Improve Email Security

Follow the latest best practices for email security to mitigate evolving threats.

Analyst Perspective

Protecting your organization’s digital assets begins with securing your email communication.

As organizations increasingly rely on email communication for day-to-day business operations, threat actors are exploiting the increased traction to develop and implement more sophisticated email-based attacks. Furthermore, the lack of investment in measures, tools, and technologies for an organization’s email security exacerbates the vulnerabilities at hand.

Effective use of security procedures and techniques can mitigate and minimize email-based threats have been shown to reduce the ability of these attacks to infiltrate the email inbox. These guidelines and best practices will help your organization conduct due diligence to protect the contents of the email, its transit, and its arrival to the authorized recipient.

Ahmad Jowhar
Research Specialist, Security & Privacy
Info-Tech Research Group

Executive Summary

Info-Tech Insight
Email has changed. Your email security must evolve to ensure the safety of your organization’s communication.

Your Challenge

As a security leader, you need to modernize your email security services so you can protect business communications and prevent security incidents.

• Various factors must be considered when deciding how best to safeguard your organization’s communication chain. This includes the frequency of email traffic and the contents of emails.
• The increased number of email-based cyberattacks reveals the sophistication of threat actors in leveraging an organization’s lack of email security to infiltrate their business.
• As organizations continue to rely heavily on email communication, email-based threats will become increasingly prevalent.

75% of organizations have experienced an increase in email-based threats.

97% of security breaches are due to phishing attacks.

82% of companies reported a higher volume of email in 2022.

Source: Mimecast, 2023.

Modern email security controls framework for security leaders

Email has changed. Your email security must evolve to ensure the safety of your organization’s communication.

Understand the best practices in securing your organization’s emails

Email encryption

Deploy an added layer of defense by preventing the contents of your email from being intercepted.

• Protecting your organization’s emails begins by ensuring only the appropriate recipients can receive and read the email’s contents.
• This process includes encrypting the email’s contents to protect sensitive information from being read by unauthorized recipients.
• This protects the contents even if the email is intercepted by anyone besides the intended recipient.
• Other benefits of email encryption include:
• Reducing any risks associated with regulatory violations.
• Enabling business to confidently communicate sensitive information via email.
• Ensuring protective measures taken to prevent data loss and corporate policy violations.

Along with the increased use of emails, organizations are seeing an increase in the number of attacks orchestrating from emails. This has resulted in 74% of organizations seeing an increase in email-based threats.

Source: Mimecast, 2023.

Info-Tech Insight
Encrypting your email communication will provide an additional layer of protection which only allows authorized users to read the email.

Implementing email encryption

Leverage these protocols and tools to help encrypt your email.

• The most common email encryption protocols and tools include:
• Transport Layer Security (TLS): A cryptographic protocol designed to securely deliver data via the internet, which prevents third parties from intercepting and accessing the data.
• Secure/Multipurpose Internet Mail Extension (S/MIME): A protocol for sending digitally signed and encrypted messages by leveraging public key encryption to provide at-rest and in-transit data protection.
• Secure Email Gateway: An email security solution that inspects emails for malicious content prior to it reaching the corporate system. The solution is positioned between the public internet and corporate email servers. An email gateway solution would be provided by a third-party vendor and can be implemented on-premises, through the cloud, or hybrid.
• Email encryption policies can also be implemented to ensure processes are in place when sending sensitive information through emails.
• Email encryption ensures end-to-end privacy for your email and is especially important when the email requires strict content privacy.

Email authentication

Three authentication controls your organization should leverage to stay secure.

• Along with content encryption, it’s important to authenticate both the sender and recipient of an email to ensure that only legitimate users are able to send and receive it.
• Implementing email authentication techniques prevents unsolicited email (e.g. spam) from entering your mailbox.
• This also prevents unauthorized users from sending email on your organization’s behalf.
• Having these standards in place would safeguard your organization from spam, spoofing, and phishing attacks.
• The three authentication controls include:
• Sender Policy Framework (SPF): Email validation control that verifies that the incoming email is from an authorized list of IP addresses provided by the sender’s domain administrator.
• DomainKeys Identified Mail (DKIM): Enables recipients to verify that an email from a specific domain was authorized by the domain’s owner. This is conducted through cryptographic authentication by adding a digital signature to the message headers of outbound emails.
• Domain Message Authentication Reporting & Conformance (DMARC): Provides domain-level protection of email channel by publishing DMARC records in the organization’s domain name system (DNS) and creates policies which prompts actions to take if an email fails authentication.

Although these authentication controls are available for organizations to leverage, the adoption rate remains low. 73% of survey respondents indicated they didn’t deploy email authentication controls within their organization.

Source: Mimecast, 2023.

Email authentication controls

All three authentication controls should be implemented to effectively secure your organization’s email. They ensure the emails you send and receive are securely authorized and legitimate.

For more information:

• Microsoft 365
• Google Workspace

Data classification

Ensure sensitive data is securely processed, analyzed, and stored.

• Besides authenticating the legitimacy of an email and its traffic to the recipient, it’s important to have procedures in place to protect the contents of an email.
• Data classification is found not only in databases and spreadsheets, but also in the email messages being communicated. Examples of data most commonly included in emails:
• Personal identifiable information (PII): social security number, financial account number, passcodes/passwords
• Applying data classification to your email can help identify the sensitivity of the information it contains. This ensures any critical data within an email message is securely processed and protected against unauthorized use, theft, and loss.
• Emails can be classified based on various sensitivity levels. such as:
• Top secret, public, confidential, internal

Discover and Classify Your Data

Leverage this Info-Tech blueprint for guidelines on implementing a data classification program for your organization.

Info-Tech Insight
Having tools and technologies in place to ensure that data is classified and backed up will enable better storage, analysis, and processing of the email.

Data loss prevention (DLP)

Protect your data from being lost/stolen.

• Protecting an email’s contents through data classification is only one approach for improving email security. Having a data loss prevention solution would further increase security by minimizing the threat of sensitive information leaving your organization’s email network.
• Examples of tools embedded in DLP solutions that help monitor an organization's email communication:
• Monitoring data sent and received from emails: This ensures the data within an email communication is protected with the necessary encryption based on its sensitivity.
• Detecting suspicious email activity: This includes analyzing users’ email behavior regarding email attachments and identifying irregular behaviors.
• Flagging or blocking email activities which may lead to data loss: This prevents highly sensitive data from being communicated via email and reduces the risk of information being intercepted.
• The types of DLP technologies that can be leveraged include:
• Rule-based: Data that has been tagged by admins as sensitive can be blocklisted, which would flag and/or block data from being sent via email.
• Machine learning: Data on users’ email behavior is collected, processed, and trained to understand the employee’s normal email behavior and detect/flag suspicious activities.
• Implementing DLP solutions would complement your data classification techniques by ensuring proper measures are in place to secure your organization’s assets through policies, technology, and tools.

48% of employees have accidently attached the wrong file to an email.

39% of respondents have accidently sent emails that contained security information such as passwords and passcodes.

Source: Tessian, 2021.

User awareness & training

A strong security awareness & training program is an important element of strengthening your email security.

• Having all these tools and techniques in place to improve your email security will not be effective unless you also improve your employees’ awareness.
• Employees should participate in email security training, especially since the majority utilize this channel of communication for day-to-day operations.
• User awareness and training should go beyond phishing campaigns and should highlight the various types of email-based threats, the characteristics of these threats, and what procedures they can follow to minimize these threats.
• 95% of data breaches are caused by human error. It can take nine months to discover and contain them, and they are expected to cost $8 trillion this year (Mimecast, 2023).
• Investments in employee awareness and training would mitigate these risks by ensuring employees recognize and report suspicious emails, remain mindful of what type of data to share via email, and improve their overall understanding of the importance of email security.

Develop a Security Awareness and Training Program That Empowers End Users

Leverage this Info-Tech blueprint for assistance on creating various user training materials and empower your employees to become a main line of defense for your organization.

64% of organizations conduct formal training sessions (in-person or computer-based).

74% of organizations only focus on providing phishing-based training.

Source: Proofpoint, 2021.

Examples of email-based threats

Phishing
Email sent by threat actors designed to manipulate end user into providing sensitive information by posing as a trustworthy source

Business Email Compromise
Attackers trick a user into sending money or providing confidential information

Spam
Users receive unsolicited email, usually in bulk, some of which contains malware

Spear Phishing
A type of phishing attack where the email is sent to specific and targeted emails within the organization

Whaling
A type of phishing attack similar to spear phishing, but targeting senior executives within the organization

Password/Email Exposure
Employees use organizational email accounts and passwords to sign up for social media, leaving them susceptible to email and/or password exposure in a social media breach

Email policies

Having policies in place will enable these controls to be implemented.

Developing security policies that are reasonable, auditable, enforceable, and measurable ensures proper procedures are followed and necessary measures are implemented to protect the organization. Policies relating to email security can be categorized into two groups:

• User policy: Policies employees must adhere to when using their corporate email. Examples:
• User acceptance of technology: Acknowledgment of legitimate and restrictive actions when using corporate email
• Security awareness and training: Acknowledging completion of email security training
• Administrator-set policy: Policies that are implemented by IT and/or security admins. Examples:
• Email backup: Policy on how long emails should be archived and processes for disposing of them
• Log retention: Policy on how to retain, process, and analyze logs created from email servers
• Throttling: Policies that limit the number of emails sent by a sender and the number of recipients per email and per day depending on the employee’s grouping

Develop and Deploy Security Policies

Leverage this Info-Tech blueprint for assistance on developing and deploying actionable policies and creating an overall policy management lifecycle to keep your policies current, effective, and compliant.

Info-Tech Insight
Policies ensure acceptable standards are in place to protect the organization’s assets, including the creation, attachment, sending, and receiving of emails.

Email security technologies & tools (SoftwareReviews)

SoftwareReviews, a division of Info-Tech Research Group, provides enterprise software reviews to help organizations make more efficient decisions during the software selection process. Reviews are provided by authenticated IT professionals who have leveraged the software and provide unbiased insights on different vendors and their products.

Learn from the collective knowledge of real IT professionals.

• Know the products and features available.
• Explore modules and detailed feature-level data.
• Quickly understand the market.

Evaluate market leaders through vendor rankings and awards.

• Convince stakeholders with professional reports.
• Avoid pitfalls with unfiltered data from real users.
• Choose software with confidence.

Cut through misleading marketing material.

• Negotiate contracts based on data.
• Know what to expect before you sign.
• Effectively manage the vendor.

Email security technologies & tools

Leverage these tools for an enhanced email security solution.

• SoftwareReviews provides vendor and software reviews of various email security solutions. View the details below on the different email security solutions and the top vendors for each solution.
• Cloud Email Security
• Avanan, Perception Point, SpamTitan
• Email Backup
• Dropsuite Email Backup, Mimecast Sync & Recover, BackupAssist
• Secure Email Gateway – Enterprise Software
• Forcepoint Email Security, FortiMail, Cisco Secure Email
• Secure Email Gateway – Midmarket Software
• Avanan, SpamTitan, Spambrella

Email Security Checklist

Follow these guidelines to ensure you are implementing best practices for securing your organization’s emails.

• The Email Security Checklist is a tool to assess the current and future state of your organization’s email security and provides a holistic understanding on monitoring your progress within each category and associated controls.
• The status column allows you to select the feature’s current implementation status, which includes the following options:
• Enabled: The feature is deployed within the organization’s network.
• Implemented: The feature is implemented within the organization’s network, but not yet deployed.
• Not implemented: The feature has not been enabled or implemented.
• Comments can be added for each feature to provide details such as indicating the progress on enabling/implementing a feature and why certain features are not yet implemented.

Download the Email Security Checklist tool

Related Info-Tech Research

Discover and Classify Your Data
Leverage this Info-Tech blueprint for guidelines on implementing a data classification program for your organization.

Develop a Security Awareness and Training Program That Empowers End Users
Leverage this Info-Tech blueprint for assistance on creating various user training materials and empower your employees to become a main line of defense for your organization.

Develop and Deploy Security Policies
Leverage this Info-Tech blueprint for assistance on developing and deploying actionable policies and creating an overall policy management lifecycle to keep your policies current, effective, and compliant.

Bibliography

“10 Best Practices for Email Security in 2022.” TitanFile, 22 Sept. 2022. Web.

“2021 State of the Phish.” Proofpoint, 2021. Web.

Ahmad, Summra. “11 Email Security Best Practices You Shouldn't Miss (2023).” Mailmunch, 9 Mar. 2023. Web.

“Blumira's State of Detection and Response.” Blumira, 18 Jan. 2023. Web.

Clay, Jon. “Email Security Best Practices for Phishing Prevention.” Trend Micro, 17 Nov. 2022. Web.

Crane, Casey. “6 Email Security Best Practices to Keep Your Business Safe in 2019.” Hashed Out by The SSL Store™, 7 Aug. 2019. Web.

Hateb, Seif. “Basic Email Security Guide.” Twilio Blog, Twilio, 5 Dec. 2022. Web.

“How DMARC Advances Email Security.” CIS, 9 July 2021. Web.

Pal, Suryanarayan. “10 Email Security Best Practices You Should Know in 2023.” Mailmodo, 9 Feb. 2023. Web.

Pitchkites, Max. “Email Security: A Guide to Keeping Your Inbox Safe in 2023.” Cloudwards, 9 Dec. 2022. Web.

Rudra, Ahona. “Corporate Email Security Checklist.” PowerDMARC, 4 July 2022. Web.

“Sender Policy Framework.” Mimecast, n.d. Web.

Shea, Sharon, and Peter Loshin. “Top 15 Email Security Best Practices for 2023: TechTarget.” TechTarget, 14 Dec. 2022. Web.

“The Email Security Checklist: Upguard.” UpGuard, 16 Feb. 2022. Web.

“The State of Email Security 2023.” Mimecast, 2023. Web.

Wetherald, Harry. “New Product - Stop Employees Emailing the Wrong Attachments.” Tessian, 16 Sept. 2021. Web.

“What Is DMARC? - Record, Verification & More: Proofpoint Us.” Proofpoint, 9 Mar. 2023. Web.

“What Is Email Security? - Defining Security of Email: Proofpoint Us.” Proofpoint, 3 Mar.2023. Web.

Wilton, Laird. “How to Secure Email in Your Business with an Email Security Policy.” Carbide, 31 Jan. 2022. Web.

Considerations for a Hub and Spoke Model When Deploying Infrastructure in the Cloud

Don't revolve around a legacy design; choose a network design that evolves with the organization.

Analyst Perspective

Cloud adoption among organizations increases gradually across both the number of services used and the amount those services are used. However, network builders tend to overlook the vulnerabilities of network topologies, which leads to complications down the road, especially since the structures of cloud network topologies are not all of the same quality. A network design that suits current needs may not be the best solution for the future state of the organization.

Even if on-prem network strategies were retained for ease of migration, it is important to evaluate and identify the cloud network topology that can not only elevate the performance of your infrastructure in the cloud, but also that can make it easier to manage and provision resources.

