Organizational Change Management
- Buy Link or Shortcode: {j2store}35|cart{/j2store}
- Parent Category Name: Project Portfolio Management and Projects
- Parent Category Link: /ppm-and-projects
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Kick off an acquisition by establishing acquisition goals, validating the decision to acquire a service, and structuring an acquisition approach. There are several RFP approaches and strategies – evaluate the options and develop one that aligns with the nature of the acquisition.
A solid RFP is critical to the success of this project. Assess the current and future requirements, examine the characteristics of an effective RFP, and develop an RFP.
Manage the activities surrounding vendor questions and score the RFP responses to select the best-fit solution.
Perform due diligence in reviewing the SLAs and contract before signing. Plan to transition the service into the environment and manage the vendor on an ongoing basis for a successful partnership.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Establish procurement goals and success metrics.
Develop a projected acquisition timeline.
Establish the RFP approach and strategy.
Defined acquisition approach and timeline.
1.1 Establish your acquisition goals.
1.2 Establish your success metrics.
1.3 Develop a projected acquisition timeline.
1.4 Establish your RFP process and refine your RFP timeline.
Acquisition goals
Success metrics
Acquisition timeline
RFP strategy and approach
Gather requirements for services to build into the RFP.
Gathered requirements.
2.1 Assess the current state.
2.2 Evaluate service requirements and targets.
2.3 Assess the gap and validate the service acquisition.
2.4 Define requirements to input into the RFP.
Current State Assessment
Service requirements
Validation of services being acquired and key processes that may need to change
Requirements to input into the RFP
Build the RFP.
RFP development.
3.1 Build the RFP requirement section.
3.2 Develop the rest of the RFP.
Service requirements input into the RFP
Completed RFP
Review RFP responses to select the best solution for the acquisition.
Vendor selected.
4.1 Manage vendor questions regarding the RFP.
4.2 Review RFP responses and shortlist the vendors.
4.3 Conduct additional due diligence on the vendors.
4.4 Select a vendor.
Managed RFP activities
Imperceptive scoring of RFP responses and ranking of vendors
Additional due diligence and further questions for the vendor
Selected vendor
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Learn how to apply the Digital Value Pools thought model and scope strategy around them.
Identify business imperatives, define digital outcomes, and define the strategy’s guiding principles.
Define, prioritize, and roadmap digital initiatives and plan contingencies.
Create, polish, and socialize the Digital Strategy-on-a-Page.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify the need for and use of digital strategy and determine a realistic scope for the digital strategy.
The digital strategy project is planned and scoped around a subset of the five digital value pools.
1.1 Introduction to digital strategy.
1.2 Establish motivation for digital.
1.3 Discuss in-flight digital investments.
1.4 Define the scope of digital.
1.5 Identify stakeholders.
1.6 Perform discovery interviews.
1.7 Select two value pools to focus day 2, 3, and 4 activities.
Business model canvas
Stakeholder power map
Discovery interview results
Two value pools for focus throughout the workshop
Create guiding principles to help define future digital initiatives. Generate the target state with the help of strategic goals.
Establish the basis for planning out the initiatives needed to achieve the target state from the current state.
2.1 Identify digital imperatives.
2.2 Define key digital outcomes.
2.3 Create a digital investment thesis.
2.4 Define digital guiding principles.
Corporate strategy analysis, PESTLE analysis, documented operational pain points (value streams)
Customer needs assessment (journey maps)
Digital investment thesis
Digital guiding principles
Understand the gap between the current and target state. Create transition options and assessment against qualitative and quantitative metrics to generate a list of initiatives the organization will pursue to reach the target state. Build a roadmap to plan out when each transition initiative will be implemented.
Finalize the initiatives the organization will use to achieve the target digital state. Create a roadmap to plan out the timing of each initiative and generate an easy-to-present document for digital strategy approval.
3.1 Identify initiatives to achieve digital outcomes.
3.2 Align in-flight initiatives to digital initiatives.
3.3 Prioritize digital initiatives.
3.4 Document architecturally significant requirements for high-priority initiatives.
Digital outcomes and KPIs
Investment/value pool matrix
Digital initiative prioritization
Architecturally significant requirements for high-priority initiatives
Plan your approach to socializing the digital strategy to help facilitate the cultural changes necessary for digital transformation.
Plant the seed of digital and innovation to start making digital a part of the organization’s DNA.
4.1 Review and refine Digital Strategy on a Page.
4.2 Assess company culture.
4.3 Define high-level cultural changes needed for successful transformation.
4.4 Define the role of the digital transformation team.
4.5 Establish digital transformation team membership and desired outcomes.
Digital Strategy on a Page
Strategyzer Culture Map
Digital transformation team charter
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Develop goals and KPIs to measure your progress.
Learn how to present different types of metrics.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Create a prioritized list of goals to improve the security program’s current state.
Insight into the current program and the direct it needs to head in.
1.1 Discuss current state and existing approach to metrics.
1.2 Review contract metrics already in place (or available).
1.3 Determine security areas that should be measured.
1.4 Determine what stakeholders are involved.
1.5 Review current initiatives to address those risks (security strategy, if in place).
1.6 Begin developing SMART goals for your initiative roadmap.
Gap analysis results
SMART goals
Develop unique KPIs to measure progress against your security goals.
Learn how to develop KPIs
Prioritized list of security goals
2.1 Continue SMART goal development.
2.2 Sort goals into types.
2.3 Rephrase goals as KPIs and list associated metric(s).
2.4 Continue KPI development.
KPI Evolution Worksheet
Determine which metrics will be included in the initial program launch.
A set of realistic and manageable goals-based metrics.
3.1 Lay out prioritization criteria.
3.2 Determine priority metrics (implementation).
3.3 Determine priority metrics (improvement & organizational trend).
Prioritized metrics
Tool for tracking and presentation
Strategize presentation based around metric type to indicate organization’s risk posture.
Develop versatile reporting techniques
4.1 Review metric types and discuss reporting strategies for each.
4.2 Develop a story about risk.
4.3 Discuss the use of KPXs and how to scale for less mature programs.
Key Performance Index Tool and presentation materials
"Metrics programs tend to fall into two groups: non-existent and unhelpful.
The reason so many security professionals struggle to develop a meaningful metrics program is because they are unsure of what to measure or why.
The truth is, for metrics to be useful, they need to be tied to something you care about – a state you are trying to achieve. In other words, some kind of goal. Used this way, metrics act as the scoreboard, letting you know if you’re making progress towards your goals, and thus, boosting your overall maturity."
– Logan Rohde, Research Analyst, Security Practice Info-Tech Research Group
Info-Tech Insight
Governance
Management
While business leaders are now taking a greater interest in cybersecurity, alignment between the two groups still has room for improvement.
5% of public companies feel very confident that they are properly secured against a cyberattack.
41% of boards take on cybersecurity directly rather than allocating it to another body (e.g. audit committee).
19% of private companies do not discuss cybersecurity with the board.
(ISACA, 2018)
Info-Tech Insight
Metrics help to level the playing field
Poor alignment between security and the business often stems from difficulties with explaining how security objectives support business goals, which is ultimately a communication problem.
However, metrics help to facilitate these conversations, as long as the metrics are expressed in practical, relatable terms.
Security professionals have the perception that metrics programs are difficult to create. However, this attitude usually stems from one of the following myths. In reality, security metrics are much simpler than they seem at first, and they usually help resolve existing challenges rather than create new ones.
| Myth | Truth | |
|---|---|---|
| 1 | There are certain metrics that are important to all organizations, based on maturity, industry, etc. | Metrics are indications of change; for a metric to be useful it needs to be tied to a goal, which helps you understand the change you're seeing as either a positive or a negative. Industry and maturity have little bearing here. |
| 2 | Metrics are only worthwhile once a certain maturity level is reached | Metrics are a tool to help an organization along the maturity scale. Metrics help organizations measure progress of their goals by helping them see which tactics are and are not working. |
| 3 | Security metrics should focus on specific, technical details (e.g. of systems) | Metrics are usually a means of demonstrating, objectively, the state of a security program. That is, they are a means of communicating something. For this reason, it is better that metrics be phrased in easily digestible, non-technical terms (even if they are informed by technical security statistics). |
Specific
Measurable
Achievable
Realistic
Timebound
Achievable: What is an achievable metric?
When we say that a metric is “achievable,” we imply that it is tied to a goal of some kind – the thing we want to achieve.
How do we set a goal?
Start:
Review current state and decide on priorities.
Set a SMART goal for improvement.
Develop an appropriate KPI.
Use KPI to monitor program improvement.
Present metrics to the board.
Revise metrics if necessary.
A security strategy is ultimately a large goal-setting exercise. You begin by determining your current maturity and how mature you need to be across all areas of information security, i.e. completing a gap analysis.
As such, linking your metrics program to your security strategy is a great way to get your metrics program up and running – but it’s not the only way.
Short term: Streamline your program. Based on your organization’s specific requirements and risk profile, figure out which metrics are best for now while also planning for future metrics as your organization matures.
Long term: Once the program is in place, improvements will come with increased visibility into operations. Investments in security will be encouraged when more evidence is available to executives, contributing to overall improved security posture. Potential opportunities for eventual cost savings also exist as there is more informed security spending and fewer incidents.
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked-off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| 1. Link Security Metrics to Goals to Boost Maturity | 2. Adapt Your Reporting Strategy for Various Metric Types | |
|---|---|---|
| Best-Practice Toolkit |
1.1 Review current state and set your goals 1.2 Develop KPIs and prioritize your goals 1.3 Implement and monitor the KPI to track goal progress |
2.1 Review best practices for presenting metrics 2.2 Strategize your presentation based on metric type 2.3 Tailor presentation to your audience 2.4 Use your metrics to create a story about risk 2.5 Revise your metrics |
| Guided Implementations |
|
|
| Onsite Workshop | Module 1: Current State, Initiatives, Goals, and KPIs | Module 2: Metrics Reporting |
|
Phase 1 Outcome:
|
Phase 2 Outcome:
|
Contact your account representative or email Workshops@InfoTech.com for more information.
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | Workshop Day 5 | |
|---|---|---|---|---|---|
| Activities |
Current State, Initiatives, and Goals
|
KPI Development
|
Metrics Prioritization
|
Metrics Reporting
|
Offsite Finalization
|
| Deliverables |
|
|
|
|
|
1.1 Review current state and set your goals
1.2 Develop KPIs and prioritize your goals
1.3 Implement and monitor KPIs
Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of two to three advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 2-4 weeks
Start with an analyst kick-off call:
Then complete these activities…
Review findings with analyst:
Then complete these activities…
With these tools & templates:
120 minutes
Before program improvement can take place, it is necessary to look at where things are at presently (in terms of maturity) and where we need to get them to.
In other words, we need to perform a security program gap analysis.
Info-Tech Best Practice
The most thorough way of performing this gap analysis is by completing Info-Tech’s Build an Information Security Strategy blueprint, as it will provide you with a prioritized list of initiatives to boost your security program maturity.
Use the Capability Maturity Model Integration (CMMI) scale below to help you understand your current level of maturity across the various areas of your security program.
(Adapted from the “CMMI Institute Maturity Model”)
The most effective metrics programs are personalized to reflect the goals of the security team and the business they work for. Using goals-based metrics allows you to make incremental improvements that can be measured and reported on, which makes program maturation a natural process.
Info-Tech Best Practice
Before setting a SMART goal, take a moment to consider your maturity for each security area, and which metric type you need to collect first, before moving to more ambitious goals.
Security Areas
| Metric Type | Description |
|---|---|
| Initial Probe | Determines what can be known (i.e. what sources for metrics exist?). |
| Baseline Testing | Establishes organization’s normal state based on current metrics. |
| Implementation | Focuses on setting up a series of related processes to increase organizational security (i.e. roll out MFA). |
| Improvement | Sets a target to be met and then maintained based on organizational risk tolerance. |
| Organizational Trends | Culls together several metrics to track (sometimes predict) how various trends affect the organization’s overall security. Usually focuses on large-scale issues (e.g. likelihood of a data breach). |
Specific
Measurable
Achievable
Realistic
Timebound
Examples of possible goals for various maturity levels:
1.1 Security Metrics Determination and Tracking Tool
To increase visibility into the cost, effort, and value of any given goal, assess them using the following criteria:
Use the calculated Cost/Effort Rating, Benefit Rating, and Difference Score later in this project to help with goal prioritization.
Info-Tech Best Practice
If you have already completed a security strategy with Info-Tech resources, this work may likely have already been done. Consult your Information Security Program Gap Analysis Tool from the Build an Information Security Strategy research.
At this time, it is necessary to evaluate the priorities of your security program.
Option 1: Progress to KPI Development
Option 2: Progress to Prioritization of Goals
Terms like “key performance indicator” may make this development practice seem more complicated than it really is. A KPI is just a single metric used to measure success towards a goal. In relational terms (i.e. as a percentage, ratio, etc.) to give it context (e.g. % of improvement over last quarter).
KPI development is about answering the question: what would indicate that I have achieved my goal?
KPIs differ from goal to goal, but their forms follow certain trends
| Metric Type | KPI Form |
|---|---|
| Initial Probe | Progress of probe (e.g. % of systems checked to see if they can supply metrics). |
| Baseline Testing | What current data shows (e.g. % of systems needing attention). |
| Implementation | Progress of the implementation (e.g. % of complete vulnerability management program implementation). |
| Improvement | The threshold or target to be achieved and maintained (e.g. % of incidents responded to within target window). |
| Organizational Trends | The interplay of several KPIs and how they affect the organization’s risk posture (e.g. assessing the likelihood for a data breach). |
1. Initial Probe
Focused on determining how many sources for metrics exist.
2. Baseline Testing
Focused on gaining initial insights about the state of your security program (what are the measurements?).
Info-Tech Insight
Don't lose hope if you lack resources to move beyond these initial steps. Even if you are struggling to pull data, you can still draw meaningful metrics. The percent or ratio of processes or systems you lack insight into can be very valuable, as it provides a basis to initiate a risk-based discussion with management about the organization's security blind spots.
3. Program Implementation
Focused on developing a basic program to establish basic maturity (e.g. implement an awareness and training program).
4. Improvement
Focused on attaining operational targets to lower organizational risk.
Info-Tech Insight
Don't overthink your KPI. In many cases it will simply be your goal rephrased to express a percentage or ratio. In others, like the example above, it makes sense for them to be identical.
5. Organizational Impact
Focused on studying several related KPIs (Key Performance Index, or KPX) in an attempt to predict risks.
Let’s take a look at KPI development in action.
Meet Maria, the new CISO at a large hospital that desperately needs security program improvements. Maria’s first move was to learn the true state of the organization’s security. She quickly learned that there was no metrics program in place and that her staff were unaware what, if any, sources were available to pull security metrics from.
After completing her initial probe into available metrics and then investigating the baseline readings, she determined that her areas of greatest concern were around vulnerability and access management. But she also decided it was time to get a security training and awareness program up and running to help mitigate risks in other areas she can’t deal with right away.
See examples of Maria’s KPI development on the next four slides...
Info-Tech Insight
There is very little variation in the kinds of goals people have around initial probes and baseline testing. Metrics in these areas are virtually always about determining what data sources are available to you and what that data actually shows. The real decisions start in determining what you want to do based on the measures you’re seeing.
Metric development example: Vulnerability Management
See examples of Maria’s KPI development on the next four slides...
Goal: Implement vulnerability management program
KPI: % increase of insight into existing vulnerabilities
Associated Metric: # of vulnerability detection methods
Goal: Improve deployment time for patches
KPI: % of critical patches fully deployed within target window
Goal: Implement MFA for privileged accounts
KPI: % of privileged accounts with MFA applied
Associated Metric: # of privileged accounts
Goal: Remove all unnecessary privileged accounts
KPI: % of accounts with unnecessary privileges
Goal: Implement training and awareness program
KPI: % of organization trained
Associated Metric: # of departments trained
Goal: Improve time to report phishing
KPI: % of phishing cases reported within target window
Goal: Predict Data Breach Likelihood
1.2 120 minutes
Follow the example of the CISO in the previous slides and try developing KPIs for the SMART goals set in step 1.1.
1.2 Security Metrics Determination and Tracking Tool
Tab “3. Identify Goal KPIs” allows you to record each KPI and its accompanying metadata:
Optionally, each KPI can be mapped to goals defined on tab “2. Identify Security Goals.”
Info-Tech Best Practice
Ensure your metadata is comprehensive, complete, and realistic. A different employee should be able to use only the information outlined in the metadata to continue collecting measurements for the program.
1.2 KPI Development Worksheet
Follow the examples contained in this slide deck and practice creating KPIs for:
As well as drafting associated metrics to inform the KPIs you create.
Info-Tech Best Practice
Keep your metrics program manageable. This exercise may produce more goals, metrics, and KPIs than you deal with all at once. But that doesn’t mean you can’t save some for future use.
1.2 120 minutes
An effort map visualizes a cost and benefit analysis. It is a quadrant output that visually shows how your SMART goals were assessed. Use the calculated Cost/Effort Rating and Benefit Rating values from tab “2. Identify Security Goals” of the Security Metrics Determination and Tracking Tool to aid this exercise.
Now that you’ve developed KPIs to monitor progress on your goals, it’s time to use them to drive security program maturation by following these steps:
The term key risk indicator (KRI) gets used in a few different ways. However, in most cases, KRIs are closely associated with KPIs.
1.3 Security Metrics Determination and Tracking Tool
Tracking metric data in Info-Tech's tool provides the following data visualizations:
Info-Tech Best Practice
Be diligent about measuring and tracking your metrics. Record any potential measurement biases or comments on measurement values to ensure you have a comprehensive record for future use. In the tool, this can be done by adding a comment to a cell with a metric measurement.
Workshops offer an easy way to accelerate your project. While onsite, our analysts will work with you and your team to facilitate the activities outlined in the blueprint.
Getting key stakeholders together to formalize the program, while getting started on data discovery and classification, allows you to kickstart the overall program.
In addition, leverage over-the-phone support through Guided Implementations included in advisory memberships to ensure the continuous improvement of the classification program even after the workshop.
Logan Rohde
Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Ian Mulholland
Senior Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Call 1-888-670-8889 for more information.
2.1 Review best practices for presenting metrics
2.2 Strategize your presentation based on metric type
2.3 Tailor your presentation to your audience
2.4 Use your metrics to create a story about risk
2.5 Revise Metrics
This phase will walk you through the following activities:
This phase involves the following participants:
Outcomes of this phase
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of two to three advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 2-4 weeks
Start with an analyst kick-off call:
Then complete these activities…
Review findings with analyst:
Then complete these activities…
With these tools & templates:
Phase 2 Results & Insights:
Avoid technical details (i.e. raw data) by focusing on the KPI.
Put things in terms of risk; it's the language you both understand.
Explain why you’re monitoring metrics in terms of the goals you’re hoping to achieve.
Choose between KPI or KRI as the presentation format.
Match presentation with the audience.
Read between the lines.
Read the news if you’re stuck for content.
Present your metrics as a story.
Metric Type: Initial Probe
Scenario: Implementing your first metrics program.
Decisions: Do you have sufficient insight into the program? (i.e. do you need to acquire additional tools to collect metrics?)
Strategy: If there are no barriers to this (e.g. budget), then focus your presentation on the fact that you are addressing the risk of not knowing what your organization's baseline state is and what potential issues exist but are unknown. This is likely the first phase of an improvement plan, so sketching the overall plan is a good idea too.
Possible KPIs:
Metric Type: Baseline Testing
Scenario: You've taken the metrics to determine what your organization’s normal state is and you're now looking towards addressing your gaps or problem areas.
Decisions: What needs to be prioritized first and why? Are additional resources required to make this happen?
Strategy: Explain your impression of the organization's normal state and what you plan to do about it. In other words, what goals are you prioritizing and why? Be sure to note any challenges that may occur along the way (e.g. staffing).
Possible KPIs:
Metric Type: Implementation
Scenario: You are now implementing solutions to address your security priorities.
Decisions: What, to you, would establish the basis of a program?
Strategy: Focus on what you're doing to implement a certain security need, why, and what still needs to be done when you’re finished.
Possible KPIs:
Metric Type: Improvement
Scenario: Now that a basic program has been established, you are looking to develop its maturity to boost overall performance (i.e. setting a new development goal).
Decisions: What is a reasonable target, given the organization's risk tolerance and current state?
Strategy: Explain that you're now working to tighten up the security program. Note that although things are improving, risk will always remain, so we need to keep it within a threshold that’s proportionate with our risk tolerance.
Possible KPIs:
Metric Type: Organizational Trends
Scenario: You've reached a mature state and now how several KPIs being tracked. You begin to look at several KPIs together (i.e. a KPX) to assess the organization's exposure for certain broad risk trends.
Decisions: Which KPIs can be used together to look at broader risks?
Strategy: Focus on the overall likelihood of a certain risk and why you've chosen to assess it with your chosen KPIs. Spend some time discussing what factors affect the movement of these KPIs, demonstrating how smaller behaviors create a ripple effect that affects the organization’s exposure to large-scale risks.
Possible KPX: Insider Threat Risk
Even challenges can elicit useful metrics.
Not every security program is capable of progressing smoothly through the various metric types. In some cases, it is impossible to move towards goals and metrics for implementation, improvement, or organizational trends because the security program lacks resources.
Info-Tech Insight
When your business is suffering from a lack of resources, acquiring these resources automatically becomes the goal that your metrics should be addressing. To do this, focus on what risks are being created because something is missing.
When your security program is lacking a critical resource, such as staff or technology, your metrics should focus on what security processes are suffering due to this lack. In other words, what critical activities are not getting done?
KPI Examples:
1. Raw Data
2. Management-Level
3. Board-Level
As a general rule, security metrics should become decreasingly technical and increasingly behavior-based as they are presented up the organizational hierarchy.
"The higher you travel up the corporate chain, the more challenging it becomes to create meaningful security metrics. Security metrics are intimately tied to their underlying technologies, but the last thing the CEO cares about is technical details." – Ben Rothke, Senior Information Security Specialist, Tapad.
Reporting metrics is not just another presentation. Rather, it is an opportunity to demonstrate and explain the value of security.
It is also a chance to correct any misconceptions about what security does or how it works.
Use the tips on the right to help make your presentation as relatable as possible.
Info-Tech Insight
There is a difference between data manipulation and strategic presentation: the goal is not to bend the truth, but to present it in a way that allows you to show the board what they need to see and to explain it in terms familiar to them.
Avoid jargon; speak in practical terms
Address compliance
Have solid answers
Security is about managing risk. This is also its primary value to the organization. As such, risk should be the theme of the story you tell.
"Build a cohesive story that people can understand . . . Raw metrics are valuable from an operations standpoint, but at the executive level, it's about a cohesive story that helps executives understand the value of the security program and keeps the company moving forward. "– Adam Ely, CSO and Co-Founder, Bluebox Security, qtd. by Tenable, 2016
The following model encapsulates the basic trajectory of all story development.
Use this model to help you put together your story about risk.
Introduction: Overall assessment of security program.
Initial Incident: Determination of the problems and associated risks.
Rising Action: Creation of goals and metrics to measure progress.
Climax: Major development indicated by metrics.
Falling Action: New insights gained about organization’s risks.
Resolution: Recommendations based on observations.
Info-Tech Best Practice
Follow this model to ensure that your metrics presentation follows a coherent storyline that explains how you assessed the problem, why you chose to address it the way you did, what you learned in doing so, and finally what should be done next to boost the security program’s maturity.
Board-Level KPI
Mgmt.-Level KPI
Raw Data
Think of your lower-level metrics as evidence to back up the story you are telling.
When you’re asked how you arrived at a given conclusion, you know it’s time to go down a level and to explain those results.
Think of this like showing your work.
Info-Tech Insight
This approach is built into the KPX reporting format, but can be used for all metric types by drawing from your associated metrics and goals already achieved.
2.4 Security Metrics Determination and Tracking Tool
Info-Tech provides two options for metric dashboards to meet the varying needs of our members.
If you’re just starting out, you’ll likely be inclined towards the dashboard within the Security Metrics Determination and Tracking Tool (seen here).
But if you’ve already got several KPIs to report on, you may prefer the Security Metrics KPX Dashboard Tool, featured on the following slides.
Info-Tech Best Practice
Not all graphs will be needed in all cases. When presenting, consider taking screenshots of the most relevant data and displaying them in Info-Tech’s Board-Level Security Metrics Presentation Template.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
"An important key to remember is to be consistent and stick to one framework once you've chosen it. As you meet with the same audiences repeatedly, having the same framework for reference will ensure that your communications become smoother over time." – Caroline Wong, Chief Strategy Officer, Cobalt.io
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
2.4 Security Metrics KPX Dashboard
Use Info-Tech’s Security Metrics KPX Dashboard to track and show your work.
This tool helps you convert your KPIs into the language of risk by assessing frequency and severity, which helps to make the risk relatable for senior leadership. However, it is still useful to track fluctuations in terms of percentage. To do this, track changes in the frequency, severity, and trend scores from quarter to quarter.
2.4 Board-Level Security Metrics Presentation Template
Use the Board-Level Security Metrics Presentation Template deck to help structure and deliver your metrics presentation to the board.
To make the dashboard slide, simply copy and paste the charts from the dashboard tool and arrange the images as needed.
Adapt the status report and business alignment slides to reflect the story about risk that you are telling.
Now that you’ve made it through your metrics presentation, it’s important to reassess your goals with feedback from your audience in mind. Use the following workflow.
Workshops offer an easy way to accelerate your project. While onsite, our analysts will work with you and your team to facilitate the activities outlined in the blueprint.
Getting key stakeholders together to formalize the program, while getting started on data discovery and classification, allows you to kickstart the overall program.
In addition, leverage over-the-phone support through Guided Implementations included in advisory memberships to ensure the continuous improvement of the classification program even after the workshop.
Logan Rohde
Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Ian Mulholland
Senior Research Analyst – Security, Risk & Compliance Info-Tech Research Group
Call 1-888-670-8889 for more information.
Mike Creaney, Senior Security Engineer at Federal Home Loan Bank of Chicago
Peter Chestna, Director, Enterprise Head of Application Security at BMO Financial Group
Zane Lackey, Co-Founder / Chief Security Officer at Signal Sciences
Ben Rothke, Senior Information Security Specialist at Tapad
Caroline Wong, Chief Strategy Officer at Cobalt.io
2 anonymous contributors
Build an Information Security Strategy
Tailor best practices to effectively manage information security.
Implement a Security Governance and Management Program
Align security and business objectives to get the greatest benefit from both.
Capability Maturity Model Integration (CMMI). ISACA. Carnegie Mellon University.
Ely, Adam. “Choose Security Metrics That Tell a Story.” Using Security Metrics to Drive Action: 33 Experts Share How to Communicate Security Program Effectiveness to Business Executives and the Board Eds. 2016. Web.
https://www.ciosummits.com/Online_Assets_Tenable_eBook-_Using_Security_Metrics_to_Drive_Action.pdf
ISACA. “Board Director Concerns about Cyber and Technology Risk.” CSX. 11 Sep. 2018. Web.
Rothke, Ben. “CEOs Require Security Metrics with a High-Level Focus.” Using Security Metrics to Drive Action: 33 Experts Share How to Communicate Security Program Effectiveness to Business Executives and the Board Eds. 2016. Web.
https://www.ciosummits.com/Online_Assets_Tenable_eBook-_Using_Security_Metrics_to_Drive_Action.pdf
Wong, Caroline. Security Metrics: A Beginner’s Guide. McGraw Hill: New York, 2012.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Define a digital product vision that takes into account your objectives, business value, stakeholders, customers, and metrics.
Build a structure for your backlog that supports your product vision.
Define standards, ownership for your backlog to effectively communicate your strategy in support of your digital product vision.
Understand what to consider when planning your next release.
Build a plan for communicating and updating your strategy and where to go next.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the elements of a good product vision and the pieces that back it up.
Provide a great foundation for an actionable vision and goals people can align to.
1.1 Build out the elements of an effective digital product vision
Completed product vision definition for a familiar product via the product canvas
Define the standards and approaches to populate your product backlog that support your vision and overall strategy.
