First I must address an error I included in one of last week's newsletters, "Management and open source software, together at last." I had said the fledgling industry organization, the Open Management Forum, seemed to be defunct, but I was mistaken. A DNS error had made their Web site inaccessible from the address I had and from the links provided in a Google search. I am happy to report the OMC is alive and thriving with more than 30 members working toward open source and commercial management application interoperability. More on that group in future newsletters.

Now onto today's topic. Aspects of IT governance have come to the forefront of IT executives priorities in light of compliance deadlines for industry regulations such as Sarbanes-Oxley and Health Insurance Portability and Accountability Act (HIPAA). While there are commercial products that promise to help IT managers track compliance, IT governance in and of itself is not just about technology. It is about how IT delivers services -- either in a centralized or decentralized manner -- and the controls and documentation put in place to maintain accurate configurations and enforce processes. For instance, IT governance would monitor changes and access made to systems and assess if those acts comply with security or regulatory policies.

Forrester Research categorizes such products as governance, risk and compliance (GRC) management tools. The products comprise many functions once handled by disparate department across an enterprise organization.

"Increased risk and regulatory pressures in a distributed enterprise are propelling organizations to craft consistent game plans for centralizing GRC oversight," reads a recent Forrester report. "Organizations are to establish a platform that maintains a system of record for GRC. This enables disparate compliance and governance technologies to combine into a coherent regime for managing GRC across the enterprise."

With the size of todays IT environments and the constant rate of change to systems, many vendors have emerged with products that would automate the monitoring and assessment of these myriad changes. One problem area is monitoring changes to determine if they comply with preset policies and that those making changes are authorized. In the past month alone, Active Reasoning and Tripwire updated their governance platforms to provide enterprise IT managers with more ways to ensure policies are followed and compliance demands are met.

Denise Dubie is senior editor with Network World.