An "as the need arises" strategy will not work efficiently since changing network designs will change the way data travels within your network, which will then need to be adopted to existing application architectures. This becomes more complicated as the number of services hosted in the cloud grows.

Keep a network strategy in place early on and start designing your infrastructure accordingly. This gives you more control over your networks and eliminates the need for huge changes to your infrastructure down the road.

Nitin Mukesh
Senior Research Analyst, Infrastructure and Operations
Info-Tech Research Group

Executive Summary

Your Challenge

The organization is planning to move resources to the cloud or devise a networking strategy for their existing cloud infrastructure to harness value from the cloud.

The right topology needs to be selected to deploy network level isolation, design the cloud for management efficiencies, and provide access to shared services in the cloud.

A perennial challenge for infrastructure in the cloud is planning for governance vs. flexibility, which is often overlooked.

Common Obstacles

The choice of migration method may result in retaining existing networking patterns and only making changes when the need arises.

Networking in the cloud is still new, and organizations new to the cloud may not be aware of the cloud network designs they can consider for their business needs.

Info-Tech's Approach

Define organizational needs and understand the pros and cons of cloud network topologies to strategize for the networking design.

Consider the layered complexities of addressing the governance vs. flexibility spectrum for your domains when designing your networks.

Insight Summary

Don't wait until the necessity arises to evaluate your networking in the cloud. Get ahead of the curve and choose the topology that optimizes benefits and supports organizational needs in the present and future.

Your challenge

Selecting the right topology: Many organizations migrate to the cloud retaining a mesh networking topology from their on-prem design, or they choose to implement the mesh design leveraging peering technologies in the cloud without a strategy in place for when business needs change. While there may be many network topologies for on-prem infrastructure, the network design team may not be aware of the best approach in cloud platforms for their requirements, or a cloud networking strategy may even go overlooked during the migration.

Finding the right cloud networking infrastructure for:

• Management efficiencies
• Network-level isolation of resources
• Access to shared services

Deciding between governance and flexibility in networking design: In the hub and spoke model, if a domain is in the hub, the greater the governance over it, and if it sits in the spoke, the higher the flexibility. Having a strategy for the most important domains is key. For example, some security belongs in the hub and some security belongs in the spoke. The tradeoff here is if it sits completely in the spoke, you give it a lot of freedom, but it becomes harder to standardize across the organization.

Mesh network topology

A mesh is a design where virtual private clouds (VPCs) are connected to each other individually creating a mesh network. The network traffic is fast and can be redirected since the nodes in the network are interconnected. There is no hierarchical relationship between the networks, and any two networks can connect with each other directly.

In the cloud, this design can be implemented by setting up peering connections between any two VPCs. These VPCs can also be set up to communicate with each other internally through the cloud service provider's network without having to route the traffic via the internet.

While this topology offers high redundancy, the number of connections grows tremendously as more networks are added, making it harder to scale a network using a mesh topology.

Mesh Network on AWS

Source: AWS, 2018

Constraints

The disadvantages of peering VPCs into a mesh quickly arise with:

• Transitive connections: Transitive connections are not supported in the cloud, unlike with on-prem networking. This means that if there are two networks that need to communicate, a single peering link can be set up between them. However, if there are more than two networks and they all need to communicate, they should all be connected to each other with separate individual connections.
• Cost of operation: The lack of transitive routing requires many connections to be set up, which adds up to a more expensive topology to operate as the number of networks grows. Cloud providers also usually limit the number of peering networks that can be set up, and this limit can be hit with as few as 100 networks.
• Management: Mesh tends to be very complicated to set up, owing to the large number of different peering links that need to be established. While this may be manageable for small organizations with small operations, for larger organizations with robust cybersecurity practices that require multiple VPCs to be deployed and interconnected for communications, mesh opens you up to multiple points of failure.
• Redundancy: With multiple points of failure already being a major drawback of this design, you also cannot have more than one peered connection between any two networks at the same time. This makes designing your networking systems for redundancy that much more challenging.

Proportional relationship of virtual networks to required peering links in a mesh topology

Case study

INDUSTRY: Blockchain
SOURCE: Microsoft

An organization with four members wants to deploy a blockchain in the cloud, with each member running their own virtual network. With only four members on the team, a mesh network can be created in the cloud with each of their networks being connected to each other, adding up to a total of 12 peering connections (four members with three connections each). While the members may all be using different cloud accounts, setting up connections between them will still be possible.

The organization wants to expand to 15 members within the next year, with each new member being connected with their separate virtual networks. Once grown, the organization will have a total of 210 peering connections since each of the virtual networks will then need 14 peering connections. While this may still be possible to deploy, the number of connections makes it harder to manage and would be that much more difficult to deploy if the organization grows to even 30 or 40 members. The new scale of virtual connections calls for an alternative networking strategy that cloud providers offer – the hub and spoke topology.

Source: Microsoft, 2017

Hub and spoke network topology

In hub and spoke network design, each network is connected to a central network that facilitates intercommunication between the networks. The central network, also called the hub, can be used by multiple workloads/servers/services for hosting services and for managing external connectivity. Other networks connected to the hub through network peering are called spokes and host workloads.

Communications between the workloads/servers/services on spokes pass in or out of the hub where they are inspected and routed. The spokes can also be centrally managed from the hub with IT rules and processes.

A hub and spoke design enable a larger number of virtual networks to be interconnected as each network only needs one peered connection (to the hub) to be able to communicate with any other network in the system.

Hub and Spoke Network on AWS

What hub and spoke networks do better

1. Ease of connectivity: Hub and spoke decreases the liabilities of scale that come from a growing business by providing a consistent connection that can be scaled easily. As more networks are added to an organization, each will only need to be connected once – to the hub. The number of connections is considerably lower than in a mesh topology and makes it easier to maintain and manage.
2. Business agility and scalability: It is easier to increase the number of networks than in mesh, making it easier to grow your business into new channels with less time, investment, and risk.
3. Data collection: With a hub and spoke design, all data flows through the hub – depending on the design, this includes all ingress and egress to and from the system. This makes it an excellent central network to collect all business data.
4. Network-level isolation: Hub and spoke enables separation of workloads and tiers into different networks. This is particularly useful to ensure an issue affecting a network or a workload does not affect the rest.
5. Network changes: Changes to a separated network are much easier to carry out knowing the changes made will not affect all the other connected networks. This reduces work-hours significantly when systems or applications need to be altered.
6. Compliance: Compliance requirements such as SOC 1 and SOC 2 require separate environments for production, development, and testing, which can be done in a hub and spoke model without having to re-create security controls for all networks.

Hub and spoke constraints

While there are plenty of benefits to using this topology, there are still a few notable disadvantages with the design.

Point-to-point peering

The total number of total peered connections required might be lower than mesh, but the cost of running independent projects is cheaper on mesh as point-to-point data transfers are cheaper.

Global access speeds with a monolithic design

With global organizations, implementing a single monolithic hub network for network ingress and egress will slow down access to cloud services that users will require. A distributed network will ramp up the speeds for its users to access these services.

Costs for a resilient design

Connectivity between the spokes can fail if the hub site dies or faces major disruptions. While there are redundancy plans for cloud networks, it will be an additional cost to plan and build an environment for it.

Leverage the hub and spoke strategy for:

Providing access to shared services: Hub and spoke can be used to give workloads that are deployed on different networks access to shared services by placing the shared service in the hub. For example, DNS servers can be placed in the hub network, and production or host networks can be connected to the hub to access it, or if the central network is set up to host Active Directory services, then servers in other networks can act as spokes and have full access to the central VPC to send requests. This is also a great way to separate workloads that do not need to communicate with each other but all need access to the same services.

Adding new locations: An expanding organization that needs to add additional global or domestic locations can leverage hub and spoke to connect new network locations to the main system without the need for multiple connections.

Cost savings: Apart from having fewer connections than mesh that can save costs in the cloud, hub and spoke can also be used to centralize services such as DNS and NAT to be managed in one location rather than having to individually deploy in each network. This can bring down management efforts and costs considerably.

Centralized security: Enterprises can deploy a center of excellence on the hub for security, and the spokes connected to it can leverage a higher level of security and increase resilience. It will also be easier to control and manage network policies and networking resources from the hub.

Network management: Since each spoke is peered only once to the hub, detecting connectivity problems or other network issues is made simpler in hub and spoke than on mesh. A network manager deployed on the cloud can give access to network problems faster than on other topologies.

Hub and spoke – mesh hybrid

The advantages of using a hub and spoke model far exceed those of using a mesh topology in the cloud and go to show why most organizations ultimately end up using the hub and spoke as their networking strategy.

However, organizations, especially large ones, are complex entities, and choosing only one model may not serve all business needs. In such cases, a hybrid approach may be the best strategy. The following slides will demonstrate the advantages and use cases for mesh, however limited they might be.

Where it can be useful:

An organization can have multiple network topologies where system X is a mesh and system Y is a hub and spoke. A shared system Z can be a part of both systems depending on the needs.

An organization can have multiple networks interconnected in a mesh and some of the networks in the mesh can be a hub for a hub-spoke network. For example, a business unit that works on data analysis can deploy their services in a spoke that is connected to a central hub that can host shared services such as Active Directory or NAT. The central hub can then be connected to a regional on-prem network where data and other shared services can be hosted.

Hub and spoke – mesh hybrid network on AWS

Why mesh can still be useful

Designing for governance vs. flexibility in hub and spoke

Governance and flexibility in managing resources in the cloud are inversely proportional: The higher the governance, the less freedom you have to innovate.

The complexities of designing an organization's networks grow with the organization as it becomes global and takes on more services and lines of business. Organizations that choose to deploy the hub and spoke model face a dilemma in choosing between governance and flexibility for their networks. Organizations need to find that sweet spot to find the right balance between how much they want to govern their systems, mainly for security- and cost-monitoring, and how much flexibility they want to provide for innovation and other operations, since the two usually tend to have an inverse relationship.

This decision in hub and spoke usually means that the domains chosen for higher governance must be placed in the hub network, and the domains that need more flexibility in a spoke. The key variables in the following slide will help determine the placement of the domain and will depend entirely on the organization's context.

The two networking patterns in the cloud have layered complexities that need to be systematically addressed.

Designing for governance vs. flexibility in hub and spoke

If a network has more flexibility in all or most of these domains, it may be a good candidate for a spoke-heavy design; otherwise, it may be better designed in a hub-centric pattern.

• Function: The function the domain network is assigned to and the autonomy the function needs to be successful. For example, software R&D usually requires high flexibility to be successful.
• Regulations: The extent of independence from both internal and external regulatory constraints the domain has. For example, a treasury reporting domain typically has high internal and external regulations to adhere to.
• Human resources: The freedom a domain has to hire and manage its resources to perform its function. For example, production facilities in a huge organization have the freedom to manage their own resources.
• Operations: The freedom a domain has to control its operations and manage its own spending to perform its functions. For example, governments usually have different departments and agencies, each with its own budget to perform its functions.
• Technology: The independence and the ability a domain has to manage its selection and implementation of technology resources in the cloud. For example, you may not want a software testing team to have complete autonomy to deploy resources.

Optimal placement of services between the hub and spoke

Shared services and vendor management

Resources that are shared between multiple projects or departments or even by the entire organization should be hosted on the hub network to simplify sharing these services. For example, e-learning applications that may be used by multiple business units to train their teams, Active Directory accessed by most teams, or even SAAS platforms such as O365 and Salesforce can leverage buying power and drive down the costs for the organization. Shared services should also be standardized across the organization and for that, it needs to have high governance.

Services that are an individual need for a network and have no preexisting relationship with other networks or buying power and scale can be hosted in a spoke network. For example, specialized accounting software used exclusively by the accounting team or design software used by a single team. Although the services are still a part of the wider network, it helps separate duties from the shared services network and provides flexibility to the teams to customize and manage their services to suit their individual needs.

Network egress and interaction

Network connections, be they in the cloud or hybrid-cloud, are used by everyone to either connect to the internet, access cloud services, or access the organization's data center. Since this is a shared service, a centralized networking account must be placed in the hub for greater governance. Interactions between the spokes in a hub and spoke model happens through the hub, and providing internet access to the spokes through the hub can help leverage cost benefits in the cloud. The network account will perform routing duties between the spokes, on-prem assets, and egress out to the internet.

For example, NAT gateways in the cloud that are managed services are usually charged by the hour, and deploying NAT on each spoke can be harder to manage and expensive to maintain. A NAT gateway deployed in a central networking hub can be accessed by all spokes, so centralizing it is a great option.

Note that, in some cases, when using edge locations for data transfers, it may be cost effective to deploy a NAT in the spoke, but such cases usually do not apply to most organizational units.

A centralized network hub can also be useful to configure network policies and network resources while organizational departments can configure non-network resources, which helps separate responsibilities for all the spokes in the system. For example, subnets and routes can be controlled from the central network hub to ensure standardized network policies across the network.

Security

While there needs to be security in the hub and the spokes individually, finding the balance of operation can make the systems more robust. Hub and spoke design can be an effective tool for security when a principal security hub is hosted in the hub network. The central security hub can collect data from the spokes as well as non-spoke sources such as regulatory bodies and threat intelligence providers, and then share the information with the spokes.

Threat information sharing is a major benefit of using this design, and the hub can take actions to analyze and enrich the data before sharing it with spokes. Shared services such as threat intelligence platforms (TIP) can also benefit from being centralized when stationed in the hub. A collective defense approach between the hub and spoke can be very successful in addressing sophisticated threats.

Compliance and regulatory requirements such as HIPAA can also be placed in the hub, and the spokes connected to it can make use of it instead of having to deploy it in each spoke individually.

Cloud metering

The governance vs. flexibility paradigm usually decides the placement of cloud metering, i.e. if the organization wants higher control over cloud costs, it should be in the central hub, whereas if it prioritizes innovation, the spokes should be allowed to control it. Regardless of the placement of the domain, the costs can be monitored from the central hub using cloud-native monitoring tools such as Azure Monitor or any third-party software deployed in the hub.

For ease of governance and since resources are usually shared at a project level, most cloud service providers suggest that an individual metering service be placed in the spokes. The centralized billing system of the organization, however, can make use of scale and reserved instances to drive down the costs that the spokes can take advantage of. For example, billing and access control resources are placed in the lower levels in GCP to enable users to set up projects and perform their tasks. These billing systems in the lower levels are then controlled by a centralized billing system to decide who pays for the resources provisioned.

Don't get stuck with your on-prem network design. Design for the cloud.

1. Peering VPCs into a mesh design can be an easy way to get onto the cloud, but it should not be your networking strategy for the long run.
2. Hub and spoke network design offers more benefits than any other network strategy to be adopted only when the need arises. Plan for the design early on and keep a strategy in place to deploy it as early as possible.
3. Hybrid of mesh and hub and spoke will be very useful in connecting multiple large networks especially when they need to access the same resources without having to route the traffic over the internet.
4. Governance vs. flexibility should be a key consideration when designing for hub and spoke to leverage the best out of your infrastructure.
5. Distribute domains across the hub or spokes to leverage costs, security, data collection, and economies of scale, and to foster secure interactions between networks.

