Chapter 17 — Documentation and change records

Chapter 17 — Documentation and change records

Lesson map

Lesson 17 published. Map, example, EX065.

flowchart TD
  N0["Learning outcomes"]
  N1["17.1 Runbooks"]
  N2["17.2 Configuration records"]
  N3["17.3 Change records"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX065"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["17.1 Runbooks"]
  N2["17.2 Configuration records"]
  N3["17.3 Change records"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX065"]

[Learning outcomes]
    |
    v
[17.1 Runbooks]
    |
    v
[17.2 Configuration records]
    |
    v
[17.3 Change records]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX065]

Learning outcomes

You will (1) write runbooks and configuration records; (2) record changes; (3) keep documentation current.

17.1 Runbooks

Tomas writes runbooks for each routine task: joiner, mover, leaver, recovery, access review, certificate renewal and the stale account report. Each lists steps, who does them and how to check the result. He tests each by having the second IT person follow it unaided, and improves unclear steps. Runbooks matter in a small practice where IT duties are shared and part-time, because tasks must be done the same way whoever is on duty that day. The runbooks are kept in one shared folder.

17.2 Configuration records

Tomas records key settings: MFA policies, session lengths, lock times, SSO connections with certificate dates, admin role holders and alert rules. Each entry notes when it was set, why and who approved it. When a supplier asks why session length is eight hours, the record gives the answer and the trial result. Configuration records let anyone see the intended state, so drift or unauthorised changes can be noticed by comparing the record with the live settings. Tomas checks records against live settings quarterly.

17.3 Change records

Every change has a short record: what, why, who approved, when, how it was tested and how to roll back. Tomas reviews the directory audit log monthly and matches entries to change records; one unrecorded change, a group added by a supplier engineer, is found and reviewed with the practice manager. Matching changes to records keeps configuration under control and finds changes nobody planned, which is how small problems are caught before they grow. Supplier engineers are reminded to request changes through the practice manager.

Worked example

Seven runbooks are tested; configuration and change records are kept; one unrecorded supplier change is found by matching audit logs.

Synthetic case. Runbooks and changes are synthetic.

Errors and limits

Relying on memory for configuration reasons leaves no answer when settings are questioned.

Exercises

• EX065 — Runbook test. How are runbooks tested? Rubric: 3 = second IT person follows them unaided;; 2 = follow;; 1 = read;; 0 = none.
• EX066 — Session question. What answers the supplier's session question? Rubric: 3 = configuration record with trial result;; 2 = record;; 1 = memory;; 0 = none.
• EX067 — Unrecorded change. What unrecorded change was found? Rubric: 3 = a group added by a supplier engineer;; 2 = supplier;; 1 = vague;; 0 = none.
• EX068 — Change fields. Name two fields of a change record. Rubric: 3 = what and rollback;; 2 = why, approver;; 1 = vague;; 0 = none.

Synthesis

Runbooks, configuration records and matched change records keep identity settings understood and controlled.

Continue studying — chapter 17 of 18

← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →