IT operations governance
Do we know our IT operations run under a controlled governance model?
Most technology risk is realized in daily operations: an unauthorized change breaks production, an unknown asset goes unpatched, a service degrades below what the business was promised. The governing body's question is not whether operations run, but whether it can require, and see in evidence, that changes are authorized, the estate is known, vulnerabilities are managed, production is secured, service levels are managed, and operational state is measured.
Note
Adopting a page here decides nothing for you. The leadership pages linked here are explanatory and advisory; they establish no requirement and prove nothing about your organization. Every claim in them resolves to the governing reference documents in the corpus, and it is those documents that govern.
Leadership
The leadership pages
Pages from the executive layer mapped to this concern, generated from the narrative registry. They explain and advise; the documents below govern.
- What the governing body should require for IT operations governance oversightexecutive brief
- What the governing body should ask about the organization's change control, patch posture, estate inventory, monitoring, and service performanceoversight question set
- When an unauthorized production change takes a critical service downscenario
Documents
The governing documents
The evidence shelf: the corpus documents the pages above resolve to, joined to the library's registries at build time. These are the documents that govern, and the evidence to ask for starts here.
- IT Service Management Frameworkframework, Operations
- Production Security Requirementsstandard, Operations
- Service Level Management Standardstandard, Operations
- Change Management and Configuration Control Procedureprocedure, Operations
- Patch Management Procedureprocedure, Operations
- Release Management Procedureprocedure, Operations
- Security Monitoring and Alert Management Procedureprocedure, Operations
- Asset Inventory Registerregister, Operations
- IT Operations Key Performance Indicators Registerregister, Operations
- IT Security Operations Registerregister, Operations
Frameworks
Frameworks touched
The external frameworks the shelf above maps, from the corpus registry. The documents' framework spellings are normalized against the crosswalk's committed alias maps: every spelling that names a crosswalk instrument, whole or by a clause, appears once as the instrument's short label and links its instrument page; a cited text that names no instrument is shown as plain text.
- CIS Controls v8.1
- COBIT
- CSA CCM
- DORA (DevOps Research and Assessment) accelerate metrics
- Google SRE
- ISO/IEC 20000-1:2018
- ISO/IEC 27001
- ISO/IEC 27002
- ISO/IEC TS 20000-11:2021
- ITIL 4
- NIS 2
- NIST
- NIST CSF
- NIST IR 8011 Vol. 2 (Hardware Asset Management)
- NIST SP 800-218 Version 1.1
- NIST SP 800-40r4
- NIST SP 800-53
- NIST SP 800-61r3
- NIST SSDF
- OWASP SAMM
Go deeper