In a world where change is the only constant, organizations can no longer afford to be complacent. Keeping up with the pace of technological change is tough, and all business leaders must learn to adapt. It’s no longer enough to react to disruption. To get ahead of the competition, organizations need to challenge how they think about change by adopting a change management perspective.

Change management clearly isn’t new – it’s a discipline that has evolved over the past quarter of a century. In the field of information technology (IT), it’s the practice designed to minimize disruptions to IT operations while making changes to critical systems and services. A good change management process is also vital for information security because it helps organizations protect their most sensitive assets during changes to systems, processes and technology.

What is change management?

Simply put, change management is a game plan. While change management for the organization refers to the methodologies surrounding people, process and culture, it has an entirely different meaning when applied to controlling the changes that flow through an IT system, product or the development of a software platform. In information security, then, IT change management is the methodology that helps organizations adapt to new processes and technologies with ease and efficiency.

Expectations from management are sky high when it comes to embracing new technology, and IT teams must be capable of implementing regular service updates that enable organizations to adapt to constantly changing security and business requirements. Whether they’re rolling out new services, managing existing ones or resolving problems in code, a well-oiled IT change management process has become the must-have capability to see them through the transition.

Building change capability

An underlying principle of all change management theories is that change doesn’t happen in a silo. In one way or another, it impacts the whole organization and all the people within it. The reality is, there is always a group of people who want to maintain the status quo. This means that, for change to be successful, we must prepare, equip and support individuals as they go through the motions, building a path of least resistance to change.

With good change management, employees can:

• Understand why the change is happening
• Adopt changes faster, more completely and more proficiently
• Stay engaged with the organization during disruptive change
• Have the time and tools to get on board and feel heard and supported

This can be achieved by communicating openly and honestly, providing training and support, and being available to answer questions. Change management is a team effort, so it’s also vital to get leadership on board to drive the project forward.

What are the elements of change management?

Change management is about getting the whole organization on the same page, with a clear and comprehensive message about why the change is happening and how it will take place. This will help ensure everybody who is involved in the change project is aligned and happy. Managing change – and resistance to change – may at first seem a little daunting, but adopting a few essential elements of change management will set you up for success.

These typically include six main components:

• Leadership alignment: Get leaders to present a united front; this is essential to successfully drive change forward.
• Stakeholder engagement: Secure buy-in from all those affected by the change initiative to ensure they are fully engaged and an integral part of the process.
• Communication: Be prepared to communicate not just once, but over and again, as this helps keep everyone motivated and focused on the task at hand.
• Training: Educate employees to better handle the changes in process, workflow and environment that are coming their way.
• Change impact and readiness: Assess how the change will impact your business processes and people as the organization moves through the paces of change.
• Continuous improvement: Change is good, but monitoring change is better. Perform regular checks to ensure there are no negative impacts – and improve as necessary.

Setting a change management framework

How you support your employees through the change process enhances the effectiveness of your change management programme. The key is to use a structured method – or framework – to guide individuals through the change, and ensure that they embrace and adopt it. A change management framework is a model – or set of action steps – that can act as a basis for any organizational change programme. Three of the most popular are ITIL, COBIT and Agile.

Most of these frameworks present exciting challenges, but also major complexities, for change practitioners, who will need to resolve them swiftly and efficiently. To fulfil this task, they must possess up-to-date change management knowledge combined with the confirmed ability to apply key change frameworks. Several globally recognized credentials allow professionals to demonstrate their competency as leaders of change. Some excellent options are the Prosci Change Management Certification, ITIL Change Management Certification and Agile Change Management Certification.*

* ISO does not undertake certification and issue certificates. Certification is performed by external certification bodies.

Choosing the change management model that’s right for you

Various frameworks and models have been formulated to manage change. In the late 1940s, social psychologist Kurt Lewin introduced the Lewin’s Change Management Model, a three-stage approach for organizational change. His model – unfreezing, moving, and refreezing – has served as the foundation for many of the change management frameworks and models that exist today. Other popular models are McKinsey’s 7S Model, Kotter’s 8-Step Change Model, Prosci’s ADKAR Model, and the Kübler-Ross Model.

