LEARN. PRACTICE. GROW.Concept and mechanism
Change analysis needs to understand what changes, why it changes, and what may be affected. Include application, configuration, data, access, infrastructure, security, and upstream and downstream dependencies. A change small in code lines can have a large operational reach. Use specialists to assess technical mechanisms and service owners to confirm consequences and tolerance. The calendar should show more than reserved hours: consider shared teams, recovery capacity, critical business periods, and simultaneous changes. An isolated approval can be insufficient when two changes interact within one service or require the same specialist.
Guided application
In a fictional case, a firewall change and middleware update are scheduled for Saturday. Both need the same network specialist for validation and rollback. Execution appears not to overlap, but recovery phases may coincide. Map the flow, confirm availability, and compare a coordinated sequence with separate windows. For a 120-minute window, a plan sequentially reserving 70 minutes of execution, 25 of validation, and 35 of recovery needs 130 minutes before any additional margin. Expose the ten-minute gap; do not hide recovery outside the window. The decision should change the plan, scope, or window with appropriate authorization.
70 + 25 + 35 = 130 minutes; the 120-minute window is ten minutes shorter than the considered plan.
Common pitfalls
Few lines treated as low impact; calendar without recovery; invisible shared specialist; unconfirmed dependencies.
Related topics: Mandate, models, and authorization · Evidence, artifacts, and controls · Readiness and execution decision
Analyze the service and shared capacity before confirming the window.
Reference: SP 800-128 full publication · NIST SP 800-128 updated October 2019; DORA five-metric model and change approval guidance; vendor documentation inspected 2026-10-01