Cloud network design strategy

Bibliography

Borschel, Brett. "Azure Hub Spoke Virtual Network Design Best Practices." Acendri Solutions, 13 Jan. 2022. Web.
Singh, Garvit. "Amazon Virtual Private Cloud Connectivity Options." AWS, January 2018. Web.
"What Is the Hub and Spoke Information Sharing Model?" Cyware, 16 Aug. 2021. Web.
Youseff, Lamia. "Mesh and Hub-and-Spoke Networks on Azure." Microsoft, Dec. 2017. Web.

Prepare for the Upgrade to Windows 11

The upgrade is inevitable, but you have time, and you have options.

Analyst Perspective

Upgrading to Windows 11 is easy, and while it should be properly investigated and planned, it should absolutely be an activity you undertake.

“You hear that Mr. Anderson? That is the sound of inevitability.” ("The Matrix Quotes" )

The fictitious Agent Smith uttered those words to Keanu Reeves’ character, Neo, in The Matrix in 1999, and while Agent Smith was using them in a very sinister and figurative context, the words could just as easily be applied to the concept of upgrading to the Windows 11 operating system from Microsoft in 2022.

There have been two common, recurring themes in the media since late 2019. One is the global pandemic and the other is cyber-related crime. Microsoft is not in a position to make an impact on a novel coronavirus, but it does have the global market reach to influence end-user technology and it appears that it has done just that. Windows 11 is a step forward in endpoint security and functionality. It also solidifies the foundation for future innovations in end-user operating systems and how they are delivered. Windows-as-a-Service (WAAS) is the way forward for Microsoft. Windows 10 is living on borrowed time, with a defined end of support date of October 14, 2025. Upgrading to Windows 11 is easy, and while it should be properly investigated and planned, it should absolutely be an activity you undertake.

It is inevitable!

P.J. Ryan

Research Director, Infrastructure & Operations

Info-Tech Research Group

Executive Summary

Your Challenge

• Windows 10 is going EOL in 2025. That is closer than you think.
• Many of your endpoints are not eligible for the Windows 11 upgrade. You can’t afford to replace all your endpoints this year. How do you manage this Microsoft-initiated catastrophe?
• You want to stay close to the leading edge of technology and services, but how do you do that while keeping your spending in check and within budget?

Common Obstacles

• The difference between Windows 10 and Windows 11 is not clear. Windows 11 looks like Windows 10 with some minor changes, mostly cosmetic. Many online users don’t see the need. Why upgrade? What are the benefits?
• The cost of upgrading devices just to be eligible for Windows 11 is high.
• Your end users don’t like change. This is not going to go over well!

Info-Tech's Approach

• Spend wisely. Space out your endpoint replacements and upgrades over several years. You do not have to upgrade everything right away.
• Be patient. Windows 11 contained some bugs when it was initially released. Microsoft fixed most of the issues through monthly quality updates, but you should ensure that you are comfortable with the current level of functionality before you upgrade.
• Use the upgrade ring approach. Test your applications with a small group first, and then stage the rollout to increasingly larger groups over time.

Info-Tech Insight

There is a lot of talk about Windows 11, but this is only an operating system upgrade, and it is not a major one. Understand what is new, what is added, and what is missing. Check your devices to determine how many are eligible and ineligible. Many organizations will have to spend capital on endpoint upgrades. Solid asset management practices will help.

Insight summary

Windows 11 is a step forward in security, which is one of the primary reasons for the release of the new operating system.

Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

The hardware requirements for Windows 11 enable security features such as password-less logon, disk encryption, increased startup protection with secure boot, and virtualization-based security.

Many organizations will have to spend capital on endpoint upgrades.

Microsoft now insists that modern hardware is required for Windows 11 for not only security but also for improved stability. That same hardware requirement will mean that many devices that are only three or four years old (as well as older ones) may not be eligible for Windows 11.

Windows 11 is a virtualization challenge for some providers.

The hardware requirements for physical devices are also required for virtual devices. The TPM module appears to be the biggest challenge. Oracle VirtualBox and Citrix Hypervisor as well as AWS and Google are unable to support Windows 11 virtual devices as of the time of writing.

Windows 10 will be supported by Microsoft until October 2025.

That will remove some of the pressure felt due to the ineligibility of many devices and the need to refresh them. Take your time and plan it out, keeping within budget constraints. Use the upgrade ring approach for systems that are eligible for the Windows 11 upgrade.

New look and feel, and a center screen taskbar.

Corners are rounded, some controls look a little different, but overall Windows 11 is not a dramatic shift from Windows 10. It is easier to navigate and find features. Oh, and yes, the taskbar (and start button) is shifted to the center of the screen, but you can move them back to the left if desired.

The education industry gets extra attention with the release of Windows 11.

Windows 11 comes with multiple subscription-based education offerings, but it also now includes a new lightweight SE edition that is intended for the K-8 age group. Microsoft also released a Windows 11 Education SE specific laptop, at a very attractive price point. Other manufacturers also offer Windows 11 SE focused devices.

Why Windows 11?

Windows 10 was supposed to be the final desktop OS from Microsoft, wasn’t it?

Maybe. It depends who you ask.

Jerry Nixon, a Microsoft developer evangelist, gained notoriety when he uttered these words while at a Microsoft presentation as part of Microsoft Ignite in 2015: “Right now we’re releasing Windows 10, and because Windows 10 is the last version of Windows, we’re all still working on Windows 10,” (Hachman). Microsoft never officially made that statement. Interestingly enough, it never denied the comments made by Jerry Nixon either.

Perhaps Microsoft released a new operating system as a financial grab, a way to make significant revenue?

Nope.

Windows 11 is a free upgrade or is included with any new computer purchase.

Market share challenges?

Doubtful.

It’s true that Microsoft's market share of desktop operating systems is dropping while Apple OS X and Google Chrome OS are rising.

In fact, Microsoft has relinquished over 13% of the market share since 2012 and Apple has almost doubled its market share. BUT:

Microsoft is still holding 75.12% of the market while Apple is in the number 2 spot with 14.93% (gs.statcounter.com).

The market share is worth noting for Microsoft but it hardly warrants a new operating system.

New look and feel?

Unlikely

New start button and taskbar orientation, new search window, rounded corners, new visual look on some controls like the volume bar, new startup sound, new Windows logo, – all minor changes. Updates could achieve the same result.

Security?

Likely the main reason.

Windows 11 comes with a list of hardware requirements that enable the use of tools and features that, when combined, will reduce malware infections.

The hardware requirements for Windows 11 enable security features such as password-less logon, disk encryption, increased startup protection with secure boot, and virtualization-based security.

The features are available on all Windows 11 physical devices, due to the common hardware requirements.

Windows 11 hardware-based security

These hardware options and features were available in Windows 10 but not enforced. With Windows 11, they are no longer optional. Below is a description and explanation of the main features.

How do all the hardware-based security features work?

This scenario explains how a standard boot up and login should happen.

You turn on your computer. Secure Boot authorizes the processes and UEFI hands over control to the operating system. Windows Hello works with TPM and uses a pin to authenticate the user and the operating systems gives you access to the Windows environment.

Now imagine the same process with various compromised scenarios.

You turn on your computer. Secure Boot does not recognize the signature presented to it by the second process in the boot sequence. You will be presented with a “Secure Boot Violation” message and an option to reboot. Your computer remains protected.

You boot up and get past the secure boot process and UEFI passes control over to the Windows 11 operating system. Windows Hello asks for your pin, but you cannot remember the pin and incorrectly enter it three times before admitting temporary defeat. Windows Hello did not find a matching pin on the TPM and will not let you proceed. You cannot log in but in the eyes of the operating system, it has prevented an unauthorized login attempt.

You power up your computer, log in without issue, and go about your morning routine of checking email, etc. You are not aware that malware has infiltrated your system and modified a page in system memory to run code and access the operating system kernel. VBS and HVCI check the integrity of that code and detect that it is malicious. The code remains isolated and prevented from running, protecting your system.

TPM, Hello, UEFI with Secure Boot, VBS and HVCI all work together like a well-oiled machine.

“Microsoft's rationale for Windows 11's strict official support requirements – including Secure Boot, a TPM 2.0 module, and virtualization support – has always been centered on security rather than raw performance.” – Andrew Cunningham, arstechnica.com

“Windows 11 raises the bar for security by requiring hardware that can enable protections like Windows Hello, Device Encryption, virtualization-based security (VBS), hypervisor-protected code integrity (HVCI), and Secure Boot. These features in combination have been shown to reduce malware by 60% on tested devices.” – Steven J. Vaughan-Nichols, Computerworld

Can any device upgrade to Windows 11?

In addition to the security-related hardware requirements listed previously, which may exclude some devices from Windows 11 eligibility, Windows 11 also has a minimum requirement for other hardware components.

Windows 7 and Windows 10 were publicized as being backward compatible and almost any hardware would be able to run those operating systems. That changed with Windows 11. Microsoft now insists that modern hardware is required for Windows 11 for not only security but also improved stability.

Software Requirement

You must be running Windows 10 version 2004 or greater to be eligible for a Windows 11 upgrade (“Windows 11 Requirements”).

Complete hardware requirements for Windows 11

• 1 GHz (or faster) compatible 64-bit processor with two or more cores
  • Not all processors are compatible; compatible processors are listed in this link: “Windows Processor Requirements”
• 4 GB RAM
• 64 GB or more of storage space
• Compatible with DirectX 12 or later with WDDM 2.0 driver
  • DirectX connects the hardware in your computer with Windows. It allows software to display graphics using the video card or play audio, as long as that software is DirectX compatible. Windows 11 requires version 12 (“What are DirectX 12 compatible graphics”).
  • WDDM is an acronym for Windows Display Driver Model. WDDM is the architecture for the graphics driver for Windows (“Windows Display Driver Model”).
  • Version 2.0 of WDDM is required for Windows 11.
• 720p display greater than 9" diagonally with 8 bits per color channel
• UEFI Secure Boot capable
• TPM 2.0 chip

(“Windows 11 Requirements”)

Windows 11 may challenge your virtual environment

When Windows 11 was initially released, some IT administrators experienced issues when trying to install or upgrade to Windows 11 in the virtual world.

The Challenge

The issues appeared to be centered around the Windows 11 hardware requirements, which must be detected by the Windows 11 pre-install check before the operating system will install.

The TPM 2.0 chip requirement was indeed a challenge and not offered as a configuration option with Citrix Hypervisor, the free VMware Workstation Player or Oracle VM VirtualBox when Windows 11 was released in October 2021, although it is on the roadmap for Oracle and Citrix Hypervisor. VMware provides alternative products to the free Workstation Player that do support a virtual TPM. Oracle and Citrix reported that the feature would be available in the future and Windows 11 would work on their platforms.

Short-Term Solutions

VMware and Microsoft users can add a vTPM hardware type when configuring a virtual Windows 11 machine. Microsoft Azure does offer Windows 11 as an option as a virtual desktop. Citrix Desktop-As-A-Service (DAAS) will connect to Azure, AWS, or Google Cloud and is only limited by the features of the hosting cloud service provider.

Additional Insight

According to Microsoft, any VM running Windows 11 must meet the following requirements (“Virtual Machine Support”):

• It must be a generation 2 VM, and upgrading a generation 1 VM to Windows 11 (in-place) is not possible
• 64 GB of storage or greater
• Secure Boot capable with the virtual TPM enabled
• 4 GB of memory or greater
• 2 or more virtual processors
• The CPU of the physical computer that is hosting the VM must meet the Windows 11 (“Windows Processor Requirements”)

What’s new or updated in Windows 11?

The following two slides highlight some of the new and updated features in Windows 11.

Security

The most important change with Windows 11 is what you cannot see – the security. Windows 11 adds requirements and controls to make the user and device more secure, as described in previous slides.

Taskbar

The most prominent change in relation to the look and feel of Windows 11 is the shifting of the taskbar (and Start button) to the center of the screen. Some users may find this more convenient but if you do not and prefer the taskbar and start button back on the left of your screen, you can change it in taskbar settings.

Updated Apps

Paint, Photos, Notepad, Media Player, Mail, and other standard Windows apps have been updated with a new look and in some cases minor enhancements.

User Interface

The first change users will notice after logging in to Windows 11 is the new user interface – the look and feel. You may not notice the additional colors added to the Windows palette, but you may have thought that the startup sound was different, and the logo also looks different. You would be correct. Other look-and-feel items that changed include the rounded corners on windows, slightly different icons, new wallpapers, and controls for volume and brightness are now a slide bar. File explorer and the settings app also have a new look.

Microsoft Teams

Microsoft Teams is now installed on the taskbar by default. Note that this is for a personal Microsoft account only. Teams for Work or School will have to be installed separately if you are using a work or school account.

What’s new or updated in Windows 11?

Snap Layouts

Snap layouts have been enhanced and snap group functionality has been added. This will allow you to quickly snap one window to the side of the screen and open other Windows in the other side. This feature can be accessed by dragging the window you wish to snap to the left or right edge of the screen. The window should then automatically resize to occupy that half of the screen and allow you to select other Windows that are already open to occupy the remaining space on the screen. You can also hover your mouse over the maximize button in the upper right-hand corner of the window. A small screen with multiple snap layouts will appear for your selection. Multiple snapped Windows can be saved as a “Snap Group” that will open together if one of the group windows are snapped in the future.

Widgets

Widgets are expanding. Microsoft started the re-introduction of widgets in Windows 10, specifically focusing on the weather. Widgets now include other services such as news, sports, stock prices, and others.

Android Apps

Android apps can now run in Windows 11. You will have to use the Amazon store to access and install Android apps, but if it is available in the Amazon store, you can install it on Windows 11.

Docking

Docking has improved with Windows 11. Windows knows when you are docked and will minimize apps when you undock so they are not lost. They will appear automatically when you dock again.

This is not intended to be an inclusive list but does cover some of the more prominent features.

What’s missing from Windows 11?

The following features are no longer found in Windows 11:

• Backward compatibility
  • The introduction of the hardware requirements for Windows 11 removed the backward compatibility (from a hardware perspective) that made the transition from previous versions of Windows to their successor less of a hardware concern. If a computer could run Windows 7, then it could also run Windows 10. That does not automatically mean it can also run Windows 11.
• Internet Explorer
  • Internet Explorer is no longer installed by default in Windows 11. Microsoft Edge is now the default browser for Windows. Other browsers can also be installed if preferred.
• Tablet mode
  • Windows 11 does not have a "tablet" mode, but the operating system will maximize the active window and add more space between icons to make selecting them easier if the 2-in-1 hardware detects that you wish to use the device as a tablet (keyboard detached or device opened up beyond 180 degrees, etc.).
• Semi-annual updates
  • It may take six months or more to realize that semi-annual feature updates are missing. Microsoft moved to an annual feature update schema but continued with monthly quality updates with Windows 11.
• Specific apps
  • Several applications have been removed (but can be manually added from the Microsoft Store by the user). They include:
    • OneNote for Windows 10
    • 3D Viewer
    • Paint 3D
    • Skype
• Cortana (by default)
  • Cortana is missing from Windows 11. It is installed but not enabled by default. Users can turn it on if desired.

