With IT systems and their associated code being so complex, one can see how easy
it is to mistype a digit or miss a step in a procedure. Nonetheless, with the consequences
of downtime or exploitation presenting such a high risk to you and your business, you
cannot afford such missteps. You need to ensure that any changes to your security baseline
are closely managed and risks controlled.
Many businesses are required to have change management controls as directed by
such laws and regulations as the Sarbanes–Oxley Act and the HIPAA. If you are part of an
organization operating or supplying critical national infrastructure, change management
controls are mandatory to ensure safety and security. Shareholder and regulators both look
to see whether management is effective in making information secure in accordance with
mandatory controls and industry best practices. Failure to comply and deliver satisfactory
results clearly (and appropriately) is viewed as management failure.
Billy Crystal says, “Change is such hard work.” It indeed is hard work, yet change
is a fact of life that occurs in both your home and business environments, in available
technologies, and in personnel and processes. In order to manage your cybersecurity
risk, you must tightly control your change management process.