Education, HIPAA / HITECH Enforcement, Risk Analysis/Risk Management, Vulnerability Testing & Management

How to Manage Change

by CJ Michael

One of the most difficult systems to manage is change. Every organization undergoes change in their applications or operating environment; it is difficult to stay relevant in your industry without keeping up-to-date. One of the most convincing reasons to implement a formal process to document and approve changes is that it really only takes one oversight to create chaos in your organization and unintentionally expose information security problems.

Change control can be defined as “a formal process used to ensure that changes to an application or system are conducted in a systematic, controlled, and coordinated manner.”1 The benefits of having a system for implementing changes in the organization are numerous and include reducing unauthorized changes and/or downtime, improving communication, maintaining system integrity, and preventing unnecessary security exposures. These benefits can translate into better sales, improved margins, and a more productive workforce. In determining the processes to follow for tracking and approving changes, an organization-wide decision must be made with risk management in mind. Consider any current processes in place and their effectiveness or what change tracking system is most compatible with existing infrastructure. Remember that the goal of a project like this is to improve processes, not make them more difficult or complex!

Change control is a “standard method and set of procedures for handling changes within the IT environment to help minimize risk to the business” and is a part of the more comprehensive discipline of change management. When employing a change management system, your organization should consider including all or most of the following steps for effective change management. This is a pattern recommended by Michelle Bigelow, contributor to Implementing Information Security in Healthcare: Building a Security Program.

  • A change is requested
  • The change is reviewed
  • The change is either approved for testing or denied
  • An approved change request is tested
  • The change is documented
  • The change is scheduled
  • Information about the change is communicated to all affected parties
  • The change is implemented
  • The change is evaluated
  • Technical vulnerabilities are assessed
  • The change control database is updated

This is a very high-level process for managing changes within your organization. There are many other potential steps that are necessary depending on the importance of the system or regularity of the changes or updates. Unfortunately for many organizations, a lack of controls and documentation around change management is adding to risk exposure on a daily basis. If this type of program is something that your organization needs, please contact RISC Management for assistance. Remember that with any security program decision, the first step is always a Risk Analysis. If you don’t identify, analyze, and document your risk, you’ll never effectively manage it.

Sponsored by: RISC Management,


Implementing Information Security in Healthcare: Building a Security Program


Tip of the Week, Trends & Technology

The Role of Security Controls in a Security Program

When your organization is building a security program, clear direction must come from the Executive level to guide management and staff in implementing the right solutions. Without a greater understanding of the organization’s direction, management lacks the proper knowledge to make decisions in the best interests of the organization. In much the same way, a security program needs the proper structure of controls in place to guide the organization at the lower levels of the workforce.

A security control is “any administrative, management, technical or legal method that is used to manage risk.”1 Once your organization has identified areas of need, whether because of security or compliance concerns, controls are the tools used to correct the problem or fill the gap. These tools can consist of staff members, physical or technical measures, procedures, or governance. As Kim Sassaman explains, “Implementation of information technology security controls is how the Security Program is put into operation.”1 When deciding on a control to deploy, the decision needs to be part of a risk analysis or risk management process; each type of control must exist for a specific reason, hopefully filling multiple needs at once.

Some examples of controls include door locks, ID badges, firewalls, encryption, policies, procedures, and oversight committees. One of the most glaring results of the OCR KPMG Audit Program was that nearly 80% of Covered Entities were lacking a formal risk analysis, the very first step in determining the proper controls for your organization!2 And if you haven’t heard about some of the most recent data breaches, many of them have been caused by a lack of encryption or media disposal controls. These issues and more can be resolved with a proper security program supported by security controls outlined in organization policies.

Contact RISC Management if you need help developing a security program or implementing controls. Remember, the first step is always a Risk Analysis. If you don’t identify, analyze, and document your risk, you’ll never effectively manage it.



  1. Implementing Information Security in Healthcare: Building a Security Program
  2. “Preparing for HIPAA Compliance Audits.” Healthcare Info Security Website