With how quickly technology changes, there’s no shortage of opportunities to invest in cutting edge technologies. However, these investments are often done without consideration of how an organization will deploy, implement, and support these investments to ensure maximum value to the organization. That’s where IT governance comes in.
IT governance helps establish guardrails around your use of technology and helps mitigate the risks to your organization’s infrastructure. It can be tricky to get IT governance right because it depends on your organization’s ability to set expectations and consequences that helps your employees understand the risks they face.
However, what does IT governance actually consist of?
Defining “IT Governance”
When trying to define IT governance, the best way to think about it is the strategy and frameworks for aligning business with technology. What this means is that it helps you tie together everything technology related in a coordinated way to benefit, secure, and protect your organization.
In practice, IT governance is about taking stock of what your organization is currently working with and identifying what needs to happen in order to safely use technologies to their fullest. Often, this requires documenting policies, procedures, establishing a training program to ensure every employee is on the same page, compliance measures in the event of policy violations, creating an incident response plan, and creating and maintaining a business continuity plan. It’s a lot to think about!
Fundamentally, its about keeping your organization safe and secure.
What Goes into an Effective “Acceptable Use Policy?”
An acceptable use policy or AUP, is a policy that details acceptable use for company devices, use of enterprise resources, guidelines for how to set up and manage passwords, bringing your own device, and any other aspect of IT that’s unique to your business.
Whether you keep these policies in a printed format or on the company’s intranet is largely besides the point, because the real function of such policies is to ensure that your employees know how they’re permitted to use the technology provided by the organization and the consequences they can expect from noncompliance. Choosing which policies are likely to work for your organization can’t really fit into a singular mold, because leaders should look to avoid creating such strict rules or harsh punishments that your employees won’t see the value in complying. Policies should set reasonable expectations for your employees rather than risk being too stringent.
The goal should also be to keep your organization safe by ensuring network security and minimizing the risks of shadow IT.
What Should Be in an Incident Response Plan?
As nice as it would be to believe you’ll never face a security incident or data breach, the reality is that it’s not really a question of if your organization will experience one, but when they’ll experience it. Business leaders who understand this difference are able to recognize that they need an incident response plan in place because it’s the first step to ensuring their organization has the potential to bounce back after a cyber attack.
Incident response plans consist of documentation that provides organizations with procedures to follow during a cyber attack. The plan should include steps to identify and respond to a malicious actor and limit the devastating impacts of an attack on organizational IT infrastructure. Having a robust Incident response plan in place can mean the difference between an attack that gets stopped and an attack that has the potential to put your organization out of business.
How Do I Know If My Organization is “Resilient?”
A resilient organization is one that has a plan in place for business continuity in case disaster strikes. The best situation for any organization to be in is to implement best-practice cybersecurity strategies, while also planning to ensure business continuity and recovery following a disaster. But just having the plan isn’t enough. The pandemic forced many organizations to deploy their disaster plans, and they found they didn’t have updated policies and procedures in place to handle it, causing issues with shadow IT and nonapproved hardware gaining access to corporate networks.
I Don’t Have a Ton of Resources to Devote to This; Can I Skip Developing an IT Governance Plan?
You can always skip investing in IT governance, but doing so runs a risk that’s much higher than what it would cost to have one in place.
A cyber attack that’s allowed to run through your network could end up locking you out of your systems, compromising your organization’s ability to operate and costing time, resources, and reputation while you work to remediate the issue. Even having a plan for which systems to prioritize as business critical in the course of a cyber attack can minimize the downtime your organization experiences as a result of a cyber attack.
A mature business continuity plan may be ideal, but having something in place is far better than having nothing because there weren’t enough resources for a “perfect” plan.
If you’re looking for help with figuring out how to develop or strengthen your IT governance, contact us.
Mike is a Consultant with nearly two decades of experience as a digital disruptor within the technology space. He has worked with non-profit, for-profit, and educational institutions.
