SDHS: Change Management, Notifications and User Acceptance Testing
The SDHS is relied upon by researchers and data managers to support their research and operate clinical trials. Studies are free to implement procedural or technical solutions which may rely on components of the SDHS being configured in a particular state. Changes to these states may be disruptive to these studies or trials. To support the studies that are using our service, we have defined the notice that we will give for changes.
Changes fall into one of 3 categories below. Each of the categories below define what changes fall into the scope, the requirements for Change Management processes, and the notification requirements.
Change Categories
Routine Maintenance (minor changes)
| Scope | Installation of operating system and application patches that resolve security, performance or feature issues. Changes must not knowingly affect the architecture of the SDHS, including but not limited to folder names and URLs |
|---|---|
| Change Management Required? | No Changes in this category are documented and have a well defined recovery plan. They are considered minor changes and follow a documented process, procedure, policy or work instruction. This type of change would be considered BAU and its associated risks have already been identified and treated. |
| Notifications | None Routine changes |
Planned Changes
| Scope | Changes to SDHS User or External Collaborator methods of access. Data locations, URLs, folder names. Operating system or published application releases. e.g changing to Office 2016 from Office 2013 Published applications which are made available to more than one study. |
|---|---|
| Change Management Required? | Yes Changes in this category are likely to be one off changes requiring adequate planning. |
| Notifications | If the change is for an IT system which has no effect on the end user or data manager, then a notification to Data Managers or End Users is not required. If the change has any effect on the end users or data managers, then notifications should be sent according to the following schedule.
In all cases, notifications should be limited to only the users that are affected by the change. There is no requirement for SDHS External Collaborators to be notified of any changes by CSCS. Data Managers are required to notify External Collaborators for their studies if the change will affect them. Different studies have different requirements and processes for External Collaborators, and it is not possible for CSCS to tailor notifications to meet all use cases. |
Unplanned, Emergency Changes
| Scope | Mitigation of Security Vulnerabilities deemed to be an immediate risk to the integrity of the SDHS Resolutions to failures of hardware or software which jeopardise the availability, integrity or confidentiality of the data or the system. Changes in this category should avoid, wherever possible, changing access paths, application or operating system versions or any component of the SDHS which may have an adverse effect on end-user access. |
|---|---|
| Change Management Required? | Yes Changes in this category will require the Change Management for Emergency Changes to be followed. |
| Notifications | Depends on the Scope of the Change If the change has had an effect on end user access, paths, URLs or similar, then a notification should be sent to either all SDHS Users or all Data Managers. Notifications should be sent within 24 hours of the change being implemented on the system. |
User Acceptance Testing
We are not required to provide User Acceptance Testing for any changes that are made. However, upon announcement of a Planned Change a Data Manager is entitled to ask for an environment in which they can test the proposed changes and their effect on their studies.
If a request for a UAT environment is received, then CSCS will review the request. If it is practical to provide an environment, without incurring additional costs, consuming excessive resources or jeopardising the availability, integrity or confidentiality of the existing environment, then reasonable attempts will be made to provide the environment to the Data Manager. The right to request an environment is limited to Data Managers.