A prioritized backlog with quality throughout that enables alignment and the operationalization of the overall strategy.
2.1 Introduction to key activities required to support your digital product vision
2.2 What do we mean by a quality backlog?
2.3 Explore backlog structure and standards
2.4 Define backlog data, content, and quality filters
Articulate the activities required to support the population and validation of your backlog
An understanding of what it means to create a quality backlog (quality filters)
Defining the structural elements of your backlog that need to be considered
Defining the content of your backlog and quality standards
Define standards and procedures for creating and updating your roadmap.
Enable your team to create a product roadmap to communicate your product strategy in support of your digital product vision.
3.1 Disambiguating backlogs vs. roadmaps
3.2 Defining audiences, accountability, and roadmap communications
3.3 Exploring roadmap visualizations
Understand the difference between a roadmap and a backlog
Roadmap standards and agreed-to accountability for roadmaps
Understand the different ways to visualize your roadmap and select what is relevant to your context
Build a release plan aligned to your roadmap.
Understand what goes into defining a release via the release canvas.
Considerations in communication of your strategy.
Understand how to frame your vision to enable the communication of your strategy (via an executive summary).
4.1 Lay out your release plan
4.2 How to introduce your product vision
4.3 Communicate changes to your strategy
4.4 Where do we get started?
Release canvas
An executive summary used to introduce other parties to your product vision
Specifics on communication of the changes to your roadmap
Your first step to getting started
This research is designed to help organizations who are preparing for a merger or acquisition and need help with:
The goal of M&A cybersecurity due diligence is to assess security risks and the potential for compromise. To succeed, you need to look deeper.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Read our concise Executive Brief to find out how to master M&A cyber security due diligence, review Info-Tech’s methodology, and understand how we can support you in completing this project.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the benefits of a robust CXM strategy.
Identify drivers and objectives for CXM using a persona-driven approach and deploy the right applications to meet those objectives.
Complete the initiatives roadmap for CXM.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Establish a consistent vision across IT, marketing, sales, and customer service for CXM technology enablement.
A clear understanding of key business and technology drivers for CXM.
1.1 CXM fireside chat
1.2 CXM business drivers
1.3 CXM vision statement
1.4 Project structure
CXM vision statement
CXM project charter
Create a set of strategic requirements for CXM based on a thorough external market scan and internal capabilities assessment.
Well-defined technology requirements based on rigorous, multi-faceted analysis.
2.1 PEST analysis
2.2 Competitive analysis
2.3 Market and trend analysis
2.4 SWOT analysis
2.5 VRIO analysis
2.6 Channel map
Completed external analysis
Strategic requirements (from external analysis)
Completed internal review
Channel interaction map
Augment strategic requirements through customer persona and scenario development.
Functional requirements aligned to supporting steps in customer interaction scenarios.
3.1 Persona development
3.2 Scenario development
3.3 Requirements definition for CXM
Personas and scenarios
Strategic requirements (based on personas)
Using the requirements identified in the preceding modules, build a future-state application inventory for CXM.
A cohesive, rationalized portfolio of customer interaction applications that aligns with identified requirements and allows investment (or rationalization) decisions to be made.
4.1 Build business process maps
4.2 Review application satisfaction
4.3 Create the CXM application portfolio
4.4 Prioritize applications
Business process maps
Application satisfaction diagnostic
Prioritized CXM application portfolio
Establish repeatable best practices for CXM applications in areas such as data management and end-user adoption.
Best practices for rollout of new CXM applications.
A prioritized initiatives roadmap.
5.1 Create data integration map
5.2 Define adoption best practices
5.3 Build initiatives roadmap
5.4 Confirm initiatives roadmap
Integration map for CXM
End-user adoption plan
Initiatives roadmap
"Customers want to interact with your organization on their own terms, and in the channels of their choice (including social media, mobile applications, and connected devices). Regardless of your industry, your customers expect a frictionless experience across the customer lifecycle. They desire personalized and well-targeted marketing messages, straightforward transactions, and effortless service. Research shows that customers value – and will pay more for! – well-designed experiences.
Strong technology enablement is critical for creating customer experiences that drive revenue. However, most organizations struggle with creating a cohesive technology strategy for customer experience management (CXM). IT leaders need to take a proactive approach to developing a strong portfolio of customer interaction applications that are in lockstep with the needs of their marketing, sales, and customer service teams. It is critical to incorporate the voice of the customer into this strategy.
When developing a technology strategy for CXM, don’t just “pave the cow path,” but instead move the needle forward by providing capabilities for customer intelligence, omnichannel interactions, and predictive analytics. This blueprint will help you build an integrated CXM technology roadmap that drives top-line revenue while rationalizing application spend."
Ben Dickie
Research Director, Customer Experience Strategy
Info-Tech Research Group
Info-Tech Insight
CXM - Customer Experience Management
CX - Customer Experience
CRM - Customer Relationship Management
CSM - Customer Service Management
MMS - Marketing Management System
SMMP - Social Media Management Platform
RFP - Request for Proposal
SaaS - Software as a Service
Today’s consumers expect speed, convenience, and tailored experiences at every stage of the customer lifecycle. Successful organizations strive to support these expectations.
67% of end consumers will pay more for a world-class customer experience. 74% of business buyers will pay more for strong B2B experiences. (Salesforce, 2018)
(Customer Experience Insight, 2016)
Customers expect to interact with organizations through the channels of their choice. Now more than ever, you must enable your organization to provide tailored customer experiences.
Providing a seamless customer experience increases the likelihood of cross-sell and up-sell opportunities and boosts customer loyalty and retention. IT can contribute to driving revenue and decreasing costs by providing the business with the right set of tools, applications, and technical support.
Cross-sell, up-sell, and drive customer acquisition.
67% of consumers are willing to pay more for an upgraded experience. (Salesforce, 2018)
80%: The margin by which CX leaders outperformer laggards in the S&P 500.(Qualtrics, 2017)
59% of customers say tailored engagement based on past interactions is very important to winning their business. (Salesforce, 2018)
Focus on customer retention as well as acquisition.
It is 6-7x more costly to attract a new customer than it is to retain an existing customer. (Salesforce Blog, 2019)
A 5% increase in customer retention has been found to increase profits by 25% to 95%. (Bain & Company, n.d.)
Organizations are prioritizing CXM capabilities (and associated technologies) as a strategic investment. Keep pace with the competition and gain a competitive advantage by creating a cohesive strategy that uses best practices to integrate marketing, sales, and customer support functions.
87% of customers share great experiences they’ve had with a company. (Zendesk, n.d.)
61% of organizations are investing in CXM. (CX Network, 2015)
53% of organizations believe CXM provides a competitive advantage. (Harvard Business Review, 2014)
Top Investment Priorities for Customer Experience
(CX Network 2015)
Get ahead of the competition by doing omnichannel right. Devise a CXM strategy that allows you to create and maintain a consistent, seamless customer experience by optimizing operations within an omnichannel framework. Customers want to interact with you on their own terms, and it falls to IT to ensure that applications are in place to support and manage a wide range of interaction channels.
Omnichannel is a “multi-channel approach to sales that seeks to provide the customer with a seamless transactional experience whether the customer is shopping online from a desktop or mobile device, by telephone, or in a bricks and mortar store.” (TechTarget, 2014)
97% of companies say that they are investing in omnichannel. (Huffington Post, 2015)
23% of companies are doing omnichannel well.
The success of your CXM strategy depends on the effective interaction of various marketing, sales, and customer support functions. To deliver on customer experience, organizations need to take a customer-centric approach to operations.
From an application perspective, a CRM platform generally serves as the unifying repository of customer information, supported by adjacent solutions as warranted by your CXM objectives.
CXM ECOSYSTEM
Customer Relationship Management Platform
CXM solutions are a broad range of tools that provide comprehensive feature sets for supporting customer interaction processes. These suites supplant more basic applications for customer interaction management. Popular solutions that fall under the umbrella of CXM include CRM suites, marketing automation tools, and customer service applications.
Microsoft Dynamics
Adobe
Marketo
sprinklr
Salesforce
SugarCRM
Strong CXM applications can improve:
Technology is the key enabler of building strong customer experiences: IT must stand shoulder-to-shoulder with the business to develop a technology framework for CXM.
(Harvard Business Review, 2014)
Only 19% of organizations have a customer experience team tasked with bridging gaps between departments. (Genesys, 2018)
IT and Marketing can only tackle CXM with the full support of each other. The cooperation of the departments is crucial when trying to improve CXM technology capabilities and customer interaction and drive a strong revenue mandate.
CASE STUDY
Industry Entertainment
Source Forbes, 2014
Blockbuster
As the leader of the video retail industry, Blockbuster had thousands of retail locations internationally and millions of customers. Blockbuster’s massive marketing budget and efficient operations allowed it to dominate the competition for years.
Situation
Trends in Blockbuster’s consumer market changed in terms of distribution channels and customer experience. As the digital age emerged and developed, consumers were looking for immediacy and convenience. This threatened Blockbuster’s traditional, brick-and-mortar B2C operating model.
The Competition
Netflix entered the video retail market, making itself accessible through non-traditional channels (direct mail, and eventually, the internet).
Results
Despite long-term relationships with customers and competitive standing in the market, Blockbuster’s inability to understand and respond to changing technology trends and customer demands led to its demise. The organization did not effectively leverage internal or external networks or technology to adapt to customer demands. Blockbuster went bankrupt in 2010.
Customer Relationship Management
Blockbuster did not leverage emerging technologies to effectively respond to trends in its consumer network. It did not optimize organizational effectiveness around customer experience.
CASE STUDY
Industry Entertainment
Source Forbes, 2014
Netflix
Beginning as a mail-out service, Netflix offered subscribers a catalog of videos to select from and have mailed to them directly. Customers no longer had to go to a retail store to rent a video. However, the lack of immediacy of direct mail as the distribution channel resulted in slow adoption.
The Situation
In response to the increasing presence of tech-savvy consumers on the internet, Netflix invested in developing its online platform as its primary distribution channel. The benefit of doing so was two-fold: passive brand advertising (by being present on the internet) and meeting customer demands for immediacy and convenience. Netflix also recognized the rising demand for personalized service and created an unprecedented, tailored customer experience.
The Competition
Blockbuster was the industry leader in video retail but was lagging in its response to industry, consumer, and technology trends around customer experience.
Results
Netflix’s disruptive innovation is built on the foundation of great CXM. Netflix is now a $28 billion company, which is tenfold what Blockbuster was worth.
Customer Relationship Management Platform
Netflix used disruptive technologies to innovatively build a customer experience that put it ahead of the long-time, video rental industry leader, Blockbuster.
Creating an end-to-end technology-enablement strategy for CXM requires a concerted, dedicated effort: Info-Tech can help with our proven approach.
Build the CXM Project Charter
Conduct a Thorough Environmental Scan
Build Customer Personas and Scenarios
Draft Strategic CXM Requirements
Build the CXM Application Portfolio
Implement Operational Best Practices
Info-Tech draws on best-practice research and the experiences of our global member base to develop a methodology for CXM that is driven by rigorous customer-centric analysis.
Our approach uses a unique combination of techniques to ensure that your team has done its due diligence in crafting a forward-thinking technology-enablement strategy for CXM that creates measurable value.
CASE STUDY
Industry Professionals Services
Source Info-Tech Workshop
The Situation
A global professional services firm in the B2B space was experiencing a fragmented approach to customer engagement, particularly in the pre-sales funnel. Legacy applications weren’t keeping pace with an increased demand for lead evaluation and routing technology. Web experience management was also an area of significant concern, with a lack of ongoing customer engagement through the existing web portal.
The Approach
Working with a team of Info-Tech facilitators, the company was able to develop several internal and external customer personas. These personas formed the basis of strategic requirements for a new CXM application stack, which involved dedicated platforms for core CRM, lead automation, web content management, and site analytics.
Results
Customer “stickiness” metrics increased, and Sales reported significantly higher turnaround times in lead evaluations, resulting in improved rep productivity and faster cycle times.
| Components of a persona | |
|---|---|
| Name | Name personas to reflect a key attribute such as the persona’s primary role or motivation. |
| Demographic | Include basic descriptors of the persona (e.g. age, geographic location, preferred language, education, job, employer, household income, etc.) |
| Wants, needs, pain points | Identify surface-level motivations for buying habits. |
| Psychographic/behavioral traits | Observe persona traits that are representative of the customers’ behaviors (e.g. attitudes, buying patterns, etc.). |
Create the Project Vision
Structure the Project
Scan the External Environment
Assess the Current State of CXM
Create an Application Portfolio
Develop Deployment Best Practices
Create an Initiative Rollout Plan
Confirm and Finalize the CXM Blueprint
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Diagnostics and consistent frameworks used throughout all four options
| 1. Drive Value With CXM | 2. Create the Framework | 3. Finalize the Framework | |
|---|---|---|---|
| Best-Practice Toolkit | 1.1 Create the Project Vision 1.2 Structure the CXM Project |
2.1 Scan the External Environment 2.2 Assess the Current State of CXM 2.3 Create an Application Portfolio 2.4 Develop Deployment Best Practices |
3.1 Create an Initiative Rollout Plan 3.2 Confirm and Finalize the CXM Blueprint |
| Guided Implementations |
|
|
|
| Onsite Workshop | Module 1: Drive Measurable Value with a World-Class CXM Program | Module 2: Create the Strategic Framework for CXM | Module 3: Finalize the CXM Framework |
Phase 1 Outcome:
|
Phase 2 Outcome:
|
Phase 3 Outcome:
|
Contact your account representative or email Workshops@InfoTech.com for more information.
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | Workshop Day 5 | |
|---|---|---|---|---|---|
| Activities | Create the Vision for CXM Enablement 1.1 CXM Fireside Chat 1.2 CXM Business Drivers 1.3 CXM Vision Statement 1.4 Project Structure |
Conduct the Environmental Scan and Internal Review 2.1 PEST Analysis 2.2 Competitive Analysis 2.3 Market and Trend Analysis 2.4 SWOT Analysis 2.5 VRIO Analysis 2.6 Channel Mapping |
Build Personas and Scenarios 3.1 Persona Development 3.2 Scenario Development 3.3 Requirements Definition for CXM |
Create the CXM Application Portfolio 4.1 Build Business Process Maps 4.2 Review Application Satisfaction 4.3 Create the CXM Application Portfolio 4.4 Prioritize Applications |
Review Best Practices and Confirm Initiatives 5.1 Create Data Integration Map 5.2 Define Adoption Best Practices 5.3 Build Initiatives Roadmap 5.4 Confirm Initiatives Roadmap |
| Deliverables |
|
|
|
|
|
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 2 weeks
Step 1.1: Create the Project Vision
Start with an analyst kick-off call:
Then complete these activities…
With these tools & templates:
Step 1.2: Structure the Project
Review findings with analyst:
Then complete these activities…
With these tools & templates:
Phase 1 Results & Insights:
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
An aligned, optimized CX strategy is:
Rapid: to intentionally and strategically respond to quickly-changing opportunities and issues.
Outcome-based: to make key decisions based on strong business cases, data, and analytics in addition to intuition and judgment.
Rigorous: to bring discipline and science to bear; to improve operations and results.
Collaborative: to conduct activities in a broader ecosystem of partners, suppliers, vendors, co-developers, and even competitors.
(The Wall Street Journal, 2013)
Info-Tech Insight
If IT fails to adequately support marketing, sales, and customer service teams, the organization’s revenue will be in direct jeopardy. As a result, CIOs and Applications Directors must work with their counterparts in these departments to craft a cohesive and comprehensive strategy for using technology to create meaningful (and profitable) customer experiences.
1.1.1 30 minutes
1.1.2 30 minutes
There’s no silver bullet for developing a strategy. You can encounter pitfalls at a myriad of different points including not involving the right stakeholders from the business, not staying abreast of recent trends in the external environment, and not aligning sales, marketing, and support initiatives with a focus on the delivery of value to prospects and customers.
Common Pitfalls When Creating a Technology-Enablement Strategy for CXM
Senior management is not involved in strategy development.
Not paying attention to the “art of the possible.”
“Paving the cow path” rather than focusing on revising core processes.
Misalignment between objectives and financial/personnel resources.
Inexperienced team on either the business or IT side.
Not paying attention to the actions of competitors.
Entrenched management preferences for legacy systems.
Sales culture that downplays the potential value of technology or new applications.
IT →Marketing, Sales, and Service →External Customers
Internal-Facing Applications
Customer-Facing Applications
Info-Tech Insight
IT often overlooks direct customer considerations when devising a technology strategy for CXM. Instead, IT leaders rely on other business stakeholders to simply pass on requirements. By sitting down with their counterparts in marketing and sales, and fully understanding business drivers and customer personas, IT will be much better positioned to roll out supporting applications that drive customer engagement.
1.1.3 30 minutes
| Business Driver Name | Driver Assumptions, Capabilities, and Constraints | Impact on CXM Strategy |
|---|---|---|
| High degree of customer-centric solution selling | A technically complex product means that solution selling approaches are employed – sales cycles are long. | There is a strong need for applications and data quality processes that support longer-term customer relationships rather than transactional selling. |
| High desire to increase scalability of sales processes | Although sales cycles are long, the organization wishes to increase the effectiveness of rep time via marketing automation where possible. | Sales is always looking for new ways to leverage their reps for face-to-face solution selling while leaving low-level tasks to automation. Marketing wants to support these tasks. |
| Highly remote sales team and unusual hours are the norm | Not based around core hours – significant overtime or remote working occurs frequently. | Misalignment between IT working only core hours and after-hours teams leads to lag times that can delay work. Scheduling of preventative sales maintenance must typically be done on weekends rather than weekday evenings. |
1.1.4 30 minutes
| IT Driver Name | Driver Assumptions, Capabilities, and Constraints | Impact on CXM Strategy |
|---|---|---|
| Sales Application Procurement Methodology | Strong preference for on-premise COTS deployments over homebrewed applications. | IT may not be able to support cloud-based sales applications due to security requirements for on premise. |
| Vendor Relations | Minimal vendor relationships; SLAs not drafted internally but used as part of standard agreement. | IT may want to investigate tightening up SLAs with vendors to ensure more timely support is available for their sales teams. |
| Development Methodology | Agile methodology employed, some pockets of Waterfall employed for large-scale deployments. | Agile development means more perfective maintenance requests come in, but it leads to greater responsiveness for making urgent corrective changes to non-COTS products. |
| Data Quality Approach | IT sees as Sales’ responsibility | IT is not standing as a strategic partner for helping to keep data clean, causing dissatisfaction from customer-facing departments. |
| Staffing Availability | Limited to 9–5 | Execution of sales support takes place during core hours only, limiting response times and access for on-the-road sales personnel. |
1.1.5 30 minutes
1. Based on the IT and business drivers identified, craft guiding principles for CXM technology enablement. Keep guiding principles in mind throughout the project and ensure they support (or reconcile) the business and IT drivers.
| Guiding Principle | Description |
|---|---|
| Sales processes must be scalable. | Our sales processes must be able to reach a high number of target customers in a short time without straining systems or personnel. |
| Marketing processes must be high touch. | Processes must be oriented to support technically sophisticated, solution-selling methodologies. |
2. Summarize the guiding principles above by creating a CXM mission statement. See below for an example.
Example: CXM Mission Statement
To ensure our marketing, sales and service team is equipped with tools that will allow them to reach out to a large volume of contacts while still providing a solution-selling approach. This will be done with secure, on-premise systems to safeguard customer data.
Determine if now is the right time to move forward with building (or overhauling) your technology-enablement strategy for CXM.
Not all organizations will be able to proceed immediately to optimize their CXM technology enablement. Determine if the organizational willingness, backbone, and resources are present to commit to overhauling the existing strategy. If you’re not ready to proceed, consider waiting to begin this project until you can procure the right resources.
1.1.3; 1.1.4; 1.1.5 - Identify business and IT drivers to create CXM guiding principles
The facilitator will work with stakeholders from both the business and IT to identify implicit or explicit strategic drivers that will support (or pose constraints on) the technology-enablement framework for the CXM strategy. In doing so, guiding principles will be established for the project.
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
CXM Strategy Project Charter Template
1.2.1 CXM Strategy Project Charter Template
Having a project charter is the first step for any project: it specifies how the project will be resourced from a people, process, and technology perspective, and it clearly outlines major project milestones and timelines for strategy development. CXM technology enablement crosses many organizational boundaries, so a project charter is a very useful tool for ensuring everyone is on the same page.
Sections of the document:
INFO-TECH DELIVERABLE
CXM Strategy Project Charter Template
Populate the relevant sections of your project charter as you complete activities 1.2.2-1.2.8.
Understand the role of each player within your project structure. Look for listed participants on the activities slides to determine when each player should be involved.
| Title | Role Within Project Structure |
|---|---|
| Project Sponsor |
|
| Project Manager |
|
| Business Lead |
|
| Project Team |
|
| Steering Committee |
|
Info-Tech Insight
Do not limit project input or participation to the aforementioned roles. Include subject matter experts and internal stakeholders at particular stages within the project. Such inputs can be solicited on a one-off basis as needed. This ensures you take a holistic approach to creating your CXM technology-enablement strategy.
1.2.2 30 minutes
Hold a meeting with IT, Marketing, Sales, Service, Operations, and any other impacted business stakeholders that have input into CXM to accomplish the following:
Info-Tech Insight
Going forward, set up a quarterly review process to understand changing needs. It is rare that organizations never change their marketing and sales strategy. This will change the way the CXM will be utilized.
In order to gauge the effectiveness of CXM technology enablement, establish core metrics:
| Metric Description | Current Metric | Future Goal |
|---|---|---|
| Market Share | 25% | 35% |
| Share of Voice (All Channels) | 40% | 50% |
| Average Deal Size | $10,500 | $12,000 |
| Account Volume | 1,400 | 1,800 |
| Average Time to Resolution | 32 min | 25 min |
| First Contact Resolution | 15% | 35% |
| Web Traffic per Month (Unique Visitors) | 10,000 | 15,000 |
| End-User Satisfaction | 62% | 85%+ |
| Other metric | ||
| Other metric | ||
| Other metric |
Be sure to understand what is in scope for a CXM strategy project. Prevent too wide of a scope to avoid scope creep – for example, we aren’t tackling ERP or BI under CXM.
Establishing the parameters of the project in a scope statement helps define expectations and provides a baseline for resource allocation and planning. Future decisions about the strategic direction of CXM will be based on the scope statement.
Well-executed requirements gathering will help you avoid expanding project parameters, drawing on your resources, and contributing to cost overruns and project delays. Avoid scope creep by gathering high-level requirements that lead to the selection of category-level application solutions (e.g. CRM, MMS, SMMP, etc.), rather than granular requirements that would lead to vendor application selection (e.g. Salesforce, Marketo, Hootsuite, etc.).
Out-of-scope items should also be defined to alleviate ambiguity, reduce assumptions, and further clarify expectations for stakeholders. Out-of-scope items can be placed in a backlog for later consideration. For example, fulfilment and logistics management is out of scope as it pertains to CXM.
| In Scope | ||
|---|---|---|
| Strategy | ||
| High-Level CXM Application Requirements | CXM Strategic Direction | Category Level Application Solutions (e.g. CRM, MMS, etc.) |
| Out of Scope | ||
|---|---|---|
| Software Selection | ||
| Vendor Application Review | Vendor Application Selection | Granular Application System Requirements |
1.2.3 30 minutes
To form your scope statement, ask the following questions:
Consider the core team functions when composing the project team. Form a cross-functional team (i.e. across IT, Marketing, Sales, Service, Operations) to create a well-aligned CXM strategy.
| Required Skills/Knowledge | Suggested Project Team Members |
|---|---|
| IT | |
|
|
| Business | |
|
|
| Other | |
|
|
Info-Tech Insight
Don’t let your project team become too large when trying to include all relevant stakeholders. Carefully limiting the size of the project team will enable effective decision making while still including functional business units such as marketing, sales, service, and finance, as well as IT.
1.2.4 45 minutes
Build a list of the core CXM strategy team members, and then structure a RACI chart with the relevant categories and roles for the overall project.
Responsible - Conducts work to achieve the task
Accountable - Answerable for completeness of task
Consulted - Provides input for the task
Informed - Receives updates on the task
Info-Tech Insight
Avoid missed tasks between inter-functional communications by defining roles and responsibilities for the project as early as possible.
Benefits of Assigning RACI Early:
1.2.5 30 minutes
| Example: RACI Chart | Project Sponsor (e.g. CMO) | Project Manager (e.g. Applications Manager) | Business Lead (e.g. Marketing Director) | Steering Committee (e.g. PM, CMO, CFO…) | Project Team (e.g. PM, BL, SMEs…) |
|---|---|---|---|---|---|
| Assess Project Value | I | C | A | R | C |
| Conduct a Current State Assessment | I | I | A | C | R |
| Design Application Portfolio | I | C | A | R | I |
| Create CXM Roadmap | R | R | A | I | I |
| ... | ... | ... | ... | ... | ... |
1.2.6 30 minutes
| Key Activities | Start Date | End Date | Target | Status | Resource(s) |
|---|---|---|---|---|---|
| Structure the Project and Build the Project Team | |||||
| Articulate Business Objectives and Define Vision for Future State | |||||
| Document Current State and Assess Gaps | |||||
| Identify CXM Technology Solutions | |||||
| Build the Strategy for CXM | |||||
| Implement the Strategy |
| Management Support | Change Management | IT Readiness | |
|---|---|---|---|
| Definition | The degree of understanding and acceptance of CXM as a concept and necessary portfolio of technologies. | The degree to which employees are ready to accept change and the organization is ready to manage it. | The degree to which the organization is equipped with IT resources to handle new systems and processes. |
| Assessment Outcomes |
|
|
|
| Risk |
|
|
|
1.2.7 45 minutes
Likelihood:
1 - High/Needs Focus
2 - Can Be Mitigated
3 - Unlikely
Impact
1 - High Impact
2 - Moderate Impact
3 - Minimal Impact
Example: Risk Register and Mitigation Tactics
| Risk | Impact | Likelihood | Mitigation Effort |
|---|---|---|---|
| Cost of time and implementation: designing a robust portfolio of CXM applications can be a time consuming task, representing a heavy investment for the organization | 1 | 1 |
|
| Availability of resources: lack of in-house resources (e.g. infrastructure, CXM application developers) may result in the need to insource or outsource resources | 1 | 2 |
|
1.2.8 45 minutes
Before beginning to develop the CXM strategy, validate the project charter and metrics with senior sponsors or stakeholders and receive their approval to proceed.
Info-Tech Insight
In most circumstances, you should have your CXM strategy project charter validated with the following stakeholders:
1.2.2 Define project purpose, objectives, and business metrics
Through an in-depth discussion, an analyst will help you prioritize corporate objectives and organizational drivers to establish a distinct project purpose.
1.2.3 Define the scope of the CXM strategy
An analyst will facilitate a discussion to address critical questions to understand your distinct business needs. These questions include: What are the major coverage points? Who will be using the system?
1.2.4; 1.2.5; 1.2.6 Create the CXM project team, build a RACI chart, and establish a timeline
Our analysts will guide you through how to create a designated project team to ensure the success of your CXM strategy and suite selection initiative, including project milestones and team composition, as well as designated duties and responsibilities.
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 4 weeks
Step 2.1: Scan the External Environment
Start with an analyst kick-off call:
Then complete these activities…
With these tools & templates:
CXM Strategy Stakeholder Presentation Template
Step 2.2: Assess the Current State for CRM
Review findings with analyst:
Then complete these activities…
With these tools & templates:
CXM Strategy Stakeholder Presentation Template
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 4 weeks
Step 2.3: Create an Application Portfolio
Start with an analyst kick-off call:
Then complete these activities…
With these tools & templates:
CXM Portfolio Designer
CXM Strategy Stakeholder Presentation Template
CXM Business Process Shortlisting Tool
Step 2.4: Develop Deployment Best Practices
Review findings with analyst:
Then complete these activities…
With these tools & templates:
CXM Strategy Stakeholder Presentation Template
Phase 2 Results & Insights:
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
Establish the drivers, enablers, and barriers to developing a CXM technology enablement strategy. In doing so, consider needs, environmental factors, organizational drivers, and technology drivers as inputs.
CXM Strategy
| Business Needs | Organizational Drivers | Technology Drivers | Environmental Factors | |
|---|---|---|---|---|
| Definition | A business need is a requirement associated with a particular business process (for example, Marketing needs customer insights from the website – the business need would therefore be web analytics capabilities). | Organizational drivers can be thought of as business-level goals. These are tangible benefits the business can measure such as customer retention, operation excellence, and financial performance. | Technology drivers are technological changes that have created the need for a new CXM enablement strategy. Many organizations turn to technology systems to help them obtain a competitive edge. | External considerations are factors taking place outside of the organization that are impacting the way business is conducted inside the organization. These are often outside the control of the business. |
| Examples |
|
|
|
|
Info-Tech Insight
A common organizational driver is to provide adequate technology enablement across multiple channels, resulting in a consistent customer experience. This driver is a result of external considerations. Many industries today are highly competitive and rapidly changing. To succeed under these pressures, you must have a rationalized portfolio of enterprise applications for customer interaction.
2.1.1 30 minutes