Microsoft included a complete list of features that have been removed or deprecated with Windows 11, which can be found here Windows 11 Specs and System Requirements.

Windows 11 editions

• Windows 11 is offered in several editions:
  • Windows 11 Home
  • Windows 11 Pro
  • Windows 11 Pro for Workstations
  • Windows 11 Enterprise Windows 11 for Education
  • Windows 11 SE for Education
• Windows 11 hardware requirements and security features are common throughout all editions.
• The new look and feel along with all the features mentioned previously are common to all editions as well.
• Windows Home
  • Standard offering for home users
• Pro versus Pro for Workstations
  • Windows 11 Pro and Pro for Workstations are both well suited for the business environment with available features such as support for Active Directory or Azure Active Directory, Windows Autopilot, OneDrive for Business, etc.
  • Windows Pro for Workstations is designed for increased demands on the hardware with the higher memory limits (2 TB vs. 6 TB) and processor count (2 CPU vs. 4 CPU).
  • Windows Pro for Workstations also features Resilient File System, Persistent Memory, and SMB Direct. Neither of these features are available in the Windows 11 Pro edition.
  • Windows 11 Pro and Pro for Workstations are both very business focused, although Pro may also be a common choice for non-business users (Home and Education).
• Enterprise Offerings
  • Enterprise licenses are subscription based and are part of the Microsoft 365 suite of offerings.
  • Windows 11 Enterprise is Windows 11 Pro with some additional addons and functionality in areas such as device management, collaboration, and security services.
  • The level of the Microsoft 365 Enterprise subscription (E3 or E5) would dictate the additional features and functionality, such as the complete Microsoft Defender for Endpoint suite or the Microsoft phone system and Audio Conferencing, which are only available with the E5 subscription.

Windows 11 Education Editions

With the release of a laptop targeted specifically at the education market, Microsoft must be taking notice of the Google Chrome educational market penetration, especially with headlines like these.

“40 Million Chromebooks in Use in Education” (Thurrott)

“The Unprecedented Growth of the Chromebook Education Market Share” (Carklin)

“Chromebooks Gain Market Share as Education Goes Online” (Hruska)

“Chromebooks Gain Share of Education Market Despite Shortages” (Mandaro)

“Chromebook sales skyrocketed in Q3 2020 with online education fueling demand” (Duke)

• Education licenses are subscription based and are part of the Microsoft 365 suite of offerings. Educational pricing is one benefit of the Microsoft 365 Education model.
• Windows 11 Education is Windows 11 Pro with some additional addons and functionality similar to the Enterprise offerings for Windows 11 in areas such as device management, collaboration, and security services. Windows 11 Education also adds some education specific settings such as Classroom Tools, which allow institutions to add new students and their devices to their own environment with fewer issues, and includes OneNote Class Notebook, Set Up School PCs app, and Take a Test app.
• The level of the Microsoft 365 Education subscription (A3 or A5) would dictate the additional features and functionality, such as the complete Microsoft Defender for Endpoint suite or the Microsoft phone system and Audio Conferencing, which are only available with the A5 subscription.
• Windows 11 SE for Education:
  • A cloud-first edition of Windows 11 specifically designed for the K-8 education market.
  • Windows 11 SE is a light version of Windows 11 that is designed to run on entry-level devices with better performance and security on that hardware.
  • Windows 11 SE requires Intune for Education and only IT admins can install applications.
• Microsoft and others have come out with Windows SE specific devices at a low price point.
  • The Microsoft Surface Laptop SE comes pre-loaded with Windows 11 SE and can be purchased for US$249.00.
  • Dell, Asus, Acer, Lenovo, and others also offer Windows 11 SE specific devices (“Devices for Education”).

Initial Reactions

Below you can find some actual initial reactions to Windows 11.

Initial reactions are mixed, as is to be expected with any new release of an operating system. The look and feel is new, but it is not a huge departure from the Windows 10 look and feel. Some new features are well received such as the snap feature.

The shift of the taskbar (and start button) is the most popular topic of discussion online when it comes to Windows 11 reactions. Some love it and some do not. The best part about the shift of the taskbar is that you can adjust it in settings and move it back to its original location.

The best thing about reactions is that they garner attention, and thanks in part to all the online reactions and comments, Microsoft is continually improving Windows 11 through quality updates and annual feature releases.

“My 91-year-old Mum has found it easy!” Binns, Paul ITRG

“It mostly looks quite nice and runs well.” Jmbpiano, Reddit user

“It makes me feel more like a Mac user.” Chang, Ben Info-Tech

“At its core, Windows 11 appears to be just Windows 10 with a fresh coat of paint splashed all over it.” Rouse, Rick RicksDailyTips.com

“Love that I can snap between different page orientations.” Roberts, Jeremy Info-Tech

“I finally feel like Microsoft is back on track again.” Jawed, Usama Neowin

“A few of the things that seemed like issues at first have either turned out not to be or have been fixed with patches.” Jmbpiano, Reddit user

“The new interface is genuinely intuitive, well-designed, and colorful.” House, Brett AnandTech

“No issues. Have it out on about 50 stations.” Sandrews1313, Reddit User

“The most striking change is to the Start menu.” Grabham, Dan pocket-lint.com

How do I upgrade to Windows 11?

The process is very similar to applying updates in Windows 10.

• Windows 11 is offered as an upgrade through the standard Windows 10 update procedure. Windows Update will notify you when the Windows 11 upgrade is ready (assuming your device is eligible for Windows 11).
  • Allow the update (upgrade in this case) to proceed, reboot, and your endpoint will come back to life with Windows 11 installed and ready for you.
• A fresh install can be delivered by downloading the required Windows 11 installation media from the Microsoft Software Download site for Windows 11.
• Business users can control the timing and schedule of the Windows 11 rollout to corporate endpoints using Microsoft solutions such as WSUS, Configuration Manager, Intune and Endpoint Manager, or by using other endpoint management solutions.
• WSUS and Configuration Manager will have to sync the product category for Windows 11 to manage the deployment.
• Windows Update for Business policies will have to use the target version capability rather than using the feature update referrals alone.
• Organizations using Intune and a Microsoft 365 E3 license will be able to use the Feature Update Deployments page to select Windows 11.
• Other modern endpoint management solutions may also allow for a controlled deployment.

Info-Tech Insight

The upgrade itself may be a simple process but be prepared for the end-user reactions that will follow. Some will love it but others will despise it. It is not an optional upgrade in the long run, so everyone will have to learn to accept it.

When can I upgrade to Windows 11?

You can upgrade right now BUT there is no need to rush. Windows 11 was released in October 2021 but that doesn’t mean you have to upgrade everyone right away. Plan this out.

• Build deployment rings into your Windows 11 upgrade approach: This approach, also referred to as Canary Releases or deployment rings, allows you to ensure that IT can support users if there's a major problem with the upgrade. Instead of disrupting all end users, you are only disrupting a portion of end users.
  • Deploy the initial update to your test environment.
  • After testing is successful or changes have been made, deploy Windows 11 to your pilot group of users.
  • After the pilot group gives you the thumbs up, deploy to the rest of production in phases. Phases are sometimes by office/location, sometimes by department, sometimes by persona (i.e. defer people that don't handle updates well), and usually by a combination of these factors.
  • Increase the size of each ring as you progress.
• Always back up your data before any upgrade.

Deployment Ring Example

Pilot Ring - Individuals from all departments - 10 users

Ring #1 - Dev, Finance - 20 Users

Ring #2 - Research - 100 Users

Ring #3 - Sales, IT, Marketing - 500 Users

Upgrade your eligible devices and users to Windows 11

Build Windows 11 Deployment Rings

Instructions:

1. Identify who will be in the pilot group. Use individuals instead of user groups.
2. Identify how many standard rings you need. This number will be based on the total number of employees per office.
3. Map groups to rings. Define which user groups will be in each ring.
4. Allow some time to elapse between upgrades. Allow the first group to work with Windows 11 and identify any potential issues that may arise before upgrading the next group.
5. Track and communicate. Record all information into a spreadsheet like the one on the right. This will aid in communication and tracking.

What are my options if my devices cannot upgrade to Windows 11?

Don’t rush out to replace all the ineligible endpoint devices. You have some time to plan this out. Windows 10 will be available and supported by Microsoft until October 2025.

Use asset management strategies and budget techniques in your Windows 11 upgrade approach:

• Start with current inventory and determine which devices will not be eligible for upgrade to Windows 11.
• Prioritize the devices for replacement, taking device age, the role of the user the device supports, and delivery times for remote users into consideration.
• Take this opportunity to review overall device offerings and end-user compute strategy. This will help decide which devices to offer going forward while improving end-user satisfaction.
• Determine the cost for replacement devices:
  • Compare vendor offerings using an RFP process.
• Use the hardware asset management planning spreadsheet on the next slide to budget for the replacements over the coming months leading up to October 2025.

Leverage Info-Tech research to improve your end-user computing strategy and hardware asset management processes:

New to End User Computing Strategies? Start with Modernize and Transform Your End-User Computing Strategy.

New to IT asset management? Use Info-Tech’s Implement Hardware Asset Management blueprint.

Use Info-Tech’s HAM Budgeting Tool to plan your hardware asset budget

Build a Windows 11 Device Replacement Budget

The link below will open up a hardware asset management (HAM) budgeting tool. This tool can easily be modified to assist in developing and justifying the budget for hardware assets for the Windows 11 project. The tool will allow you to budget for hardware asset refresh and to adjust the budget as needed to accommodate any changes. Follow the instructions on each tab to complete the tool.

A sample of a possible Windows 11 budgeting spreadsheet is shown on the right, but feel free to play with the HAM budgeting tool to fit your needs.

HAM Budgeting Tool

Related Info-Tech Research

Modernize and Transform Your End-User Computing Strategy

This project helps support the workforce of the future by answering the following questions: What types of computing devices, provisioning models, and operating systems should be offered to end users? How will IT support devices? What are the policies and governance surrounding how devices are used? What actions are we taking and when? How do end-user devices support larger corporate priorities and strategies?

Implement Hardware Asset Management

This project will help you analyze the current state of your HAM program, define assets that will need to be managed, and build and involve the ITAM team from the beginning to help embed the change. It will also help you define standard policies, processes, and procedures for each stage of the hardware asset lifecycle, from procurement through to disposal.

Bibliography

aczechowski, et al. “Windows 11 Requirements.” Microsoft, 3 June 2022. Accessed 13 June 2022.

Binns, Paul. Personal interview. 07 June 2022.

Butler, Sydney. “What Is Trusted Platform Module (TPM) and How Does It Work?” Help Desk Geek, 5 August 2021. Accessed 18 May 2022.

Carklin, Nicolette. “The Unprecedented Growth of the Chromebook Education Market Share.” Parallels International GmbH, 26 October 2021. Accessed 19 May 2022.

Chang, Ben. Personal interview. 26 May 2022.

Cunningham, Andrew. “Why Windows 11 has such strict hardware requirements, according to Microsoft.” Ars Technica, 27 August 2021. Accessed 19 May 2022.

Dealnd-Han, et al. “Windows Processor Requirements.” Microsoft, 9 May 2022. Accessed 18 May 2022.

“Desktop Operating Systems Market Share Worldwide.” Statcounter Globalstats, June 2021–June 2022. Accessed 17 May 2022.

“Devices for education.” Microsoft, 2022. Accessed 13 June 2022.

Duke, Kent. “Chromebook sales skyrocketed in Q3 2020 with online education fueling demand.” Android Police, 16 November 2020. Accessed 18 May 2022.

Grabham, Dan. “Windows 11 first impressions: Our initial thoughts on using Microsoft's new OS.” Pocket-Lint, 24 June 2021. Accessed 3 June 2022.

Hachman, Mark. “Why is there a Windows 11 if Windows 10 is the last Windows?” PCWorld, 18 June 2021. Accessed 17 May 2022.

Howse, Brett. “What to Expect with Windows 11: A Day One Hands-On.” Anandtech, 16 November 2020. Accessed 3 June 2022.

Hruska, Joel. “Chromebooks Gain Market Share as Education Goes Online.” Extremetech, 26 October 2020. Accessed 19 May 2022.

Jawed, Usama. “I am finally excited about Windows 11 again.” Neowin, 26 February 2022. Accessed 3 June 2022.

Jmbpiano. “Windows 11 - What are our initial thoughts and feelings?” Reddit, 22 November 2021. Accessed 3 June 2022.

Lumunge, Erick. “UEFI and Legacy boot.” OpenGenus, n.d. Accessed 18 May 2022.

Bibliography

Mandaro, Laura. “Chromebooks Gain Share of Education Market Despite Shortages.” The Information, 9 September 2020. Accessed 19 May 2022.

Murtaza, Fawad. “What Is Virtualization Based Security in Windows?” Valnet Inc, 24 October 2021. Accessed 17 May 2022.

Roberts, Jeremy. Personal interview. 27 May 2022.

Rouse, Rick. “My initial thoughts about Windows 11 (likes and dislikes).” RicksDailyTips.com, 5 September 2021. Accessed 3 June 2022.

Sandrews1313. “Windows 11 - What are our initial thoughts and feelings?” Reddit, 22 November 2021. Accessed 3 June 2022.

“The Matrix Quotes." Quotes.net, n.d. Accessed 18 May 2022.

Thurrott, Paul.” Google: 40 Million Chromebooks in Use in Education.” Thurrott, 21 January 2020. Accessed 18 May 2022.

Vaughan-Nichols, Steven J. “The real reason for Windows 11.” Computerworld, 6 July 2021, Accessed 19 May 2022.

“Virtual Machine Support.” Microsoft,3 June 2022. Accessed 13 June 2022.

“What are DirectX 12 compatible graphics and WDDM 2.x.” Wisecleaner, 20 August 2021. Accessed 19 May 2022.

“Windows 11 Specs and System Requirements.” Microsoft, 2022. Accessed 13 June 2022.

“Windows Display Driver Model.” MiniTool, n.d. Accessed 13 June 2022.

Build a Value Measurement Framework

Focus product delivery on business value–driven outcomes.

ANALYST PERSPECTIVE

"A meaningful measurable definition of value is the key to effectively managing the intake, prioritization, and delivery of technology-enabled products and services."

Cole Cioran,

Senior Director, Research – Application Development and Portfolio Management

Info-Tech Research Group

Our understanding of the problem

This Research Is Designed For:

• CIOs who need to understand the value IT creates
• Application leaders who need to make good decisions on what work to prioritize and deliver
• Application and project portfolio managers who need to ensure the portfolio creates business value
• Product owners who are accountable for delivering value

This Research Will Help You:

• Define quality in your organization’s context from both business and IT perspectives.
• Define a repeatable process to understand the value of a product, application, project, initiative, or enhancement.
• Define value sources and metrics.
• Create a tool to make it easier to balance different sources of value.

This Research Will Also Assist:

• Product and application delivery teams who want to make better decisions about what they deliver
• Business analysts who need to make better decisions about how to prioritize their requirements

This Research Will Help Them:

• Create a meaningful relationship with business partners around what creates value for the organization.
• Enable better understanding of your customers and their needs.

