Cloud change management: What you need to plan for
Traditional change management and frameworks like ITIL are usually too slow and bureaucratic. You need to adapt them for the speed, and agility -- and risks -- of the cloud.
Cloud change management combines strategies, processes and tools to get the most value from cloud resources. It adapts traditional change management elements of governance, performance optimization, security, cost management, development and business alignment for the fast-changing nature of cloud business processes.
"Cloud change management is becoming more crucial because the environment is so dynamic. Constant updates, new features and services happen rapidly and can affect the security and compliance of your systems," said Tim Beerman, CTO of Ensono, a digital transformation consultancy. This rapid pace of change means it is equally important to put the right governance and auditability in place without sacrificing the speed and agility gained through cloud deployments, according to Beerman.
Cloud change management often involves an ongoing process of adapting to changes in business needs, security posture, data requirements and cost allocation. This adaptive and iterative approach helps teams adapt to new business requirements, the discovery of new security vulnerabilities and cost or performance differences between cloud platforms. Cloud change management differs in those ways from the change management approaches traditionally used for specific digital transformation initiatives.
John Pettit, CTO of Promevo, a Google Premier Partner, said continuous change management is important because cloud migration is more dynamic than when a fixed data center is involved. It requires organizations to use continuous analytics to properly size costs and resources and protect against threats to better manage their cloud practices in an ever-changing technology landscape.
Agility is essential
Nicolas Avila, CTO for North America at Globant, a digital services consultancy, argued that many executives misunderstand the value of the cloud by thinking it's just going to save them money on infrastructure when they might, in fact, be spending a lot more. "The reality is that cloud is not about saving money, but rather about agility," he said. For example, having a foundation in cloud change management can help companies keep pace with nimble startups that might encroach on their market.
"A cloud-native organization is a company that spreads out decisions, where technology is a part of business and doesn't just exist in a vacuum, and where each business area thinks of itself as a tech organization," Avila said. "If you're not driving a company to become more nimble, or you're trying to be in a very stable position, then cloud might not be right for you."
It is also imperative that the cloud supports different types of automation to enable this level of agility. "Part of the magic of the cloud is the ability to very quickly add, change or decommission resources via infrastructure as code, API calls or other methods of automation," said Randy Armknecht, global cloud engineering practice lead at Protiviti, a business consultancy.
The ease with which large changes can be performed necessitates equally strong governance to prevent unintended consequences. Achieving this requires a deliberate effort to modernize and automate the controls and governance processes over change so as not to impede business objectives, Armknecht said.
Benefits of cloud change management
Mahadeva Bisappa, principal architect at SPR, a technology modernization firm, said the top benefits of cloud change management include the following:
- Minimized downtime. Ensures updates or changes to cloud services are implemented smoothly.
- Security. Helps identify and mitigate potential security risks.
- Compliance. Automates the process of ensuring changes comply with relevant laws and regulations.
- Cost management. Helps predict and control cloud spending.
- Consistency and reliability. Ensures changes are documented and tested, leading to more reliable and consistent cloud services.
- User satisfaction. Minimizes disruptions and maintains service quality.
Challenges of cloud change management
It's also important to appreciate that the faster pace of the cloud introduces various challenges. Beerman said complexity is the main challenge and that a digital skills gap can intensify it.
"Where legacy IT systems are localized and easy to control, cloud environments are widely distributed and involve multiple stakeholders, services and regions of business," Beerman said. This decentralization makes tracking changes and balancing compliance more difficult. Security also gets more complex, as teams need to navigate shared responsibility models and ensure data and applications are protected across many cloud services.
It's also important to appreciate that the cloud makes it easy for business units to purchase cloud services in ways that confound management efforts, Pettit said. The result can be inefficient resource allocation, data privacy and security concerns or antiquated migration practices. "Organizations may struggle to adopt cloud change management processes if they do not ensure complete organizational buy-in," he added.
Rahul Lele, a principal in the digital and analytics practice of Kearney, a strategy and management consulting firm, said the essential challenges of cloud change management to consider include the following:
- Coordination, collaboration, communication. The autonomy in cloud environments can lead to uncoordinated changes, risking service disruptions. Effective change management demands strong cross-team coordination and communication to maintain business continuity.
- External dependencies. Managing changes in cloud environments requires alignment with platform providers like AWS or Microsoft Azure, necessitating careful coordination with third-party release schedules and potential service disruptions.
