Six months after a configuration change is made to a critical system, an auditor asks a simple question: who approved it?
The change may have been entirely legitimate. Proving it is another matter. Teams can find themselves piecing together tickets, spreadsheets and records across multiple systems, while also having to demonstrate that the configuration running today matches what was originally approved.
In financial services, making a configuration change is only half the job. You need a clear, defensible record that shows what changed, who approved it and whether the system remained compliant afterwards.
Most disruption doesn’t come from attackers
Banks, insurers and payments firms operate complex IT estates where systems are patched, settings are updated and configurations change as part of everyday operations. But when an auditor or regulator asks who approved a particular change, when it happened and why, finding the answer can mean piecing together information across tickets, spreadsheets and different systems.
The scale of the operational resilience challenge is significant. In the first annual reporting period under the EU’s Digital Operational Resilience Act (DORA), financial entities reported 3,383 major IT-related incidents. In the UK, the FCA has also confirmed new rules designed to make operational incident and third-party reporting clearer and more consistent, strengthening the focus on firms’ ability to understand and respond to disruption.
Against this backdrop, knowing that a system changed isn’t enough. Financial services organisations need to understand what changed, whether it was authorised and have the evidence to demonstrate that controls worked.
Proving change is under control
DORA, SOX, FCA requirements, PCI DSS and ISO 27001 approach technology risk in different ways, but all place expectations around effective controls, change management or secure configuration. For IT teams, that makes visibility over configuration change – and the evidence behind it – increasingly important.
Guardian is Cloudhouse’s configuration monitoring platform. It establishes a trusted baseline across your estate, detects configuration changes and reconciles them against approved change records. Each change is identified as matched, unmatched or ambiguous, allowing teams to quickly separate expected activity from exceptions that require investigation.
Guardian measures systems against CIS benchmarks, giving teams evidence of their security posture rather than an assumption about how systems are configured.
Crucially, every detection, reconciliation and subsequent action is captured in a durable audit trail. Instead of reconstructing what happened after the fact, teams have a record showing how a configuration changed and how that change was handled.
What an auditor actually asks for
Go back to that six-month-old change. The auditor isn’t asking whether you have a change process. They want the specific change, the approval behind it, and proof that the system ended up in the state the approval described. If the configuration doesn’t match the approved record, working out what happened becomes harder the longer you leave it.
Guardian surfaces the discrepancy at the point it happens. Teams see the change, whether it matched the approved record, and what action was taken next. When the auditor asks six months later, the evidence is already there.
Effective change management isn’t simply about keeping systems running. It’s about being able to demonstrate that changes were authorised and controlled.
Watch the video below to see how Guardian turns configuration change into audit evidence, or book a walkthrough with our team.