Executive summary

Situation

• Measuring the business value provided by IT is critical for improving the relationship between business and IT.
• Rapid changes in today’s market require rapid, value-based decisions.
• Every organization has unique drivers that make it difficult to see the benefits based on time and impact approaches to prioritization.

Complication

• An organization’s lack of a shared definition of value leads to politics and decision making that does not have a firm, quantitative basis.
• Different parts of an organization have different value drivers that must be given balanced consideration.
• Focusing solely on revenue does not necessarily result in the right outcomes.

Resolution

• Standardize your definition of business value. Work with your business partners to define the different sources of business value that are created through technology-enabled products and services.
• Weigh your value drivers. Ensure business and IT understand the relative weight and priority of the different sources of business value you have identified.
• Use a balanced scorecard to understand value. Use the different value drivers to understand and prioritize different products, applications, projects, initiatives, and enhancements.

Info-Tech Insight

1. Business is the authority on business value. While IT can identify some sources of value, business stakeholders must participate in the creation of a definition that is meaningful to the whole organization.
2. It’s about more than profit. Organizations must have a definition that encompasses all of the sources of value, or they risk making short-term decisions with long-term negative impacts.
3. Technology creates business value. Treating IT as a cost center makes for short-sighted decisions in a world where every business process is enabled by technology.

Software is not currently creating the right outcomes

Software products are taking more and more out of IT budgets.

38% of spend on IT employees goes to software roles.

Source: Info-Tech’s Staffing Survey

18% of opex is spent on software licenses.

Source: SoftwareReviews.com

33% of capex is spent on new software.

However, the reception and value of software products do not justify the money invested.

Only 34% of software is rated as both important and effective by users.

Source: Info-Tech’s CIO Business Vision

IT benchmarks do not help or matter to the business. Focus on the metrics that represent business outcomes.

IT departments have a tendency to measure only their own role-based activities and deliverables, which only prove useful for selling practice improvement services. Technology doesn’t exist for technology's sake. It’s in place to generate specific outcomes. IT and the business need to be aligned toward a common goal of enabling business outcomes, and that’s the important measurement.

"In today’s connected world, IT and business must not speak different languages. "

– Cognizant, 2017

CxOs stress the importance of value as the most critical area for IT to improve reporting

N=469 CxOs from Info-Tech’s CEO/CIO Alignment Diagnostic

Key stakeholders want to know how you and your products or services help them realize their goals.

While the basics of value are clear, few take the time to reach a common definition and means to measure and apply value

Often, IT misses the opportunity to become a strategic partner because it doesn’t understand how to communicate and measure its value to the business.

"Price is what you pay. Value is what you get."

– Warren Buffett

Being able to understand the value context will allow IT to articulate where IT spend supports business value and how it enables business goal achievement.

Value is...

Derived from business context

Enabled through governance and strategy

The underlying context for decision making

A measure of achievement

Determine your business context by assessing the goals and defining the unique value drivers in your organization

Competent organizations know that value cannot always be represented by revenue or reduced expenses. However, it is not always apparent how to envision the full spectrum of sources of value. Dissecting value by the benefit type and the value source’s orientation allows you to see the many ways in which a product or service brings value to the organization.

Financial Benefits vs. Improved Capabilities

Inward vs. Outward Orientation

Inward refers to value sources that have an internal impact and improve your organization’s effectiveness and efficiency in performing its operations.Outward refers to value sources that come from your interaction with external factors, such as the market or your customers.

See your strategy through by involving both IT and the business

Buy-in for your IT strategy comes from the ability to showcase value. IT needs to ensure it has an aligned understanding of what is valuable to the organization.

Business value needs to first be established by the business. After that, IT can build a partnership with the business to determine what that value means in the context of IT products and services.

Measure your product or services with Info-Tech’s Value Measurement Framework (VMF) and value scores

The VMF provides a consistent and less subjective approach to generating a value score for an application, product, service, or individual feature, by using business-defined value drivers and product-specific value metrics.

A consistent set of established value drivers, sources, and metrics gives more accurate comparisons of relative value

A balanced and weighted scorecard allows you to measure the various ways products generate value to the business

The Info-Tech approach to measuring value applies the balanced value scorecard approach.

Value Score1 + VS2 + … + VSN = Overall Balance Value Score

Value scores help support decisions. This blueprint looks specifically at four use cases for value scores.

A value score is an input to the following activities:

1. Prioritize Your Product Backlog

Estimate the relative value of different product backlog items (i.e. epics, features, etc.) to ensure the highest value items are completed first.

This blueprint can be used as an input into Info-Tech’s Build a Better Backlog.

2. Prioritize Your Project Backlog

Estimate the relative value of proposed new applications or major changes or enhancements to existing applications to ensure the right projects are selected and completed first.

This blueprint can be used as an input into Info-Tech’s Optimize Project Intake, Approval, and Prioritization.

3. Rationalize Your Applications

Gauge the relative value from the current use of your applications to support strategic decision making such as retirement, consolidation, and further investments.

This blueprint can be used as an input into Info-Tech’s Visualize Your Application Portfolio Strategy With a Business Value-Driven Roadmap.

4. Categorize Application Tiers

Gauge the relative value of your existing applications to distinguish your most to least important systems and build tailored support structures that limit the downtime of key value sources.

This blueprint can be used as an input into Info-Tech’s Streamline Application Maintenance.

The priorities, metrics, and a common understanding of value in your VMF carry over to many other Info-Tech blueprints

Transition to Product Delivery

Build a Product Roadmap

Modernize Your SDLC

Build a Strong Foundation for Quality

Implement Agile Practices That Work

Use Info-Tech’s Value Calculator

The Value Calculator facilitates the activities surrounding defining and measuring the business value of your products and services.

Use this tool to:

• Weigh the importance of each Value Driver based on established organizational priorities.
• Create a repository for Value Sources to provide consistency throughout each measurement.
• Produce an Overall Balanced Value Score for a specific item.

Info-Tech Deliverable

Populate the Value Calculator as you complete the activities and steps on the following slides.

Limitations of the Value Measurement Framework

"All models are wrong, but some are useful."

– George E.P. Box, 1979

Value is tricky: Value can be intangible, ambiguous, and cause all sorts of confusion, with the multiple, and often conflicting, priorities any organization is sure to have. You won’t likely come to a unified understanding of value or an agreement on whether one thing is more valuable than something else. However, this doesn’t mean you shouldn’t try. The VMF provides a means to organize various priorities in a meaningful way and to assess the relative value of a product or service to guide managers and decision makers on the right track and keep alignment with the rest of the organization.

Relative value vs. ROI: This assessment produces a score to determine the value of a product or service relative to other products or services. Its primary function is to prioritize similar items (projects, epics, requirements, etc.) as opposed to producing a monetary value that can directly justify cost and make the case for a positive ROI.

Apply caution with metrics: We live in a metric-crazed era, where everything is believed to be measurable. While there is little debate over recent advances in data, analytics, and our ability to trace business activity, some goals are still quite intangible, and managers stumble trying to link these goals to a quantifiable data source.

In applying the VMF Info-Tech urges you to remember that metrics are not a magical solution. They should be treated as a tool in your toolbox and are sometimes no more than a rough gauge of performance. Carefully assign metrics to your products and services and do not disregard the informed subjective perspective when SMART metrics are unavailable.

"One of the deadly diseases of management is running a company on visible figures alone."

– William Edwards Deming, 1982

Info-Tech’s Build a Value Measurement Framework glossary of terms

This blueprint discusses value in a variety of ways. Use our glossary of terms to understand our specific focus.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostics and consistent frameworks used throughout all four options

Build a Value Measurement Framework – project overview

Phase 1

Define Your Value Drivers

First determine your value drivers and add them to your VMF

One of the main aspects of the VMF is to apply consistent and business-aligned weights to the products or services you will evaluate.

This is why we establish your value drivers first:

• Get the right executive-level “value authorities” to establish the overarching weights.
• Build these into the backbone of the VMF to consistently apply to all your future measurements.

Step 1.1: Identify Value Authorities

Phase 1

1.1: Identify Value Authorities

1.2: Define Value Drivers

Phase 2

2.1: Identify Product or Service SMEs

2.2: Measure Value

This step will walk you through the following activities:

• Identify your authorities on business value.

This step involves the following participants:

• Owners of your value measurement framework

Outcomes of this step

• Your list of targeted individuals to include in Step 2.1

Business value is best defined and measured by the combined effort and perspective of both IT and the business

Buy-in for your IT strategy comes from the ability to showcase value. IT needs to ensure it has an aligned understanding of what is valuable to the organization. First, priorities need to be established by the business. Second, IT can build a partnership with the business to determine what that value means in the context of IT products and services.

Engage key stakeholders to reach a consensus on organizational priorities and value drivers

Engage these key players to create your value drivers:

CEO: Who better holds the vision or mandate of the organization than its leader? Ideally, they are front and center for this discussion.

CIO: IT must ensure that technical/practical considerations are taken into account when determining value.

CFO: The CFO or designated representative will ensure that estimated costs and benefits can be used to manage the budgets.

VPs: Application delivery and mgmt. is designed to generate value for the business. Senior management from business units must help define what that value is.

Evaluators (PMO, PO, APM, etc.): Those primarily responsible for applying the VMF should be present and active in identifying and carefully defining your organization’s value drivers.

Steering Committee: This established body, responsible for the strategic direction of the organization, is really the primary audience.

Identify your authorities of business value to identify, define, and weigh value drivers

1.1 Estimated Time: 15 minutes

The objective of this exercise is to identify key business stakeholders involved in strategic decision making at an organizational level.

1. Review your organization’s governance structure and any related materials.
2. Identify your key business stakeholders. These individuals are the critical business strategic partners.
1. Target those who represent the business at an organizational level and often comprise the organization’s governing bodies.
2. Prioritize a product backlog – include product owners and product managers who are in tune with the specific value drivers of the product in question.

INFO-TECH TIP

If your organization does not have a formal governance structure, your stakeholders would be the key players in devising business strategy. For example:

• CEO
• CFO
• BRMs
• VPs

Leverage your organizational chart, governing charter, and senior management knowledge to better identify key stakeholders.

INPUT

• Key decision maker roles

OUTPUT

• Targeted individuals to define and weigh value drivers

Materials

• N/A

Participants

• Owner of the value measurement framework

Step 1.2: Define Value Drivers

Phase 1

1.1: Identify Value Authorities

1.2: Define Value Drivers

Phase 2

2.1: Identify Product or Service SMEs

2.2: Measure Value

This step will walk you through the following activities:

• Define your value drivers.
• Weigh your value drivers.

This step involves the following participants:

• Owners of your value measurement framework
• Authorities of business value

Outcomes of this step

• A list of your defined and weighted value drivers

Value is based on business needs and vision

Value is subjective. It is defined through the organization’s past achievement and its future objectives.

There must be a consensus view of what is valuable within the organization, and these values need to be shared across the enterprise. Instead of maintaining siloed views and fighting for priorities, all departments must have the same value and purpose in mind. These factors – purpose and mission, past achievement and current state, vision and future state, and culture and leadership – impact what is valuable to the organization.

Value derives from the mission and vision of an organization; therefore, value is unique to each organization

Business value represents what the business needs to do to achieve its target state. Establishing the mission and vision helps identify that target state.

Understand the many types of value your products or services produce

Competent organizations know that value cannot always be represented by revenue or reduced expenses. However, it is not always apparent how to envision the full spectrum of value sources. Dissecting value by the benefit type and the value source’s orientation allows you to see the many ways in which a product or service brings value to the organization.

Financial Benefits vs. Improved Capabilities

Financial Benefits refers to the degree to which the value source can be measured through monetary metrics and is often quite tangible. Human Benefits refers to how a product or service can deliver value through a user’s experience.

Inward vs. Outward Orientation

Inward refers to value sources that have an internal impact and improve your organization’s effectiveness and efficiency in performing its operations. Outward refers to value sources that come from your interaction with external factors, such as the market or your customers.

Expand past Info-Tech’s high-level value quadrants and identify the value drivers specific to your organization

Different industries have a wide range of value drivers. Consider the difference between public and private entities with respect to generating revenue or reaching their customers or other external stakeholders. Even organizations in the same industry may have different values. For example, a mature, well-established manufacturer may view reputation and innovation as its highest-priority values, whereas a struggling manufacturer will see revenue or market share growth as its main drivers.

You do not need to dissect each quadrant into an exhaustive list of value drivers. Info-Tech recommends defining distinct value drivers only for the areas you’ve identified as critical to your organization’s core goals and objectives.

Understand value drivers that enable revenue growth

Understand value drivers that reduce costs

Understand the value drivers that enhance your services

Understand business value drivers that connect the business to your customers

Define your value drivers

1.2 Estimated Time: 1.5 hours

The objective of this exercise is to establish a common understanding of the different values of the organization.

1. Place your business value authorities at the center of this exercise.
2. Collect all the documents your organization has on the mission and vision, strategy, governance, and target state, which may be defined by enterprise architecture.
3. Identify the company mission and vision. Simply transfer the information from the mission and vision document into the appropriate spaces in the business value statement.
4. Determine the organization’s business value drivers. Use the mission and vision, as well as the information from the collected documents, to formulate your own idea of business values.
5. Use value driver template on the next slide to define the value driver, including:

• Value Driver Name
• Description
• Related Business Capabilities – If available, review business architecture materials, such as business capability maps.
• Established KPI and Targets – If available, include any organization-wide established KPIs related to your value driver. These KPIs will likely be used or influence the metrics eventually assigned to your applications.

INPUT

• Mission, vision, value statements

OUTPUT

• List and description of value drivers

Materials

• Whiteboard
• Markers

Participants

• Business value authorities
• Owner of value measurement framework

Example Value Driver

Weigh your value drivers

1.3 Estimated Time: 30 minutes

The objective of this exercise is to prioritize your value drivers based on their relative importance to the business.

1. Again, place the business value authorities at the center of this exercise.
2. In order to determine priority, divide 100% among your value drivers, allocating a percentage to each based on its relative importance to the organization.
3. Normalize those percentages on to a scale of 1 to 10, which will act as the weights for your value drivers.

INPUT

• Mission, vision, value statements

OUTPUT

• Weights for value drivers

Materials

• Whiteboard
• Markers

Participants

• Business value authorities
• Owner of value measurement framework

Weigh your value drivers

1.3 Estimated Time: 30 minutes

Carry results over to the Value Calculator

1.3

Document results of this activity in the “Value Drivers” tab of the Value Calculator.

List your value drivers.

Define or describe your value drivers.

Use this tool to create a repository for value sources to reuse and maintain consistency across your measurements.

Enter the weight of each value driver in terms of importance to the organization.

Phase 2

Measure Value

Step 2.1: Identify Product or Service SMEs

Phase 1

1.1: Identify Value Authorities

1.2: Define Value Drivers

Phase 2

2.1: Identify Product or Service SMEs

2.2: Measure Value

This step will walk you through the following activities:

• Identify your product or service SMEs.
• List your product or services items and components.