Take stock of internal challenges and barriers to effective CXM strategy execution.
Example: Internal Challenges & Potential Barriers
| Understanding the Customer | Change Management | IT Readiness | |
|---|---|---|---|
| Definition | The degree to which a holistic understanding of the customer can be created, including customer demographic and psychographics. | The degree to which employees are ready to accept operational and cultural changes and the degree to which the organization is ready to manage it. | The degree to which IT is ready to support new technologies and processes associated with a portfolio of CXM applications. |
| Questions to Ask |
|
|
|
| Implications |
|
|
|
2.1.2 30 minutes

Existing internal conditions, capabilities, and resources can create opportunities to enable the CXM strategy. These opportunities are critical to overcoming challenges and barriers.
Example: Opportunities to Leverage for Strategy Enablement
| Management Buy-In | Customer Data Quality | Current Technology Portfolio | |
|---|---|---|---|
| Definition | The degree to which upper management understands and is willing to enable a CXM project, complete with sponsorship, funding, and resource allocation. | The degree to which customer data is accurate, consistent, complete, and reliable. Strong customer data quality is an opportunity – poor data quality is a barrier. | The degree to which the existing portfolio of CXM-supporting enterprise applications can be leveraged to enable the CXM strategy. |
| Questions to Ask |
|
|
|
| Implications |
|
|
|
2.1.3 30 minutes

A successful CXM strategy requires a comprehensive understanding of an organization’s overall corporate strategy and its effects on the interrelated departments of marketing, sales, and service, including subsequent technology implications. For example, a CXM strategy that emphasizes tools for omnichannel management and is at odds with a corporate strategy that focuses on only one or two channels will fail.
Corporate Strategy
CXM Strategy
Unified Strategy
Info-Tech Insight
Your organization’s corporate strategy is especially important in dictating the direction of the CXM strategy. Corporate strategies are often focused on customer-facing activity and will heavily influence the direction of marketing, sales, customer service, and consequentially, CXM. Corporate strategies will often dictate market targeting, sales tactics, service models, and more.
Identifying organizational objectives of high priority will assist in breaking down CXM objectives to better align with the overall corporate strategy and achieve buy-in from key stakeholders.
| Corporate Objectives | Aligned CXM Technology Objectives | ||
|---|---|---|---|
| Increase Revenue | Enable lead scoring | Deploy sales collateral management tools | Improve average cost per lead via a marketing automation tool |
| Enhance Market Share | Enhance targeting effectiveness with a CRM | Increase social media presence via an SMMP | Architect customer intelligence analysis |
| Improve Customer Satisfaction | Reduce time-to-resolution via better routing | Increase accessibility to customer service with live chat | Improve first contact resolution with customer KB |
| Increase Customer Retention | Use a loyalty management application | Improve channel options for existing customers | Use customer analytics to drive targeted offers |
| Create Customer-Centric Culture | Ensure strong training and user adoption programs | Use CRM to provide 360-degree view of all customer interaction | Incorporate the voice of the customer into product development |
2.1.4 30 minutes
Industry E-Commerce
Source Pardot, 2012
Amazon.com, Inc. is an American electronic commerce and cloud computing company. It is the largest e-commerce retailer in the US.
Amazon originated as an online book store, later diversifying to sell various forms of media, software, games, electronics, apparel, furniture, food, toys, and more.
By taking a data-driven approach to marketing and sales, Amazon was able to understand its customers’ needs and wants, penetrate different product markets, and create a consistently personalized online-shopping customer experience that keeps customers coming back.
Use Browsing Data Effectively
Amazon leverages marketing automation suites to view recent activities of prospects on its website. In doing so, a more complete view of the customer is achieved, including insights into purchasing interests and site navigation behaviors.
Optimize Based on Interactions
Using customer intelligence, Amazon surveys and studies standard engagement metrics like open rate, click-through rate, and unsubscribes to ensure the optimal degree of marketing is being targeted to existing and prospective customers, depending on level of engagement.
Insights gained from having a complete understanding of the customer (from basic demographic characteristics provided in customer account profiles to observed psychographic behaviors captured by customer intelligence applications) are used to personalize Amazon’s sales and marketing approaches. This is represented through targeted suggestions in the “recommended for you” section of the browsing experience and tailored email marketing.
It is this capability, partnered with the technological ability to observe and measure customer engagement, that allows Amazon to create individual customer experiences.
Do not develop your CXM technology strategy in isolation. Work with Marketing to understand your STP strategy (segmentation, targeting, positioning): this will inform persona development and technology requirements downstream.
Market Segmentation
Market Targeting
Product Positioning
Info-Tech Insight
It is at this point that you should consider the need for and viability of an omnichannel approach to CXM. Through which channels do you target your customers? Are your customers present and active on a wide variety of channels? Consider how you can position your products, services, and brand through the use of omnichannel methodologies.
2.1.5 1 hour
2.1.5 30 minutes
Example: Competitive Implications
| Competitor Organization | Recent Initiative | Associated Technology | Direction of Impact | Competitive Implication |
|---|---|---|---|---|
| Organization X | Multichannel E-Commerce Integration | WEM – hybrid integration | Positive |
|
| Organization Y | Web Social Analytics | WEM | Positive |
|
A PEST analysis is a structured planning method that identifies external environmental factors that could influence the corporate and IT strategy.
Political - Examine political factors, such as relevant data protection laws and government regulations.
Economic - Examine economic factors, such as funding, cost of web access, and labor shortages for maintaining the site(s).
Technological - Examine technological factors, such as new channels, networks, software and software frameworks, database technologies, wireless capabilities, and availability of software as a service.
Social - Examine social factors, such as gender, race, age, income, and religion.
Info-Tech Insight
When looking at opportunities and threats, PEST analysis can help to ensure that you do not overlook external factors, such as technological changes in your industry. When conducting your PEST analysis specifically for CXM, pay particular attention to the rapid rate of change in the technology bucket. New channels and applications are constantly emerging and evolving, and seeing differential adoption by potential customers.
2.1.6 30 minutes
Example: PEST Analysis
Political
Economic
Technological
Social
2.1.7 30 minutes
For each PEST quadrant:
Example: Parsing Requirements from PEST Analysis
Technological Trend: There has been a sharp increase in popularity of mobile self-service models for buying habits and customer service access.
Goal: Streamline mobile application to be compatible with all mobile devices. Create consistent branding across all service delivery applications (e.g. website, etc.).
Strategic Requirement: Develop a native mobile application while also ensuring that resources through our web presence are built with responsive design interface.
Creating a customer-centric CXM technology strategy requires archetypal customer personas. Creating customer personas will enable you to talk concretely about them as consumers of your customer experience and allow you to build buyer scenarios around them.
A persona (or archetypal user) is an invented person that represents a type of user in a particular use-case scenario. In this case, personas can be based on real customers.
| Components of a persona | Example – Organization: Grocery Store | |
|---|---|---|
| Name | Name personas to reflect a key attribute such as the persona’s primary role or motivation | Brand Loyal Linda: A stay-at-home mother dedicated to maintaining and caring for a household of 5 people |
| Demographic | Include basic descriptors of the persona (e.g. age, geographic location, preferred language, education, job, employer, household income, etc.) | Age: 42 years old Geographic location: London Suburbia Language: English Education: Post-secondary Job: Stay-at-home mother Annual Household Income: $100,000+ |
| Wants, needs, pain points | Identify surface-level motivations for buying habits | Wants: Local products Needs: Health products; child-safe products Pain points: Fragmented shopping experience |
| Psychographic/behavioral traits | Observe persona traits that are representative of the customers’ behaviors (e.g. attitudes, buying patterns, etc.) | Psychographic: Detail-oriented, creature of habit Behavioral: Shops at large grocery store twice a week, visits farmers market on Saturdays, buys organic products online |
2.1.8 2 hours
Project Team
Info-Tech Insight
For CXM, persona building is typically used for understanding the external customer; however, if you need to gain a better understanding of the organization’s internal customers (those who will be interacting with CXM applications), personas can also be built for this purpose. Examples of useful internal personas are sales managers, brand managers, customer service directors, etc.
Post-secondary educated, white-collar professional, three children
Goals & Objectives
Behaviors
Services of Interest
Traits
General Literacy - High
Digital Literacy - Mid-High
Detail-Oriented - High
Willing to Try New Things - Mid-High
Motivated and Persistent - Mid-High
Time Flexible - Mid-High
Familiar With [Red.] - Mid
Access to [Red.] Offices - High
Access to Internet - High
Single, college educated, planning vacation in [redacted], interested in [redacted] job opportunities
Goals & Objectives
Behaviors
Services of Interest
Traits
General Literacy - Mid
Digital Literacy - High
Detail-Oriented - Mid
Willing to Try New Things - High
Motivated and Persistent - Mid
Time Flexible - Mid-High
Familiar With [Red.] - Low
Access to [Red.] Offices - Low
Access to Internet - High
15-year resident of [redacted], high school education, waiter, recently divorced, two children
Goals & Objectives
Behaviors
Services of Interest
Traits
General Literacy - Mid
Digital Literacy - Mid-Low
Detail-Oriented - Mid-Low
Willing to Try New Things - Mid
Motivated and Persistent - High
Time Flexible - Mid
Familiar With [Red.] - Mid-High
Access to [Red.] Offices - High
Access to Internet - High
Single, [redacted] resident, high school graduate
Goals & Objectives
Behaviors
Services of Interest
Traits
General Literacy - Mid
Digital Literacy - Mid
Detail-Oriented - Mid-Low
Willing to Try New Things - Mid-High
Motivated and Persistent - Mid-Low
Time Flexible - High
Familiar With [Red.] - Mid-Low
Access to [Red.] Offices - Mid-Low
Access to Internet - Mid
A scenario is a story or narrative that helps explore the set of interactions that a customer has with an organization. Scenario mapping will help parse requirements used to design the CXM application portfolio.
A Good Scenario…
Scenarios Are Used To…
To Create Good Scenarios…
2.1.9 1.5 hours
Example: Scenario Map
Persona Name: Brand Loyal Linda
Scenario Goal: File a complaint about in-store customer service
Look up “[Store Name] customer service” on public web. →Reach customer support landing page. →Receive proactive notification prompt for online chat with CSR. →Initiate conversation: provide order #. →CSR receives order context and information. →Customer articulates problem, CSR consults knowledgebase. →Discount on next purchase offered. →Send email with discount code to Brand Loyal Linda.
2.1.1; 2.1.2; 2.1.3; 2.1.4 - Create a CXM operating model
An analyst will facilitate a discussion to identify what impacts your CXM strategy and how to align it to your corporate strategy. The discussion will take different perspectives into consideration and look at organizational drivers, external environmental factors, as well as internal barriers and enablers.
2.1.5 Conduct a competitive analysis
Calling on their depth of expertise in working with a broad spectrum of organizations, our facilitator will help you work through a structured, systematic evaluation of competitors’ actions when it comes to CXM.
2.1.6; 2.1.7 - Conduct a PEST analysis
The facilitator will use guided conversation to target each quadrant of the PEST analysis and help your organization fully enumerate political, economic, social, and technological trends that will influence your CXM strategy. Our analysts are deeply familiar with macroenvironmental trends and can provide expert advice in identifying areas of concern in the PEST and drawing strategic requirements as implications.
2.1.8; 2.1.9 - Build customer personas and subsequent persona scenarios
Drawing on the preceding exercises as inputs, the facilitator will help the team create and refine personas, create respective customer interaction scenarios, and parse strategic requirements to support your technology portfolio for CXM.
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
A SWOT analysis is a structured planning method that evaluates the strengths, weaknesses, opportunities, and threats involved in a project.
Strengths - Strengths describe the positive attributes that are within your control and internal to your organization (i.e. what do you do better than anyone else?)
Weaknesses - Weaknesses are internal aspects of your business that place you at a competitive disadvantage; think of what you need to enhance to compete with your top competitor.
Opportunities - Opportunities are external factors the project can capitalize on. Think of them as factors that represent reasons your business is likely to prosper.
Threats - Threats are external factors that could jeopardize the project. While you may not have control over these, you will benefit from having contingency plans to address them if they occur.
Info-Tech Insight
When evaluating weaknesses of your current CXM strategy, ensure that you’re taking into account not just existing applications and business processes, but also potential deficits in your organization’s channel strategy and go-to-market messaging.
2.2.1 30 minutes
Example: SWOT Analysis
Strengths
Weaknesses
Opportunities
Threats
2.2.2 30 minutes
For each SWOT quadrant:
Example: Parsing Requirements from SWOT Analysis
Weakness: Customer service inaccessible in real-time through website or mobile application.
Goal: Increase the ubiquity of access to customer service knowledgebase and agents through a web portal or mobile application.
Strategic Requirement: Provide a live chat portal that matches the customer with the next available and qualified agent.
Applications are the bedrock of technology enablement for CXM. Review your current application portfolio to identify what is working well and what isn’t.
Build the CXM Application Inventory →Assess Usage and Satisfaction →Map to Business Processes and Determine Dependencies →Determine Grow/Maintain/ Retire for Each Application
When assessing the CXM applications portfolio, do not cast your net too narrowly; while CRM and MMS applications are often top of mind, applications for digital asset management and social media management are also instrumental for ensuring a well-integrated CX.
Identify dependencies (either technical or licensing) between applications. This dependency tracing will come into play when deciding which applications should be grown (invested in), which applications should be maintained (held static), and which applications should be retired (divested).
Info-Tech Insight
Shadow IT is prominent here! When building your application inventory, ensure you involve Marketing, Sales, and Service to identify any “unofficial” SaaS applications that are being used for CXM. Many organizations fail to take a systematic view of their CXM application portfolio beyond maintaining a rough inventory. To assess the current state of alignment, you must build the application inventory and assess satisfaction metrics.
Review the major enterprise applications in your organization that enable CXM and align your requirements to these applications (net-new or existing). Identify points of integration to capture the big picture.

