Refreshing your IT strategy after a period of rapid change

Why a periodic refresh matters

Static technology infrastructure, and the assumption that staff would always be in one building to use it, has been overtaken by events. The scale of change accelerated sharply from 2020, when organisations adopted cloud services in large numbers for their practicality, flexibility and scalability, precisely because those qualities were what remote collaboration demanded. Many of those decisions were made under pressure, which is a reasonable way to survive a crisis but a poor way to run a strategy indefinitely.

The task now, for most organisations, is to review what was adopted quickly and decide what should become permanent, what should be reworked, and what should be retired. That review is not a single event but a habit: infrastructure and process should be checked on a regular cycle against current and anticipated needs, not left until the next disruption forces the question.

Get the digital strategy right

A strategy refresh should cover the infrastructure and the processes built on top of it, not the visible applications alone. That means favouring agnostic solutions that work consistently across platforms, and investing in the parts of the estate that are easy to neglect because they are invisible day to day: internet bandwidth, cloud services, servers and the hardware people actually use.

Once a plan is agreed and implemented, it needs to stay under regular review rather than being treated as finished. Whatever form the plan takes, it should be communicated to and discussed with the people it affects, with training provided where a change in tools or process requires it. A strategy nobody has been told about is not being followed, it is being guessed at.

• Review infrastructure and process together, not applications in isolation
• Prefer agnostic solutions that run across platforms rather than locking into one
• Invest in bandwidth, cloud services, servers and hardware, not only visible software
• Put the strategy on a recurring review cycle
• Communicate changes and provide training before rollout, not after

Treat security as an organisation-wide discipline

The rapid shift to home working exposed gaps in systems that allowed unauthorised access, and criminals took advantage of it. The Colonial Pipeline incident, where a $4.4 million ransom was paid to restore systems taken offline in May 2021, is a widely cited example of the cost of that exposure. In response, more organisations have adopted a zero-trust approach to reduce operational and security risk, on the basis that no connection should be trusted by default regardless of where it originates.

No security measure offers complete protection, and even well-trained staff will not anticipate every method an attacker might use. Staying current with developments in the threat landscape gives an organisation its best chance of responding quickly when an incident does occur, rather than discovering the gap during the attack itself.

Cybersecurity is not a discrete project owned by one team; it runs through the whole organisation. Educating staff accordingly, so that using technology responsibly becomes an ordinary habit rather than an occasional reminder, is part of the strategy refresh rather than separate from it.

Adopt a user-centred approach to change

Agile methods, proven in software development, deliver new capability incrementally so users are not confronted with a steep learning curve all at once. Extending that mindset beyond the development team to other parts of the organisation helps those teams respond to change without it feeling sudden or unmanaged.

Putting the people who will actually use a system at the centre of planning, rather than deciding on their behalf, means understanding how they interact with existing products, systems and services before changing them. That is fundamentally a communication exercise: change only takes hold once people understand it and see the reason for it, which can require a genuine culture shift but is worth the investment.

Manage and maintain the technology people rely on

Employees need seamless access to the tools they use for work regardless of where they are working from. A high-quality, effective IT support and management capability that can deal swiftly with technical issues is essential both to maintaining productivity and to keeping confidential data safe. A remote support tool such as 247connect can play a useful role here, letting a support technician reach a user's device securely without a site visit, though the underlying discipline matters more than any single product.

Cloud services, however, are not universally appropriate. Organisations such as financial institutions, government bodies or military organisations often need to keep data on-site and within their own network for security reasons. Where that applies, any solution deployed should carry proper security safeguards, including configurable data encryption, two-factor authentication, security keys and smartcard authentication, to protect against unauthorised access. A capable set of tools that minimises downtime when problems arise also reduces cost.

• Ensure support can resolve issues remotely and quickly, wherever staff are working
• Assess whether cloud or on-site storage is appropriate for the data involved
• Where data must stay on-site, insist on strong encryption and multi-factor authentication
• Track downtime reduction as a direct cost saving, not just a convenience

Look for the right places to automate

Automation is often met with concern that it will displace jobs, but its more realistic role is removing repetitive, low-value activity such as data entry or routing requests to the correct department. That frees staff time for more creative work or for training in areas where the organisation has skills gaps, which benefits both the individual and the organisation's productivity.

Any automation decision should be informed by data and analytics rather than assumption, and staff should be brought into the change and given the chance to buy in before it is implemented. It is worth being explicit about what automation cannot replace: people skills, human interaction and creative thinking, and demonstrating that those things remain valued as specific functions are automated.