Lesson 10: The IT-Security Tug-of-War – Balancing Agility and Compliance

By Tom Jones, IT Project Manager

Welcome back to my 21-part series on lessons learned throughout my IT project management career. Today’s topic is one that every IT project manager has wrestled with at some point: the constant battle between business agility and security compliance.

On one side, you have the business teams who want to move fast, innovate, and launch new features yesterday.

On the other side, you have the security and compliance teams who want to lock everything down, run exhaustive risk assessments, and add six layers of approvals before anything goes live.

Sound familiar?

In today’s lesson, I’ll cover: ✅ Why IT and security teams always seem to be at odds. ✅ How to strike a balance between agility and risk management. ✅ The biggest mistakes companies make when handling security. ✅ How ezRACI helps ensure compliance without stalling progress.

The Security Showdown That Almost Killed a Product Launch

In 2013, I was leading a customer portal upgrade for a major financial services company. The business team wanted a seamless digital experience that let customers access real-time data, submit requests, and make account changes online.

The security team? They saw this as a potential data breach waiting to happen.

• They wanted multi-factor authentication, role-based access, and encrypted session management.

• The business team complained that the extra security steps would frustrate customers and hurt engagement.

• The legal team was caught in the middle, unsure which side to take.

After weeks of deadlock, the project stalled—until we found a compromise.

By involving security early and building a risk-based approach to feature rollouts, we managed to:

• Implement security controls in phases instead of all at once.

• Allow low-risk features to launch sooner, while high-risk ones went through deeper security reviews.

• Use ezRACI to define clear roles so security approvals didn’t become a bottleneck.

This taught me an important lesson: Security and agility aren’t enemies—they just need to be balanced properly.

The 5 Biggest Security vs. Agility Mistakes (And How to Avoid Them)

🚨 1. Security is Brought in Too Late

❌ What happens: The business builds a system, then security steps in at the last minute and blocks deployment.

✅ Fix it:

• Involve security at the start of the project, not right before go-live.

• Hold joint planning meetings between IT, security, and business stakeholders.

• Use ezRACI to assign security responsibilities from day one.

🚨 2. Security Policies Are Too Rigid

❌ What happens: Security teams enforce one-size-fits-all policies that slow down innovation.

✅ Fix it:

• Use risk-based security models—not every system needs the same level of controls.

• Define acceptable risk thresholds instead of just saying “no.”

• Work with business teams to implement security in phases.

🚨 3. Business Teams Ignore Security Best Practices

❌ What happens: The business bypasses security to move faster, leading to shadow IT and compliance risks.

✅ Fix it:

• Educate business teams on why security matters—make them part of the process.

• Create a fast-track approval process for low-risk changes.

• Establish a RACI matrix to clarify who is responsible for security decisions.

🚨 4. Security Reviews Lack Transparency

❌ What happens: Business teams don’t understand why security is rejecting requests, leading to frustration.

✅ Fix it:

• Require security teams to provide clear explanations when denying a request.

• Create a decision log to document security approvals and rejections.

• Track all security-related issues in ezRACI to ensure transparency.

🚨 5. Compliance is Treated as a ‘Check-the-Box’ Exercise

❌ What happens: Companies only worry about security when an audit is coming up.

✅ Fix it:

• Make security a continuous process, not a one-time task.

• Automate compliance tracking with tools like ezRACI.

• Establish monthly security check-ins to review risks proactively.

How ezRACI Helps Bridge the Gap Between Security and Agility

Security conflicts arise when roles and responsibilities aren’t clear. That’s why I use ezRACI to:

✅ Define who owns security approvals for each project phase. ✅ Create transparency between IT, security, and business teams. ✅ Track compliance and risk assessments without slowing down development.

If your organization struggles with balancing security and agility, ezRACI can help you find the middle ground.

Final Thoughts: Security and Agility Can Coexist

The biggest lesson I’ve learned? Security isn’t about saying ‘no’—it’s about managing risk in a way that allows the business to keep moving forward.

✔️ Engage security early to avoid last-minute roadblocks. ✔️ Use risk-based security policies instead of rigid rules. ✔️ Make compliance a continuous process, not an afterthought.

Next time, in Lesson 11: The Art of the Executive Status Report, I’ll share how to deliver project updates that keep leadership engaged—without overwhelming them with unnecessary details.

Disclaimer: This blog is written from the perspective of Tom Jones, a fictional IT Project Manager, and is intended for informational and educational purposes. While based on real-world project management principles, all anecdotes and characters in these posts are entirely fictitious. Any resemblance to actual persons or events is purely coincidental. The blog also references ezRACI, a project management tool designed to help teams succeed in project execution. However, these opinions are solely those of the fictional character and do not constitute an official endorsement.