A+ Core 2 Operational Procedures: Change Management, Documentation, Safety, and AI

A wide domain built on judgment

Operational Procedures is the smallest Core 2 domain at 21%, but it has ten objectives, more than any other Core 2 domain except Operating Systems and Security. Most of it is professional judgment rather than technical recall. Two parts have their own pages: backups (4.3) in the backup types guide and scripting (4.8) in the scripting guide.

Documentation: a ticket that would pass a review (4.1)

Objective 4.1 lists what a ticket needs: user information, device information, a description of the issue, a category, a severity, an escalation level, and clear written progress notes and resolution. Here is an invented example that covers each field.

A good ticket lets the next technician pick up the work without calling the user again.

The same objective covers asset management (inventory lists, a configuration management database or CMDB, asset tags, the procurement life cycle, warranty and licensing, assigned users) and document types: incident reports, standard operating procedures (SOPs), onboarding and offboarding checklists, internal and external service-level agreements (SLAs), and knowledge base articles.

Change management: three change types with examples (4.2)

The rest of 4.2 reads like the fields on a change request: the purpose and scope of the change, the date and time (including change freezes and maintenance windows), affected systems and impact, a risk analysis with a risk level, a rollback plan, a backup plan, sandbox testing, the responsible staff, change board approval, implementation, peer review, and end-user acceptance. A scenario that skips one of these, such as a change with no rollback plan or no end-user acceptance, is describing a process that is not ready to run.

Safety and the environment (4.4 and 4.5)

• ESD. Wear an ESD strap, work on an ESD mat, and store components in antistatic bags.
• Electrical safety. Disconnect power before repairing a PC, and make sure equipment is properly grounded. Never use water on a fire involving electrical equipment. Use an extinguisher rated for electrical fires.
• Personal safety. Lift with your legs, not your back. Wear safety goggles and an air filter mask when the job calls for them, for example when cleaning dusty equipment.
• Handling and disposal. Use the material safety data sheet (MSDS) for handling and disposing of batteries, toner, and other materials. Follow local regulations for disposal.
• Environment. Watch temperature, humidity, and ventilation, place equipment where air can move, and clean dust with compressed air or a suitable vacuum.
• Power problems. A surge suppressor absorbs voltage spikes. An uninterruptible power supply (UPS) keeps equipment running through brownouts and short blackouts long enough to shut down safely.

Incident response, licensing, and regulated data (4.6)

If you find prohibited content or evidence of a crime while working on a device, stop, do not keep browsing, preserve the device as it is, and inform management, which may involve law enforcement. Then document everything. The objective lists chain of custody, a copy of the drive for data integrity and preservation, incident documentation, and order of volatility.

Order of volatility means collecting the evidence that disappears fastest first. RFC 3227 gives an example order: registers and cache; then routing table, ARP cache, process table, kernel statistics, and memory; then temporary file systems; then disk; then remote logging and monitoring data; then physical configuration and network topology; and finally archival media. Powering off a machine first destroys everything at the top of that list.

Chain of custody is the record of who had the evidence, when, and what they did with it. A gap in it can make the evidence unusable.

Licensing. Know valid licenses, perpetual licenses, personal-use versus corporate-use licenses, open-source licenses, DRM, and the EULA. A home license installed on a company laptop is a compliance problem even if it activates.

Regulated data. Credit card payment information, government-issued personal information, PII, and healthcare data each come with handling and retention requirements. Non-disclosure agreements (NDA and mutual NDA), the acceptable use policy (AUP), and splash screens that state the rules at sign-in round out the objective.

Communication and professionalism (4.7)

The objective lists behaviors rather than facts: dress for the environment, avoid jargon, stay positive, listen without interrupting, be culturally sensitive, be on time, avoid distractions, handle difficult customers without arguing, set and meet expectations, follow up, and treat the customer's confidential materials with discretion. In a question, the right answer is usually the one that clarifies with an open-ended question, restates the problem, or sets a clear expectation, and the wrong answers dismiss, blame, or argue.

Remote access and its risks (4.9)

AI basics (4.10)

The objective lists application integration, policy (appropriate use and plagiarism), limitations (bias, hallucinations, and accuracy), and private versus public AI (data security, data source, and data privacy).

• Hallucinations. NIST's generative AI profile calls this confabulation, "the production of confidently stated but erroneous or false content." For a technician, that means checking an AI-suggested command or registry change against vendor documentation before running it.
• Bias. NIST lists harmful bias among generative AI risks. Treat AI output about people, such as summaries of complaints, with the same care.
• Private vs public. Pasting a user's ticket with names, passwords, or PII into a public AI tool can expose regulated data. Use only the tools your organization's policy approves, and remove sensitive details first.
• Policy. Appropriate-use rules say where AI may be used. Plagiarism rules apply when AI writes documentation or knowledge base articles that will be published as your own.

Turn the domain into practice

Write a ticket for a problem you have fixed, even at home, using the table's fields, classify three changes you can imagine at a small office as standard, normal, or emergency, and read the RFC 3227 order of volatility list out loud once. The security settings that support many of these procedures are in the Core 2 security guide. Then practice A+ Core 2 operational procedures scenarios with Passy →.