Authorization of changes should be documented on a standard request form that details the changes, provides appropriate justification and requires a predefined level of user management approval. These forms should also provide for approval by IT management and should be retained to serve as evidence that the change was authorized. There should be documentation that test results were reviewed and approved per policy.
As we learned in our reader poll (see charts), change is frequently authorized by technology owners, who are also the ones making the changes, and not an appointed change-management board. In fact, only 19 percent of survey respondents use a change-control board. Clearly, in many organizations, technology owners have been granted excessive authority for implementing change.
3. Approval
Ensure that business and IT management, separate from the CM team, approves all changes before they're placed in production. Approval should be based on satisfactory test results, evidence of thorough consideration for the proposed change, and an understanding of how the change could impact the productivity and security within the organization.
Change requests can be made on simple paper forms or complex electronic tracking systems. For small environments, with few tiers of management and even fewer systems administrators, paper request forms make complete sense. In large or complex organizations, an electronic CM system is probably worth implementing. A well-constructed system can route requests through various pathways based on predefined policy (for a unique take on a CM tool, see "Talk Quick and Dirty to Me,").
To realize the benefits of cloud-native software, an application must actually be cloud-native—designed to run in the cloud, interacting with disaggregated cloud services, fully manageable as code—to deliver the expected benefits.
By combining resources and expertise, the AI-Enabled ICT Workforce Consortium will offer a blueprint for how industries can adapt to an AI-dominated future.
IT leaders should heed the guidance of cybersecurity insurance providers who think businesses should prioritize security education, incident preparedness, regular internal audits, and ongoing vulnerability scanning and patching.
