Written by Jack Heath, Information Security Engineer, 2024
Introduction
About 6 months ago, one engineering team experienced a data incident due to a software bug. In response, the company’s leadership, eager to prevent future issues, implemented a sweeping set of new security controls across all teams and applications. This included mandatory approval workflows, more frequent reporting, and additional documentation requirements.
The new controls were well-intentioned, but over time, they started to affect productivity in unexpected ways. For instance, the product development team, which worked with less sensitive data, now spent more time on compliance tasks than actual development. It created delays, bottlenecks, and a drop in team morale. Meanwhile, the application who actually managed highly sensitive information, continued to work under the same new controls, but they needed even more stringent measures to address their unique security needs.
After a few months, leadership noticed that overall project timelines were slipping. Despite the new measures, minor incidents were still occurring, and employees started raising concerns. To everyone but leadership, the issue was clear: by treating all teams and systems the same, they had added unnecessary complexity to some processes while falling short in securing others. Attempting to micro-manage the agile process through controls.
In any organization, effective change management is crucial for both success and maintaining compliance. However, applying broad, one-size-fits-all controls across various applications and teams always leads to inefficiencies, stifling both productivity and innovation. The tendency is to try as part of every corrective action or incident to implement some new control or policy to keep offer assurances that the problem will never happen again. But this approach is unsustainable. First, because no system is perfect, and the continuous and broad deployment of ever stricter rules won't ever accomplish the ideal of a perfect system. But second, because different teams and applications have unique needs, so imposing these uniform standards can create bottlenecks, reduce agility, depower teams to self-manage, and ultimately compromise compliance itself.
Agile is about encouraging ownership and responsibility, which leads to more successful and compliant change practices. In the pervious example, the approach was too broad. Under agile management needed to listen to each team and adjust controls to fit their specific needs. Conduct a risk assessment to identify the unique security requirements of each department, and then make sure only the teams and systems with significant risk get the highest level of security controls, while others are allowed to operate with fewer restrictions.
Localized controls, adapted to each team’s needs and the specific applications they use, are key to sustaining operational efficiency and effective change management. By empowering agile teams to manage their own processes, we not only streamline workflows but also strengthen compliance. But this means leadership must trust in team autonomy and have confidence those closest to the work know how to prevent impact best.
Governance is essential here: before implementing any new control, impact assessments and team collaboration ensure that changes address specific needs without affecting unrelated workflows. Automated tools can aid in managing controls, identifying redundancies, and ensuring that controls are relevant and applied only where necessary.
Avoiding a Change Process that Becomes Unmanageable under Agile
Many organizations struggle with change management because they rely too heavily on one-size-fits-all controls. Over time, these general controls accumulate, creating inefficiencies and even threatening compliance. However, by moving to a more localized, context-specific approach, organizations can simplify change management, reduce errors, and boost efficiency. But lean change management practices minimize waste from redundant controls, promoting continuous improvement and create methods to remove controls that no longer serve their purpose on a team-by-team basis.
Here are key steps to implement this tailored approach:
1. Use Localized, Context-Specific Controls
- Apply controls that target specific issues and workflows rather than blanket policies.
- Conduct a targeted risk analysis to ensure corrective actions only impact relevant systems, reducing unintended side effects.
- For example, if one application has a specific vulnerability, apply a tailored control to that application only, rather than introducing it universally.
2. Implement a Tiered Control System
- Develop a system of tiered controls that differentiates between critical controls (mandatory across all systems) and application-specific controls applied only where necessary.
- By prioritizing high-risk areas, this approach minimizes unnecessary complexity and reduces operational burden.
3. Adopt Lean Change Management Practices
- Emphasize lean practices to eliminate waste and simplify controls, using continuous improvement models like Kaizen.
- Conduct regular reviews of controls to assess their effectiveness and remove any that are overly complex or redundant.
4. Create a Governance Framework for Control Implementation
- Establish a formal governance process that requires impact analysis and cross-team collaboration before implementing new controls.
- Set up a decision-making body to review each control for necessity and proportionality, preventing the automatic addition of new controls.
5. Leverage Automation to Manage and Track Controls
- Use automated tools to monitor controls, ensuring they are applied only where needed.
- Automation also helps identify redundant or overlapping controls, reducing system complexity and supporting streamlined processes.
6. Build in Flexibility for Exceptions
- Create a flexible framework that allows teams to request control adjustments when justified by specific needs.
- This adaptability helps keep controls relevant and avoids unnecessary operational burdens, ensuring teams work more effectively.