This step involves the following participants:

• Owners of your value measurement framework
• Product or service SMEs

Outcomes of this step

• Your list of targeted individuals to include in Step 2.2

Identify the products and services you are evaluating and break down their various components for the VMF

In order to get a full evaluation of a product or service you need to understand its multiple facets, functions, features capabilities, requirements, or any language you use to describe its various components.

Decompose a product or service:

• Get the right subject matter experts in place who know the business and technical aspects of the product or service.
• Decompose the product or service to capture all necessary components.

Before beginning, consider how your use case will impact your value measurement approach

This table looks at how the different use cases of the VMF call for variations of this analysis, is directed at different roles, and relies on participation from different subject matter experts to provide business context.

Identify your product or service SMEs

2.1 Estimated Time: 15 minutes

The objective of this exercise is to identify specific business stakeholders who can speak to the business outcomes of your applications at a functional level.

1. Review your related materials that reference the stakeholders for the scoped products and services (i.e. capability maps, org charts, stakeholder maps).
2. Identify your specific business stakeholders and application SMEs. These individuals represent the business at a functional level and are in tune with the business outcomes of their operations and the applications that support their operations.
1. Use Case 1 – Product Owner, Product Manager
2. Use Case 2 – Project Portfolio Manager, Project Manager, Product Owners, Business Process Owners, Appropriate Business Unit Representatives
3. Use Case 3 – Application Portfolio Manager, Product Owners, Business Analysts, Application SMEs, Business Process Owners, Appropriate Business Unit Representatives
4. Use Case 4 – Application Maintenance Manager, Operations Managers, Application Portfolio Manager, Product Owners, Application SMEs, Business Process Owners, Appropriate Business Unit Representatives

INPUT

• Specific product or service knowledge

OUTPUT

• Targeted individuals to measure specific products or services

Materials

• Whiteboard
• Markers

Participants

• Owner of value measurement framework

Use Case 1: Collect and review all of the product backlog items

Prioritizing your product backlog (epics, features, etc.) requires a consistent method of measuring the value of your product backlog items (PBIs) to continuously compare their value relative to one another. This should be treated as an ongoing initiative as new items are added and existing items change, but an initial introduction of the VMF will require you to collect and analyze all of the items in your backlog.

Regardless of producing a value score for an epic, feature, or user story, your focus should be on identifying their various value sources. Review your product’s artifact documentation, toolsets, or other information sources to extract the business outcomes, impact, benefits, KPIs, or any other description of a value source.

What’s in your backlog?

You may need to create standards for defining and measuring your different PBIs. Traceability can be critical here, as defined business outcomes for features or user stories may be documented at an epic level.

Additional Research

Build a Better Backlog helps you define and organize your product backlog items.

Use Case 2: Review the scope and requirements of the project to determine all of the business outcomes

Depending on where your project is in your intake process, there should be some degree of stated business outcomes or benefits. This may be a less refined description in the form of a project request or business case document, or it could be more defined in a project charter, business requirements document/toolset, or work breakdown structure (WBS). Regardless of the information source, to make proper use of the VMF you need a clear understanding of the various business outcomes to establish the new or improved value sources for the proposed project.

Set Metrics Early

Good project intake documentation begins the discussion of KPIs early on. This alerts teams to the intended value and gives your PMO the ability to integrate it into the workload of other proposed or approved projects.

Additional Research

Optimize Project Intake, Approval, and Prioritization provides templates to define proposed project benefits and outcomes.

Use Cases 3 & 4: Ensure you’ve listed all of each application’s uses (functions, features, capabilities, etc.) and user groups

An application can enable multiple capabilities, perform a variety of functions, and have a range of different user groups. Therefore, a single application can produce multiple value sources, which range in type, impact, and significance to the business’ overarching priorities. In order to effectively measure the overall value of an application you need to determine all of the ways in which that application is used and apply a business-downward view of your applications.

Business Capability

• Sub-capability
• Process
• Task

Application

• Module
• Feature
• Function

Aim for Business Use

Simply listing the business capabilities of an app can be too high level. Regardless of your organization’s terminology, you need to establish all of the different uses and users of an application to properly measure all of the facets of its value.

Additional Research

Discover Your Applications helps you identify and define the business use and features of your applications.

List your product or services items and components

2.2 Estimated Time: 15 minutes

The objective of this exercise is to produce a list of the different items that you are scoring and ensure you have considered all relevant components.

1. List each item you intend to produce a value score for:
1. Use Case 1 – This may be the epics in your product backlog.
2. Use Case 2 – This may be the projects in your project backlog.
3. Use Cases 3 & 4 – This may be the applications in your portfolio. For this approach Info-Tech strongly recommends iteratively assessing the portfolio to produce a list of a subset of applications.
2. For each item list its various components:
1. Use Case 1 – This may be the features or user stories of an epic.
2. Use Case 2 – This may be the business requirements of a project.
3. Use Cases 3 & 4 – This may be the modules, features, functions, capabilities, or subsystems of an application.

INPUT

• Product or service knowledge

OUTPUT

• Detailed list of items and components

Materials

• Whiteboard
• Markers

Participants

• Owner of value measurement framework
• Product or service SMEs

Use Cases 3 & 4: Create a functional view of your applications (optional)

2.3 Estimated Time: 1 hour

The objective of this exercise is to establish the different use cases of an application.

1. Recall the functional requirements and business capabilities for your applications.
2. List the various actors who will be interacting with your applications and list the consumers who will be receiving the information from the applications.
3. Based on your functional requirements, list the use cases that the actors will perform to deliver the necessary information to consumers. Each use case serves as a core function of the application. See the diagram below for an example.
4. Sometimes several use cases are completed before information is sent to consumers. Use arrows to demonstrate the flow of information from one use case to another.

Example: Ordering Products Online

INPUT

• Product or service knowledge

OUTPUT

• Product or service function

Materials

• Whiteboard
• Markers

Participants

• Application architect
• Enterprise architect
• Business and IT stakeholders
• Business analyst
• Development teams

Use Cases 3 & 4: Create a functional view of your applications (optional) (cont’d.)

2.3 Estimated Time: 1 hour

5. Align your application’s use cases to the appropriate business capabilities and stakeholder objectives.

Example:

Step 2.2: Measure Value

Phase 1

1.1: Identify Value Authorities

1.2: Define Value Drivers

Phase 2

2.1: Identify Product or Service SMEs

2.2: Measure Value

This step will walk you through the following activities:

• Identify your value sources.
• Align to a value driver.
• Assign metrics and gauge value fulfillment.

This step involves the following participants:

• Owners of your value measurement framework
• Product or service SMEs

Outcomes of this step

• An initial list of reusable value sources and metrics
• Value scores for your products or services

Use your VMF and a repeatable process to produce value scores for all of your items

With your products or services broken down, you can then determine a list of value sources, as well as their alignment to a value driver and a gauge of their value fulfillment, which in turn indicate the importance and impact of a value source respectively.

Lastly, we produce a value score for all items:

• Determine business outcomes and value sources.
• Align to the appropriate value driver.
• Use metrics as the gauge of value fulfillment.
• Collect your score.
• Repeat.

The business outcome is the impact the product or service has on the intended business activity

Business outcomes are the business-oriented results produced by organization’s capabilities and the applications that support those capabilities. The value source is, in essence, “How does the application impact the outcome?” and this can be either qualitative or quantitative.

Adapted from Agile Coach Journal.

Measure value – Identify your value sources

2.4 Estimated Time: 30 minutes

The objective of this exercise is to establish the different value sources of a product or service.

1. List the items you are producing an overall balance value score for. These can be products, services, projects, applications, product backlog items, epics, etc.
2. For each item, list its various business outcomes in the form of a description that includes:
1. The item being measured
2. Business capability or activity
3. How the item impacts said capability or activity

Consider applying the user story format for future value sources or a variation for current value sources.

As a (user), I want to (activity) so that I get (impact)

INPUT

• Product or service knowledge
• Business process knowledge

OUTPUT

• List of value sources

Materials

• Whiteboard
• Markers

Participants

• Owner of value measurement framework
• Product or service SMEs

Measure value – Align to a value driver

2.5 Estimated Time: 30 minutes

The objective of this exercise is to determine the value driver for each value source.

1. Align each value source to a value driver. Choose between options A and B.
1. Using a whiteboard, draw out a 2 x 2 business value matrix or an adapted version based on your own organizational value drivers. Place each value source in the appropriate quadrant.
1. Increase Revenue
2. Reduce Costs
3. Enhance Services
4. Reach Customers
2. Using a whiteboard or large sticky pads, create a section for each value driver. Place each value source with the appropriate value driver.

INPUT

• Product or service knowledge
• Business process knowledge

OUTPUT

• Value driver weight

Materials

• Whiteboard
• Markers

Participants

• Owner of value measurement framework
• Product or service SMEs

Brainstorm the different sources of business value (cont’d.)

2.5

Example:

Carry results over to the Value Calculator

2.5

Document results of this activity in the Value Calculator in the Item {#} tab.

List your Value Sources

Your Value Driver weights will auto-populate

Aim, but do not reach, for SMART metrics

Creating meaningful metrics

S pecific

M easureable

A chievable

R ealisitic

T ime-based

Follow the SMART framework when adding metrics to the VMF.

The intention of SMART goals and metrics is to make sure you have chosen a gauge that will:

• Reflect the actual business outcome or value source you are measuring.
• Ensure all relevant stakeholders understand the goals or value you are driving towards.
• Ensure you actually have the means to capture the performance.

Info-Tech Insight

Metrics are NOT a magical solution. They should be treated as a tool in your toolbox and are sometimes no more than a rough gauge of performance. Carefully assign metrics to your products and services and do not disregard the informed subjective perspective when SMART metrics are unavailable.

Info-Tech Best Practice

One last critical consideration here is the degree of effort required to collect the metric compared to the value of the analysis you are performing. Assessing whether or not to invest in a project should apply the rigor of carefully selecting and measuring value. However, performing a rationalization of the full app portfolio will likely lead to analysis paralysis. Taking an informed subjective perspective may be the better route.

Measure value – Assign metrics and gauge value fulfillment

2.6 30-60 minutes

The objective of this exercise is to determine an appropriate metric for each value source.

1. For each value source assign a metric that will be the unit of measurement to gauge the value fulfilment of the application.
2. Review the product or services performance with the metric
1. Use case 1&2 (Proposed Applications and/or Features) - You will need to estimate the degree of impact the product or services will have on your selected metric.
2. Use case 3&4 (Existing Applications and/or Features) – You can review historically how the product or service has performed with your selected metric
3. Determine a value fulfillment on a scale of 1 – 10.

10 = The product or service far exceeds expectations and targets on the metric.

5 = the product or service meets expectations on this metric.

1 = the product or service underperforms on this metric.

INPUT

• Product or service knowledge
• Business process knowledge

OUTPUT

• Value driver weight

Materials

• Whiteboard
• Markers

Participants

• Owner of value measurement framework
• Product or service SMEs

Carry results over to the Value Calculator

2.6

Document results of this activity in the Value Calculator in the Item {#} tab.

Assign Metrics.

Consider using current or estimated performance and targets.

Assess the impact on the value source with the value fulfillment.

Collect your Overall Balanced Value Score

Appendix

Bibliography

Brown, Alex. “Calculating Business Value.” Agile 2014 Orlando – July 13, 2014. Scrum Inc. 2014. Web. 20 Nov. 2017.

Brown, Roger. “Defining Business Value.” Scrum Gathering San Diego 2017. Agile Coach Journal. Web.

Curtis, Bill. “The Business Value of Application Internal Quality.” CAST. 6 April 2009. Web. 20 Nov. 2017.

Fleet, Neville, Joan Lasselle, and Paul Zimmerman. “Using a Balance Scorecard to Measure the Productivity and Value of Technical Documentation Organizations.” CIDM. April 2008. Web. 20 Nov. 2017.

Harris, Michael. “Measuring the Business Value of IT.” David Consulting Group. 20 Nov. 2017.

Intrafocus. “What is a Balanced Scorecard?” Intrafocus. Web. 20 Nov. 2017

Kerzner, Harold. Project Management: A Systems Approach to Planning, Scheduling, and Controlling. 12th ed., Wiley, 2017.

Lankhorst, Marc., et al. “Architecture-Based IT Valuation.” Via Nova Architectura. 31 March 2010. Web. 20 Nov. 2017.

Rachlin, Sue, and John Marshall. “Value Measuring Methodology.” Federal CIO Council, Best Practices Committee. October 2002. Web. April 2019.

Thiagarajan, Srinivasan. “Bridging the Gap: Enabling IT to Deliver Better Business Outcomes.” Cognizant. July 2017. Web. April 2019.

Develop a Master Data Management Practice and Platform

Are you sure you have a master data problem?

Analyst Perspective

Executive Summary

Info-Tech Insight

Everybody has master data (e.g. customer, product) but not a master data problem (e.g. duplicate customers and products). MDM is complex in practice and requires investments in data governance, data architecture, and data strategy. Identifying business outcomes based on quality master data is essential before you pull the trigger on an MDM solution.

What is master data and master data management?

• Master data domains include the most important data assets of an organization. For this data to be used across an enterprise in consistent and value-added ways, the data must be properly managed. Some common master data entities include customer, product, and employees.
• Master data management (MDM) is the control over master data values to enable consistent, shared, contextual use across systems, of the most accurate, timely, and relevant version of truth about essential business entities (DAMA DMBOK).
• The fundamental objective of MDM is to enable the business to see one view of critical data elements across the organization.
• MDM systems will detect and declare relationships between data, resolve duplicate records, and make data available to the people, processes, and applications that need it. The end goal of an MDM implementation is to make sure your investment in MDM technology delivers the promised business results. By supplementing the technology with rules, guidelines, and standards around enterprise data you will ensure data continues to be synchronized across data sources on an ongoing basis.

Info-Tech’s Data Management Framework Adapted from DAMA-DMBOK and Advanced Knowledge Innovations Global Solutions. See Create a Data Management Roadmap blueprint for more information.

Why manage master data?

Master data drives practical insights that arise from key aspects of the business.

Your Challenge

Modern organizations have unprecedented data challenges.

• The volume of enterprise data is growing rapidly and comes from a wide variety of internal and external data sources (e.g. ERP, CRM). When data is located in different systems and applications, coupled with degradation and proliferation, this can lead to inaccurate, inconsistent, and redundant data being shared across departments within an organization.
• For example, customer information may not be identical in the customer service system, shipping system, and marketing management platform because of manual errors or different name usage (e.g. GE or General Electric) when input by different business units.
• Data kept in separate soiled sources can also result in poor stakeholder decision making and inefficient business processes. Some issues include:
  • The lack of clean customer list results in poor customer service.
  • Hindering good analytics and business predictions, such as incorrect supply chain decision when having duplicate product and vendor data between plants.
  • Creating cross-group consolidated reports from duplicate and inconsistent local data requires too much manual effort and resources.

On average, 25 different data sources are used for generating customer insights and engagement.

On average, 16 different technology applications are used to leverage customer data.

Source: Deloitte Digital, 2020

Common Obstacles

Finding a single source of truth throughout the organization can be difficult.