- Governance and oversight. The decentralized nature of cloud change management can lead to inconsistencies in standards and documentation. Strong governance is needed to ensure consistent oversight and track changes effectively.
- Security and compliance. Automation and frequent updates can introduce vulnerabilities if not properly managed. The structured approach of ITIL helps mitigate such risks with rigorous review processes.
Best practices for implementing cloud change management
Beerman said that, at a high level, the three best practices for implementing cloud change management can be narrowed down to improving automation, embracing an iterative approach, and developing and enforcing policies. Tools like Azure Policy and AWS Config can help automate policy enforcement and continuously monitor and record configuration changes.
Pettit recommended performing a cloud health check to assess the status of the organization's cloud infrastructure and identify how to create a better path for cloud transformation. The health check might span infrastructure assessments, security audits, compliance reviews and performance testing.
Armknecht said it's also important to think about communication and establish clear roles and responsibilities, which can help teams assess what is possible to automate and what can't or shouldn't be automated. Teams need to think through the criteria used to approve or reject changes to develop in-cloud guardrails and controls in the deployment pipeline.
Himanshu Jain, a partner in Kearney's digital and analytics practice, said organizations should also think about safely decentralizing decision-making to balance agility and governance. For example, research suggests that peer reviews of changes at the team level can achieve the same level of risk optimization as using a change advisory board. "This is important because it allows organizations to decentralize change approval authority and move faster," he said.
Cloud change management vs. traditional change management
Change management in the cloud is broader than in traditional IT service management. Jain said one important difference is business teams can reach out to cloud vendors directly to get their requirements fulfilled. This can result in technical debt and problems ensuring timely support. He suggested IT teams consider new processes, such as DevOps for provisioning and FinOps for cost management.
Armknecht said another big difference from traditional change management approaches is the reduction of time-consuming human involvement, which requires a shift in thinking. For example, many of the questions a traditional approver would ask can be quantitatively and automatically answered via appropriate code. "This can serve as a filter to auto-approve certain changes and highlight those with unique complexity to a human reviewer," he said.
Also, changes are often performed through pipeline automation to remove human error from the list of potential issues during a change window. The process can also ensure consistency between testing and production environments, Armknecht said.
Traditional ITIL vs. cloud change management
Traditional ITIL approaches have played an important role in digital transformation efforts, such as launching new services, spinning up new resources and modernizing applications. Armknecht said the same ITIL process and subprocesses can apply to a cloud change management program. However, the speed and breadth of change in the cloud requires a deliberate effort to modernize and automate the controls and governance processes of change so as not to impede business objectives.
Lele contended that a shift toward a cloud-first strategy requires moving away from traditional ITIL processes for the following reasons:
- Speed vs. rigorous planning and approvals. Cloud environments are designed for speed, and changes can be made using a few clicks and without elaborate planning. Also, cloud environments provide for increased automation and integration, which means that routing changes through a centralized repository, formal process and approvals takes a back seat because it can create a bottleneck that slows down change.
- Enablement vs. control. New development and deployment processes, such as DevOps and Agile, are shifting the change management philosophy toward enablement and away from control. The traditional ITIL approach infuses bureaucracy, such as a change advisory board, depending on the type of change. That approach is counterproductive for cloud environments due to the need for agility and the incremental, frequent nature of changes.
- Decentralized vs. centralized. Change management is often decentralized for cloud environments, and teams such as DevOps, development and operations have more autonomy to make changes directly to the systems they manage. In contrast, traditional ITIL change management is typically centralized, emphasizing control to ensure that every change aligns with organizational policies, regulatory requirements and strategic goals. This can sometimes slow down the change process. But decentralization can also introduce risks if not properly coordinated.
- Business-driven vs. IT-dependent. Cloud platforms empower business units to manage changes directly through user-friendly, self-service tools, reducing IT dependency. ITIL, in contrast, requires business teams to submit changes through a formal IT review, slowing noncritical updates.
Lele suggested a hybrid approach that combines cloud-oriented and ITIL change management can help balance agility with risk control. For example, he said he worked with a financial services provider so it could benefit from cloud speed and flexibility while ensuring critical changes were properly scrutinized through a structured governance framework. Succeeding at this required integrating cloud change management and ITIL processes.
George Lawton is a journalist based in London. Over the last 30 years, he has written more than 3,000 stories about computers, communications, knowledge management, business, health and other areas that interest him.
