IT operations

IT operations is usually organised around IT service management practices, most often from ITIL 4 (2019): incident management restores normal service as quickly as possible, problem management finds and removes root causes, change enablement assesses and authorises changes, service configuration management maintains the CMDB, and IT asset management tracks hardware, software and licences through their life cycle. Many teams now blend this with DevOps and site reliability engineering, where infrastructure is defined as code, changes flow through pipelines, and service level objectives with error budgets decide how much change risk is acceptable.

Most technical security controls are operational tasks. In ISO/IEC 27002:2022 this includes 8.8 (management of technical vulnerabilities), 8.9 (configuration management), 8.13 (information backup), 8.15 and 8.16 (logging and monitoring activities), 8.32 (change management) and 5.18 (access rights). CIS Controls v8.1 makes the point even more directly: its first controls, inventory of enterprise and software assets, data protection, secure configuration, account and access control management and continuous vulnerability management, are day-to-day operations work, and safeguards 7.3 and 7.4 expect operating system and application patching to be automated on a monthly or more frequent basis. Patch service levels are typically tiered by severity and exploitation status, with actively exploited vulnerabilities such as those in CISA's KEV catalogue handled far faster than routine updates.

The relationship with security is a well-known source of friction. Operations is measured on uptime and change throughput, security on risk reduction, and a patch or hardening change can cause the outage operations is trying to avoid. Change management is where the two meet: a change advisory board or automated policy checks review risk, emergency changes follow a faster path with retrospective review, and maintenance windows are agreed per service. Privileged operations accounts are among the most valuable targets for attackers, so separate admin accounts, tiered administration, just-in-time access and logging of administrative sessions are central controls.

IT operations differs from a security operations center: operations builds and runs the systems, while a SOC monitors them for threats, triages alerts and coordinates incident response, often with operations carrying out containment and recovery. Segregation of duties between those who administer systems and those who review their logs is itself a control. Outsourcing operations to a managed service provider does not move accountability; under NIS2 Art. 21(2)(d) supply chain security, including the security of such providers, is part of the entity's own risk-management measures, and managed service providers are themselves in scope of NIS2.