Research · Research feature
Fast change makes the fundamentals easy to lose
Fundamentals map · The story · Myth or fact · Simulation · Sources
Change now happens daily, across laptops, personal phones, services and suppliers. The practices that keep an estate understandable did not go away. They are just easier to lose track of. This piece maps ten fundamentals, tells the story for leaders, tests three myths and lets you run an illustrative simulation of a change nobody wrote down.
The fundamentals map
Editorial summary. The practices follow the structure of widely used IT service management and security practice. The right-hand column is illustrative, not a statistic.
| Classic practice | Modern form | What goes wrong without it (illustrative) | Related source |
|---|---|---|---|
| 1. Configuration and asset records | Discovered automatically from the estate; covers services and owners as well as devices | Nobody can say what is affected; unpatched or unwatched items stay unseen. | CISA, NCSC |
| 2. Change enablement | Change record generated by the delivery pipeline, peer review inside development, automated checks and a rollback plan | The cause of an outage takes hours to find; nobody knows who approved what. | Uptime 2025, Uptime 2026 |
| 3. Incident management | Defined severities, on-call, one timeline and customer communication | Slow, ad hoc response; unclear who decides. | — |
| 4. Problem management | Blameless review, with the root cause tracked to a fix | The same outage repeats. | — |
| 5. Service ownership | Each service has a named owner, a support route and a target | Alerts go to nobody; everyone assumes someone else owns it. | Uptime 2025 |
| 6. Monitoring and event management | Events tied to a service and an owner, with noise filtered out | Alert fatigue; the real issue is lost; gaps are found only after an incident. | — |
| 7. Knowledge | Runbooks and decisions kept next to the service and updated after incidents | Fixes live in one person’s head; unclear or inconsistent processes. | Uptime 2026 |
| 8. Access management | Least privilege, joiner, mover and leaver steps, and personal and corporate devices handled by policy | Former staff, shared accounts and unmanaged devices keep access. | — |
| 9. Backup and recovery | Tested restores and stated recovery targets | Backups exist but do not restore. | — |
| 10. Supplier management | An inventory of suppliers’ services, with criticality, exit and contact plans | A supplier fault becomes your outage with no plan. | Uptime 2026 |
The story for leaders, in six steps
Our thesis: fast change makes the fundamentals easy to lose.
A fast-moving estate
- According to the UK National Cyber Security Centre (NCSC), a bring-your-own device “is the property of the user”, and how well its data can be protected depends on “how thoroughly the device can be managed (how much this is allowed by the owner)”. (NCSC, bring your own device)
- According to Uptime Institute, over nine years of tracking publicly reported outages, third-party IT and data-centre providers account for about two-thirds of them. (Uptime Institute, 2026)
In plain words: The estate now changes daily, and part of it belongs to someone else.
What goes missing
- According to CISA, “without an inventory, organizations do not know what they have and what should be secured and protected.” (CISA, asset inventory guidance)
- According to the NCSC, “You can only patch something if you know it exists, and what state it’s in now.” (NCSC, the problems with patching)
- According to Uptime Institute (2025), software-based resiliency “can blur responsibility for failures, complicating root cause analysis”. (Uptime Institute, 2025)
In plain words: Three questions go unanswered: what exists, who approved the change, and who owns the alert.
How it shows up
- According to Uptime Institute (2026), failure to follow established procedures remains the leading driver of human error-related outages; inconsistent or unclear processes, installation errors and in-service errors are also common. (2026 press release)
- According to Uptime Institute (2025), nearly 40% of organizations had a major human-error outage in the previous three years, and 85% of those stemmed from staff not following procedures or from flawed procedures and processes. (2025 press release)
- According to Uptime Institute (2025), IT and networking outages rose in 2024 to 23% of impactful outages, and the report links this to IT and network complexity that causes change management problems and misconfigurations. The 23% is the share for IT and networking, not the share caused by change.
- For balance: according to Uptime Institute (2026), outage rates per site fell for the fifth year in a row, and power remains the top cause of impactful outages.
In plain words: Two visible symptoms: outages after change, and problems nobody was watching for.
This story is about the part within IT’s control. It does not say that every outage or breach starts with a missed basic, and it does not say that automation causes outages or breaches.
The fundamentals in plain language
In plain words: Know what you have. Control change. Handle incidents and find root causes. Own each service.
The ten-row map above shows each practice, its modern form, and what goes wrong without it.
The modern form of each
In plain words: Same purpose, lighter and automatic. The change record is generated by the pipeline. The asset record is discovered, not typed. Ownership is a field that blocks a release if it is empty.
Editorial view; no source is cited for this step.
Compliance and leaders
In plain words: Records and approvals are also the audit evidence. If the record does not exist, neither does the proof.
This is not legal advice and does not say that having records means you are secure. See Compliance didn’t go away, it moved.
Myth or fact
Myth or fact 1
“Automation replaces process.”
Verdict and basis. Automation runs the process faster. It does not decide who owns it. According to Uptime Institute (2026), more automation “can create different classes of problems”. (2026 press release)
Myth or fact 2
“The classic service management framework is obsolete.*”
Verdict and basis. No source we opened says it is. According to Uptime Institute (2026), failure to follow established procedures remains the leading driver of human error-related outages, so procedures still matter. What has changed is the form: control is lighter and often built into the pipeline, not removed. * ITIL is a registered trademark of its owner; no affiliation, certification or training is claimed.
Myth or fact 3
“Containers don’t need a record of what exists.”
Verdict and basis. Mostly a myth (our editorial judgement). According to CISA (BOD 23-01, 3 October 2022), asset visibility is a “basic pre-condition for any organization to effectively manage cybersecurity risk”; the directive’s own scope excludes ephemeral assets such as containers, which is a scope decision for that directive, not a statement that containers need no records. Each container is short-lived, so the record shifts to what it was built from, what service it belongs to, and who owns it. (CISA, BOD 23-01)
The change nobody wrote down
Illustrative Set how many services a release touches and how often you release, then press Play. You will see one release handled with no records and the same release with a change record and a configuration record. The numbers are made up to show the idea, not measured.
Planning for this in your organization?
King Tech collaborates on custom solution architecture: we work alongside your team to design an approach that fits your systems, your constraints and your timeline. Contact King Tech to start the conversation.
Sources
- Uptime Institute, Annual Outage Analysis Report 2026, press release (13 May 2026). Checked Oct 25, 2026.
- Uptime Institute, Annual Outage Analysis Report 2025, press release (6 May 2025). Checked Oct 25, 2026.
- CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance (13 August 2025). Checked Oct 25, 2026.
- CISA, Binding Operational Directive 23-01 (3 October 2022). Checked Oct 25, 2026.
- UK NCSC, The problems with patching (10 July 2019). Checked Oct 25, 2026.
- UK NCSC, Device security guidance: Bring your own device (version 2.1, reviewed 13 May 2025). Checked Oct 25, 2026.
Facts checked Oct 25, 2026.
General information, not legal or audit advice. Illustrative figures are marked Illustrative.