IT Operations Management (IT Ops) is the organizational discipline responsible for the day-to-day delivery, monitoring, governance, and continuous improvement of IT infrastructure and services. Within the CRISC framework, IT Ops is a primary source and mitigator of enterprise operational risk — not merely a 'keep-the-lights-on' function. IT Ops encompasses five core process families: Incident Management (detect, respond, restore), Problem Management (eliminate root causes), Change Management (control alterations to production systems), Capacity Management (ensure adequate resources), and Configuration Management (maintain authoritative records of IT assets and their relationships). Modern IT Ops extends these ITIL 4-rooted processes into hybrid and multi-cloud environments, applies observability and AIOps for proactive risk detection, integrates with security operations (SOC/NOC convergence), and translates operational metrics into enterprise risk language for executive decision-making. IT Ops IS: the operational governance of live IT systems with explicit risk accountability. IT Ops IS NOT: IT project delivery, enterprise architecture design, or a purely technical function divorced from business outcomes.
Where it stops · what it isn't
- —IT Ops covers production system management — it does NOT include IT project delivery, software development, or enterprise architecture design; those are sibling or dependent domains.
- —IT Ops is distinct from Disaster Recovery and Business Continuity Management, though it directly enables both. IT Ops governs day-to-day operational risk; DR/BCM governs catastrophic failure recovery.
- —IT Ops is NOT synonymous with IT Service Management (ITSM). ITSM is the framework; IT Ops is the organizational function that executes it.
- —Under the CRISC lens, IT Ops must be measured in risk terms — probability of SLA breach, financial exposure per outage, compliance gap rate — not in technical metrics alone (uptime %, ticket volume).
- —IT Ops does NOT own security policy or architecture, but it IS responsible for operational security controls: patching, vulnerability scanning, security event alerting, and initial incident triage.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFISACA CRISC Domain 4: IT and Security
REQUIRESData Life Cycle Management
RELATED TOBusiness Continuity ManagementDisaster Recovery ManagementInformation Security Concepts and FrameworksProject Management
ENABLESEnterprise Architecture (operational execution of architecture decisions)Security Operations (SOC/NOC convergence — IT Ops provides alerting and telemetry)
CONSTRAINSChange Management (IT Ops change controls constrain unmanaged system modifications)