Info-Tech Insight
When assessing the current application portfolio that supports CXM, the tendency will be to focus on the applications under the CXM umbrella, relating mostly to marketing, sales, and customer service. Be sure to include systems that act as input to, or benefit due to outputs from, CRM or similar applications. Examples of these systems are ERP systems, ECM (e.g. SharePoint) applications, and more.
Having a portfolio but no contextual data will not give you a full understanding of the current state. The next step is to thoroughly assess usage patterns as well as IT, management, and end-user satisfaction with each application.
Example: Application Usage & Satisfaction Assessment
| Application Name | Level of Usage | IT Satisfaction | Management Satisfaction | End-User Satisfaction | Potential Business Impact |
|---|---|---|---|---|---|
| CRM (e.g. Salesforce) | Medium | High | Medium | Medium | High |
| CRM (e.g. Salesforce) | Low | Medium | Medium | High | Medium |
| ... | ... | ... | ... | ... | ... |
Info-Tech Insight
When evaluating satisfaction with any application, be sure to consult all stakeholders who come into contact with the application or depend on its output. Consider criteria such as ease of use, completeness of information, operational efficiency, data accuracy, etc.
2.2.3 Application Portfolio Assessment: End-User Feedback
Info-Tech’s Application Portfolio Assessment: End-User Feedback diagnostic is a low-effort, high-impact program that will give you detailed report cards on end-user satisfaction with an application. Use these insights to identify problems, develop action plans for improvement, and determine key participants.
Application Portfolio Assessment: End-User Feedback is an 18-question survey that provides valuable insights on user satisfaction with an application by:
INFO-TECH DIAGNOSTIC
2.2.4 1 hour
Example: CXM Application Inventory
| Application Name | Deployed Date | Processes Supported | Technical and Licensing Dependencies |
|---|---|---|---|
| Salesforce | June 2018 | Customer relationship management | XXX |
| Hootsuite | April 2019 | Social media listening | XXX |
| ... | ... | ... | ... |
A VRIO analysis evaluates the ability of internal resources and capabilities to sustain a competitive advantage by evaluating dimensions of value, rarity, imitability, and organization. For critical applications like your CRM platform, use a VRIO analysis to determine their value.
| Is the resource or capability valuable in exploiting an opportunity or neutralizing a threat? | Is the resource or capability rare in the sense that few of your competitors have a similar capability? | Is the resource or capability costly to imitate or replicate? | Is the organization organized enough to leverage and capture value from the resource or capability? | |
| NO | → | → | → | COMPETITIVE DISADVANTAGE |
| YES | NO→ | → | → | COMPETITIVE EQUALITY/PARITY |
| YES | YES | NO→ | → | TEMPORARY COMPETITIVE ADVANTAGE |
| YES | YES | YES | NO→ | UNUSED COMPETITIVE ADVANTAGE |
| YES | YES | YES | YES | LONG-TERM COMPETITIVE ADVANTAGE |
(Strategic Management Insight, 2013)
2.2.5 30 minutes
2.2.1; 2.2.2 Conduct a SWOT Analysis
Our facilitator will use a small-team approach to delve deeply into each area, identifying enablers (strengths and opportunities) and challenges (weaknesses and threats) relating to the CXM strategy.
2.2.3; 2.2.4 Inventory your CXM applications, and assess usage and satisfaction
Working with your core team, the facilitator will assist with building a comprehensive inventory of CXM applications that are currently in use and with identifying adjacent systems that need to be identified for integration purposes. The facilitator will work to identify high and low performing applications and analyze this data with the team during the workshop exercise.
2.2.5 Conduct a VRIO analysis
The facilitator will take you through a VRIO analysis to identify which of your internal technological competencies ensure, or can be leveraged to ensure, your competitiveness in the CXM market.
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
CXM application portfolio map
The interaction between sales, marketing, and customer service is very process-centric. Rethink sales and customer-centric workflows and map the desired workflow, imbedding the improved/reengineered process into the requirements.
Business process modeling facilitates the collaboration between the business and IT, recording the sequence of events, tasks performed, who performed them, and the levels of interaction with the various supporting applications.
By identifying the events and decision points in the process and overlaying the people that perform the functions, the data being interacted with, and the technologies that support them, organizations are better positioned to identify gaps that need to be bridged.
Encourage the analysis by compiling an inventory of business processes that support customer-facing operations that are relevant to achieving the overall organizational strategies.
Outcomes
INFO-TECH OPPORTUNITY
Refer to Info-Tech’s Create a Comprehensive BPM Strategy for Successful Process Automation blueprint for further assistance in taking a BPM approach to your sales-IT alignment.
APQC’s Process Classification Framework is a taxonomy of cross-functional business processes intended to allow the objective comparison of organizational performance within and among organizations.
| OPERATING PROCESSES | ||||
|---|---|---|---|---|
| 1.0 Develop Vision and Strategy | 2.0 Develop and Manage Products and Services | 3.0 Market and Sell Products and Services | 4.0 Deliver Products and Services | 5.0 Manage Customer Service |
| 6.0 Develop and Manage Human Capital | ||||
| 7.0 Manage Information Technology | ||||
| 8.0 Manage Financial Resources | ||||
| 9.0 Acquire, Construct, and Manage Assets | ||||
| 10.0 Manage Enterprise Risk, Compliance, and Resiliency | ||||
| 11.0 Manage External Relationships | ||||
| 12.0 Develop and Manage Business Capabilities | ||||
(APQC, 2011)
MORE ABOUT APQC
3.1 Understand markets, customers, and capabilities
3.2 Develop marketing strategy
3.3 Develop sales strategy
3.4 Develop and manage marketing plans
3.5 Develop and manage sales plans
5.1 Develop customer care/customer service strategy
5.2 Plan and manage customer service operations
5.2 Plan and 5.2.3.1 Receive customer complaints 5.2.3.2 Route customer complaints 5.2.3.3 Resolve customer complaints 5.2.3.4 Respond to customer complaints manage customer service operations
The APQC framework provides levels 1 through 3 for the “Market and Sell Products and Services” framework. Level 4 processes and beyond will need to be defined by your organization as they are more granular (represent the task level) and are often industry-specific.
Level 1 – Category - 1.0 Develop vision and strategy (10002)
Represents the highest level of process in the enterprise, such as manage customer service, supply chain, financial organization, and human resources.
Level 2 – Process Group - 1.1 Define the business concept and long-term vision (10014)
Indicates the next level of processes and represents a group of processes. Examples include perform after sales repairs, procurement, accounts payable, recruit/source, and develop sales strategy.
Level 3 – Process - 1.1.1 Assess the external environment (10017)
A series of interrelated activities that convert input into results (outputs); processes consume resources and require standards for repeatable performance; and processes respond to control systems that direct quality, rate, and cost of performance.
Level 4 – Activity - 1.1.1.1 Analyze and evaluate competition (10021)
Indicates key events performed when executing a process. Examples of activities include receive customer requests, resolve customer complaints, and negotiate purchasing contracts.
Level 5 – Task - 12.2.3.1.1 Identify project requirements and objectives (11117)
Tasks represent the next level of hierarchical decomposition after activities. Tasks are generally much more fine grained and may vary widely across industries. Examples include create business case and obtain funding, and design recognition and reward approaches.
Info-Tech Insight
Define the Level 3 processes in the context of your organization. When creating a CXM strategy, concern yourself with the interrelatedness of processes across existing departmental silos (e.g. marketing, sales, customer service). Reserve the analysis of activities (Level 4) and tasks (Level 3) for granular work initiatives involved in the implementation of applications.
2.3.1 CXM Business Process Shortlisting Tool
The CXM Business Process Shortlisting Tool can help you define which marketing, sales, and service processes you should focus on.
Working in concert with stakeholders from the appropriate departments, complete the short questionnaire.
Based on validated responses, the tool will highlight processes of strategic importance to your organization.
These processes can then be mapped, with requirements extracted and used to build the CXM application portfolio.
INFO-TECH DELIVERABLE

2.3.2 1 hour


Current legend for Weights and Scores
F – Finance
H – Human Resources
I – IT
L – Legal
M – Marketing
BU1 – Business Unit 1
BU2 – Business Unit 2
2.3.3 45 minutes
INFO-TECH OPPORTUNITY
Refer to Info-Tech’s Create a Comprehensive BPM Strategy for Successful Process Automation blueprint for further assistance in taking a BPM approach to your sales-IT alignment.
Info-Tech Insight
Analysis of the current state is important in the context of gap analysis. It aids in understanding the discrepancies between your baseline and the future state vision, and ensures that these gaps are documented as part of the overall requirements.

2.3.4 30 minutes
- What is the input?
- What is the output?
- What are the underlying risks and how can they be mitigated?
- What conditions should be met to mitigate or eliminate each risk?
- What are the improvement opportunities?
- What conditions should be met to enable these opportunities?
Info-Tech Insight
The business and IT should work together to evaluate the current state of business processes and the business requirements necessary to support these processes. Develop a full view of organizational needs while still obtaining the level of detail required to make informed decisions about technology.
Identify the owners of the business processes being evaluated to extract requirements. Process owners will be able to inform business process improvement and assume accountability for reengineered or net-new processes going forward.
Process ownership ensures support, accountability, and governance for CXM and its supporting processes. Process owners must be able to negotiate with business users and other key stakeholders to drive efficiencies within their own process. The process owner must execute tactical process changes and continually optimize the process.
Responsibilities include the following:
Info-Tech Insight
Identify the owners of existing processes early so you understand who needs to be involved in process improvement and reengineering. Once implemented, CXM applications are likely to undergo a series of changes. Unstructured data will multiply, the number of users may increase, administrators may change, and functionality could become obsolete. Should business processes be merged or drastically changed, process ownership can be reallocated during CXM implementation. Make sure you have the right roles in place to avoid inefficient processes and poor data quality.
2.3.5 Process Owner Assignment Guide
The Process Owner Assignment Guide will ensure you are taking the appropriate steps to identify process owners for existing and net-new processes created within the scope of the CXM strategy.
The steps in the document will help with important considerations such as key requirements and responsibilities.
INFO-TECH DELIVERABLE
2.3.6 30 minutes
Face-to-Face is efficient and has a positive personalized aspect that many customers desire, be it for sales or customer service.
Telephony (or IVR) has been a mainstay of customer interaction for decades. While not fading, it must be used alongside newer channels.
Postal used to be employed extensively for all domains, but is now used predominantly for e-commerce order fulfillment.
Email is an asynchronous interaction channel still preferred by many customers. Email gives organizations flexibility with queuing.
Live Chat is a way for clients to avoid long call center wait times and receive a solution from a quick chat with a service rep.
Web Portals permit transactions for sales and customer service from a central interface. They are a must-have for any large company.
Social Media consists of many individual services (like Facebook or Twitter). Social channels are exploding in consumer popularity.
HTML5 Mobile Access allows customers to access resources from their personal device through its integrated web browser.
Dedicated Mobile Apps allow customers to access resources through a dedicated mobile application (e.g. iOS, Android).
Info-Tech Insight
Your channel selections should be driven by customer personas and scenarios. For example, social media may be extensively employed by some persona types (i.e. Millennials) but see limited adoption in other demographics or use cases (i.e. B2B).
2.3.7 30 minutes
Example: Business Unit Channel Use Survey
| Marketing | Sales | Customer Service | ||||
|---|---|---|---|---|---|---|
| Current Used? | Future Use? | Current Used? | Future Use? | Current Used? | Future Use? | |
| Yes | Yes | No | No | No | No | |
| Direct Mail | Yes | No | No | No | No | No |
| Phone | No | No | Yes | Yes | Yes | Yes |
| In-Person | No | No | Yes | Yes | Yes | No |
| Website | Yes | Yes | Yes | Yes | Yes | Yes |
| Social Channels | No | Yes | Yes | Yes | No | Yes |
Discovering your organizational requirements is vital for choosing the right business-enabling initiative, technology, and success metrics. Sorting the requirements by marketing, sales, and service is a prudent mechanism for clarification.
Definition: High-level requirements that will support marketing functions within CXM.
Examples
Definition: High-level requirements that will support sales functions within CXM.
Examples
Definition: High-level requirements that will support customer service functions within CXM.
Examples
2.3.8 30 minutes
Info-Tech Insight
Strategic CXM requirements will be used to prioritize specific initiatives for CXM technology enablement and application rollout. Ensure that IT, the business, and executive management are all aligned on a consistent and agreed upon set of initiatives.
Industry Consumer Goods, Clothing
Source Retail Congress, 2017
Burberry London
Internally, Burberry invested in organizational alignment and sales force brand engagement. The more the sales associate knew about the brand engagement and technology-enabled strategy, the better the store’s performance. Before the efforts went to building relationships with customers, Burberry built engagement with employees.
Burberry embraced “omnichannel,” the hottest buzzword in retailing to provide consumers the most immersive and intuitive brand experience within the store.
RFID tags were attached to products to trigger interactive videos on the store’s screens in the common areas or in a fitting room. Consumers are to have instant access to relevant product combinations, ranging from craftsmanship information to catwalk looks. This is equivalent to the rich, immediate information consumers have grown to expect from the online shopping experience.
Another layer of Burberry’s added capabilities includes in-memory-based analytics to gather and analyze data in real-time to better understand customers’ desires. Burberry builds customer profiles based on what items the shoppers try on from the RFID-tagged garments. Although this requires customer privacy consent, customers are willing to provide personal information to trusted brands.
This program, called “Customer 360,” assisted sales associates in providing data-driven shopping experiences that invite customers to digitally share their buying history and preferences via their tablet devices. As the data is stored in Burberry’s customer data warehouse and accessed through an application such as CRM, it is able to arm sales associates with personal fashion advice on the spot.
Lastly, the customer data warehouse/CRM application is linked to Burberry’s ERP system and other custom applications in a cloud environment to achieve real-time inventory visibility and fulfillment.
Industry Consumer Goods, Clothing
Source Retail Congress, 2017
Burberry London
Internally, Burberry invested in organizational alignment and sales force brand engagement. The more the sales associate knew about the brand engagement and technology-enabled strategy, the better the store’s performance. Before the efforts went to building relationships with customers, Burberry built engagement with employees.
Burberry embraced “omnichannel,” the hottest buzzword in retailing to provide consumers the most immersive and intuitive brand experience within the store.
Burberry achieved one of the most personalized retail shopping experiences. Immediate personal fashion advice using customer data is only one component of the experience. Not only are historic purchases and preference data analyzed, a customer’s social media posts and fashion industry trend data is proactively incorporated into the interactions between the sales associate and the customer.
Burberry achieved CEO Angela Ahrendts’ vision of “Burberry World,” in which the brand experience is seamlessly integrated across channels, devices, retail locations, products, and services.
The organizational alignment between Sales, Marketing, and IT empowered employees to bring the Burberry brand to life in unique ways that customers appreciated and were willing to advocate.
Burberry is now one of the most beloved and valuable luxury brands in the world. The brand tripled sales in five years, became one of the leading voices on trends, fashion, music, and beauty while redefining what top-tier customer experience should be both digitally and physically.
The debate between best-of-breed point solutions versus comprehensive CRM suites is ongoing. There is no single best answer. In most cases, an effective portfolio will include both types of solutions.
Customer Relationship Management (CRM)
Social Media Management Platform (SMMP)
Field Sales/Service Automation (FSA)
Marketing Management Suites
Sales Force Automation
Email Marketing Tools
Lead Management Automation (LMA)
Customer Service Management Suites
Customer Intelligence Systems
Some may find that the capabilities of a CRM suite are not enough to meet their specific requirements: supplementing a CRM suite with a targeted point solution can get the job done. A variety of CXM point solutions are designed to enhance your business processes and improve productivity.
Sales Force Automation: Automatically generates, qualifies, tracks, and contacts leads for sales representatives, minimizing time wasted on administrative duties.
Field Sales: Allows field reps to go through the entire sales cycle (from quote to invoice) while offsite.
Sales Compensation Management: Models, analyzes, and dispenses payouts to sales representatives.
Social Media Management Platforms (SMMP): Manage and track multiple social media services, with extensive social data analysis and insight capabilities.
Email Marketing Bureaus: Conduct email marketing campaigns and mine results to effectively target customers.
Marketing Intelligence Systems: Perform in-depth searches on various data sources to create predictive models.
Customer Service Management (CSM): Manages the customer support lifecycle with a comprehensive array of tools, usually above and beyond what’s in a CRM suite.
Customer Service Knowledge Management (CSKM): Advanced knowledgebase and resolution tools.
Field Service Automation (FSA): Manages customer support tickets, schedules work orders, tracks inventory and fleets, all on the go.
Info-Tech Insight
CRM and point solution integration is critical. A best-of-breed product that poorly integrates with your CRM suite compromises the value generated by the combined solution, such as a 360-degree customer view. Challenge point solution vendors to demonstrate integration capabilities with CRM packages.
Standalone CRM Suite
Sales Conditions: Need selling and lead management capabilities for agents to perform the sales process, along with sales dashboards and statistics.
Marketing or Communication Conditions: Need basic campaign management and ability to refresh contact records with information from social networks.
Member Service Conditions: Need to keep basic customer records with multiple fields per record and basic channels such as email and telephony.
Add a Best-of-Breed or Point Solution
Environmental Conditions: An extensive customer base with many different interactions per customer along with industry specific or “niche” needs. Point solutions will benefit firms with deep needs in specific feature areas (e.g. social media or field service).
Sales Conditions: Lengthy sales process and account management requirements for assessing and managing opportunities – in a technically complex sales process.
Marketing Conditions: Need social media functionality for monitoring and social property management.
Customer Service Conditions: Need complex multi-channel service processes and/or need for best-of-breed knowledgebase and service content management.
Info-Tech Insight
The volume and complexity of both customers and interactions have a direct effect on when to employ just a CRM suite and when to supplement with a point solution. Check to see if your CRM suite can perform a specific business requirement before deciding to evaluate potential point solutions.
2.3.9 CXM Portfolio Designer
The CXM Portfolio Designer features a set of questions geared toward understanding your needs for marketing, sales, and customer service enablement.
These results are scored and used to suggest a comprehensive solution-level set of enterprise applications for CXM that can drive your application portfolio and help you make investment decisions in different areas such as CRM, marketing management, and customer intelligence.
INFO-TECH DELIVERABLE

(Social Centered Learning, n.d.)

Use the two-by-two matrix below to structure your optimal CXM application portfolio. For more help, refer to Info-Tech’s blueprint, Use Agile Application Rationalization Instead of Going Big Bang.
0 Richness of Functionality |
INTEGRATE | RETAIN | |
| REPLACE | REPLACE OR ENHANCE | ||
0 Degree of Integration |
|||
Integrate: The application is functionally rich, so spend time and effort integrating it with other modules by building or enhancing interfaces.
Retain: The application satisfies both functionality and integration requirements, so it should be considered for retention.
Replace/Enhance: The module offers poor functionality but is well integrated with other modules. If enhancing for functionality is easy (e.g. through configuration or custom development), consider enhancement or replace it.
Replace: The application neither offers the functionality sought nor is it integrated with other modules, and thus should be considered for replacement.
2.3.10 1-2 hours
Example: Brainstorming the Art of the Possible
| Application | Gap Satisfied | Related Process | Number of Linked Requirements | Do we have the system? | Priority |
|---|---|---|---|---|---|
| LMA |
|
Sales | 8 | No | Business Critical |
| Customer Intelligence |
|
Customer Service | 6 | Yes | Business Enabling |
| ... | ... | ... | ... | ... | ... |
Now that you have developed the CXM application portfolio and identified areas of new investment, you’re well positioned to execute specific vendor selection projects. After you have built out your initiatives roadmap in phase 3, the following reports provide in-depth vendor reviews, feature guides, and tools and templates to assist with selection and implementation.
Info-Tech Insight
Not all applications are created equally well for each use case. The vendor reports help you make informed procurement decisions by segmenting vendor capabilities among major use cases. The strategic requirements identified as part of this project should be used to select the use case that best fits your needs.
2.3.2; 2.3.3 Shortlist and map the key top-level business processes
Based on experience working with organizations in similar verticals, the facilitator will help your team map out key sample workflows for marketing, sales, and customer service.
2.3.6 Create your strategic requirements for CXM
Drawing on the preceding exercises, the facilitator will work with the team to create a comprehensive list of strategic requirements that will be used to drive technology decisions and roadmap initiatives.
2.3.10 Create and finalize the CXM application portfolio
Using the strategic requirements gathered through internal, external, and technology analysis up to this point, a facilitator will assist you in assembling a categorical technology application portfolio to support CXM.
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
Integration is paramount: your CXM application portfolio must work as a unified face to the customer. Create an integration map to reflect a system of record and the exchange of data.
The points of integration that you’ll need to establish must be based on the objectives and requirements that have informed the creation of the CXM application portfolio. For instance, achieving improved customer insights would necessitate a well-integrated portfolio with customer interaction point solutions, business intelligence tools, and customer data warehouses in order to draw the information necessary to build insight. To increase customer engagement, channel integration is a must (i.e. with robust links to unified communications solutions, email, and VoIP telephony systems).
Info-Tech Insight
If the CXM application portfolio is fragmented, it will be nearly impossible to build a cohesive view of the customer and deliver a consistent customer experience. Points of integration (POIs) are the junctions between the applications that make up the CXM portfolio. They are essential to creating value, particularly in customer insight-focused and omnichannel-focused deployments. Be sure to include enterprise applications that are not included in the CXM application portfolio. Popular systems to consider for POIs include billing, directory services, content management, and collaboration tools.

