Editor’s note: This article originally appeared in Security Management magazine. Its inclusion in IFMA’s FMJ is part of a strategic partnership between IFMA and ASIS.

There is no such thing as the perfect security deployment, project or program. Even the most well-designed deployments are vulnerable — not just to threat actors, but also to the disruptive forces of change. These forces might take the form of a new regulatory requirement, shifting organizational priorities or an unexpected technology update. Change is the only constant in security and failure to plan for it only increases your risk.

Hence the need for strong change management.

Change management is an organizational framework that describes how teams will anticipate, communicate and adapt to change. A change management plan empowers teams to understand and respond to potential business impacts by proactively identifying affected individuals and then tailoring training and communication to their specific roles. The goal is to ensure that security initiatives achieve their intended outcomes while also safeguarding the organization against potential threats during times of transition.

Imagine your organization upgrades its aging, card-based access control system to use mobile credentials. You’ve advocated for this change because it stands to reduce costs while increasing convenience for employees and visitors. Without effective change management, however, you face resistance, confusion at entry points and security gaps caused by a lack of preparation. Additional risks might include project delays, scope creep and cost overruns.

Conversely, a change management program would:

  • Identify affected stakeholders, from those administering the technology to those who will be using it

  • FMJ Extra - TurningResistance-ShehzadInitiate communications regarding potential changes, providing impacted teams with defined channels to deliver feedback or escalate concerns

  • Introduce pilot groups and user acceptance testing (UAT) to fine-tune configurations before full deployment

  • Allocate resources appropriately to maintain project scope and avoid future phased project requirements

  • Deliver role-specific training, ensuring that each group understands its responsibilities as they relate to a new tool or process

  • Equip end users with the resources and information they need to effectively and willingly adapt to security changes

The upgrade from proximity cards to mobile credentials is an example of both a new tool and process that necessitates change management. However, there are many other scenarios where implementing change management is just as critical. Consider revised governance, changes to the organizational structure, new compliance requirements and even updated change control — in other words, any scenario where those managing and interacting with security experience a shift in responsibilities, workflows or expectations.

Change management is similarly utilized during every project phase. When planning a new project that has yet to evolve, it is the change management framework that prepares teams for potential impacts. During testing, it ensures that stakeholders are involved at the right time and able to provide meaningful feedback. And at deployment or other inflection points, it facilitates seamless adoption and stakeholder confidence.

But perhaps at no point is change management more critical than post-deployment. At this point, stakeholders have become accustomed to working with a given technology, team or process. Changing behavior, if not guided and reinforced through a structured approach, leads to errors and resistance that ultimately undermine the success of an initiative. It is here where communication and training, cornerstones of a strong change management program, are key.

Employee resistance to change remains a significant challenge. According to Oak Engage’s 2023 Change Report, 37 percent of employees resist organizational change management efforts. Top reasons include a lack of trust in the organization (41 percent), lack of awareness about why change is happening (39 percent), fear of the unknown (38 percent) and insufficient information (28 percent). This data underscores the importance of approaching change as both a technical and people-centered process. To do that effectively, organizations should incorporate the following elements into their change management strategy.

Ownership. Just as project managers oversee the deployment of a new project, a dedicated change manager oversees the implementation of a change management program. Designating a single point person to manage communication, planning and execution fosters trust and accountability among teams. This individual understands the full project scope and interdependencies, identifying all end users and stakeholders who have a role in the change management plan. Depending on the size of your organization, this could be a full-time role or a responsibility embedded within an existing program management role.

Governance. The change management lead works closely with key stakeholders to establish clear governance structures. Together, they define roles and map how each role connects to the core project. They also determine how to notify roles of changes, train them appropriately and provide channels for them to provide feedback. By creating clear lines of accountability and communication, the organization helps all affected parties understand why change is happening and equips them with the information they need to respond effectively.

Stakeholder engagement. Early communication with stakeholder teams regarding potential change establishes a critical two-way dialogue. It not only helps stakeholders anticipate future technology and process changes but also allows change managers to assess the level of involvement required from each team at every stage of the project. In this way, no team is caught off guard as change impact, training, communication and support are tailored to each role.

Documented framework. Having a change management program in place also means having the appropriate documentation to support it. After all, you never know when the loss of a change manager becomes the change itself. Therefore, it is essential to document key elements of the program, including identification of roles in the current state versus future state, potential use cases based on role, points of contact for each stakeholder group, cadence and method of communication per group, applicable project stages and role-based tasks.

Success metrics. Defining success during times of change can be challenging. However, clear, measurable criteria help set clear goals that all roles can work toward. This might include milestones such as UAT sign-off, deployment of a training plan, distribution of updated documentation, availability of feedback channels and activation of a response team to address concerns. These metrics not only provide a benchmark for evaluating progress but also build confidence among stakeholders that a project is being managed with intention and accountability.

Above all, a change management plan should be sustainable following project completion and implementation. Change does not end on the go-live date. Security tools evolve, teams change and processes continue to adapt. Maintaining resources dedicated to ongoing change management ensures that teams adopt updates to solutions or processes. An example is leveraging documentation to capture change requests, then engaging a change manager to surface and address them. Consider also how your teams will adapt to future changes, such as a solution or tool reaching its end of life, which may necessitate a new change management program.

When you adopt a structured change management program across all project stages and types, you position your security initiatives for long-term success. For security leaders and their teams, understanding who will govern change and how makes all the difference between embraced change and potential resistance. For user groups, it means feeling informed and empowered in their role, leading to smoother transitions, fewer disruptions and a stronger sense of trust in the systems and processes that keep the organization secure.