Change and configuration management, IT audit, business continuity and disaster recovery
In short: Uncontrolled changes cause many outages, so changes are planned, approved and recorded, and device configurations are backed up and compared to a baseline. Audits check that controls work. Business continuity keeps the organisation running during a disruption; disaster recovery restores IT afterwards.
Network change and configuration management (NCCM)
NCCM is the discipline of controlling every change to network devices and keeping their configurations known, backed up and compliant. NCCM tools typically:
- Discover devices and keep an inventory.
- Back up configurations automatically and keep version history.
- Compare running configs with an approved baseline and alert on unauthorised changes.
- Push approved changes to many devices at once and roll back if they fail.
- Report on compliance with policies and standards.
Change management best practice
- A change advisory board (CAB) reviews significant changes for risk, timing and impact.
- Every change has a written plan, a test plan and a rollback plan.
- Changes happen in agreed maintenance windows and are communicated in advance.
- Emergency changes are allowed, but documented and reviewed afterwards.
IT audit
An IT audit independently checks whether IT controls are designed well and actually working. Auditors review access rights, change records, backup and restore tests, patch levels, logs, physical security and compliance with policy and law. The result is a list of findings with risk ratings and agreed actions.
Business continuity and disaster recovery
| Business continuity (BC) | Disaster recovery (DR) | |
|---|---|---|
| Focus | Keeping the whole organisation running | Restoring IT systems and data |
| Scope | People, premises, suppliers, processes and IT | Servers, networks, applications, backups |
| When | During and after the disruption | After the incident |
Planning starts with a business impact analysis (BIA), which identifies critical processes, the cost of downtime and how quickly each must recover.
- Carry out the BIA and risk assessment.
- Choose recovery strategies (backup site, replication, cloud).
- Write the plan with clear roles and contact lists.
- Train staff.
- Test the plan regularly and update it after every test and change.
Common mistakes: never testing the plan, leaving it out of date, keeping it only on the systems that have failed, and ignoring people and suppliers.
Data loss: causes and prevention
| Cause | Prevention |
|---|---|
| Human error (accidental deletion or overwrite) | Backups, version history, permissions, training |
| Hardware failure | RAID, monitoring disk health, replacing ageing equipment |
| Malware and ransomware | Endpoint protection, patching, offline backups |
| Theft of devices | Full-disk encryption, physical security, remote wipe |
| Power problems and natural disasters | UPS, surge protection, off-site copies |
| Data leaking out | Data loss prevention (DLP) tools, classification, email and USB controls |
Real-world example: a change that went wrong, and recovered
An engineer at a fictional logistics company changed an access list on the head office firewall late one afternoon to open a port for a new supplier. The rule was placed above an existing one and blocked the warehouse scanners from reaching the stock system. Because the company used change management, the change had a ticket, a named owner and a written rollback plan. The service desk linked the scanner complaints to the change within minutes, the engineer restored the saved configuration, and the warehouse was working again in under half an hour. The post-change review led to a new rule: firewall changes are made in a scheduled window and tested against a short checklist of critical systems.
Practice
What should every change request include apart from the change itself?
Your RPO is 4 hours. How often must backups or replication run?
BC or DR: arranging for staff to work from another office?
Key takeaways
- NCCM backs up configs, detects unauthorised changes and enforces baselines.
- Changes need approval, a test plan and a rollback plan.
- IT audits check that controls exist and work.
- BC keeps the business running; DR restores IT. Both start with a BIA.
- RPO limits data loss; RTO limits downtime.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.