One question that came in a few weeks ago from the ITSM Uplift community was - how do you overcome Unauthorised Changes?
Gone are the days where each IT team is an Island, with their own sandpits, driving their own agendas and implementing things as and when they choose. ’as a service’ offerings are changing the traditional IT landscape at a rapid pace - we are now moving into a highly-integrated environment mixing cloud and internal configurations to drive business outcomes. From an IT Operational perspective understanding component demarcations and cross team responsibilities has become even more important than ever when developing and maintaining credible Service Levels.
In the sprawl of IT components and end points - getting to the bottom of critical stability issues is often a process of elimination - so what happens when the root cause is an unauthorised change? and it brings your organisation to a standstill? In the tradition sense IT is usually great at responding however with more pressure on IT to scale and refine services - a more strategic view is paramount.
Firstly - do you have a robust end to end IT Change Management capability in place? - How have you communicated it? - are the implications of non-compliance clear? Do you have a mechanism for understanding the up & downstream impacts?
Secondly - how will you detect Unauthorised Change? detecting unauthorised Changes is a balancing act, between getting enough insight without initiating your own fully blown detective agency. The good news is that technology is progressing year on year and setting automated alerts for unauthorised change across your landscape is becoming easier:
Here are 4 Tools that have Unauthorised Change Detection features:
Splunk - Change Audit & Change Detection feature.
SolarWinds - Network Security Tool - Allows you to track and monitor unauthorised Change
Evolven - Detects changes that do not correlate to any Change request.
Configure - Unauthorised Change Detection Feature
Thirdly - when you find an Unauthorised Change - What are you going to do about it?
This is the most important part - This is the step that targets the very core of your Change Management Control culture - does your governance have teeth? What are the implications of non compliance? - You must have consequences, and your It Change Management Policy must be explicit in terms consequences to support your broader organisational governance. If you have invested time and money in your IT Change Management Process Capability then you want it upheld and to formally supported. This conversation needs to be had with your sponsors and senior leaders to lobby and apply formal endorsement.
Keep in mind that your Change Management Process should allow for all types of Changes from emergency to standard to normal Changes and therefore should eliminate any real reason for an unauthorised Change to make it into your IT landscape.
If you have other strategies that have helped you to overcome Unauthorised Change within your organisation or you want to share techniques that have resonated with you the most, I’d love to hear from you, leave a comment here or drop me an email firstname.lastname@example.org..