From Infrastructure to Cyber Security: Why IT Teams Need a Framework

There was a time when running IT infrastructure felt relatively straightforward. I don’t mean to suggest it was easy. Keeping systems available, managing storage growth, planning upgrades, maintaining backups and troubleshooting complex outages was challenging enough. But the boundaries of the role were generally understood. If the business wanted reliable technology, the infrastructure team built it, operated it and kept it running. Most technology professionals who have been around for more than a decade will recognise that world.

Over the last few years, however, the responsibilities that sit alongside traditional infrastructure management have expanded considerably. The IT manager who once spent most of their time worrying about server capacity and network performance is now expected to have an opinion on ransomware. Boards want reassurance that cyber risks are being managed. Auditors want evidence. Cyber insurers have detailed questionnaires. Regulators are asking tougher questions than they were a few years ago.

And as if that wasn’t enough, many organisations are now wrestling with the risks introduced by AI. What information can employees share with AI tools? How do we prevent sensitive information ending up somewhere it shouldn’t? Which AI services are being used across the organisation? Who is responsible for overseeing all of this?

For many organisations, the answer to that last question tends to be the same person who was looking after the infrastructure yesterday. Somewhere along the way, security landed on their desk.

Most infrastructure professionals never expected to find themselves in this position. They built careers around servers, storage, networking, cloud platforms and operational support. They understand technology deeply, but cyber security often feels like a different discipline with its own language, frameworks and specialists. That can create an uncomfortable feeling. Over the space of a few years, responsibilities have expanded well beyond the traditional boundaries of infrastructure management. Questions that once sat elsewhere in the organisation are increasingly landing with technology teams. Many people find themselves trying to understand which of the hundreds of security concerns being discussed online actually deserve attention first.

I’ve had versions of this conversation countless times over the years. The person sitting opposite me is usually highly experienced. They’ve led infrastructure teams, managed major outages and delivered complex transformation projects. They’re trusted by their organisations because they consistently solve difficult technology problems. Yet when the conversation turns to cyber security, they often describe feeling as though they’re starting from scratch.

The longer I’ve worked in cyber security, the less convinced I’ve become that it’s a completely separate discipline. Some of the best security outcomes I’ve seen have come from people who didn’t start their careers in security at all. They came from infrastructure backgrounds where understanding dependencies, managing change, monitoring critical systems and planning for failure was simply part of the job.

That’s probably one of the reasons so many infrastructure professionals undersell themselves when security lands on their desk. They focus on the areas they don’t know yet and overlook the experience they already have. In reality, many of the underlying principles are surprisingly familiar.

Technology risk has changed dramatically over the last decade. What was once viewed primarily as an IT concern is now firmly a business issue. A ransomware attack can halt operations entirely. A data breach can lead to regulatory scrutiny and reputational damage. Poor governance around AI can expose sensitive information in ways organisations haven’t previously had to consider. Technology has become inseparable from business operations, and that means technology risk has become business risk. That’s why infrastructure teams keep finding themselves pulled into conversations that would have been somebody else’s responsibility in the past.

Most of the people I speak to already have the technical capability to deal with these challenges. What they’re often looking for is a way to organise and prioritise everything that’s suddenly competing for their attention. When people first encounter cyber security, it often feels like dozens of separate subjects. Asset inventories, vulnerability management, phishing, privileged access, logging, incident response, disaster recovery, regulatory compliance and AI governance can appear disconnected, each demanding immediate attention.

This is where frameworks earn their place.

Frameworks rarely generate much excitement. Most people don’t get out of bed in the morning wanting to learn another one. Their value comes from helping us organise complexity into something manageable.

One framework that has stood the test of time is NIST. What I like about NIST is that it doesn’t start with technology. It starts by creating structure. It provides a way of looking at security as a collection of connected activities rather than an endless list of unrelated problems. Once you begin viewing security through that lens, prioritisation becomes much easier. You need to understand what exists in your environment. You need to determine what’s important. You need appropriate controls around it. You need visibility when something goes wrong. You need a plan for responding. And ultimately, you need confidence that the organisation can continue operating when problems occur.

One of the challenges many organisations face is that none of these responsibilities exist in isolation. Security, resilience, compliance, operational risk and increasingly AI governance are becoming part of the same conversation. That’s one of the reasons frameworks such as NIST are valuable. They provide a structure that helps technology teams organise what can otherwise feel like an overwhelming list of competing priorities. Over time, that structure helps organisations move from reacting to individual problems towards managing risk more deliberately. Instead of dealing with security, resilience, governance and operational risk as separate activities, they can begin to view them as connected parts of the same strategy.

Perhaps that’s the most important message I want to leave you with.

In many cases, the skills are already there. What has changed is the context in which they’re being applied. Decisions that were once operational concerns increasingly have security, regulatory and business implications attached to them.

The technology landscape has changed. The threats have changed. Regulatory expectations have changed. AI has introduced another layer of complexity that many organisations are only beginning to understand. The fundamental disciplines, however, remain surprisingly familiar. Visibility, control, monitoring, response and resilience have always been part of running technology successfully. You’ve probably spent much of your career developing those skills, often without thinking of them in security terms. The challenge now is bringing them together into a coherent security strategy.

That’s where frameworks such as NIST can help, and it’s where we’ll start in the next article.

Next in the series: You Can’t Protect What You Can’t Find: Why Asset Discovery Is the Real Starting Point for Security