"Find the absolute minimum number of ‘quick wins’ – the POIs you need from day one that are necessary to keep end users happy and deliver value." – Maria Cindric, Australian Catholic University Source: Interview
2.4.1 1 hour
Example: Mapping the Integration of CXM Applications

Data quality is king: if your customer data is garbage in, it will be garbage out. Enable strategic CXM decision making with effective planning of data quality initiatives.
Identify and Eliminate Dead Weight
Poor data can originate in the firm’s system of record, which is typically the CRM system. Custom queries, stored procedures, or profiling tools can be used to assess the key problem areas.
Loose rules in the CRM system lead to records of no significant value in the database. Those rules need to be fixed, but if changes are made before the data is fixed, users could encounter database or application errors, which will reduce user confidence in the system.
Create and Enforce Standards & Policies
Now that the data has been cleaned, protect the system from relapsing.
Work with business users to find out what types of data require validation and which fields should have changes audited. Whenever possible, implement drop-down lists to standardize values and make programming changes to ensure that truncation ceases.
Applications are a critical component of how IT supports Sales, but IT also needs to help Sales keep its data current and accurate. Conducting a sales data audit is critical to ensure Sales has the right information at the right time.
Info-Tech Insight
Data is king. More than ever, having accurate data is essential for your organization to win in hyper-competitive marketplaces. Prudent current state analysis looks at both the overall data model and data architecture, as well as assessing data quality within critical sales-related repositories. As the amount of customer data grows exponentially due to the rise of mobility and the Internet of Things, you must have a forward-looking data model and data marts/customer data warehouse to support sales-relevant decisions.
Refer to Info-Tech’s Develop a Master Data Management Strategy and Roadmap blueprint for further reference and assistance in data management for your sales-IT alignment.
2.4.2 30 minutes
Example: Data Steward Structure
Department A
Department B
Department C
A customer data warehouse (CDW) “is a subject-oriented, integrated, time-variant, non-volatile collection of data used to support the strategic decision-making process across marketing, sales, and service. It is the central point of data integration for customer intelligence and is the source of data for the data marts, delivering a common view of customer data” (Corporate Information Factory, n.d.).
Analogy
CDWs are like a buffet. All the food items are in the buffet. Likewise, your corporate data sources are centralized into one repository. There are so many food items in a buffet that you may need to organize them into separate food stations (data marts) for easier access.
Examples/Use Cases
Pros
Cons
2.4.3. 30 minutes
INFO-TECH OPPORTUNITY
Refer to Info-Tech’s Build an Agile Data Warehouse blueprint for more information on building a centralized and integrated data warehouse.
All training modules will be different, but some will have overlapping areas of interest.
– Assign Project Evangelists – Analytics Training – Mobile Training
Application Training
Info-Tech Insight
Train customers too. Keep the customer-facing sales portals simple and intuitive, have clear explanations/instructions under important functions (e.g. brief directions on how to initiate service inquiries), and provide examples of proper uses (e.g. effective searches). Make sure customers are aware of escalation options available to them if self-service falls short.
The team leading the rollout of new initiatives (be they applications, new governance structures, or data quality procedures) should establish a communication process to ensure management and users are well informed.
CXM-related department groups or designated trainers should take the lead and implement a process for:
The overall objective for inter-departmental kick-off meetings is to confirm that all parties agree on certain key points and understand alignment rationale and new sales app or process functionality.
The kick-off process will significantly improve internal communications by inviting all affected internal IT groups, including business units, to work together to address significant issues before the application process is formally activated.
The kick-off meeting(s) should encompass:
Info-Tech Insight
Determine who in each department will send out a message about initiative implementation, the tone of the message, the medium, and the delivery date.
Info-Tech Insight
Every piece of information that you give to a stakeholder that is not directly relevant to their interests is a distraction from your core message. Always remember to tailor the message, medium, and timing accordingly.
Once the sales-IT alignment committees have been formed, create organizational cadence through a variety of formal and informal gatherings between the two business functions.
Isolation

Collaboration

Synergy

2.4.1 Develop a CXM application integration map
Using the inventory of existing CXM-supporting applications and the newly formed CXM application portfolio as inputs, your facilitator will assist you in creating an integration map of applications to establish a system of record and flow of data.
2.4.2 Develop a mitigation plan for poor quality customer data
Our facilitator will educate your stakeholders on the importance of quality data and guide you through the creation of a mitigation plan for data preservation.
2.4.3 Assess the need for a customer data warehouse
Addressing important factors such as data volume, complexity, and flow, a facilitator will help you assess whether or not a customer data warehouse for CXM is the right fit for your organization.
Build a Strong Technology Foundation for Customer Experience Management
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion: 1 week
Step 3.1: Create an Initiative Rollout Plan
Start with an analyst kick-off call:
Then complete these activities…
With these tools & templates:
Step 3.2: Confirm and Finalize the CXM Blueprint
Review findings with analyst:
Then complete these activities…
With these tools & templates:
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
Creating a comprehensive CXM strategy roadmap reduces the risk of rework, misallocation of resources, and project delays or abandonment.
Optimize the Change Management Process
You need to design a process that is flexible enough to meet demand for change and strict enough to protect the live environment from change-related incidents.
Create Project Management Success
Investing time up front to plan the project and implementing best practices during project execution to ensure the project is delivered with the planned outcome and quality is critical to project success.
3.1.1 45 minutes
Example: Constructing a Risk Management Plan
| Risk | Impact | Likelihood | Mitigation Effort | |
|---|---|---|---|---|
| Strategy Risks | Project over budget |
|
||
| Inadequate content governance | ||||
| System Risks | Integration with additional systems |
|
||
| .... | ... | ... | ... |
Likelihood
1 – High/ Needs Focus
2 – Can Be Mitigated
3 - Unlikely
Impact
1 - High Risk
2 - Moderate Risk
3 - Minimal Risk
Understanding technical and strategic risks can help you establish contingency measures to reduce the likelihood that risks will occur. Devise mitigation strategies to help offset the impact of risks if contingency measures are not enough.
Remember
The biggest sources of risk in a CXM strategy are lack of planning, poorly defined requirements, and lack of governance.
Apply the following mitigation tips to avoid pitfalls and delays.
Risk Mitigation Tips
Completion of initiatives for your CXM project will be contingent upon multiple variables.
Initiative complexity will define the need for enabling projects. Create a process to define dependencies:
Complex....Initiative
Simple....Initiative
3.1.2 45 minutes
Example: Importance-Capability Matrix

Pinpoint quick wins: high importance, low effort initiatives.
| The size of each plotted initiative must indicate the effort or the complexity and time required to complete. | |
|---|---|
| Top Right Quadrant | Strategic Projects |
| Top Left Quadrant | Quick Wins |
| Bottom Right Quadrant | Risky Bets |
| Bottom Left Quadrant | Discretionary Projects |
3.1.3 1 hour
Example: Project Dependencies
Initiative: Omnichannel E-Commerce
Dependency: WEM Suite Deployment; CRM Suite Deployment; Order Fulfillment Capabilities
3.1.4 30 minutes
Example: Importance-Capability Matrix
| Importance | Initiative | Owner | Completion Date | |
|---|---|---|---|---|
| Example Projects | High | Gather business requirements. | Project Manager | MM/DD/YYYY |
| Quick Wins | ||||
| Long Term | Medium | Implement e-commerce across all sites. | CFO & Web Manager | MM/DD/YYYY |
Importance
3.1.1 Create a risk management plan
Based on the workshop exercises, the facilitator will work with the core team to design a priority-based risk mitigation plan that enumerates the most salient risks to the CXM project and addresses them.
3.1.2; 3.1.3; 3.1.4 Identify initiative dependencies and create the CXM roadmap
After identifying dependencies, our facilitators will work with your IT SMEs and business stakeholders to create a comprehensive roadmap, outlining the initiatives needed to carry out your CXM strategy roadmap.
1.1 Create the Project Vision
1.2 Structure the Project
2.1 Scan the External Environment
2.2 Assess the Current State of CXM
2.3 Create an Application Portfolio
2.4 Develop Deployment Best Practices
3.1 Create an Initiative Rollout Plan
3.2 Confirm and Finalize the CXM Blueprint
Key performance indicators (KPIs) are quantifiable measures that demonstrate the effectiveness of a process and its ability to meet business objectives.
Specific
Measurable
Achievable
Realistic
Time-bound
Follow the SMART methodology when developing KPIs for each process.
Adhering to this methodology is a key component of the Lean management methodology. This framework will help you avoid establishing general metrics that aren’t relevant.
Info-Tech Insight
Metrics are essential to your ability to measure and communicate the success of the CXM strategy to the business. Speak the same language as the business and choose metrics that relate to marketing, sales, and customer service objectives.
3.2.1 1 hour
Example: Metrics for Marketing, Sales, and Customer Service Functions
| Metric | Example | |
|---|---|---|
| Marketing | Customer acquisition cost | X% decrease in costs relating to advertising spend |
| Ratio of lifetime customer value | X% decrease in customer churn | |
| Marketing originated customer % | X% increase in % of customer acquisition driven by marketing | |
| Sales | Conversion rate | X% increase conversion of lead to sale |
| Lead response time | X% decrease in response time per lead | |
| Opportunity-to-win ratio | X% increase in monthly/annual opportunity-to-win ratio | |
| Customer Service | First response time | X% decreased time it takes for customer to receive first response |
| Time-to-resolution | X% decrease of average time-to-resolution | |
| Customer satisfaction | X% improvement of customer satisfaction ratings on immediate feedback survey |
3.2.2 Stakeholder Power Map Template
Use this template and its power map to help visualize the importance of various stakeholders and their concerns. Prioritize your time according to the most powerful and most impacted stakeholders.
Answer questions about each stakeholder:
Focus on key players: relevant stakeholders who have high power, should have high involvement, and are highly impacted.
INFO-TECH DELIVERABLE
3.2.3 Stakeholder Communication Planning Template
Use the Stakeholder Communication Planning Template to document your list of initiative stakeholders so you can track them and plan communication throughout the initiative.
Track the communication methods needed to convey information regarding CXM initiatives. Communicate how a specific initiative will impact the way employees work and the work they do.
INFO-TECH DELIVERABLE
3.2.4 1 hour
3.2.5 CXM Strategy Stakeholder Presentation Template
Complete the presentation template as indicated when you see the green icon throughout this deck. Include the outputs of all activities that are marked with this icon.
Info-Tech has designed the CXM Strategy Stakeholder Presentation Template to capture the most critical aspects of the CXM strategy. Customize it to best convey your message to project stakeholders and to suit your organization.
The presentation should be no longer than one hour. However, additional slides can be added at the discretion of the presenter. Make sure there is adequate time for a question and answer period.
INFO-TECH DELIVERABLE
After the presentation, email the deck to stakeholders to ensure they have it available for their own reference.
3.2.6 30 minutes
3.2.4 Create a stakeholder power map and communication plan
An analyst will walk the project team through the creation of a communication plan, inclusive of project metrics and their respective goals. If you are planning a variety of CXM initiatives, track how the change will be communicated and to whom. Determine the employees who will be impacted by the change.
Accenture Digital. “Growing the Digital Business: Accenture Mobility Research 2015.” Accenture. 2015. Web.
Afshar, Vala. “50 Important Customer Experience Stats for Business Leaders.” Huffington Post. 15 Oct. 2015. Web.
APQC. “Marketing and Sales Definitions and Key Measures.” APQC’s Process Classification Framework, Version 1.0.0. APQC. Mar. 2011. Web.
CX Network. “The Evolution of Customer Experience in 2015.” Customer Experience Network. 2015. Web.
Genesys. “State of Customer Experience Research”. Genesys. 2018. Web.
Harvard Business Review and SAS. “Lessons From the Leading Edge of Customer Experience Management.” Harvard Business School Publishing. 2014. Web.
Help Scout. “75 Customer Service Facts, Quotes & Statistics.” Help Scout. n.d. Web.
Inmon Consulting Services. “Corporate Information Factory (CIF) Overview.” Corporate Information Factory. n.d. Web
Jurevicius, Ovidijus. “VRIO Framework.” Strategic Management Insight. 21 Oct. 2013. Web.
Keenan, Jim, and Barbara Giamanco. “Social Media and Sales Quota.” A Sales Guy Consulting and Social Centered Selling. n.d. Web.
Malik, Om. “Internet of Things Will Have 24 Billion Devices by 2020.” Gigaom. 13 Oct. 2011. Web.
McGovern, Michele. “Customers Want More: 5 New Expectations You Must Meet Now.” Customer Experience Insight. 30 July 2015. Web.
McGinnis, Devon. “40 Customer Service Statistics to Move Your Business Forward.” Salesforce Blog. 1 May 2019. Web.
Reichheld, Fred. “Prescription for Cutting Costs”. Bain & Company. n.d. Web.
Retail Congress Asia Pacific. “SAP – Burberry Makes Shopping Personal.” Retail Congress Asia Pacific. 2017. Web.
Rouse, Margaret. “Omnichannel Definition.” TechTarget. Feb. 2014. Web.
Salesforce Research. “Customer Expectations Hit All-Time High.” Salesforce Research. 2018. Web.
Satell, Greg. “A Look Back at Why Blockbuster Really Failed and Why It Didn’t Have To.” Forbes. 5 Sept. 2014. Web.
Social Centered Learning. “Social Media and Sales Quota: The Impact of Social Media on Sales Quota and Corporate Review.” Social Centered Learning. n.d. Web.
Varner, Scott. “Economic Impact of Experience Management”. Qualtrics/Forrester. 16 Aug. 2017. Web.
Wesson, Matt. “How to Use Your Customer Data Like Amazon.” Salesforce Pardot Blog. 27 Aug. 2012. Web.
Winterberry Group. “Taking Cues From the Customer: ‘Omnichannel’ and the Drive For Audience Engagement.” Winterberry Group LLC. June 2013. Web.
Wollan, Robert, and Saideep Raj. “How CIOs Can Support a More Agile Sales Organization.” The Wall Street Journal: The CIO Report. 25 July 2013. Web.
Zendesk. “The Impact of Customer Service on Customer Lifetime Value 2013.” Z Library. n.d. Web.
The complex nature of data investment leads to de-scoping and delivery of data services that do not meet business needs or give value to the business. Subject matter experts are hired to resolve the problem, but their success is impacted by absent architecture, technology, and organizational alignment.
Walking through a book of architecture building plans with a personal guide is cheaper and faster than employing an architect to build and design your home.
Info-Tech's approach provides a proven methodology that includes the following:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Info-Tech's approach provides a proven methodology that includes following:
Data practice & platform pre-build pattern templates based on Info-Tech data reference patterns and data platform design best practices.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Establish business context and value.
Business context and strategic driver.
1.1 Understand/confirm the organization's strategic goals
1.2 Classify the strategic goals and map to business drivers
1.3 Identify the business capabilities that the strategy focuses on
1.4 Identify the business processes realizing the strategy
Business context and strategic drivers
Prioritized business capabilities and processes
Data culture survey results analysis
Identify your top initiatives.
High-value business-aligned data initiative.
2.1 Highlight data-related outcomes/goals to realize to fulfill the business goal
2.2 Map business data initiatives to the business strategic goals
2.3 Prioritize data initiatives
High-value, business-aligned data initiatives
Analyze data challenges.
Clear understanding of the data challenges.
3.1 Map data challenges to Info-Tech data challenges
3.2 Review Info-Tech data capabilities based on prioritized initiatives
3.3 Discuss data platform and practice next steps
List of data challenges preventing data maturation with the organization
Map data capability.
Prioritized data capability.
4.1 Map data challenges to Info-Tech data challenges
4.2 Review Info-Tech data capabilities based on prioritized initiatives
4.3 Discuss data platform and practice next steps
Required data capabilities
Data platform and practice – plan
Initialized data management RACI
The build or optimization of your data practice and data platform must be predicated on a thorough understanding of the organization’s goals, objectives, and priorities and the business capabilities and process they are meant to support and enable.
Formalizing your practice or constructing your platform just for the sake of doing so often results in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.
Leverage Info-Tech’s approach and incorporate our pre-built models and patterns to effectively navigate that crucial and often difficult phase upfront of comprehensively defining business data needs so you can ultimately realize faster time-to-delivery of your overall data practice and platform.
![]() |
Rajesh Parab
|
![]() |
Crystal Singh
|
Situation
|
Complication
|
Resolution
|
The true value of data comes from defining intentional relationships between the business and the data through a well thought out data platform and practice.
I can’t access the data. I don’t trust the data in the report. It takes too long to get to the data for decision making |
|
|
Use the road-tested patterns and frameworks in our blueprint to break the perpetual data solution cycle. Focus on the value that a data and analytics platform will bring rather than focusing on the data problems alone. |
Build Your Data Practice and PlatformBring Your Data Strategy to Life |
![]() |
CONVENTIONAL WISDOM
Attempting to Solve Your Data Problems
|
BREAK THE CYCLE
Solving Your Data Problems
|
CONTINUOUS PHASE: ROADMAP, SPONSORSHIP FEEDBACK AND DELIVERY
Develop a roadmap to establish the practice and implement the architecture as designed. Ensure continuous alignment of the practice and architecture with the business landscape. |
|||||||||
![]() |
Phase-by-Phase Approach
|

| Only 14.29% of Transportation and Logistics respondents agree BI and Analytics Process and Technology are sufficient | What is a diagnostic?
Our diagnostics are the simplest way to collect the data you need, turn it into actionable insights, and communicate with stakeholders across the organization. |
52.54% of respondents from the healthcare industry are unaware of their organization’s data security policy | ||
| Ask the Right Questions
Use our low-effort surveys to get the data you need from stakeholders across the organization. |
Use Our Diagnostic Engine
Our diagnostic engine does all the heavy lifting and analysis, turning your data into usable information. |
Communicate & Take Action
Wow your executives with the incredible insights you've uncovered. Then, get to action: make IT better. |
||
| On average only 40% agree that they have the reporting when needed
(Source: Info-Tech’s Data Culture Diagnostic, 53 Organizations, 3138 Responses) |
35% of respondents feel that a governance body is in place looking at strategic data
Build a Data-Driven Strategy Using Info-Tech Diagnostic ProgramsMake informed IT decisions by starting your diagnostic program today. Your account manager is waiting to help you. |
![]() |
||
![]() |
![]() |
The first step is to align business strategy with data strategy and then start building your data practice and data platform |
![]() |
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Diagnostics and consistent frameworks used throughout all four options |
|||
| Phase 1 –
Define Your Data Requirements and Conduct Your Data Discovery |
Phase 2 –
Design Your Data Practices |
Phase 3 –
Architect Your Data Platform |
|
| Phase Steps |
|
|
|
| Phase Outcomes | Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives | Comprehensive data practice design based on the required business and data capabilities | Data platform design based on Info-Tech data architecture reference pattern and prioritized data initiatives and capabilities |

