7. Scheduling
Schedule all changes and communicate the schedule to users and IT management. There should be procedures for scheduling changes to production systems or network devices in order to minimize disruption, confusion and the possibility of erroneous processing. There also needs to be a method for communicating this schedule to the users and IT personnel who will be affected by the changes. One common method of reducing the inconvenience changes can have on an enterprise is to group multiple changes into "releases."
This release concept, used widely by hardware and software vendors, reduces the steady volume of changes into a number of regularly scheduled events, either weekly, monthly or quarterly. Problems with this method include potential delays for critically needed changes and a larger potential for post-change problems with a corresponding increase in troubleshooting difficulty. In addition, a single cancellation because of business demands can throw critical changes on the back burner for an extra week, month or more. In such cases, there must be protocols for requesting emergency updates.
8. Emergency Procedures
Determine appropriate procedures for handling emergency changes that occur when prior authorization and approval cannot be obtained, as for a patch to block a new vulnerability. This is often referred to as a deviation standard. Also, in many organizations, information processing runs 24/7/365. As a result, there are very few times when change can be considered opportune. In these situations, changes must sometimes be made quickly, and completing a full change-approval process may not practical. Knowing that these events are inevitable, deviation procedures are essential.
To realize the benefits of cloud-native software, an application must actually be cloud-native—designed to run in the cloud, interacting with disaggregated cloud services, fully manageable as code—to deliver the expected benefits.
By combining resources and expertise, the AI-Enabled ICT Workforce Consortium will offer a blueprint for how industries can adapt to an AI-dominated future.
IT leaders should heed the guidance of cybersecurity insurance providers who think businesses should prioritize security education, incident preparedness, regular internal audits, and ongoing vulnerability scanning and patching.
