1

Hi,

Q1. How do you document all the system and network changes done by outside company such as consultants?

Q2. What tools or software you use? Excel, google drive, etc.

Q3. What is the best practice or ITIL way of handling this?

Q4. May I see sample templates?

I have active directory, number of different servers, VMWare, Hyper V, 300 plus switches and AP’s. System and network changes will be made by outsource/consultants and also local administrators.

7 Spice ups
2

Q1: You hold them accountable to document anything they do

Q2: Excel, Word, Visio, Pencil

Q3: ?

Q4

imgres.jpg

I know there are other threats and templates out there.

3
  1. The vendor should be documenting any changes they complete. If not make sure its part of your vendor agreement.

2)You can use whatever you want - Access, excel, third party product

  1. Configuration Management Database (CMDB)

  2. Personally I don’t have any but check on SANS.org

4

Hopefully your outside companies aren’t performing any changes without your knowledge. If they have that ability then you need to push to revoke that authority. In an ideal situation you should require all outside vendors to document any changes and present that documentation to you before the change so you can approve it (their documentation should also include some type of rollback plan).

For documentation I use a combination of Spiceworks Inventory, Google Docs, Sheets & Drawings as well as Evernote. It all depends on what I’m documenting. I also use a PINS password DB (kept on Google Drive) for passwords as well as for keeping other important information about the infrastructure.

It’s been a few years since I was ITIL certified, but I’m sure they’d want you to use some type of CMDB (Change Management Database) where you could log all of the changes. Even a simple spreadsheet can function as a CMDB; just include the important information, such as a change number, time & date of the change, description (which may include a link to an external Change Request Form document), who approved the change, and affected systems. It depends on your resources how feasible and detailed this is.

I don’t have any templates, but I’m sure there are some available (Google is your friend).

It sounds like you might need to implement a network monitoring tool to help you get a better handle on what’s going on in your environment. SolarWinds (if you can afford them) and PRTG are both good options, along with a number of others. I use Spiceworks Network Monitor, but I’m monitoring a much smaller environment currently (and don’t have the budget to spend on SW or PRTG, and yes PRTG is free, but only for the first 100 monitors).

@SolarWinds

1 Spice up
5

(2) weekly change management meetings, one on Monday and one on Thurs. All changes are entered into Quickbase and then have to be approved by a business owner and then by a change management approver.

6

Spiceworks inventory and word and excel docs. I use onenote for quick references and short notes. First and foremost any vendor or outside consultant SHOULD document any and all changes made, it should be one of the very first items discussed. Know from them what they are, how they plan to do it, and how are they documenting said changes. I never let a vendor touch a thing until they show me they have a plan in place and aren’t just chasing dollar bills. As for any local admins, they should be documentin changes as they go, this should be part of on-site training to ensure proper communication. Our local admins have a shared one drive for business where they store their notes for each other and documentation while in the field.

7

We just document in Excel worksheets and word documents

8

Yeah, for me, I use Excel a lot to document the change, though it take time.

We’re looking for a system too.

9

I use Excel alot and it works well. I have dates, people who requested the changes and the contraters who affected the changes. Additionaly i never delete any info off the sheet, i leave it in for record purposes.