Changes in business process often come with challenges for CIOs and IT leaders. From an IT perspective, there are several common business operating models that can result in multiple sets of master data being created and held in various locations. Some examples could be:

• Integrate systems following corporate mergers and acquisitions
• Enterprise with multi-product line
• Multinational company or multi-geographic operations with various ERP systems
• Digital transformation projects such as omnichannel

In such situations, implementing an MDM solution helps achieve harmonization and synchronization of master data and provide a single, reliable, and precise view of the organization. However, MDM is a complex system that requires more than just a technical solution. An organization might experience the following pain points:

• Failure to identify master data problem and organization’s data needs.
• Conflicting viewpoints and definitions of data assets that should reside in MDM across business units.

Building a successful MDM initiative can be a large undertaking that takes some preparation before starting. Understanding the fundamental roles that data governance, data architecture, and data strategy play in MDM is essential before the implementation.

“Only 3 in 10 of respondents are completely confident in their company's ability to deliver a consistent omnichannel experience.”

Source: Dun & Bradstreet, 2022

Insight summary

Overarching insight

Everybody has master data (e.g. customer, product) but not a master data problem (e.g. duplicate customers and products). MDM is complex in practice and requires investments in data governance, data architecture, and data strategy. Figuring out what the organization needs out of its master data is essential before you pull the trigger on an MDM solution.

Phase 1 insight

A master data management solution will assist you in solving master data challenges if your organization is large or complex, such as a multinational corporation or a company with multiple product lines, with frequent mergers and acquisitions, or adopting a digital transformation strategy such as omnichannel.

Organizations often have trouble getting started because of the difficulty of agreeing on the definition of master data within the enterprise. Reference data is an easy place to find that common ground.

While the organization may have data that fits into more than one master data domain, it does not necessarily need to be mastered. Determine what master data entities your organization needs.

Although it is easy to get distracted by the technical aspects of the MDM project – such as extraction and consolidation rules – the true goal of MDM is to make sure that the consumers of master data (such as business units, sales) have access to consistent, relevant, and trusted shared data.

Phase 2 insight

An organization with activities such as mergers and acquisitions or multi-ERP systems poses a significant master data challenge. Prioritize your master data practice based on your organization’s ability to locate and maintain a single source of master data.

Leverage modern capabilities such as artificial intelligence or machine learning to support large and complex MDM deployments.

Blueprint Overview

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

1. MDM Readiness Assessment Tool	2. Business Needs Assessment Tool
3. Business Case Presentation Template	4. Project Charter Template
5. Architecture Design Template

Key deliverable:

6. MDM Practice Pattern Template

7. MDM Platform Template

Define the intentional relationships between the business and the master data through a well-thought-out master data platform and practice.

Measure the value of this blueprint

Refine the metrics for the overall Master Data Management Practice and Platform.

In phase 1 of this blueprint, we will help you establish the business context and master data needs.

In phase 2, we will help you document the current and target state of your organization and develop a practice and platform so that master data is well managed to deliver on those defined metrics.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

Guided Implementation

“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

Workshop

“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

Consulting

“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

Diagnostics and consistent frameworks used throughout all four options

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 8 to 12 calls over the course of 4 to 6 months.

Workshop Overview

Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889

Phase 1: Build a Vision for MDM

Develop a Master Data Management Practice and Platform

Step 1.1

Assess Your Master Data Problem

Objectives

1. Build a solid foundation of knowledge surrounding MDM.

2. Recognize MDM problems that the organization faces in the areas of mergers and acquisitions, omnichannel, multi-product line, and multi-ERP setups.

This step involves the following participants:

CIO, CDO, or IT Executive

Head of Information Management

Outcomes of this step

An understanding of master data, MDM, and the prerequisites necessary to create an MDM program.

Determine if there is a need for MDM in the organization.

Understand your data – it’s not all transactional

Info-Tech analyzes the value of data through the lenses of its four distinct classes: Master, Transactional, Operational, and Reference.

Recognize the fundamental prerequisites for MDM before diving into more specific readiness requirements

Organizational buy-in

• Ensure there is someone actively invested and involved in the progress of the project. Having senior management support, especially in the form of an executive sponsor or champion, is necessary to approve MDM budgets and resourcing.
• MDM changes business processes and practices that affect many departments, groups, and people – this type of change may be disruptive so sponsorship from the top ensures your project will keep moving forward even during difficulties.
• Consider developing a cross-functional master data team involving stakeholders from management, IT, and the business units. This group can ensure that the MDM initiative is aligned with and supports larger organizational needs and everyone understands their role.

Understanding the existing data environment

• Knowing the state of an organization’s data architecture, and which data sources are linked to critical business processes, is essential before starting an MDM project.
• Identify the areas of data pain within your organization and establish the root cause. Determine what impact this is having on the business.

Before starting to look at technology solutions, make sure you have organizational buy-in and an understanding of the existing data environment. These two prerequisites are the foundation for MDM success.

Master data management provides opportunities to use data for analytical and operational purposes with greater accuracy

MDM can be approached in two ways: analytical and operational.

Think of it in the context of your own organization:

• How will MDM improve the ability for accurate data to be shared across business processes (Operational MDM)?
• How will MDM improve the quality of reports for management reporting and executive decision making (Analytical MDM)?

An investment in MDM will improve the opportunities for using the organization’s most valuable data assets, including opportunities like:

• Data is more easily shared across the organization’s environment with greater accuracy and trust.
• Multiple instances of the same data are consistent.
• MDM enables the ability to find the right data more quickly.

9.5% of revenue was at risk when bad experiences were offered to customers.

Source: Qualtrics XM Institute, 2022

Master data management drives better customer experience

85% In a survey of nearly 17,000 consumers and business buyers, 85% of customers expect consistent interactions across departments.

Source: Salesforce, 2022

Yet, 60% of customer say it generally feels like sales, service, and marketing teams do not share information.

Source: Salesforce, 2022

What is a business without the customer? Positive customer service experience drives customer retention, satisfaction, and revenue growth, and ultimately, determines the success of the organization. Effective MDM can improve customer experiences by providing consistent interactions and the ability to meet customer expectations.

61% of customers say they would switch to a competitor after just one bad customer service experience.

Source: Zendesk, 2022

Common business operating models or strategies with master data problems

Mergers and acquisitions (M&A)

M&A involves activities related to the consolidation of two companies. From IT’s perspective, whether the organization maintains different IT systems and applications in parallel or undergoes data integration process, it is common to have multiple instances of the same customer or product entity across different systems between companies, leading to incomplete, duplicate, and conflicting data sets. The organization may face challenges in both operational and analytical aspects. For many, the objective is to create a list of master data to have a single view of the organization.

Multiple-instance ERP or multinational organizations

Multiple-instance ERP solutions are commonly used by businesses that operate globally to accommodate each country’s needs or financial systems (Brightwork Research). With MDM, having a single source of truth could be a great advantage in certain business units to collaborate globally, such as sharing inventory coding systems to allow common identity and productive resource allocation and shared customer information for analytical purposes.

Common business operating models or strategies with master data problems (cont.)

Multiple product lines of business

An example for firms that sells multiple product lines could be Nike’s multiple product lines including footwear, clothing, and equipment. Keeping track of many product lines is a constant challenge for organizations in terms of inventory management, vendor database, and a tracking system. The ability to track and maintain your product data accurately and consistently is crucial for a successful supply chain (whether in a warehouse, distribution center, or retail office), which leads to improved customer satisfaction and increased sales.

Info-Tech Insight
A master data management solution will assist you in solving master data challenges if your organization is large or complex such as a multinational corporation or a company with multiple product lines, frequent mergers and acquisitions, or adopting a digital transformation strategy such as omnichannel.

Omni-channel

In e-commerce and retail industry, omnichannel means a business strategy that offers seamless shopping experiences across all channels, such as in-store, mobile, and online (Oracle). This also means the company needs to provide consistent information on orders, inventory, pricing, and promotions to customers and keep the customer records up to date. The challenges of omnichannel include having to synchronize data across channels and systems such as ERP, CRM, and social media. MDM becomes a solution for the success of an omnichannel strategy that refers to the same source of truth across business functions and channels.

Assess business model using Info-Tech’s MDM Readiness Assessment Tool

30 Minutes

• The MDM Readiness Assessment Tool will help you make the decision to stop the MDM project now or to continue on the path to MDM.
• Not all organizations need MDM. Don’t waste precious IT time and resources if your organization does not have a master data problem.

Download the MDM Readiness Assessment Tool

Step 1.2

Identify the Master Data Domains

Objectives

Determine which data domain contains the most critical master data in the organization for an MDM strategy.

This step involves the following participants:

Business Domain Representatives

Data Stewards or Data Owners

Information Management Team

Outcomes of this step

Determine the ideal data domain target for the organization based on where the business is experiencing the largest pains related to master data and where it will see the most benefit from MDM.

Reference data makes tackling master data easier

Reference data serves as a great starting place for an MDM project.

• Reference data is the simple lists of data that are typically static and help categorize other data using code tables. Examples include lists of countries or states, postal codes, general ledger charts of accounts, currencies, or product codes.
• Loading information into the warehouse or an MDM hub usually requires reconciling reference data from multiple sources. By getting reference data in order first, MDM will be easier to implement.
• Reference data also requires a relatively small investment with good returns so the value of the project can easily be demonstrated to stakeholders.
• One example of how reference data makes master data easier to tackle is a master list of an organization’s customers that needs an attribute of an address. By maintaining a list of postal codes or cities as reference data, this is made much easier to manage than simply allowing free text.

Info-Tech Insight

Organizations often have trouble getting started because of the difficulty of agreeing on the definition of master data within the enterprise. Reference data is an easy place to find that common ground.

There are several key considerations when defining which data is master data in the organization

A successful implementation of MDM depends on the careful selection of the data element to be mastered. As departments often have different interests, establishing a standard set of data elements can lead to a lot of discussion. When selecting what data should be considered master data, consider the following:

• Complexity. As the number of elements in a set increases, the likelihood that the data is master data also increases.
• Volatility. Master data tends to be less volatile. The more volatile data is, the more likely it is transactional data.
• Risk. The more likely data may have a risk associated with it, the more likely it should be managed with MDM.
• Value. The more valuable a data set is to the organization, the greater the chance it is master data.
• Sharing. If the data set is used in multiple systems, it likely should be managed with an MDM system.

Begin by documenting the existing data sources within the organization.

Use Info-Tech’s Master Data Management Business Needs Assessment Tool to determine master data sources.

Info-Tech Insight

While the organization may have data that fits into more than one master data domain, it does not necessarily need to be mastered. Determine what master data entities your organization needs.

Master data also fall into these four areas

More perspectives to consider and define which data is your master data.

Master data types can be divided into four main domains

Single Domain vs. Multi-Domain

• By focusing on a single master data domain, organizations can start with smaller, more manageable steps, rather than trying to tackle everything at once.
• MDM solutions can be domain-specific or be designed to support multiple domains.
• Multi-domain MDM is a solution that manages multiple types of master data in one repository. By implementing multi-domain from the beginning, an organization is better able to support growth across all dimensions and business units.

Use Info-Tech’s Master Data Management Business Needs Assessment Tool to determine master data priorities

2 hours

Use the Master Data Management Business Needs Assessment Tool to assist you in determining the master data domains present in your organization and the suggested domain(s) for your MDM solution.

Download the MDM Business Needs Assessment Tool

Step 1.3

Create a Strategic Vision for Your MDM Program

Objectives

1. Understand the true goal of MDM – ensuring that the needs of the master data users in the organization are fulfilled.

2. Create a plan to obtain organizational buy-in for the MDM initiative.

3. Organize and officialize your project by documenting key metrics, responsibilities, and goals for MDM.

This step involves the following participants:

CEO, CDO, or CIO

Business Domain Representatives

Information Management Team

Outcomes of this step

Obtain business buy-in and direction for the MDM initiative.

Create the critical foundation plans that will guide you in evaluating, planning, and implementing your immediate and long-term MDM goals.

MDM is not just IT’s responsibility

Make sure the whole organization is involved throughout the project.

• Master data is created for the organization as a whole, so get business input to ensure IT decisions fit with corporate goals and objectives.
• The ownership of master data is the responsibility of the business. IT is responsible for the MDM project’s technology, support, platforms, and infrastructure; however, the ownership of business rules and standards reside with the business.
• MDM requires IT and the business to form a partnership. While IT is responsible for the technical component, the business will be key in identifying master data.
• MDM belongs to the entire organization – not a specific department – and should be created with the needs of the whole organization in mind. As such, MDM needs to be aligned with company’s overall data strategy. Data strategy planning involves identifying and translating business objectives and capability goals into strategies for improving data usage by the business and enhancing the capabilities of MDM.

Keep the priorities of the users of master data at the forefront of your MDM initiative.

• To fully satisfy the needs of the users of master data, you have to know how the data is consumed. Information managers and architects must work with business teams to determine how organizational objectives are achieved by using master data.
• Steps to understanding the users of master data and their needs:

1. Identify and document the users of master data – some examples include business units such as marketing, sales, and innovation teams.
2. Interview those identified to understand how their strategic goals can be enabled by MDM. Determine their needs and expectations.
3. Determine how changes to the master data management strategy will bring about improvements to information sharing and increase the value of this critical asset.

Info-Tech Insight

Although it is easy to get distracted by the technical aspects of the MDM project – such as extraction and consolidation rules – the true goal of MDM is to make sure that the consumers of master data (such as business units, sales reps) have access to consistent, relevant, and trusted shared data.

Interview business stakeholders to understand how IT’s implementation of MDM will enable better business decisions

1 hours

Instructions

1. Identify which members of the business you would like to interview to gather an understanding of their current data issues and desired data usage. (Recommendation: Gather a diverse set of individuals to help build a broader and more holistic knowledge of data consumption wants or requirements.)
2. Prepare your interview questions.
3. Interview the identified members of the business.
4. Debrief and document results.

Tactical Tips

• Include members of your team to help heighten their knowledge of the business.
• Identify a team member to operate as the formal scribe.
• Keep the discussion as free flowing as possible; it will likely enable the business to share more. Don’t get defensive – one of the goals of the interviews is to open communication lines and identify opportunities for change, not create tension between IT and the business.

Info-Tech Insight

Prevent the interviews from being just a venue for the business to complain about data by opening the discussion of having them share current concerns and then focus the second half on what they would like to do with data and how they see master data assets supporting their strategic plans.

Ensure buy-in for the MDM project by aligning the MDM vision and the drivers of the organization

MDM exists to enable the success of the organization as a whole, not just as a technology venture. To be successful in the MDM initiative, IT must understand how MDM will help the critical aspects of the business. Likewise, the business must understand why it is important to them to ensure long-term support of the project.

“If an organization only wants to look at MDM as a tech project, it will likely be a failure. It takes a very strong business and IT partnership to make it happen.”

– Julie Hunt, Software Industry Analyst, Hub Designs Magazine

Use Info-Tech’s Master Data Management Business Case Presentation Template to help secure business buy-in

1-2 hours

Objectives

• This presentation should be used to help obtain momentum for the ongoing master data management initiative and continued IT- business collaboration.
• Master data management and the state of processes around data can be a sensitive business topic. To overcome issues of resistance from the operational or strategic levels, create a well-crafted business case.

