Lessons from the Field: Delivering IT Projects in Regulated Environments

In banking, government, and healthcare, projects often slow down for reasons that have little to do with technology. A background check takes longer than planned, a security review comes late, or a change freeze lands in the middle of the schedule.

Our work in these sectors shows that access, compliance, and communication shape a project as much as the technology does. The lessons below fall into four areas: planning for constraints, protecting access and data, changing systems safely, and staffing for the environment.

Plan for the constraints

Expect security to shape the design

Security requirements can change how a system is built, not just how it’s reviewed. A control discovered later can mean rework, so those requirements need to be part of the design from the beginning.

What this means for you: bring security and compliance into your first design workshop and agree on the controls the design must meet.

Remember that moving to the cloud doesn’t move accountability

Cloud providers secure parts of the service, but your organization usually remains responsible for its data, access, and configuration. A provider’s certifications don’t automatically cover how you use the service. Our cloud and security consultants help clients work out who owns each control.

What this means for you: document who is responsible for each control across your team, your provider, and your partners.

Allow time for vendor reviews

New vendors and tools often need security questionnaires, legal review, and procurement approval. These steps can hold up a project that is otherwise ready to start, so our project managers build vendor onboarding into the plan from the beginning.

What this means for you: list every new vendor and tool early and find out how long your review process usually takes.

Protect access and data

Manage access from start to finish

Projects tend to focus on granting access, but elevated rights can linger long after someone needs them. Our identity and access engineers design controls that cover the whole lifecycle, including consultants and temporary accounts.

What this means for you: grant the minimum access needed, review it regularly, and remove it the day someone rolls off the project.

Keep real data out of testing

Copying production data into test environments can put sensitive information in systems with weaker controls and wider access. We help clients plan test environments with that risk in mind.

What this means for you: use synthetic or masked data where you can and get formal approval for any exception.

Treat evidence as a deliverable

Rebuilding proof of what was done after a project ends is hard. Our security and compliance consultants capture design decisions, approvals, test results, and change records as the work happens.

What this means for you: agree at the start on what reviewers and auditors will expect and assign someone to collect it.

Change systems without disrupting them

Securing a government VCF environment with NSX and vDefend

Respect production and its change windows

Critical systems often can’t go down during business hours, so changes have to fit narrow windows.

What this means for you: agree on change windows and approvers early, and staff for those hours.

Modernize without stopping daily operations

Regulated organizations can rarely pause a critical system while they replace it. The current platform has to stay stable and supported while the new one takes shape.

What this means for you: give the current system and the future one separate owners, so neither is neglected.

Include legacy retirement in the plan

A new system going live doesn’t finish the job. Old systems may still hold records you must keep, along with accounts and connections that need to be shut down. Our consultants support this work, from legacy system assessments through data conversion and cutover.

What this means for you: decide how you’ll retain data and retire old systems before modernization begins and give that work a named owner.

Staff for the environment

Choose leaders who can talk to everyone

In a regulated project, a technical issue can quickly become a compliance or executive concern. The people leading the work need to explain risk clearly and keep many teams aligned. We look for consultants who can do both.

What this means for you: when you evaluate consultants, ask how they explain problems to non-technical leaders.

Plan for turnover in hard-to-fill roles

Specialized skills and required screening can slow replacement, and a single departure can stall the work. We provide hard-to-find specialists, and we expect them to document their work so knowledge stays with your team.

What this means for you: keep documentation current, cross-train where you can, and identify back-up staff before you need them.

Before you start

Regulated projects go more smoothly when you plan for constraints rather than discover them. Before you set a timeline, list your access, compliance, and change-window requirements and let them shape the plan from day one. If you need specialists who already work this way, ClearBridge can help.