Dev: I need you to do X

IT: Ok we will do Y

Dev: I don’t want Y I want X

IT: Well you’ll need to go through the change request process then since you have just modified your requirements.

Dev: …

Dev needs to stop talking about their Xs and no asking Y

I was having a conversation about change controls not long ago with my employers cybersecurity "Director".

Asked why we had to do so many change controls for a process my team was fixing.

"Because compliance framework says we have to"

"It also says we can skip the ticketing requirement if we document the change in this other way. Which we're already doing. And have been doing."

"Wait we can do that?"

"....yes."

"How'd you know that?"

(Doesn't tell Director I have two certs relevant to the security and compliance standard in question because I don't want to be made responsible for it, pulls up Google search instead) "I got curious and Googled it"

"oh. How about that."

@ComputerToucher That sounds reasonable though.

@ScriptCoded Yeah no absolutely; it's why I brought it up. I want less work to do. The compliance standard says we can do it this way, so....we should...you know. Do it.

In the case of $CURRENT_EMPLOYER, it was quite honestly (and before I arrived) a job of copying and pasting 'process requirements' and creating a few slack channels just to say they'd done enough to get the compliance sticker.

To his credit, when I asked my VP about this he was radically transparent about it and visibly understanding when I just glared at him quietly.

@iSwimInTheC username checks out

That's not fair