IT Standards
What is IT Standards?
IT standards are the approved technologies, products, methods and specifications an organization requires or prefers for building, buying and running its systems, used to reduce complexity, risk and cost.
Updated November 2026 · 5 min read
IT standards tell project teams which technologies and approaches the organization has chosen. They may specify approved databases, cloud platforms, programming languages, integration methods, security controls, data formats and documentation practices. Some standards are mandatory, such as encryption requirements for sensitive data, while others express preferences, such as a default platform for new web applications. Together they narrow the range of choices so that systems across the organization fit together and can be supported efficiently.
Without standards, each team picks its own tools, and over time the organization accumulates many technologies doing the same job, each with its own licenses, skills and support needs. With standards that are too rigid, teams cannot adopt better options and may work around the rules. For enterprise architecture and IT finance, well-managed standards are one of the most effective ways to control the long-term cost and complexity of the technology estate.
Definition of IT Standards
IT standards, also called technology standards, are documented rules and approved choices for technology used within an organization. They include internal standards set by the organization and external standards, such as industry protocols and security frameworks, that the organization adopts.
They put architecture principles into practice. A principle such as "standardize platforms" becomes useful only when specific approved platforms are named in the standards.
Types of IT Standards
Technology and product standards list approved platforms, software, hardware and services, often with their lifecycle status. They are the standards most teams consult first when starting a project.
Design and development standards cover coding practices, API design, data modeling, testing and documentation. They help code written by different teams look and behave consistently, which makes maintenance easier.
Security and compliance standards set required controls, such as encryption, identity management, logging and data retention. These are usually mandatory, since they protect the organization against legal and security risks.
Operational standards cover how systems are deployed, monitored, backed up and supported, so that operations teams can manage them consistently. They also define what a system needs before it is accepted into live operation.
Standards and Lifecycle Status
Many organizations publish standards together with a status for each technology, such as emerging, preferred, contained or retiring.
Preferred technologies are the default for new work. Contained technologies may continue in existing systems but should not be used for new projects, and retiring technologies are being removed. Statuses tell teams not only what to use today but what will be supported in the years ahead.
Linking standards to technology lifecycle management keeps them current as products age and new options emerge.
Importance of IT Standards in Enterprise Architecture
Standards reduce complexity. Fewer technologies mean fewer integrations to build, fewer skills to maintain and fewer products to patch and monitor. Each technology removed from the estate also removes a set of contracts, upgrades and specialist knowledge.
They improve security and reliability, since approved technologies have been assessed and can be supported with consistent tools and processes. Security teams can focus their monitoring and testing on a known set of products.
They also speed up delivery. Teams spend less time evaluating options and can reuse templates, components and knowledge built around the standards. Staff can also move between teams more easily when everyone works with the same technologies.
Effect on Costs
Standardizing on fewer products strengthens negotiating positions with vendors and allows volume pricing through enterprise agreements. It also reduces the number of contracts procurement must manage and renew.
It reduces support costs, since operations and security teams work with a smaller set of technologies and need fewer specialists.
It also lowers the cost of future change. Systems built on standard platforms are easier to integrate, migrate and retire, which reduces the effort required for application rationalization.
These savings depend on standards being followed, so tracking the share of new projects that use preferred technologies is a useful measure.
Common Challenges
Standards that are hard to find or understand are ignored. Teams need a single, current, easy-to-search source. Standards scattered across documents and wikis quickly contradict each other.
Standards that change too slowly frustrate teams that need newer capabilities, leading to workarounds and shadow IT.
Standards without a clear exception process either block legitimate needs or are bypassed informally, so a fast, transparent route for exceptions is essential.
How to Manage IT Standards
Managing standards involves defining them with input from the people who use them, publishing them clearly, applying them through governance and reviewing them regularly.
The aim is a set of standards that teams find helpful rather than restrictive.
Defining and Publishing
Start with the areas where variety causes the most cost or risk, such as databases, cloud platforms, integration tools and security controls. The application inventory shows where the most variety exists today.
Involve architects, engineers, security and operations staff in choosing standards, so the choices reflect practical experience. Standards chosen this way are more likely to be followed, because the people who use them helped shape them.
Publish standards in one searchable place, with the status of each technology, the reasons for each choice and guidance on how to use it. Explaining the reasons helps teams accept the choices and apply them sensibly.
Applying and Reviewing
Check new designs and purchases against the standards through the architecture review board or a lighter review for smaller changes.
Provide a simple process for proposing new standards and requesting exceptions, with clear decision timelines. Recording approved exceptions, with reasons and review dates, helps similar requests be handled faster.
Review standards at least twice a year, adding new technologies that prove valuable and retiring those that are no longer suitable. Report how widely each standard is followed, so leaders can see whether the effort is paying off.
Examples of IT Standards in Enterprise Architecture
The examples below show IT standards reducing cost and complexity.
Both use illustrative figures. The first standardizes databases, and the second introduces a fast exception process.
In each, standards worked because teams found them practical.
Standardizing Databases
A logistics company uses 11 database products across 350 applications, with separate licenses, specialists and backup tools for many of them.
It names three preferred database products, marks the rest as contained and migrates applications as they are upgraded or replaced.
Over four years, the number of database products in use falls to five, and annual database licensing and support costs fall by about $2.1 million.
Introducing a Fast Exception Process
A bank's standards require months of approval for any non-standard technology, and teams increasingly adopt tools without asking.
The bank introduces a two-week exception process with clear criteria and publishes approved exceptions for others to reuse.
Requests rise sharply, unapproved tools fall, and three requested technologies are added to the standards after proving useful.
Conclusion
IT standards are the approved technologies, products, methods and specifications an organization uses to build, buy and run its systems. They cover technology choices, design and development, security and operations, often with a lifecycle status for each technology.
In enterprise architecture, standards reduce complexity, improve security and lower long-term costs. Focusing on areas of greatest variety, involving practitioners, publishing standards clearly, applying them through governance, offering fast exceptions and reviewing them regularly help organizations keep standards useful and followed.
Related terms
Architecture Principles
Architecture principles are a small set of agreed, enduring rules and guidelines that shape how an organization designs, selects and uses technology, providing a consistent basis for architecture decisions.
Technology Lifecycle Management
Technology lifecycle management is the practice of tracking and planning each technology an organization uses, from adoption through standard use, decline and retirement, so that upgrades and replacements happen on time and within budget.
Application Rationalization
Application rationalization is the process of reviewing an organization's applications and reducing duplication by retiring, consolidating, replacing or modernizing those that cost more than the value they deliver.
Shadow IT
Shadow IT is technology that employees or departments buy, build or use for work without the knowledge or approval of the organization's IT function, such as unapproved cloud services, apps and devices.