Some of these change management models focus more on employee-related goals associated with change, while others work to ensure a 360° understanding of the change, or techniques for managing resistance. Essentially, though, each provides a structured approach to change management that helps organizations to implement change in a controlled and organized manner.

Five steps to effective change management

A change management process refers to the stages involved in a change management strategy and their implementation. It helps organizations navigate the transitions of change by ensuring that all factors are being considered. Broadly speaking, the change management process can be broken down into a few basic steps:

1. Prepare for change: This step involves understanding the necessary changes and preparing staff members and stakeholders for what lies ahead. It’s an important part of the process whereby the change manager supports staff through any concerns by communicating the process and securing buy-in from leadership.
2. Create a vision for change: Once stakeholders agree to the change, managers must develop a thorough and realistic plan to make it happen. The plan should include setting goals, defining key performance indicators (KPIs) and assigning tasks to the relevant parties, while also identifying the timeline and resources needed. At this step, the change management team also accounts for potential problems and security risks associated with the change.
3. Implement the changes: All that remains now is to follow the steps outlined in the plan to implement the changes. At this stage of the process, good management and communication are essential to make sure everyone is still on board and employees remain happy and focused – so that everything runs smoothly.
4. Cement the changes: Once the changes are made, it’s important to make sure the transformation is in place. This requires monitoring the change impacts from a security perspective; any remaining issues are put under scrutiny and resolved before the project is closed.
5. Review and analysis: This final step in the process serves to ensure the change is beneficial. Conducting a project post-mortem can help leadership understand whether the change initiative was a “success”, “failure” or “incomplete”. This labelling system helps get more useful and precise metrics for any future changes.

The purpose of a change management process is to ensure that changes are effected in a rational and predictable manner while carrying out updates. You can find more advice on creating a change management plan in ISO/IEC 27001, ISO’s flagship standard for information security management systems. Organizations familiar with ISO/IEC 27001 will know that it is built around effective policies and procedures. These include guidelines on change management outlining how an organization should document and implement changes to business processes, facilities and systems that impact information security practices.

ISO/IEC 27001 Information security management systems

What does change management success look like?

All changes, big or small, benefit from a well thought-out change management process. Modern approaches to change management break down silos, provide context and transparency, while avoiding bottlenecks and minimizing risk. Additional benefits include:

• Improved communication: When employees are properly informed about changes, it promotes better communication throughout the organization.
• More productive workers: With a clear plan in place for how changes will be implemented, employees are able to focus on their work, rather than worrying about what’s going on around them.
• Better work environment: Uncertainty about the future can cause a lot of stress for employees, and change management helps to minimize this by providing clarity and structure.
• Improved morale: When employees feel they are a valued part of the change process and their concerns are being heard, it can boost morale and help to create a more positive work environment.
• Enhanced business processes: With change comes opportunity, and change management can help unleash employee creativity as they explore new ways of doing things.
• A competitive advantage: A successful change programme positively impacts a company’s position in the marketplace, giving it a more competitive edge. With that being said, change management is not always smooth sailing. When it does work, however, its benefits far outweigh the drawbacks, helping organizations to stay more competitive and resilient in today’s digital landscape.

Making change stick

Is that the end? Not exactly. Rolling out a change management process is just the beginning. Once you’ve started the process, you need to make sure that you keep it alive, and cement those benefits. The next stage of the change journey requires vigilance and reinforcement. Now is the time to strengthen people’s skill sets, refine processes and use change readiness to reinforce the change.

Applying the principles of change management before, during and after a project can go a long way to achieving the desired outcomes. The make-or-break test, however, will be your customers – that’s the best measure to evaluate how good your process is. A successful change programme will positively impact the customer experience, and a great customer experience has a positive effect on your bottom line. Surely that’s a return on project investment worth fighting for!

Disclaimer: PECB has obtained permission to publish the articles written by ISO.