Workshop Overview |
Contact your account representative for more information.
|
| Info-Tech’s Workshop support for Build Your Data Practice and Platform. | ![]() |
||
| Workshop
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." |
Workshop 1 | Workshop 2 | Workshop 3 |
Workshop 1: | Contact your account representative for more information.
|
| Day 1 | Day 2 | Day 3 | Day 4 | |
Establish Business Context and Value |
Identify Your Top Initiatives |
Analyze Data Challenges |
Map Data Capability |
|
| Activities | 1.1 Understand/confirm your organization’s strategic goals 1.2 Classify the strategic goals and map to business drivers 1.3 Identify the business capabilities that the strategy focus is on 1.4 Identify the business processes realizing the strategy |
2.1 Highlight data-related outcomes /goals to realize to fulfill the business goal 2.2 Map business data initiatives to the business strategic goals 2.3 Prioritize Data initiatives |
3.1 Understand data management capabilities and framework 3.2 Classify business data requirements using Info-Tech’s classification approach 3.3 Highlight data challenges in your current environment |
4.1 Map data challenges to Info-Tech data challenges 4.2 Review Info-Tech data capabilities based on prioritized initiative 4.3 Discuss Data Platform and Practice Next Steps |
| Deliverables |
|
|
|
|
| Participants | Business stakeholder, Business leader Business Subject Matter Expert, Data IT sponsor (CIO), Head of Data, Data Architect | Business stakeholder, Business leader Business Subject Matter Expert, Data IT sponsor (CIO), Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect |
Workshop 2: | Contact your account representative for more information.
|
| Day 1 | Day 2 | Day 3 | Day 4 | |
Plan Your Data Practices |
Design Your Data Practices 1 |
Design Your Data Practices 2 |
Design Your Data Practices 3 |
|
| Activities | Prerequisite: Business context, business data requirement, and data capabilities 1.1 Understand data practice framework 1.2 Define your practice implementation approach 1.3 Review and update data management RACI |
2.1 Understand Info-Tech data practice patterns for each prioritized practice 2.2 Define your practice setup for each prioritized practice 2.3 Highlight critical processes for each practice |
3.1 Understand Info-Tech data practice patterns for each prioritized practice 3.2 Define your practice setup for each prioritized practice 3.3 Highlight critical processes for each practice |
4.1 Understand Info-Tech data practice patterns for each prioritized practice 4.2 Define your practice setup for each prioritized practice 4.3 Highlight critical processes for each practice 4.4 Discuss data platform and practice next steps |
| Deliverables |
|
|
|
|
| Participants | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect |
Workshop 3: | Contact your account representative for more information.
|
| Day 1 | Day 2 | Day 3 | Day 4 | |
Data Platform Overview | Update Data Platform Reference Architecture | Design Your Data Platform | Design Your Data Practices 4 | |
| Activities | Prerequisite: Business context, business data requirement, and data capabilities 1.1 Understand data platform framework and data capabilities 1.2 Understand key data architecture principles and best practices 1.3 Shortlist data platform patterns | 2.1 Map and identify data capabilities to data platform components 2.2 Build data platform architecture using Info-Tech data platform reference architecture 2.3 Highlight critical processes for each practice | 3.1 Design your target data platform using Info-Tech’s data platform template 3.2 Identify new capabilities and components in your platform design | 4.1 Identify new capabilities and component in your platform design 4.2 Discuss data platform initiatives |
| Deliverables |
|
|
|
|
| Participants | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect | Data experts, Business Subject Matter Expert, Head of Data, Data Architect |
| Phase 1
1.1 Define Your Data Requirements
|
Phase 2 | Phase 3 |
A blend of business leaders and business SMEs together with the Data Strategy team.
Key personnel from IT/Data team: (Data Architect, Data Engineers, Head of Head of Reporting and Analytics)
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Select the top automation candidates to score some quick wins.
Map and optimize process flows for each task you wish to automate.
Build a process around managing IT automation to drive value over the long term.
Build a long-term roadmap to enhance your organization's automation capabilities.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify top candidates for automation.
Plan to achieve quick wins with automation for early value.
1.1 Identify MRW pain points.
1.2 Drill down pain points into tasks.
1.3 Estimate the MRW involved in each task.
1.4 Rank the tasks based on value and ease.
1.5 Select top candidates and define metrics.
1.6 Draft project charters.
MRW pain points
MRW tasks
Estimate of MRW involved in each task
Ranking of tasks for suitability for automation
Top candidates for automation & success metrics
Project charter(s)
Map and optimize the process flow of the top candidate(s).
Requirements for automation of the top task(s).
2.1 Map process flows.
2.2 Review and optimize process flows.
2.3 Clarify logic and finalize future-state process flows.
Current-state process flows
Optimized process flows
Future-state process flows with complete logic
Develop a lightweight process for rolling out automation and for managing the automation program.
Ability to measure and to demonstrate success of each task automation, and of the program as a whole.
3.1 Kick off your test plan for each automation.
3.2 Define process for automation rollout.
3.3 Define process to manage your automation program.
3.4 Define metrics to measure success of your automation program.
Test plan considerations
Automation rollout process
Automation program management process
Automation program metrics
Build a roadmap to enhance automation capabilities.
A clear timeline of initiatives that will drive improvement in the automation program to reduce MRW.
4.1 Build a roadmap for next steps.
IT automation roadmap
Automation can be very, very good, or very, very bad.
Do it right, and you can make your life a whole lot easier.
Do it wrong, and you can suffer some serious pain.
All too often, automation is deployed willy-nilly, without regard to the overall systems or business processes in which it lives.
IT professionals should follow a disciplined and consistent approach to automation to ensure that they maximize its value for their organization.
Derek Shank,
Research Analyst, Infrastructure & Operations
Info-Tech Research Group
Follow our methodology to focus IT automation on reducing toil.
Queues create waste and are extremely damaging. Like a tire fire, once you get started, they’re almost impossible to stamp out!
(Source: Edwards, citing Donald G. Reinersten: The Principles of Product Development Flow: Second Generation Lean Product Development )
Every additional layer of complexity multiplies points of failure. Beyond a certain level of complexity, troubleshooting can become a nightmare.
Today, Operations is responsible for the outcomes of a full stack of a very complex, software-defined, API-enabled system running on infrastructure they may or may not own.
– Edwards
The systems built under each new technology paradigm never fully replace the systems built under the old paradigms. It’s not uncommon for an enterprise to have an accumulation of systems built over 10-15 years and have no budget, risk appetite, or even a viable path to replace them all. With each shift, who bares [SIC] the brunt of the responsibility for making sure the old and the new hang together? Operations, of course. With each new advance, Operations juggles more complexity and more layers of legacy technologies than ever before.
– Edwards
Personnel resources in most IT organizations overlap heavily between “build” and “run.”
Some CIOs see a Sys Admin and want to replace them with a Roomba. I see a Sys Admin and want to build them an Iron Man suit.
– Deepak Giridharagopal, CTO, Puppet
When we automate, we can make sure we do something the same way every time and produce a consistent result.
We can design an automated execution that will ship logs that provide the context of the action for a detailed audit trail.
Because the C-suite relies on upwards communication — often filtered and sanitized by the time it reaches them — executives don’t see the bottlenecks and broken processes that are stalling progress.
– Andi Mann
To get the full ROI on your automation, you need to treat it like an employee. When you hire an employee, you invest in that person. You spend time and resources training and nurturing new employees so they can reach their full potential. The investment in a new employee is no different than your investment in automation.– Edwards
| Example of How to Estimate Dollar Value Impact of Automation | |||
|---|---|---|---|
| Metric | Timeline | Target | Value |
| Hours of manual repetitive work | 12 months | 20% reduction | $48,000/yr.(1) |
| Hours of project capacity | 18 months | 30% increase | $108,000/yr.(2) |
| Downtime caused by errors | 6 months | 50% reduction | $62,500/yr.(3) |
1 15 FTEs x 80k/yr.; 20% of time on MRW, reduced by 20%
2 15 FTEs x 80k/yr.; 30% project capacity, increased by 30%
3 25k/hr. of downtime.; 5 hours per year of downtime caused by errors
Industry Financial Services
Source Interview
An IT infrastructure manager had established DR failover procedures, but these required a lot of manual work to execute. His team lacked the expertise to build automation for the failover.
The manager hired consultants to build scripts that would execute portions of the failover and pause at certain points to report on outcomes and ask the human operator whether to proceed with the next step.
The infrastructure team reduced their achievable RTOs as follows:
Tier 1: 2.5h → 0.5h
Tier 2: 4h → 1.5h
Tier 3: 8h → 2.5h
And now, anyone on the team could execute the entire failover!
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| 1. Select Candidates | 2. Map Process Flows | 3. Build Process | 4. Build Roadmap | |
|---|---|---|---|---|
| Best-Practice Toolkit |
1.1 Identify MRW pain points 1.2 Drill down pain points into tasks 1.3 Estimate the MRW involved in each task 1.4 Rank the tasks based on value and ease 1.5 Select top candidates and define metrics 1.6 Draft project charters |
2.1 Map process flows 2.2 Review and optimize process flows 2.3 Clarify logic and finalize future-state process flows |
3.1 Kick off your test plan for each automation 3.2 Define process for automation rollout 3.3 Define process to manage your automation program 3.4 Define metrics to measure success of your automation program |
4.1 Build automation roadmap |
| Guided Implementations |
Introduce methodology. Review automation candidates. Review success metrics. |
Review process flows. Review end-to-end process flows. |
Review testing considerations. Review automation SDLC. Review automation program metrics. |
Review automation roadmap. |
| Onsite Workshop | Module 1: Identify Automation Candidates |
Module 2: Map and Optimize Processes |
Module 3: Build a Process for Managing Automation |
Module 4: Build Automation Roadmap |
| Phase 1 Results: Automation candidates and success metrics |
Phase 2 Results: End-to-end process flows for automation |
Phase 3 Results: Automation SDLC process, and automation program management process |
Phase 4 Results: Automation roadmap |
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Obtain organizational buy-in and build a standardized and formal AI blueprint.
Assess your people, process, and technology for AI readiness and realize areas for improvement.
Fill the required AI-related roles to meet business requirements
Assess the appropriateness of AI in your organization and identify gaps in people, processes, and technology as it relates to AI.
Compile the important information and artifacts to include in the AI blueprint.
Keep a record of services and interfaces to reduce waste.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Uncover current and future AI business drivers, and assess current capabilities.
Perform a current state assessment and create a future vision.
1.1 Identify Current and Future Business Drivers
1.2 AI Readiness Assessment
1.3 Integration Service Catalog Template
High-level groupings of AI strategy business drivers.
Determine the organization’s readiness for AI, and identify areas for improvement.
Create a record of services and interfaces to reduce waste.
Identify building blocks, common patterns, and decompose them.
Develop an AI Architecture.
2.1 Integration Principles
2.2 High-level Patterns
2.3 Pattern decomposition and recomposition
Set general AI architecture principles.
Categorize future and existing interactions by pattern to establish your integration framework.
Identification of common functional components across patterns.
Analyze the gaps between the current and future environment in people, process, and technology.
Uncover gaps between current and future capabilities and determine if your ideal environment is feasible.
3.1 Gap Analysis
Identify gaps between the current environment and future AI vision.
Define strategic initiatives, know your resource constraints, and use a timeline for planning AI.
Create a plan of strategic initiatives required to close gaps.
4.1 Identify and prioritize strategic initiatives
4.2 Distribute initiatives on a timeline
Use strategic initiatives to build the AI strategy roadmap.
Establish when initiatives are going to take place.
Build an event management practice that is situated in the larger service management environment. Purposefully choose valuable events to track and predefine their associated actions to cut down on data clutter.
Event management is useless in isolation. The goals come from the pain points of other ITSM practices. Build handoffs to other service management practices to drive the proper action when an event is detected.
Create a repeatable framework to define monitored events, their root cause, and their associated action. Record your monitored events in a catalog to stay organized.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Engineer your event management practice with tracked events informed by the business impact of the related systems, applications, and services. This storyboard will help you properly define and catalog events so you can properly respond when alerted.
Use this tool to define your workflow for adding new events to track. This cookbook includes the considerations you need to include for every tracked event as well as the roles and responsibilities of those involved with event management.
Use this tool to record your tracked events and alerts in one place. This catalog allows you to record the rationale, root-cause, action, and data governance for all your monitored events.
Use this template to help define your event management handoffs to other service management practices including change management, incident management, and problem management.
Use this tool to implement and continually improve upon your event management process. Record, prioritize, and assign your action items from the event management blueprint.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine goals and challenges for event management and set the scope to business-critical systems.
Defined system scope of Event Management
Roles and responsibilities defined
1.1 List your goals and challenges
1.2 Monitoring and event management RACI
1.3 Abbreviated business impact analysis
Event Management RACI (as part of the Event Management Cookbook)
Abbreviated BIA (as part of the Event Management Cookbook)
Define your in-scope configuration items and their operational conditions
Operational conditions, related CIs and dependencies, and CI thresholds defined
2.1 Define operational conditions for systems
2.2 Define related CIs and dependencies
2.3 Define conditions for CIs
2.4 Perform root-cause analysis for complex condition relationships
2.5 Set thresholds for CIs
Event Management Catalog
Pre-define actions for every monitored event
Thresholds and actions tied to each monitored event
3.1 Set thresholds to monitor
3.2 Add actions and handoffs to event management
Event Catalog
Event Management Workflows
Effectively implement event management
Establish an event management roadmap for implementation and continual improvement
4.1 Define your data policy for event management
4.2 Identify areas for improvement and establish an implementation plan
Event Catalog
Event Management Roadmap
Event management is useless in isolation.
Event management creates no value when implemented in isolation. However, that does not mean event management is not valuable overall. It must simply be integrated properly in the service management environment to inform and drive the appropriate actions.
Every step of engineering event management, from choosing which events to monitor to actioning the events when they are detected, is a purposeful and explicit activity. Ensuring that event management has open lines of communication and actions tied to related practices (e.g. problem, incident, and change) allows efficient action when needed.
Catalog your monitored events using a standardized framework to allow you to know:
Properly engineering event management allows you to effectively monitor and understand your IT environment and bolster the proactivity of the related service management practices.
Benedict Chang
Research Analyst, Infrastructure & Operations
Info-Tech Research Group
Strive for proactivity. Implement event management to reduce response times of technical teams to solve (potential) incidents when system performance degrades.
Build an integrated event management practice where developers, service desk, and operations can all rely on event logs and metrics.
Define the scope of event management including the systems to track, their operational conditions, related configuration items (CIs), and associated actions of the tracked events.
Managed services, subscription services, and cloud services have reduced the traditional visibility of on- premises tools.
System(s) complexity and integration with the above services has increased, making true cause and effect difficult to ascertain.
Clearly define a limited number of operational objectives that may benefit from event management.
Focus only on the key systems whose value is worth the effort and expense of implementing event management.
Understand what event information is available from the CIs of those systems and map those against your operational objectives.
Write a data retention policy that balances operational, audit, and debugging needs against cost and data security needs.
More is NOT better. Even in an AI-enabled world, every event must be collected with a specific objective in mind. Defining the purpose of each tracked event will cut down on data clutter and response time when events are detected.
In 2020, 33% of organizations listed network monitoring as their number one priority for network spending. 27% of organizations listed network monitoring infrastructure as their number two priority.
Source: EMA, 2020; n=350
33% of all IT organizations reported that end users detected and reported incidents before the network operations team was aware of them.
Source: EMA, 2020; n=350
64% of enterprises use 4-10 monitoring tools to troubleshoot their network.
Source: EMA, 2020; n=350
Define how event management informs other management practices.
Monitoring and event management can be used to establish and analyze your baseline. The more you know about your system baselines, the easier it will be to detect exceptions.
Events can inform needed changes to stay compliant or to resolve incidents and problems. However, it doesn’t mean that changes can be implemented without the proper authorization.
The best use case for event management is to detect and resolve incidents and problems before end users or IT are even aware.
Events sitting in isolation are useless if there isn’t an effective way to pass potential tickets off to incident management to mitigate and resolve.
Events can identify problems before they become incidents. However, you must establish proper data logging to inform problem prioritization and actioning.
| 1. Situate Event Management in Your Service Management Environment | 2. Define Your Monitoring Thresholds and Accompanying Actions | 3. Start Monitoring and Implement Event Management | |
|
Phase Steps |
1.1 Set Operational and Informational Goals 1.2 Scope Monitoring and States of Interest |
2.1 Define Conditions and Related CIs 2.2 Set Monitoring Thresholds and Alerts 2.3 Action Your Events |
3.1 Define Your Data Policy 3.2 Define Future State |
|
Event Cookbook Event Catalog |
|||
|
Phase Outcomes |
Monitoring and Event Management RACI Abbreviated BIA |
Event Workflow |
Event Management Roadmap |
The goals come from the pain points of other ITSM practices. Build handoffs to other service management practices to drive the proper action when an event is detected.
Trying to organize a catalog of events is difficult when working from the bottom up. Start with the business drivers of event management to keep the scope manageable.
Defining tracked events with their known conditions, root cause, and associated actions allows you to be proactive when events occur.
Start small if need be. It is better and easier to track a few items with proper actions than to try to analyze events as they occur.
Even in an AI-enabled world, every event must be collected with a specific objective in mind. Defining the purpose of each tracked event will cut down on data clutter and response time when events are detected.
Supplement the predictive value of a single event by aggregating it with other events.
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
Event Management Cookbook
Use the framework in the Event Management Cookbook to populate your event catalog with properly tracked and actioned events.
Event Management RACI
Define the roles and responsibilities needed in event management.
Event Management Workflow
Define the lifecycle and handoffs for event management.
Event Catalog
Consolidate and organize your tracked events.
Event Roadmap
Roadmap your initiatives for future improvement.
INDUSTRY - Research and Advisory
SOURCE - Anonymous Interview
One staff member’s workstation had been infected with a virus that was probing the network with a wide variety of usernames and passwords, trying to find an entry point. Along with the obvious security threat, there existed the more mundane concern that workers occasionally found themselves locked out of their machine and needed to contact the service desk to regain access.
The system administrator wrote a script that runs hourly to see if there is a problem with an individual’s workstation. The script records the computer's name, the user involved, the reason for the password lockout, and the number of bad login attempts. If the IT technician on duty notices a greater than normal volume of bad password attempts coming from a single account, they will reach out to the account holder and inquire about potential issues.
The IT department has successfully proactively managed two distinct but related problems: first, they have prevented several instances of unplanned work by reaching out to potential lockouts before they receive an incident report. They have also successfully leveraged event management to probe for indicators of a security threat before there is a breach.
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| Phase 1 | Phase 2 | Phase 3 |
|---|
|
Call #1: Scope requirements, objectives, and your specific challenges. |
Call #2: Introduce the Cookbook and explore the business impact analysis. |
Call #4: Define operational conditions. |
Call #6: Define actions and related practices. |
Call #8: Identify and prioritize improvements. |
|
Call #3: Define system scope and related CIs/ dependencies. |
Call #5: Define thresholds and alerts. |
Call #7: Define data policy. |
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between 6 to 12 calls over the course of 4 to 6 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
| Situate Event Management in Your Service Management Environment | Define Your Event Management Scope | Define Thresholds and Actions | Start Monitoring and Implement Event Management | Next Steps and Wrap-Up (offsite) | |
|
Activities |
1.1 3.1 Set Thresholds to Monitor 3.2 Add Actions and Handoffs to Event Management Introductions 1.2 Operational and Informational Goals and Challenges 1.3 Event Management Scope 1.4 Roles and Responsibilities |
2.1 Define Operational Conditions for Systems 2.2 Define Related CIs and Dependencies 2.3 Define Conditions for CIs 2.4 Perform Root-Cause Analysis for Complex Condition Relationships 2.4 Set Thresholds for CIs |
3.1 Set Thresholds to Monitor 3.2 Add Actions and Handoffs to Event Management |
4.1 Define Your Data Policy for Event Management 4.2 Identify Areas for Improvement and Future Steps 4.3 Summarize Workshop |
5.1 Complete In-Progress Deliverables From Previous Four Days 5.2 Set Up Review Time for Workshop Deliverables and to Discuss Next Steps |
| Deliverables |
|
|
|
|
|
| Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
|
1.1 Set Operational and Informational Goals |
2.1 Define Conditions and Related CIs |
3.1 Define Your Data Policy |
Engineer Your Event Management Process
1.1.1 List your goals and challenges
1.1.2 Build a RACI chart for event management
1.2.1 Set your scope using business impact
Infrastructure management team
IT managers
1.1.1 List your goals and challenges
1.1.2 Build a RACI chart for event management
Set the overall scope of event management by defining the governing goals. You will also define who is involved in event management as well as their responsibilities.
Infrastructure management team
IT managers
Define the goals and challenges of event management as well as their data proxies.
Have a RACI matrix to define roles and responsibilities in event management.
Event management needs to interact with the following service management practices:
Event management may log real-time data for operational goals and non-real time data for informational goals
|
Event Management |
||||
|---|---|---|---|---|
|
Operational Goals (real-time) |
Informational Goals (non-real time) |
|||
|
Incident Response & Prevention |
Availability Scaling |
Availability Scaling |
Modeling and Testing |
Investigation/ Compliance |
Gather a diverse group of IT staff in a room with a whiteboard.
Have each participant write down their top five specific outcomes they want from improved event management.
Consolidate similar ideas.
Prioritize the goals.
Record these goals in your Event Management Cookbook.
| Priority | Example Goals |
|---|---|
| 1 | Reduce response time for incidents |
| 2 | Improve audit compliance |
| 3 | Improve risk analysis |
| 4 | Improve forecasting for resource acquisition |
| 5 | More accurate RCAs |
The infrastructure team is accountable for deciding which events to track, how to track, and how to action the events when detected.
The service desk may respond to events that are indicative of incidents. Setting a root cause for events allows for quicker troubleshooting, diagnosis, and resolution of the incident.
Problem and change management may be involved with certain event alerts as the resultant action could be to investigate the root cause of the alert (problem management) or build and approve a change to resolve the problem (change management).
Download the Event Management Cookbook
| Event Management Task | IT Manager | SME | IT Infrastructure Manager | Service Desk | Configuration Manager | (Event Monitoring System) | Change Manager | Problem Manager |
| Defining systems and configuration items to monitor | R | C | AR | R | ||||
| Defining states of operation | R | C | AR | C | ||||
| Defining event and event thresholds to monitor | R | C | AR | I | I | |||
| Actioning event thresholds: Log | A | R | ||||||
| Actioning event thresholds: Monitor | I | R | A | R | ||||
| Actioning event thresholds: Submit incident/change/problem ticket | R | R | A | R | R | I | I | |
| Close alert for resolved issues | AR | RC | RC | |||||
1.2.1 Set your scope using business impact
Situate Event Management in Your Service Management Environment
Tracking too many events across too many tools could decrease your responsiveness to incidents. Start tracking only what is actionable to keep the signal-to-noise ratio of events as high as possible.
11 Tools: 52">
Source: Riverbed, 2016
| Systems/Services/Applications | Tier | |
|---|---|---|
| 1 | Core Infrastructure | Gold |
| 2 | Internet Access | Gold |
| 3 | Public-Facing Website | Gold |
| 4 | ERP | Silver |
| … | ||
| 15 | PaperSave | Bronze |
It might be tempting to jump ahead and preselect important applications. However, even if an application is not on the top 10 list, it may have cross-dependencies that make it more valuable than originally thought.
For a more comprehensive BIA, see Create a Right-Sized Disaster Recovery Plan
Download the Event Management Cookbook
| Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
1.1 Set Operational and Informational Goals | 2.1 Define Conditions and Related CIs | 3.1 Define Your Data Policy |
Engineer Your Event Management Process
2.1.1 Define performance conditions
2.1.2 Decompose services into related CIs
For each monitored system, define the conditions of interest and related CIs.
Business system owners
Infrastructure manager
IT managers
List of conditions of interest and related CIs for each monitored system.
2.2.1 Verify your CI conditions with a root-cause analysis
2.2.2 Set thresholds for your events
Set monitoring thresholds for each CI related to each condition of interest.
Business system managers
Infrastructure manager
IT managers
Service desk manager
List of events to track along with their root cause.
Separate the serious from trivial to keep the signal-to-noise ratio high.
You must set your own monitoring criteria based on operational needs. Events triggering an action should be reviewed via an assessment of the potential project and associated risks.
Examples:
Web sever – how many pages per minute
Network – Mbps
Storage – I/O read/writes per sec
Web Server – page load failures
Network – packets dropped
Storage – disk errors
Web Server – % load
Network – % utilization
Storage – % full
RCAs postulate why systems go down; use the RCA to inform yourself of the events leading up to the system going down.
| Dependency | CIs | Tool | Metrics |
|---|---|---|---|
| ISP | WAN | SNMP Traps | Latency |
| Telemetry | Packet Loss | ||
| SNMP Pooling | Jitter | ||
| Network Performance | Web Server | Response Time | |
| Connection Stage Errors | |||
| Web Server | Web Page | DOM Load Time | |
| Performance | |||
| Page Load Time | |||
At the end of the day, most of us can only monitor what our systems let us. Some (like Exchange Servers) offer a crippling number of parameters to choose from. Other (like MPLS) connections are opaque black boxes giving up only the barest of information. The metrics you choose are largely governed by the art of the possible.
Exhaustive RCAs proved that 54% of issues were not caused by storage.
INDUSTRY - Enterprise IT
SOURCE - ESG, 2017
Despite a laser focus on building nothing but all-flash storage arrays, Nimble continued to field a dizzying number of support calls.
Variability and complexity across infrastructure, applications, and configurations – each customer install being ever so slightly different – meant that the problem of customer downtime seemed inescapable.
Nimble embedded thousands of sensors into its arrays, both at a hardware level and in the code. Thousands of sensors per array multiplied by 7,500 customers meant millions of data points per second.
This data was then analyzed against 12,000 anonymized app-data gap-related incidents.
Patterns began to emerge, ones that persisted across complex customer/array/configuration combinations.
These patterns were turned into signatures, then acted on.
54% of app-data gap related incidents were in fact related to non-storage factors! Sub-optimal configuration, bad practices, poor integration with other systems, and even VM or hosts were at the root cause of over half of reported incidents.
Establishing that your system is working fine is more than IT best practice – by quickly eliminating potential options the right team can get working on the right system faster thus restoring the service more quickly.
Event data determined to be of minimal predictive value is shunted aside.
De-duplication and combination of similar events to trigger a response based on the number or value of events, rather than for individual events.
Ignoring events that occur downstream of a known failed system. Relies on accurate models of system relationships.
Initiating the appropriate response. This could be simple logging, any of the exception event responses, an alert requiring human intervention, or a pre-programmed script.
If the event management team toggles the threshold for an alert too low (e.g. one is generated every time a CPU load reaches 60% capacity), they will generate too many false positives and create far too much work for themselves, generating alert fatigue. If they go the other direction and set their thresholds too high, there will be too many false negatives – problems will slip through and cause future disruptions.
| Dependency | Metrics | Threshold |
| Network Performance | Latency | 150ms |
| Packet Loss | 10% | |
| Jitter | >1ms | |
| Web Server | Response Time | 750ms |
| Performance | ||
| Connection Stage Errors | 2 | |
| Web Page Performance | DOM Load time | 1100ms |
| Page Load time | 1200ms | |
2.3.1 Set actions for your thresholds
2.3.2 Build your event management workflow
With your list of tracked events from the previous step, build associated actions and define the handoff from event management to related practices.
Event management team
Infrastructure team
Change manager
Problem manager
Incident manager
Event management workflow
For informational alerts, log the event for future analysis.
For a warning or exception event or a set of events with a well-known root cause, you may have an automated resolution tied to detection.
For warnings and exceptions, human intervention may be needed. This could include manual monitoring or a handoff to incident, change, or problem management.
| Outcome | Metrics | Threshold | Response (s) | |
|---|---|---|---|---|
| Network Performance | Latency | 150ms | Problem Management | Tag to Problem Ticket 1701 |
| Web Page Performance | DOM Load time | 1100ms | Change Management | |
Download the Event Management Catalog
|
Data Fields |
|
|---|---|
|
Device |
Date/time |
|
Component |
Parameters in exception |
|
Type of failure |
Value |
| Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
1.1 Set Operational and Informational Goals | 2.1 Define Conditions and Related CIs | 3.1 Define Your Data Policy |
3.1.1 Define data policy needs
3.2.1 Build your roadmap
Business system owners
Infrastructure manager
IT managers
Activities
3.1.1 Define data policy needs
Your overall goals from Phase 1 will help define your data retention needs. Document these policy statements in a data policy.
CIO
Infrastructure manager
IT managers
Service desk manager
Outcomes of this step
Data retention policy statements for event management
|
Logs |
Metrics |
||
|---|---|---|---|
|
A log is a complete record of events from a period:
|
Missing entries in logs can be just as telling as the values existing in other entries. | A metric is a numeric value that gives information about a system, generally over a time series. | Adjusting the time series allows different views of the data. |
|
Logs are generally internal constructs to a system:
|
Completeness and context make logs excellent for:
|
As a time series, metrics operate predictably and consistently regardless of system activity. |
This independence makes them ideal for:
|
|
Large amounts of log data can make it difficult to:
|
Context insensitivity means we can apply the same metric to dissimilar systems:
|
||
Source: SolarWinds
| Security | Logs may contain sensitive information. Best practice is to ensure logs are secure at rest and in transit. Tailor your security protocol to your compliance regulations (PCI, etc.). |
|---|---|
| Architecture and Availability | When production infrastructure goes down, logging tends to go down as well. Holes in your data stream make it much more difficult to determine root causes of incidents. An independent secondary architecture helps solve problems when your primary is offline. At the very least, system agents should be able to buffer data until the pipeline is back online. |
| Performance | Log data grows: organically with the rest of the enterprise and geometrically in the event of a major incident. Your infrastructure design needs to support peak loads to prevent it from being overwhelmed when you need it the most. |
| Access Control | Events have value for multiple process owners in your enterprise. You need to enable access but also ensure data consistency as each group performs their own analysis on the data. |
| Retention | Near-real time data is valuable operationally; historic data is valuable strategically. Find a balance between the two, keeping in mind your obligations under compliance frameworks (GDPR, etc.). |
| Metrics/Log | Retention Period | Data Sensitivity | Data Rate |
|---|---|---|---|
| Latency | 150ms | No | |
| Packet Loss | 10% | No | |
| Jitter | >1ms | No | |
| Response Time | 750ms | No | |
| HAProxy Log | 7 days | Yes | 3GB/day |
| DOM Load time | 1100ms | ||
| Page Load time | 1200ms | ||
| User Access | 3 years | Yes |
Download the Event Management Catalog
3.2.1 Build your roadmap
Event management maturity is slowly built over time. Define your future actions in a roadmap to stay on track.
CIO
Infrastructure manager
IT managers
Event management roadmap and action items
Engineer your event management practice to be predictive. For example:
If the expected consequence is not observed there are three places to look:
While impractical to look at every action resulting from an alert, a regular review process will help improve your process. Effective alerts are crafted with specific and measurable outcomes.
False positives are worse than missed positives as they undermine confidence in the entire process from stakeholders and operators. If you need a starting point, action your false positives first.
Mind Your Event Management Errors
Source: IEEE Communications Magazine March 2012
You now have several core systems, their CIs, conditions, and their related events listed in the Event Catalog. Keep the Catalog as your single reference point to help manage your tracked events across multiple tools.
The Event Management Cookbook is designed to be used over and over. Keep your tracked events standard by running through the steps in the Cookbook.
An additional step you could take is to pull the Cookbook out for event tracking for each new system added to your IT environment. Adding events in the Catalog during application onboarding is a good way to manage and measure configuration.
Use the framework in the Event Management Cookbook to populate your event catalog with properly tracked and actioned events.
Add the following in-scope goals for future improvement. Include owner, timeline, progress, and priority.
You now have a structured event management process with a start on a properly tracked and actioned event catalog. This will help you detect incidents before they become incidents, changes needed to the IT environment, and problems before they spread.
Continue to use the Event Management Cookbook to add new monitored events to your Event Catalog. This ensures future events will be held to the same or better standard, which allows you to avoid drowning in too much data.
Lastly, stay on track and continually mature your event management practice using your Event Management Roadmap.
Contact your account representative for more information
workshops@infotech.com
1-888-670-8889
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.
To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
The following are sample activities that will be conducted by Info-Tech analysts with your team:
Define and document the roles and responsibilities in event management.
Define and prioritize in-scope systems and services for event management.
Improve customer service by driving consistency in your support approach and meeting SLAs.
Don’t let persistent problems govern your department
Build a service configuration management practice around the IT services that are most important to the organization.
DeMattia, Adam. “Assessing the Financial Impact of HPE InfoSight Predictive Analytics.” ESG, Softchoice, Sept. 2017. Web.
Hale, Brad. “Estimating Log Generation for Security Information Event and Log Management.” SolarWinds, n.d. Web.
Ho, Cheng-Yuan, et al. “Statistical Analysis of False Positives and False Negatives from Real Traffic with Intrusion Detection/Prevention Systems.” IEEE Communications Magazine, vol. 50, no. 3, 2012, pp. 146-154.
ITIL Foundation ITIL 4 Edition = ITIL 4. The Stationery Office, 2019.
McGillicuddy, Shamus. “EMA: Network Management Megatrends 2016.” Riverbed, April 2016. Web.
McGillicuddy, Shamus. “Network Management Megatrends 2020.” Enterprise Management Associates, APCON, 2020. Web.
Rivas, Genesis. “Event Management: Everything You Need to Know about This ITIL Process.” GB Advisors, 22 Feb. 2021. Web.
“Service Operations Processes.” ITIL Version 3 Chapters, 21 May 2010. Web.
While this text is about DORA requirements, it is really about resilient availability of your service. Even if you are not bound to this regulation, maybe you are not a financial services provider, the requirements and tips on how to get there are invaluable to your client satisfaction.
In order to address and manage ICT risk, financial entities shall use and maintain updated ICT systems, protocols and tools that are:
(a) appropriate to the magnitude of operations supporting the conduct of their activities, in accordance with the
proportionality principle as referred to in Article 4;
(b) reliable;
(c) equipped with sufficient capacity to accurately process the data necessary for the performance of activities and the timely provision of services, and to deal with peak orders, message or transaction volumes, as needed, including where new technology is introduced;
(d) technologically resilient in order to adequately deal with additional information processing needs as required under
stressed market conditions or other adverse situations.
Many of these solutions will depend on the the solutions and responses to other DORA requirements.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Organize your first 100 days as CIO into activities completed within two-week periods, aided by the guidance of an executive advisor.
Communicate your strategy with a presentation deck that you will complete in collaboration with Info-Tech advisors.
See an example of a completed presentation deck, from the new CIO of Gotham City.
Check out The Business Leadership podcast in Info-Tech's special series, The First 100 Days.
“The original concept of ‘the first 100 days’ was popularized by Franklin Delano Roosevelt, who passed a battery of new legislation after taking office as US president during the Great Depression. Now commonly extended to the business world, the first 100 days of any executive role is a critically important period for both the executive and the organization.
But not every new leader should follow FDR’s example of an action-first approach. Instead, finding the right balance of listening and taking action is the key to success during this transitional period. The type of the organization and the mode that it’s in serves as the fulcrum that determines where the point of perfect balance lies. An executive facing a turnaround situation will want to focus on more action more quickly. One facing a sustaining success situation or a realignment situation will want to spend more time listening before taking action.” (Brian Jackson, Research Director, CIO, Info-Tech Research Group)
