State Government Finance and Policy and Elections Committee Briefing January 23, 2018 James Nobles| Legislative Auditor Christopher Buse | Deputy Legislative Auditor

Why IT Change Management? Dependence Nearly All Critical Government Services Rely on Information Technology Complexity IT Systems Have A Wide Array of Interconnected Hardware and Software Components Fragility Changes to Any Interconnected Components Can Lead to System Failures

The Discipline Criteria Vendors Compliance Generally Accepted Best Practice Criteria Exist Vendors Vendor Products Help Organizations Implement IT Change Management Best Practices Compliance IT Change Management Requirements Embedded in Regulatory Frameworks

IT Change Management Process Change Request Planning Approval Implementation Closure IT Change Management Process What Why Risks Detailed Plan Testing Back-out Process Risk Analysis Change Advisory Board Assess Success Initiate Back-out Document Results Goal: Avoid Change-related Disruptions to Services

Conclusion Generally adequate controls over IT change management Enterprise policies and standards Policies and standards are being followed Several systemic issues Inadequate Adequate

Finding 1 Disparate change management software products and processes Make it difficult to diagnose problems Increase the likelihood of change-related failures OLA recommends more closely integrating disparate change management processes and software products

Finding 2 MNIT lacks key controls to detect unauthorized changes Few automated processes to detect unauthorized changes Inability to monitor compliance with security and regulatory baselines OLA Recommends that MNIT deploy specialized software to improve its ability to detect unauthorized changes

Questions? James.Nobles@state.mn.us Chris.Buse@state.mn.us