Downsizing and Managing Technology Risk

Although the word has not been used often in the world of technology, various industries today are reducing IT staff in the face of economic pressure. Office building management and real estate firms for example, are looking for cost cutting opportunities due to office vacancies and reduced real estate transaction volume. But after years of increased technology deployment and the added complexity of addressing cyber risks, how can staff levels be reduced without fallout?

The answers are not easily found.

IT labor costs represent a sizable share of IT budgets and unfortunately represent the easiest way to realize immediate cost reductions. An inventory of systems and related administrative tasks are the starting point to understanding key risks related to staff reductions. Critical functions should be prioritized using a compliance framework for guidance. For example, a quick review using SOC 2 trust criteria would highlight areas of responsibility such as backup log review, user access management, and cyber incident response. These critical functions must be transitioned to remaining staff and gaps in coverage must be avoided.

Outsourcing can be leveraged to transition internal functions even critical tasks, but decreased service levels and effectiveness are risk considerations.

Changing staffing levels without careful consideration can lead to security risks, service level failures, diminished resiliency, etc. An effective plan will map all functions to avoid responsibility gaps; however, collateral unplanned staff attrition can derail a well-planned strategy.

What can firms do to prepare?

Preparing for an uncertain future requires companies to examine staffing levels, roles and responsibilities, and technology scope during stable economic times. This affords IT leadership the time and resources to invest in technology consolidation, and outsourcing or deployment of tools that automate or streamline IT administration tasks. Even in the event of industry disruption, such as the impacts to property management, businesses would be pre-positioned to make staff changes while containing risk.