Studies show that two years after a new executive transition, as many as half are regarded as failures or disappointments (McKinsey). First impressions are hard to overcome, and a CIO’s first 100 days are heavily weighted in terms of how others will assess their overall success. The best way to approach this period is determined by both the size and the mode of an organization.
Organize a call with your executive advisor every two weeks during your first 100 days. Info-Tech recommends completing our diagnostics during this period. If you’re not able to do so, instead complete the alternative activities marked with (a).
| Call 1 | Call 2 | Call 3 | Call 4 | Call 5 | Call 6 | Call 7 | |
|---|---|---|---|---|---|---|---|
| Activities |
Before you start: Day -10 to Day 1
|
Day 0 to 15
|
Day 16 to 30
|
Day 31 to 45
|
Day 46 to 60
|
Day 61 to 75
|
Day 76 to 90
|
| Deliverables | Presentation Deck Section A: Foundational Preparation | Presentation Deck slides 9, 11-13, 19-20, 29 | Presentation Deck slides 16, 17, 21 | Presentation Deck slides 30, 34 | Presentation Deck slides 24, 25, 2 | Presentation Deck slides 27, 42 |
Interviewing your predecessor can help identify the organization’s mode and type.
Before reaching out to your predecessor, get a sense of whether they were viewed as successful or not. Ask your manager. If the predecessor remains within the organization in a different role, understand your relationship with them and how you'll be working together.
During the interview, make notes about follow-up questions you'll ask others at the organization.
Identify the organization’s corporate structure type based on your initial conversations with company leadership. The type of structure will dictate how much control you'll have as a functional head and help you understand which stakeholders you'll need to collaborate with.
Functional |
|
Projectized |
|
Matrix |
|
This organization is a ___________________ type.
(Source: Simplilearn)Presentation Deck, slide 6
Based on your interview process and discussions with company leadership, and using Michael Watkins’ STARS assessment, determine which mode your organization is in: startup, turnaround, accelerated growth, realignment, or sustaining success.
Knowing the mode of your organization will determine how you approach your 100-day plan. Depending on the mode, you'll rebalance your activities around the three categories of assess, listen, and deliver.
This organization is a ___________________ type.
(Source: Watkins, 2013.)
Presentation Deck, slide 6
| STARS | Startup | Turnaround | Accelerated Growth | Realignment | Sustaining Success |
|---|---|---|---|---|---|
| Definition | Assembling capabilities to start a project. | Project is widely seen as being in serious trouble. | Managing a rapidly expanding business. | A previously successful organization is now facing problems. | A vital organization is going to the next level. |
| Challenges | Must build strategy, structures, and systems from scratch. Must recruit and make do with limited resources. | Stakeholders are demoralized; slash and burn required. | Requires structure and systems to scale; hiring and onboarding. | Employees need to be convinced change is needed; restructure at the top required. | Risk of living in shadow of a successful former leader. |
| Advantages | No rigid preconceptions. High-energy environment and easy to pivot. | A little change goes a long way when people recognize the need. | Motivated employee base willing to stretch. | Organization has clear strengths; people desire success. | Likely a strong team; foundation for success likely in place. |
|
When Satya Nadella was promoted to the CEO role at Microsoft in 2014, he received a Glassdoor approval rating of 85% and was given an "A" grade by industry analysts after his first 100 days. What did he do right?
|
![]() Satya Nadella, CEO, Microsoft Corp. (Image source: Microsoft) |
As a new CIO, you'll have to introduce yourself to many people in the organization. To save time on communicating who you are as a person outside of the office, create a brief one-pager that includes a photo of you, where you were born and raised, and what your hobbies are. This helps make a connection more quickly so your conversations can focus on the business at hand rather than personal topics.
For your presentation deck, remove the personal details and just keep it professional. The personal aspects can be used as a one-pager for other communications. (Source: Personal interview with Denis Gaudreault, Country Lead, Intel.)
Presentation Deck, slide 5
Prepare a 20-second pitch about yourself that goes beyond your name and title. Touch on your experience that's relevant to your new role or the industry you're in. Be straightforward about your own perceived strengths and weaknesses so that people know what to expect from you. Focus on the value you believe you'll offer the group and use humor and humility where you're comfortable. For example:
“Hi everyone, my name is John Miller. I have 15 years of experience marketing conferences like this one to vendors, colleges, and HR departments. What I’m good at, and the reason I'm here, is getting the right people, businesses, and great ideas in a room together. I'm not good on details; that's why I work with Tim. I promise that I'll get people excited about the conference, and the gifts and talents of everyone else in this room will take over from there. I'm looking forward to working with all of you.”
Write down the names, or at least the key people, in each segment of this diagram. This will serve as a quick reference when you're planning communications with others and will help you remember everyone as you're meeting lots of new people in your early days on the job.
Presentation Deck, slide 29
Competitor identification and analysis are critical steps for any new leader to assess the relative strengths and weaknesses of their organization and develop a sense of strategic opportunity and environmental awareness.
Today’s CIO is accountable for driving innovation through technology. A competitive analysis will provide the foundation for understanding the current industry structure, rivalry within it, and possible competitive advantages for the organization.
Surveying your competitive landscape prior to the first day will allow you to come to the table prepared with insights on how to support the organization and ensure that you are not vulnerable to any competitive blind spots that may exist in the evaluations conducted by the organization already.
You will not be able to gain a nuanced understanding of the internal strengths and weaknesses until you are in the role, so focus on the external opportunities and how competitors are using technology to their advantage.
For a more in-depth approach to identifying and understanding relevant industry trends and turning them into insights, leverage the following Info-Tech blueprints:
Presentation Deck, slide 9
INPUT: External research
OUTPUT: Competitor array
| Competitor | Strengths | Weaknesses | Key Differentiators | IT Enablers |
|---|---|---|---|---|
| Competitor 1 | ||||
| Competitor 2 | ||||
| Competitor 3 |
INPUT: CEO-CEO Alignment Program (recommended)
OUTPUT: Desired and target state of IT maturity, Innovation goals, Top priorities
Materials: Presentation Deck, slides 11-13
Participants: CEO, CIO
Introduce the concept of the CEO-CIO Alignment Program using slide 10 of your presentation deck and the brief email text below.
Talk to your advisory contact at Info-Tech about launching the program. More information is available on Info-Tech’s website.
Once the report is complete, import the results into your presentation:
Include any immediate recommendations you have.
Hello CEO NAME,
I’m excited to get started in my role as CIO, and to hit the ground running, I’d like to make sure that the IT department is aligned with the business leadership. We will accomplish this using Info-Tech Research Group’s CEO-CIO Alignment Program. It’s a simple survey of 20 questions to be completed by the CEO and the CIO.
This survey will help me understand your perception and vision as I get my footing as CIO. I’ll be able to identify and build core IT processes that will automate IT-business alignment going forward and create an effective IT strategy that helps eliminate impediments to business growth.
Research shows that IT departments that are effectively aligned to business goals achieve more success, and I’m determined to make our IT department as successful as possible. I look forward to further detailing the benefits of this program to you and answering any questions you may have the next time we speak.
Regards,
CIO NAME
Info-Tech's CEO-CIO Alignment Program is set up to build IT-business alignment in any organization. It helps the CIO understand CEO perspectives and priorities. The exercise leads to useful IT performance indicators, clarifies IT’s mandate and which new technologies it should invest in, and maps business goals to IT priorities.
|
|
|
| Master the Basics
Cut through the jargon. Take a comprehensive look at the CEO perspective. |
Target Alignment
Identify how IT can support top business priorities. Address CEO-CIO differences. |
Start on the Right Path
Get on track with the CIO vision. Use correct indicators and metrics to evaluate IT from day one. |
Additional materials are available on Info-Tech’s website.
Step 1: Where are we today?Determine where the CEO sees the current overall maturity level of the IT organization. Step 2: Where do we want to be as an organization?Determine where the CEO wants the IT organization to be in order to effectively support the strategic direction of the business. |
|
Presentation Deck, slide 11
|
Apple CEO Tim Cook, an internal hire, had big shoes to fill after taking over from the late Steve Jobs. Cook's ability to control how the company is perceived is a big credit to his success. How does he do it? His favorite five words are “The way I see it..." These words allow him to take a line of questioning and reframe it into another perspective that he wants to get across. Similarly, he'll often say, "Let me tell you the way I look at it” or "To put it in perspective" or "To put it in context." In your first two weeks on the job, try using these phrases in your conversations with peers and direct reports. It demonstrates that you value their point of view but are independently coming to conclusions about the situation at hand. |
![]() Tim Cook, CEO, Apple Inc. (Image source: Apple) |
Run the diagnostic program or use the alternative activities to complete your presentation
INPUT: IT Management & Governance Diagnostic (recommended)
OUTPUT: Process to improve first, Processes important to the business
Materials: Presentation Deck, slides 19-20
Participants: CIO, IT staff
Introduce the IT Management & Governance Diagnostic survey that will help you form your IT strategy.
Explain that you want to understand current IT capabilities and you feel a formal approach is best. You’ll also be using this approach as an important metric to track your department’s success. Tell them that Info-Tech Research Group will be conducting the survey and it’s important to you that they take action on the email when it’s sent to them.
Example email:
Hello TEAM,
I appreciate meeting each of you, and so far I’m excited about the talents and energy on the team. Now I need to understand the processes and capabilities of our department in a deeper way. I’d like to map our process landscape against an industry-wide standard, then dive deeper into those processes to understand if our team is aligned. This will help us be accountable to the business and plan the year ahead. Advisory firm Info-Tech Research Group will be reaching out to you with a simple survey that shouldn’t take too long to complete. It’s important to me that you pay attention to that message and complete the survey as soon as possible.
Regards,
CIO NAME
Info-Tech recommends that you hold group conversations with your team to uncover their opinions of the current organizational culture. This not only helps build transparency between you and your team but also gives you another means of observing behavior and reactions as you listen to team members’ characterizations of the current culture.
(Source: Hope College Blog Network)
Note: It is inherently difficult for people to verbalize what constitutes a culture – your strategy for extracting this information will require you to ask indirect questions to solicit the highest value information.
See Info-Tech’s Cultural Archetype Calculator.
|
CVF represents the synthesis of academic study of 39 indicators of effectiveness for organizations. Using a statistical analysis, two polarities that are highly predictive of differences in organizational effectiveness were isolated:
By plotting these dimensions on a matrix of competing values, four main cultural archetypes are identified with their own value drivers and theories of effectiveness. |
|
Presentation Deck, slide 16
Autonomous evolution: Encourage teams to learn from each other. Empower hybrid teams to collaborate and reward teams that perform well.
Planned and managed change: Create steering committee and project-oriented taskforces to work in parallel. Appoint employees that have cultural traits you'd like to replicate to hold responsibility for these bodies.
Cultural destruction: When a toxic culture needs to be eliminated, get rid of its carriers. Putting new managers or directors in place with the right cultural traits can be a swift and effective way to realign.
Each option boils down to creating the right set of incentives and deterrents. What behaviors will you reward and which ones will you penalize? What do those consequences look like? Sometimes, but not always, some structural changes to the team will be necessary. If you feel these changes should be made, it's important to do it sooner rather than later. (Source: “Enlarging Your Sphere of Influence in Your Organization,” MindTools Corporate, 2014.)
As you're thinking about shaping a desired culture, it's helpful to have an easy way to remember the top qualities you want to espouse. Try creating an acronym that makes it easy for staff to remember. For example: RISE could remind your staff to be Responsive, Innovative, Sustainable, and Engaging (RISE). Draw upon your business direction from your manager to help produce desired qualities (Source: Jennifer Schaeffer).
Presentation Deck, slide 17
|
After Gary Davenport was hired on as VP of IT at MTS Allstream, his first weekend on the job was spent at an all-executive offsite meeting. There, he learned from the CEO that the IT department had a budget reduction target of 25%, like other departments in the company. “That takes your breath away,” Davenport says. He decided to meet the CEO monthly to communicate his plans to reduce spending while trying to satisfy business stakeholders. His top priorities were:
During Davenport’s 7.5-year tenure, the IT department became one of the top performers at MTS Allstream. |
![]() Gary Davenport’s first weekend on the job at MTS Allstream included learning about a 25% reduction target. (Image source: Ryerson University) |
Listen to 'The First 100 Days' podcast – David Penny & Andrew Wertkin
Talk to your Info-Tech executive advisor about launching the survey shortly after informing your team to expect it. You'll just have to provide the names and email addresses of the staff you want to be involved. Once the survey is complete, you'll harvest materials from it for your presentation deck. See slides 19 and 20 of your deck and follow the instructions on what to include.
|
|
|
| Explore IT Processes
Dive deeper into performance. Highlight problem areas. |
Align IT Team
Build consensus by identifying opposing views. |
Ownership & Accountability
Identify process owners and hold team members accountable. |
Additional materials available on Info-Tech’s website.
INPUT: Interviews with IT leadership team, Capabilities graphic on next slide
OUTPUT: High-level understanding of current IT capabilities
Run this activity if you're not able to conduct the IT Management & Governance Diagnostic.
Schedule meetings with your IT leadership team. (In smaller organizations, interviewing everyone may be acceptable.) Provide them a list of the core capabilities that IT delivers upon and ask them to rate them on an effectiveness scale of 1-5, with a short rationale for their score.
Presentation Deck, slide 21
Strategy & Governance |
IT Governance | Strategy | Performance Measurement | Policies | Quality Management | Innovation | ||
People & Resources |
Stakeholder Management | Resource Management | Financial Management | Vendor Selection & Contract Management | Vendor Portfolio Management | Workforce Strategy | Strategic Comm. | Organizational Change Enablement |
Service Management & Operations |
Operations Management | Service Portfolio Management | Release Management | Service Desk | Incident & Problem Management | Change Management | Demand Management | |
Infrastructure |
Asset Management | Infrastructure Portfolio Management | Availability & Capacity Management | Infrastructure Management | Configuration Management | |||
Information Security & Risk |
Security Strategy | Risk Management | Compliance, Audit & Review | Security Detection | Response & Recovery | Security Prevention | ||
Applications |
Application Lifecycle Management | Systems Integration | Application Development | User Testing | Quality Assurance | Application Maintenance | ||
PPM & Projects |
Portfolio Management | Requirements Gathering | Project Management | |||||
Data & BI |
Data Architecture | BI & Reporting | Data Quality & Governance | Database Operations | Enterprise Content Management | |||
Enterprise Architecture |
Enterprise Architecture | Solution Architecture |
Complete this while waiting on the IT M&G survey results. Based on your completed CEO-CIO Alignment Report, identify the initiatives you can tackle immediately.
| If you are here... | And want to be here... | Drive toward... | Innovate around... |
|
|---|---|---|---|---|
| Business Partner | Innovator | Leading business transformation |
|
|
| Trusted Operator | Business Partner | Optimizing business process and supporting business transformation |
|
|
| Firefighter | Trusted Operator | Optimize IT processes and services |
|
|
| Unstable | Firefighter | Reduce use disruption and adequately support the business |
|
Run the diagnostic program or use the alternative activities to complete your presentation
INPUT: CIO Business Vision survey (recommended)
OUTPUT: True measure of business satisfaction with IT
Materials: Presentation Deck, slide 30
Participants: CIO, IT staff
Meet the business leaders at your organization face-to-face if possible. If you can't meet in person, try a video conference to establish some rapport. At the end of your introduction and after listening to what your colleague has to say, introduce the CIO Business Vision Diagnostic.
Explain that you want to understand how to meet their business needs and you feel a formal approach is best. You'll also be using this approach as an important metric to track your department's success. Tell them that Info-Tech Research Group will be conducting the survey and it’s important to you that they take the survey when the email is sent to them.
Example email:
Hello PEER NAMES,
I'm arranging for Info-Tech Research Group to invite you to take a survey that will be important to me. The CIO Business Vision survey will help me understand how to meet your business needs. It will only take about 15 minutes of your time, and the top-line results will be shared with the organization. We will use the results to plan initiatives for the future that will improve your satisfaction with IT.
Regards,
CIO NAME
There are two strategies for gaining feedback on your initial assessments of the organization from the IT team:
Who you involve in this process will be impacted by the size of your organization. For larger organizations, involve everyone down to the manager level. In smaller organizations, you may want to involve everyone on the IT team to get an accurate lay of the land.
You need your team’s hearts and minds or you risk a short tenure. Overemphasizing business commitment by neglecting to address your IT team until after you meet your business stakeholders will result in a disenfranchised group. Show your team their importance.
|
Susan Bowen was promoted to be the president of Cogeco Peer 1, an infrastructure services firm, when it was still a part of Cogeco Communications. Part of her mandate was to help spin out the business to a new owner, which occurred when it was acquired by Digital Colony. The firm was renamed Aptum and Bowen was put in place as CEO, which was not a certainty despite her position as president at Cogeco Peer 1. She credits her ability to put the right talent in the right place as part of the reason she succeeded. After becoming president, she sought a strong commitment from her directors. She gave them a choice about whether they'd deliver on a new set of expectations – or not. She also asks her leadership on a regular basis if they are using their talent in the right way. While it's tempting for directors to want to hold on to their best employees, those people might be able to enable many more people if they can be put in another place. Bowen fully rounded out her leadership team after Aptum was formed. She created a chief operating officer and a chief infrastructure officer. This helped put in place more clarity around roles at the firm and put an emphasis on client-facing services. |
![]() Susan Bowen, CEO, Aptum (Image source: Aptum) |
Be sure to effectively communicate the context of this survey to your business stakeholders before you launch it. Plan to talk about your plans to introduce it in your first meetings with stakeholders. When ready, let your executive advisor know you want to launch the tool and provide the names and email addresses of the stakeholders you want involved. After you have the results, harvest the materials required for your presentation deck. See slide 30 and follow the instructions on what to include.
|
|
|
|
| Key Stakeholders
Clarify the needs of the business. |
Credibility
Create transparency. |
Improve
Measure IT’s progress. |
Focus
Find what’s important. |
Additional materials are available on Info-Tech’s website.
Only conduct this activity if you’re not able to run the CIO Business Vision diagnostic.
Use the Organizational Catalog as a personal cheat sheet to document the key details around each of your stakeholders, including your CEO when possible.
The catalog will be an invaluable tool to keep the competing needs of your different stakeholders in line, while ensuring you are retaining the information to build the political capital needed to excel in the C-suite.
Note: It is important to keep this document private. While you may want to communicate components of this information, ensure your catalog remains under lock and (encryption) key.
While profiling your stakeholders is important, do not be afraid to profile yourself as well. Visualizing how your interests overlap with those of your stakeholders can provide critical information on how to manage your communications so that those on the receiving end are hearing exactly what they need.
Presentation Deck, slide 34
Introduce the IT Staffing Assessment that will help you get the most out of your team
INPUT: Email template
OUTPUT: Ready to launch diagnostic
Materials: Email template, List of staff, Sample of diagnostic
Participants: CIO, IT staff
Explain that you want to understand how the IT staff is currently spending its time by function and by activity. You want to take a formal approach to this task and also assess the team’s feelings about its effectiveness across different processes. The results of the assessment will serve as the foundation that helps you improve your team’s effectiveness within the organization.
Example email:
Hello PEER NAMES,
The feedback I've heard from the team since joining the company has been incredibly useful in beginning to formulate my IT strategy. Now I want to get a clear picture of how everyone is spending their time, especially across different IT functions and activities. This will be an opportunity for you to share feedback on what we're doing well, what we need to do more of, and what we're missing. Expect to receive an email invitation to take this survey from Info-Tech Research Group. It's important to me that you complete the survey as soon as you're can. Attached you’ll find an example of the report this will generate. Thank you again for providing your time and feedback.
Regards,
CIO NAME
|
Wayne Berger was hired to be the International Workplace Group (IWG) CEO for Canada and Latin America in 2014. Wayne approached his early days with the office space leasing firm as a tour of sorts, visiting nearly every one of the 48 office locations across Canada to host town hall meetings. He heard from staff at every location that they felt understaffed. But instead of simply hiring more staff, Berger actually reduced the workforce by 33%. He created a more flexible approach to staffing:
|
![]() Wayne Berger, CEO, IWG Plc (Image source: IWG) |
Info-Tech’s IT Staffing Assessment provides benchmarking of key metrics against 4,000 other organizations. Dashboard-style reports provide key metrics at a glance, including a time breakdown by IT function and by activity compared against business priorities. Run this survey at about the 45-day mark of your first 90 days. Its insights will be used to inform your long-term IT strategy.
|
|
|
| Right-Size IT Headcount
Find the right level for stakeholder satisfaction. |
Allocate Staff Correctly
Identify staff misalignments with priorities. |
Maximize Teams
Identify how to drive staff. |
Additional materials are available on Info-Tech’s website.
Complete this exercise while waiting on the IT Staffing Assessment results. Based on your completed IT Management & Governance report, identify the initiatives you can tackle immediately. You can conduct this as a team exercise by following these steps:
This is an alternative activity to running an IT Staffing Assessment, which contains a start/stop/continue assessment. This activity can be facilitated with a flip chart or a whiteboard. Create three pages or three columns and label them Start, Stop, and Continue.
Hand out sticky notes to each team member and then allow time for individual brainstorming. Instruct them to write down their contributions for each category on the sticky notes. After a few minutes, have everyone stick their notes in the appropriate category on the board. Discuss as a group and see what themes emerge. Record the results that you want to share in your presentation deck (GroupMap).
Gather your team and explain the meaning of these categories:
Start: Activities you're not currently doing but should start doing very soon.
Stop: Activities you're currently doing but aren’t working and should cease.
Continue: Things you're currently doing and are working well.
Presentation Deck, slide 24
INPUT: Interviews with IT leadership team
OUTPUT: High-level understanding of in-flight commitments and investments
Run this only as an alternative to the IT Management & Governance Diagnostic.
Presentation Deck, slide 25
Run this only as an alternative to the IT Staffing Assessment diagnostic.
Schedule meetings with IT leadership to understand what commitments have been made to the business in terms of new products, projects, or enhancements.
Determine the following about IT’s current investment mix:
Document your key investments and commitments, as well as any points of misalignment between objectives and current commitments, as action items to address in your long-term plans. If they are small-effort fixes, consider them during your quick-win identification.
Presentation Deck, slide 25
As part of learning the IT team, you should also create a comprehensive list of vendors under contract. Collaborate with the finance department to get a clear view of how much of the IT budget is spent on specific vendors. Try to match vendors to the IT processes they serve from the IT M&G framework.
You should also organize your vendors based on their budget allocation. Go beyond just listing how much money you’re spending with each vendor and categorize them into either “transactional” relationships or “strategic relationships.” Use the grid below to organize them. Ideally, you’ll want most relationships to be high spend and strategic (Source: Gary Davenport).
Further reading: Manage Your Vendors Before They Manage You
Presentation Deck, slide 26
|
Jennifer Schaeffer joined Athabasca University as CIO in November 2017. She was entering a turnaround situation as the all-online university lacked an IT strategy and had built up significant technical debt. Armed with the mandate of a third-party consultant that was supported by the president, Schaeffer used a people-first approach to construct her strategy. She met with all her staff, listening to them carefully regardless of role, and consulted with the administrative council and faculty members. She reflected that feedback in her plan or explained to staff why it wasn’t relevant for the strategy. She implemented a “strategic calendaring” approach for the organization, making sure that her team members were participating in meetings where their work was assessed and valued. Drawing on Spotify as an inspiration, she designed her teams in a way that everyone was connected to the customer experience. Given her short timeline to execute, she put off a deep skills analysis of her team for a later time, as well as creating a full architectural map of her technology stack. The outcome is that 2.5 years later, the IT department is unified in using the same tooling and optimization standards. It’s more flexible and ready to incorporate government changes, such as offering more accessibility options. |
![]() Jennifer Schaeffer took on the CIO role at Athabasca University in 2017 and was asked to create a five-year strategic plan in just six weeks. (Image source: Athabasca University) |
A clear statement for your values, vision, and mission will help crystallize your IT strategy and communicate what you're trying to accomplish to the entire organization.
Mission: This statement describes the needs that IT was created to meet and answers the basic question of why IT exists.
Vision: Write a statement that captures your values. Remember that the vision statement sets out what the IT organization wants to be known for now and into the future.
Values: IT core values represent the standard axioms by which the IT department operates. Similar to the core values of the organization as a whole, IT’s core values are the set of beliefs or philosophies that guide its strategic actions.
Further reading: IT Vision and Mission Statements Template
Presentation Deck, slide 42
|
John Chen, known in the industry as a successful turnaround executive, was appointed BlackBerry CEO in 2014 following the unsuccessful launch of the BlackBerry 10 mobile operating system and a new tablet. He spent his first three months travelling, talking to customers and suppliers, and understanding the company's situation. He assessed that it had a problem generating cash and had made some strategic errors, but there were many assets that could benefit from more investment. He was blunt about the state of BlackBerry, making cutting observations of the past mistakes of leadership. He also settled a key question about whether BlackBerry would focus on consumer or enterprise customers. He pointed to a base of 80,000 enterprise customers that accounted for 80% of revenue and chose to focus on that. His new mission for BlackBerry: to transform it from being a "mobile technology company" that pushes handset sales to "a mobile solutions company" that serves the mobile computing needs of its customers. |
![]() John Chen, CEO of BlackBerry, presents at BlackBerry Security Summit 2018 in New York City (Image source: Brian Jackson) |
Based on your completed CIO Business Vision survey, use the IT Satisfaction Scorecard to determine some initiatives. Focus on areas that are ranked as high importance to the business but low satisfaction. While all of the initiatives may be achievable given enough time, use the matrix below to identify the quick wins that you can focus on immediately. It’s important to not fail in your quick-win initiative.
Presentation Deck, slide 27
The last few slides of your presentation deck represent a roundup of all the assessments you’ve done and communicate your plan for the months ahead.
Slide 38. Based on the information on the previous slide and now knowing which IT capabilities need improvement and which business priorities are important to support, estimate where you'd like to see IT staff spend their time in the near future. Will you be looking to shift staff from one area to another? Will you be looking to hire staff?
Slide 39. Take your IT M&G initiatives from slide 19 and list them here. If you've already achieved a quick win, list it and mark it as completed to show what you've accomplished. Briefly outline the objectives, how you plan to achieve the result, and what measurement will indicate success.
Slide 40. Reflect your CIO Business Vision initiatives from slide 31 here.
Slide 41. Use this roadmap template to list your initiatives by roughly when they’ll be worked on and completed. Plan for when you’ll update your diagnostics.
|
Alan Fong, Chief Technology Officer, Dealer-FX |
![]()
|
Andrew Wertkin, Chief Strategy Officer, BlueCat Networks
David Penny, Chief Technology Officer, BlueCat Networks |
|
Susan Bowen, CEO, Aptum |
|
Erin Bury, CEO, Willful |
|
Denis Gaudreault, Country Manager, Intel Canada and Latin America |
|
Wayne Berger, CEO, IWG Plc |
|
Eric Wright, CEO, LexisNexis Canada |
|
Gary Davenport, past president of CIO Association” of Canada, former VP of IT, Enterprise Solutions Division, MTS AllStream |
|
Jennifer Schaeffer, VP of IT and CIO, Athabasca University |
Beaudan, Eric. “Do you have what it takes to be an executive?” The Globe and Mail, 9 July 2018. Web.
Bersohn, Diana. “Go Live on Day One: The Path to Success for a New CIO.” PDF document. Accenture, 2015. Web.
Bradt, George. “Executive Onboarding When Promoted From Within To Follow A Successful Leader.” Forbes, 15 Nov. 2018. Web.
“CIO Stats: Length of CIO Tenure Varies By Industry.” CIO Journal, The Wall Street Journal. 15 Feb. 2017. Web.
“Enlarging Your Sphere of Influence in Your Organization: Your Learning and Development Guide to Getting People on Side.” MindTools Corporate, 2014.
“Executive Summary.” The CIO's First 100 Days: A Toolkit. PDF document. Gartner, 2012. Web.
Forbes, Jeff. “Are You Ready for the C-Suite?” KBRS, n.d. Web.
Gallo, Carmine. “Tim Cook Uses These 5 Words to Take Control of Any Conversation.” Inc., 9 Aug. 2019. Web.
Giles, Sunnie. “The Most Important Leadership Competencies, According to Leaders Around the World.” Harvard Business Review, 15 March 2016. Web.
Godin, Seth. “Ode: How to tell a great story.” Seth's Blog. 27 April 2006. Web.
Green, Charles W. “The horizontal dimension of race: Social culture.” Hope College Blog Network, 19 Oct. 2014. Web.
Hakobyan, Hayk. “On Louis Gerstner And IBM.” Hayk Hakobyan, n.d. Web.
Hargrove, Robert. Your First 100 Days in a New Executive Job, edited by Susan Youngquist. Kindle Edition. Masterful Coaching Press, 2011.
Heathfield, Susan M. “Why ‘Blink’ Matters: The Power of Your First Impressions." The Balance Careers, 25 June 2019. Web.
Hillis, Rowan, and Mark O'Donnell. “How to get off to a flying start in your new job.” Odgers Berndtson, 29 Nov. 2018. Web.
Karaevli, Ayse, and Edward J. Zajac. “When Is an Outsider CEO a Good Choice?” MIT Sloan Management Review, 19 June 2012. Web.
Keizer, Gregg. “Microsoft CEO Nadella Aces First-100-Day Test.” Computerworld, 15 May 2014. Web.
Keller, Scott, and Mary Meaney. “Successfully transitioning to new leadership roles.” McKinsey & Company, May 2018. Web.
Kress, R. “Director vs. Manager: What You Need to Know to Advance to the Next Step.” Ivy Exec, 2016. Web.
Levine, Seth. “What does it mean to be an ‘executive’.” VC Adventure, 1 Feb. 2018. Web.
Lichtenwalner, Benjamin. “CIO First 90 Days.” PDF document. Modern Servant Leader, 2008. Web.
Nawaz, Sabina. “The Biggest Mistakes New Executives Make.” Harvard Business Review, 15 May 2017. Web.
Pruitt, Sarah. “Fast Facts on the 'First 100 Days.‘” History.com, 22 Aug. 2018. Web.
Rao, M.S. “An Action Plan for New CEOs During the First 100 Days.” Training, 4 Oct. 2014. Web.
Reddy, Kendra. “It turns out being a VP isn't for everyone.” Financial Post, 17 July 2012. Web.
Silcoff, Sean. “Exclusive: John Chen’s simple plan to save BlackBerry.” The Globe & Mail, 24 Feb. 2014. Web.
“Start Stop Continue Retrospective.” GroupMap, n.d. Web.
Surrette, Mark. “Lack of Rapport: Why Smart Leaders Fail.” KBRS, n.d. Web.
“Understanding Types of Organization – PMP Study.” Simplilearn, 4 Sept. 2019. Web.
Wahler, Cindy. “Six Behavioral Traits That Define Executive Presence.” Forbes, 2 July 2015. Web.
Watkins, Michael D. The First 90 Days, Updated and Expanded. Harvard Business Review Press, 2013.
Watkins, Michael D. “7 Ways to Set Up a New Hire for Success.” Harvard Business Review, 10 May 2019. Web.
“What does it mean to be a business executive?” Daniels College of Business, University of Denver, 12 Aug. 2014. Web.
Yeung, Ken. “Turnaround: Marissa Mayer’s first 300 days as Yahoo’s CEO.” The Next Web, 19 May 2013. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify and categorize current collaboration toolset usage to recognize unnecessary overlaps and legitimate gaps.
Evaluate overlaps to determine which redundant tools should be phased out and explore best practices for how to do so.
Fill your collaboration toolset gaps with best-fit tools, build business requirements for those tools, and create an adoption plan for onboarding.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Create a collaboration vision.
Acknowledge the current state of the collaboration toolset.
A clear framework to structure the collaboration strategy
1.1 Set the vision for the Collaboration Strategy.
1.2 Identify your collaboration tools with use cases.
1.3 Learn what collaboration tools are used and why, including shadow IT.
1.4 Begin categorizing the toolset.
Beginnings of the Collaboration Strategy
At least five archetypical use cases, detailing the collaboration capabilities required for these cases
Use cases updated with shadow IT currently used within the organization
Overlaps and Gaps in Current Capabilities Toolset Template
Identify redundant overlapping tools and develop a phase-out plan.
Communication and phase-out plans for redundant tools, streamlining the collaboration toolset.
2.1 Identify legitimate overlaps and gaps.
2.2 Explore business and user strategies for identifying redundant tools.
2.3 Create a Gantt chart and communication plan and outline post-phase-out strategies.
Overlaps and Gaps in Current Capabilities Toolset Template
A shortlist of redundant overlapping tools to be phased out
Phase-out plan
Gather business requirements for finding best-fit tools to fill toolset gaps.
A business requirements document
3.1 Use SoftwareReviews and the Collaboration Platform Evaluation Tool to shortlist best-fit collaboration tool.
3.2 Build SMART objectives and goals cascade.
3.3 Walk through the Collaboration Tools Business Requirements Document Template.
A shortlist of collaboration tools
A list of SMART goals and a goals cascade
Completed Business Requirements Document
Create an adoption plan for successfully onboarding new collaboration tools.
An adoption plan
4.1 Fill out the Adoption Plan Gantt Chart Template.
4.2 Create the communication plan.
4.3 Explore best practices to socialize the new tools.
Completed Gantt chart
Adoption plan marketing materials
Long-term strategy for engaging employees with onboarded tools
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Assess the organization’s fit for MMS technology and structure the MMS selection project.
Produce a vendor shortlist for your MMS.
Evaluate RFPs, conduct vendor demonstrations, and select an MMS.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine a “right-size” approach to marketing enablement applications.
Confirmation of the goals, objectives, and direction of the organization is marketing application strategy.
1.1 Assess the value and identify the organization’s fit for MMS technology.
1.2 Understand the art of the possible.
1.3 Understand CXM strategy and identify your fit for MMS technology.
1.4 Build procurement team and project customer experience management (CXM) strategy.
1.5 Identify your MMS requirements.
Project team list.
Preliminary requirements list.
Enumerate relevant marketing management suites and point solutions.
List of marketing enablement applications based on requirements articulated in the preliminary requirements list strategy.
2.1 Identify relevant use cases.
2.2 Discuss the vendor landscape.
Vendor shortlist.
Develop a rationale for selecting a specific MMS vendor.
MMS Vendor decision.
A template to communicate the decision to executives.
3.1 Create a procurement strategy.
3.2 Discuss the executive presentation.
3.3 Plan the procurement process.
Executive/stakeholder PowerPoint presentation.
Selection of an MMS.
“Marketing applications are in high demand, but it is difficult to select a suite that is right for your organization. Market offerings have grown from 50 vendors to over 800 in the past five years. Much of the process of identifying an appropriate vendor is not about the vendor at all, but rather about having a comprehensive understanding of internal needs. There are instances where a smaller-point solution is necessary to satisfy requirements and a full marketing management suite is an overinvestment.
Likewise, a partner with differentiating features such as AI-driven workflows and a mobile software development kit can act as a powerful extension of an overall customer experience management strategy. It is crucial to make the right decision; missing the mark on an MMS selection will have a direct impact on the business’ bottom line.”
Ben Dickie
Research Director, Enterprise Applications
Info-Tech Research Group
This Research Is Designed For:
|
This Research Will Help You:
|
This Research Will Also Assist:
|
This Research Will Help Them
|
The MMS market is a landscape of vendors offering campaign management, multichannel support, analytics, and publishing tools. Many vendors specialize in some of these areas but not all. Sometimes multiple products are necessary – but determining which feature sets the organization truly needs can be a challenging task. The right technology stack is critical in order to bring automation to marketing initiatives.
| “When it comes to marketing automation capabilities, using CRM is like building a car from a kit. All the parts are there, but you need the time and skill to put it all together. Using marketing automation is like buying the car you want or need, with all the features you want already installed and some gas in the tank, ready to drive. In either case, you still need to know how to drive and where you want to go.” (Mac McIntosh, Marketo Inc.) | ![]() |
A master database – the central place where all up-to-the-minute data on a customer profile is stored – is essential for MMS success. This is particularly true for real-time capability effectiveness and to minimize customer fatigue. |
MMS helps marketers in two primary ways:
|
“A marketing automation solution delivers essentially all the benefits of an email marketing solution along with integrated capabilities that would otherwise need to be cobbled together using various standalone technologies.” (Marketo Inc.) |

