as defined by ITIL, refers to a type of change that is repetitive, predictable, low risk, and follows a predefined process. CI/CD, with its automated and repeatable deployment processes, fits the profile of a pattern change. The repetitive nature of CI/CD workflows enables teams to execute changes rapidly and consistently, minimizing risk, minimizing the need for extensive manual review and approval.
Benefits of Pattern Changes:
Pattern changes offer several advantages when it comes to managing change. Firstly, the predictability of these changes allows organizations to establish well-defined processes and procedures, reducing the likelihood of errors or disruptions. Secondly, the ability to automate and replicate pattern changes ensures consistency across multiple deployments, enhancing efficiency and reducing the risk of human error. Lastly, the continuous integration and deployment nature of CI/CD enables organizations to rapidly adapt to market needs and deliver value to customers more frequently. Below is a table how a CICD pipeline satisfies the requirements of a pattern change.
| Standard Change Requirement | How CICD satisfies it |
| 3 consecutive successful implementations of a Normal Change | CICD pipelines are 100% automated.multiple QA gates (unit testing, regression testing, static code analysis like Sonar cube, Vulnerability scans like VeraCode, integration testing). |
| Repeatable scope and approach to implementation for each Change | CICD are isolated to a single Service with limited ScopeIt is repeatable as it is 100% automated. |
| Low or mitigated risk plan | CICD pipelines are isolated to a single Service with limited ScopeIndividual stories are released separately as they pass all the quality gates of the CICD pipeline. They are very limited in scopeRisk is mitigated with all the Quality gate (unit testing, regression testing, Sonar cube, VeraCode) that are built within the pipelineFeature Toggle |
| Compliancy requirement and documentation | Automation of ticket creationsAutomatic notifications and approvals. |
How will it work.
Here is how I see this working.
- SDLC documentation defines what is acceptable as an approved CICD pipeline. An example of an approved pipeline is the below pipeline that has 16 defined gates.
- Source Control
- Optimized Branching strategy defined.
- Automated Unit testing
- Code Static analysis
- >80 % code coverage
- Vulnerability Scan
- Open Source scan
- Artifact version control
- Auto provisioning
- Immutable servers
- Integration testing
- Performance testing
- Automated of build, deploy, test for every automation
- Automation of change order and ticket creation for audibility and documentation.
- Zero downtime releases
- Feature toggle enablement.
- This pipeline went through at least 3 deployments as a standard change with success.
- Team submits this pipeline as a candidate for a pattern change.
- The CAB approves the pipeline as a pattern change.
- Once this pipeline is approved as a pattern change, then the team is free to start using it
- KPIs are defined and gathers for this pattern change. These KPIs would be reviewed on a quarterly basis.
- The CAB has the right to revoke the status of a pattern change if KPIs are not met.
Conclusion:
Bridging the gap between ITIL/CAB and CI/CD requires a settle approach that accounts for different change types. Recognizing CI/CD as a pattern change offers a foundation for integrating it into existing change management practices. Organizations can optimize their change management processes by identifying and automating repetitive and low-risk changes within the CI/CD pipeline, allowing the CAB to focus on higher-risk changes. By embracing automation and continuous improvement, organizations can strike a harmonious balance between agility and control, ultimately enabling them to thrive in today’s fast-paced technology landscape.