What the governing body should require for IT operations governance oversight

Authority disclaimer. This page is an executive narrative. It does not establish requirements; the linked corpus governs. It is provided to support understanding, discussion, and decision-making by the governing body and accountable executive leadership (board, ELT, or senior management, as applicable). It creates no obligation, control, or assurance by itself. Its publication approval is an editorial act only and confers no authority over any corpus document. Where it differs from a corpus document, the corpus document prevails.

IT operations is where technology risk is realized in daily practice: an unauthorized change breaks production, an unknown asset goes unpatched, a service degrades below what the business was promised. The governing body's question is not whether operations run, but whether it can require, and see in evidence, that they run under a controlled governance model, that changes are authorized, the estate is known, vulnerabilities are managed, production is secured, service levels are managed, and operational state is measured.

• The IT service-management framework is the dependency of the operations programme: it sets the ITSM structure, principles, and processes that the individual operational procedures instantiate.
• The asset inventory register is a dependency of the other operational controls: it defines the authoritative record of the IT estate that change, patch, and security controls act on.
• The change-management and configuration-control procedure is a prevention control against uncontrolled production change: a defined path to classify, approve, schedule, implement, and review changes to production.
• The patch-management procedure is a prevention control against known-vulnerability exposure: a defined process to identify, classify, test, authorize, deploy, and verify security patches and updates.
• The release-management procedure makes a contribution to safe production deployment: it governs how software, configuration, and infrastructure changes move to production, alongside the change procedure.
• The production security requirements standard makes a contribution to production-environment security: it defines the controls that govern how production systems are secured and monitored.
• The service-level-management standard makes a contribution to managed service delivery: it defines how service-level and operational-level agreements are established, monitored, reviewed, and managed.
• The IT-operations KPI register is the evidence structure for operational performance: it defines the key performance indicators against which operations effectiveness is measured and reported.
• The IT-security-operations register is the evidence structure for current operational security state: it defines the schema and governance for the authoritative record of that state.

• Require a governance model, not just running systems. Operations that run without an ITSM framework, a known estate, and change control are operating on luck; the corpus starts from the model.
• Expect evidence, not assurances. The organization's populated change records, patch-compliance reporting, SLA performance, KPI dashboard, and security-operations register are the evidence classes; a control the organization cannot evidence is not demonstrably operating. The routed corpus registers are the governing schemas, not evidence of the organization's own state.
• Unknown assets are ungoverned assets. An estate the inventory does not capture falls outside the change, patch, and production-security controls that act on the inventory.

• The change-management records for recent production changes, showing classification, approval, and post-implementation review.
• The patch-compliance reporting for the current cycle, against the defined process.
• The service-level performance against the agreed SLAs and OLAs.
• The IT-operations KPI dashboard for the current period.
• The IT-security-operations register extract for current operational security state.

This page is a non-normative executive narrative that creates no compliance by itself; the linked corpus documents govern, and where this page and a corpus document differ, the corpus document prevails. It routes to the corpus rather than reproducing its values: the KPI targets and availability thresholds, the patch-remediation timelines, the service tiers and SLA terms, the change-classification levels, and the register schemas live in the linked documents and are not restated here. This page carries composite claims: the division of labour it describes across the ITSM framework, asset inventory, change, patch, release, production-security, service-level, and measurement controls requires validation by the adopting organization against its own arrangements.