Download the MDM Business Case Presentation Template

Use Info-Tech’s project charter to support your team in organizing their master data management plans

Use this master document to centralize the critical information regarding the objectives, staffing, timeline, budget, and expected outcome of the project.

1. MDM Vision and Mission

Overview

Define the value proposition behind addressing master data strategies and developing the organization's master data management practice.

Consider

Why is this project critical for the business?

Why should this project be done now, instead of delayed further down the road?

2. Goals or Objectives

Overview

Your goals and objectives should be practical and measurable. Goals and objectives should be mapped back to the reasons for MDM that we identified in the Executive Brief.

Example Objectives

Align the organization’s IT and business capabilities in MDM to the requirements of the organization’s business processes and the data that supports it.

3. Expected Outcomes

Overview

Master data management as a concept can change based on the organization and with definitions and expectations varying heavily for individuals. Ensure alignment at the outset of the project by outlining and attaining agreement on the expectations and expected outcomes (deliverables) of the project.

Recommended Outcomes

Outline of an action plan

Documented data strategies

4. Outline of Action Plan

Overview

Document the plans for your project in the associated sections of the project charter to align with the outcomes and deliverables associated with the project. Use the sample material in the charter and the “Develop Your Timeline for the MDM Project” section to support developing your project plans.

Recommended Project Scope

Align master data MDM plan with the business.

Document current and future architectural state of MDM.

Download the MDM Project Charter Template

5. Identify the Resourcing Requirements

Overview

Create a project team that has representation of both IT and the business (this will help improve alignment and downstream implementation planning).

Business Roles to Engage

Data owners (for subject area data)

Data stewards who are custodians of business data (related to subject areas evaluated)

Data scientists or other power users who are heavy consumers of data

IT Roles to Engage

Data architect(s)

Any data management professionals who are involved in modeling data, managing data assets, or supporting the systems in which the data resides.

Database administrators or data warehousing architects with a deep knowledge of data operations.

Individuals responsible for data governance.

Phase 2: Build the MDM Practice and Platform

Develop a Master Data Management Practice and Platform

Step 2.1

Document the Current Data State

Objectives

1. Understand roles that data strategy, data governance, and data architecture play in MDM.

2. Document the organization’s current data state for MDM.

This step involves the following participants:

Data Stewards or Data Custodians

Data or Enterprise Architect

Information Management Team

Outcomes of this step

Document the organization’s current data state, understanding the business processes and movement of data across the company.

Effective data governance will create the necessary roles and rules within the organization to support MDM

• A major success factor for MDM falls under data governance. If you don’t establish data governance early on, be prepared to face major obstacles throughout your project. Governance includes data definitions, data standards, access rights, and quality rules and ensures that MDM continues to offer value.
• Data governance involves an organizational committee or structure that defines the rules of how data is used and managed – rules around its quality, processes to remediate data errors, data sharing, managing data changes, and compliance with internal and external regulations.
• What is required for governance of master data? Defined roles, including data stewards and data owners, that will be responsible for creating the definitions relevant to master data assets.

For more information, see Info-Tech Research Group’s Establish Data Governance blueprint.

Ensure MDM success by defining roles that represent the essential high-level aspects of MDM

Regardless of the maturity of the organization or the type of MDM project being undertaken, all three representatives must be present and independent. Effective communication between them is also necessary.

The following roles need to be created and maintained for effective MDM:

Data Owners are accountable for:

• Data created and consumed.
• Ensuring adequate data risk management is in place.

Data Stewards are responsible for:

• The daily and routine care of all aspects of data systems.
• Supporting the user community.
• Collecting, collating, and evaluating issues and problems with data.
• Managing standard business definitions and metadata for critical data elements.

Another crucial aspect of implementing MDM governance is defining match rules for master data

• Matching, merging, and linking data from multiple systems about the same item, person, group, etc. attempts to remove redundancy, improve data quality, and provide information that is more comprehensive.
• Matching is performed by applying inference rules. Data cleansing tools and MDM applications often include matching engines used to match data.
  • Engines are dependent on clearly defined matching rules, including the acceptability of matches at different confidence levels.
• Despite best efforts, match decisions sometimes prove to be incorrect. It is essential to maintain the history of matches so that matches can be undone when they are discovered to be incorrect.
• Artificial intelligence (AI) for match and merge is also an option, where the AI engine can automatically identify duplicate master data records to create a golden record.

Match-Merge Rules vs. Match-Link Rules

Match-Merge Rules

• Match records and merge the data from these records into a single, unified, reconciled, and comprehensive record. If rules apply across data sources, create a single unique and comprehensive record in each database.
• Complex due to the need to identify so many possible circumstances, with different levels of confidence and trust placed on data values in different fields from different sources.
• Challenges include the operational complexity of reconciling the data and the cost of reversing the operation if there is a false merge.

Match-Link Rules

• Identify and cross-reference records that appear to relate to a master record without updating the content of the cross-referenced record.
• Easier to implement and much easier to reverse.
• Simple operation; acts on the cross-reference table and not the individual fields of the merged master data record, even though it may be more difficult to present comprehensive information from multiple records.

Data architecture will assist in producing an effective data integration model for the technology underlying MDM

Data quality is directly impacted by architecture.

• With an MDM architecture, access, replication, and flow of data are controlled, which increases data quality and consistency.
• Without an MDM architecture, master data occurs in application silos. This can cause redundant and inconsistent data.

Before designing the MDM architecture, consider:

• How the business is going to use the master data.
• Architectural style (this is often dependent on the existing IT architecture, but generally, organizations starting with MDM find a hub architecture easiest to work with).
• Where master data is entered, updated, and stored.
• Whether transactions should be processed as batch or real-time.
• What systems will contribute to the MDM system.
• Implementation style. This will help ensure the necessary applications have access to the master data.

“Having an architectural oversight and reference model is a very important step before implementing the MDM solutions.”

– Selwyn Samuel, Director of Enterprise Architecture

Document the organization’s data architecture to generate an accurate picture of the current data state

2-3 hours

Populate the template with your current organization's data components and the business flow that forms the architecture.

Think about the source of master data and what other systems will contribute to the MDM system.

Download the MDM Architecture Design Template ArchiMate file

Step 2.2

Document the Target Data State

Objectives

1. Understand four implementation styles for MDM deployments.

2. Document target MDM implementation systems.

This step involves the following participants:

Data Stewards or Data Custodians

Data or Enterprise Architect

Information Management Team

Outcomes of this step

Document the organization’s target architectural state surrounding MDM, identifying the specific MDM implementation style.

How the organization’s data flows through IT systems is a convenient way to define your MDM state

Understanding the data sources present in the organization and how the business organizes and uses this data is critical to implementing a successful MDM strategy.

Operational MDM

• As you manage data in an operational MDM system, the data gets integrated back into the systems that were the source of the data in the first place. The “best records” are created from a combination of data elements from systems that create relevant data (e.g. billing system, call center, reservation system) and then the data is sent back to the systems to update it to the best record. This includes both batch and real-time processing data.

Analytical MDM

• Generates “best records” the same way that operational MDM does. However, the data doesn’t go back to the systems that generated the data but rather to a repository for analytics, decision management, or reporting system purposes.

Discovery of master data is the same for both approaches, but the end use is very different.

The approaches are often combined by technologically mature organizations, but analytical MDM is generally more expensive due to increased complexity.

Central to an MDM program is the implementation of an architectural framework

Info-Tech Research Group’s Reference MDM Architecture uses a top-down approach.

A top-down approach shows the interdependent relationship between layers – one layer of functionality uses services provided by the layers below, and in turn, provides services to the layers above.

Info-Tech Research Group’s Reference MDM Architecture can meet the unique needs of different organizations

The MDM service layers that make up the hub are:

• Virtual Registry. The virtual registry is used to create a virtual view of the master data (this layer is not necessary for every MDM implementation).
• Interface Services. The interface services work directly with the transport method (e.g. Web Service, Pub/Sub, Batch/FTP).
• Rules Management. The rules management layer manages business rules and match rules set by the organization.
• Lifecycle Management. This layer is responsible for managing the master data lifecycle. This includes maintaining relationships across domains, modeling classification and hierarchies within the domains, helping with master data quality through profiling rules, deduplicating and merging data to create golden records, keeping authoring logs, etc.
• Base Services. The base services are responsible for managing all data (master, history, metadata, and reference) in the MDM hub.
• Security. Security is the base layer and is responsible for protecting all layers of the MDM hub.

An important architectural decision concerns where master data should live

All MDM architectures will contain a system of entry, a system of record, and in most cases, a system of reference. Collectively, these systems identify where master data is authored and updated and which databases will serve as the authoritative source of master data records.

Central to an MDM program is the implementation of an architectural framework

These styles are complementary and see increasing functionality; however, organizations do not need to start with consolidation.

Consolidation implementation style

Master data is created and stored in application systems and then placed in a centralized MDM hub that can be used for reference and reporting.

Advantages

• Prepares master data for enterprise data warehouse and reporting by matching/merging.
• Can serve as a basis for coexistence or transactional MDM.

Disadvantages

• Does not provide real-time reference because updates are sent to the MDM system in batch mode.
• New data requirements will need to be managed at the system of entry.

Registry implementation style

Master data is created and stored in applications. Key identifiers are then linked to the MDM system and used as reference for operational systems.

Advantages

• Quick to deploy.
• Can get a complete view of key master data identifiers when needed.
• Data is always current since it is accessed from the source systems.

Disadvantages

• Depends on clean data at the source system level.
• Can be complex to manage.
• Except for the identifiers persisting in the MDM system, all master data records remain in the applications, which means there is not a complete view of all master data records.

Coexistence implementation style

Master data is created and stored in existing systems and then synced with the MDM system to create an authoritative record of master data.

Advantages

• Easier to deploy workflows for collaborative authoring.
• Creates a complete view for each master data record.
• Increased master data quality.
• Allows for data harmonization across systems.
• Provides organizations with a central reference system.

Disadvantages

• Master data is altered in both the MDM system and source systems. Data may not be up to date until synchronization takes place.
• Higher deployment costs because all master data records must be harmonized.

Transactional implementation style

All master data records are materialized in the MDM system, which provides the organization with a single, complete source of master data at all times.

Advantages

• Functions as a system of record, providing complete, consistent, accurate, and up-to-date data.
• Provides a single location for updating and managing master data.

Disadvantages

• The implementation of this style may require changes to existing systems and business processes.
• This implementation style comes with increased cost and complexity.

All organizations are different; identify the architecture and implementation needs of your organization

Architecture is not static – it must be able to adapt to changing business needs.

• The implementation style an organization chooses is dependent on organizational factors such as the purpose of MDM and method of use.
• Some master data domains may require that you start with one implementation style and later graduate to another style while retaining the existing data model, metadata, and matching rules. Select a starting implementation style that will best suit the organization.
• Organizations with multi-domain master data may have to use multiple implementation styles. For example, data domain X may require the use of a registry implementation, while domain Y requires a coexistence implementation.

Document your target data state surrounding MDM

2-3 hours

Populate the template with your target organization’s data architecture.

Highlight new capabilities and components that MDM introduced based on MDM implementation style.

Step 2.3

Develop MDM Practice and Platform

Objectives

1. Review Info-Tech’s practice pattern and design your master data management practice.

2. Design your master data management platform.

3. Consider next steps for the MDM project.

This step involves the following participants:

Data Stewards or Data Custodians

Data or Enterprise Architect

Information Management Team

Outcomes of this step

Define the key services and outputs that must be delivered by establishing core capabilities, accountabilities, roles, and governance for the practice and platform.

What does a master data management practice pattern look like?

The master data management practice pattern describes the core capabilities, accountabilities, processes, and essential roles and the elements that provide oversight or governance of the practice, all of which are required to deliver on high-value services and deliverables or output for the organization.

Download the Master Data Management Practice Pattern Template ArchiMate File

Master data management data practice setup

• Define the practice lead’s accountabilities and responsibilities.
• Assign the practice lead.
• Design the practice, defining the details of the practice (including the core capabilities, accountabilities, processes, and essential roles; the elements that provide oversight or governance of the practice; and the practice’s services and deliverables or output for the organization).
• Define services and accountabilities:

1. Define deployment and engagement model
2. Define practice governance and metrics
3. Define processes and deliverables
4. Summarize capabilities
5. Use activity slide to assign the skills to the role

General approach to setting up data practices

Guidelines for designing and establishing your various data practices.

Understand master data management practice pattern

A master data management practice pattern includes key services and outputs that must be delivered by establishing core capabilities, accountabilities, roles, and governance for the practice.

Assumption:

The accountabilities and responsibilities for the master data management practice have been established and assigned to a practice lead.

1. Download and review Master Data Management Practice Pattern (Level 1 – Master Data Management Practice Pattern).
2. Review and update master data management processes for your organization.

Download the Master Data Management Practice Pattern Template ArchiMate File

Info-Tech Insight

An organization with heavy merger and acquisition activity poses a significant master data challenge. Prioritize your master data practice based on your organization’s ability to locate and maintain a single source of master data.

Initiate your one-time master data management practice setup

1. Ensure data governance committees are established.
2. Align master data management working group responsibilities with data governance committee.
3. Download and review Master Data Management Practice Pattern Setup (Level 1 – Master Data Management Practice Setup).
4. Start establishing your master data practice:

4.1 Define services and accountabilities

4.2 Define processes and deliverables by stakeholder

4.3 Design practice operating model

4.4 Perform skills inventory and design roles

4.5 Determine practice governance and metrics

4.6 Summarize practice capabilities

5. Define key master data management deliverable and processes.

Download and Update:

Process Template: MDM Conflict Resolution

MDM operating model

The operating model is a visualization of how MDM commonly operates and the value it brings to the organization. It illustrates the master data flow, which works from left to right, from source system to consumption layer. Another important component of the model is the business data glossary, which is part of your data governance plan, to define terminology and master data’s key characteristics across business units.

Choosing the appropriate technology capabilities

An MDM platform should include certain core technical capabilities:

• Master data hub: Functions as a system of reference, providing an authoritative source of data in read-only format to systems downstream.
• Data modeling: Ability to model complex relationships between internal application sources and other parties.
• Workflow management: Ability to support flexible and comprehensive workflow-based capabilities.
• Relationship and hierarchies: Ability to determine relationships and identify hierarchies within the same domain or across different domains of master data.
• Information quality: Ability to profile, cleanse, match, link, identify, and reconcile master data in different data sources to create and maintain the “golden record.”
• Loading, integration, synchronization: Ability to load data quality tools and integrate so there is a bidirectional flow of data. Enable data migration and updates that prevent duplicates within the incoming data and data found in the hub.
• Security: Ability to control access of MDM and the ability to report on activities. Ability to configure and manage different rules and visibilities.
• Ease of use: Including different user interfaces for technical and business roles.
• Scalability and high performance/high availability: Ability to expand or shrink depending on the business needs and maintain a high service level.