1 |
2 |
3 |
4 |
5 |
| Establish Resources | Gather Requirements | Write and Assemble RFP | Exercise Due Diligence | Evaluate Candidate Solutions |
|
|
|
|
|
Contact your account representative or email Workshops@InfoTech.com for more information.
CASE STUDY |
Industry: Professional Services | Source: Info-Tech Consulting |
ChallengeA large professional services firm specializing in knowledge development was looking to modernize an outdated marketing services stack. Previous investments in marketing tools ranging from email automation to marketing analytics led to system fragmentation. As a result, there was no 360-degree overview of marketing operations and no way to run campaigns at scale. To satisfy the organization’s aspirations, a comprehensive marketing management suite had to be selected that met needs for the foreseeable future. |
SolutionThe Info-Tech consulting team was brought in to assist in the MMS selection process. After meeting with several stakeholders, MMS requirements were developed and weighted. An RFP was then created from these requirements. Following a market scan, four vendors were selected to complete the organization’s RFP. Demonstration scripts were then developed as the RFPs were completed by vendors. Shortlisted vendors progressed to the demonstration phase. |
ResultsVendor scorecards were utilized during the two-day demonstrations with the core project team to score each vendor. During the scoring process the team also identified the need to replace the organization’s core customer repository (a legacy CRM). The decision was made to select a CRM before finalizing the MMS selection. Doing so ensured uniform system architecture and strong interoperability between the firm’s MMS and its CRM. |
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Diagnostics and consistent frameworks used throughout all four options |
|||
| 1. Launch the MMS Project and Collect Requirements | 2. Shortlist Marketing Management Suites | 3. Select Vendor and Communicate Decision to Stakeholders | |
![]() Best-Practice Toolkit |
1.1 Assess the value and identify your organization’s fit for MMS technology. 1.2 Build your procurement team and project customer experience management (CXM) strategy. 1.3 Identify your MMS requirements. |
2.1 Produce your shortlist |
3.1 Select your MMS 3.2 Present selection |
Guided Implementations |
|
|
|
![]() Onsite Workshop |
Module 1:
Launch Your MMS Selection Project |
Module 2:
Analyze MMS Requirements and Shortlist Vendors |
Module 3:
Plan Your Procurement Process |
Phase 1 Outcome:
|
Phase 2 Outcome:
|
Phase 3 Outcome:
|
Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.
![]() |
This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project. |
![]() |
This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members who will come onsite to facilitate a workshop for your organization. |
![]() |
This icon denotes a slide that pertains directly to the Info-Tech vendor profiles on marketing management technology. Use these slides to support and guide your evaluation of the MMS vendors included in the research. |
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 1.2: Structure the Project | Step 1.3: Gather Requirements |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
Phase 1 Results:
|
|
1.1 |
1.2 |
1.3 |
||
| Understand the MMS Market | Structure the Project | Gather MMS Requirements |
| Analytics | The practice of measuring marketing performance to improve return on investment (ROI). It is often carried out through the visualization of meaningful patterns in data as a result of marketing initiatives. |
| Channels | The different places where marketers can reach customers (e.g. social media, print mail, television). |
| Click-through rate | The percentage of individuals who proceed (click-through) from one part of a marketing campaign to the next. |
| Content management | Curating, creating, editing, and keeping track of content and client-facing assets. |
| Customer relationship management (CRM) | A core enterprise application that provides a broad feature set for supporting customer interaction processes. The CRM frequently serves as a core customer data repository. |
| Customer experience management (CXM) | The holistic management of customer interaction processes across marketing, sales, and customer service to create valuable, mutually beneficial customer experiences. |
| Engagement rate | A social media metric used to describe the amount of likes, comments, shares, etc., that a piece of content receives. |
| Lead | An individual or organization who has shown interest in the product or service being marketed. |
| Omnichannel | The portfolio of interaction channels you use. |
A master database – the central place where all up-to-the-minute data on a customer profile is stored – is essential for MMS success. This is particularly true for real-time capability effectiveness and to minimize customer fatigue. If you have customer records in multiple places, you risk missing customer opportunities and potentially upsetting clients. For example, if a client has communicated preferences or disinterest through one channel, and this is not effectively recorded throughout the organization, another representative is likely to contact them in the same method again – possibly alienating the customer for good. A master database requires automatic synchronization with all point solutions, POS, billing systems, agencies, etc. If you don’t have up-to-the-minute information, you can’t score prospects effectively and you lose out on the benefits of the MMS. |
![]() |
| Focus on the fundamentals before proceeding. | Secure organizational readiness to reduce project risk using Info-Tech’s Build a Strong Technology Foundation for CXM and Select and Implement a CRM Platform blueprints. |
| The world of marketing technology changes rapidly! Understand how modern marketing management suites are used in most organizations. An MMS helps marketers in two primary ways:
Marketing suites accomplish these tasks by:
A strong MMS provides marketers with the data they need for actionable insights about their customers. “A marketing automation solution delivers essentially all the benefits of an email marketing solution along with integrated capabilities that would otherwise need to be cobbled together using various standalone technologies.” (Marketo Inc.) | Inform your way of thinking by understanding the capabilities of modern marketing applications.
|
(Source: Info-Tech Research Group; N=23)
The key drivers for MMS are business-related, not IT-related. However, this does not mean that there are no benefits to IT. In fact, the IT department will see numerous benefits, including time and resource savings. Further, not having an MMS creates more work for your IT department. IT must serve as a valued partner for selection and implementation.
Marketing management suites are ideal for large organizations with multiple product lines in complex marketing environments. IT is often more centralized than its counterparts in the business, making it uniquely positioned to encourage greater coordination by helping the business units understand the shared goals and the benefits of working together to roll out suites for marketing workflow management, intelligence, and channel management.
| Cross-Segmentation | Additional Revenue Generation | Real-Time Capabilities | Lead Growth/ Conversion Rate | |
| Business Value |
|
|
|
|
| IT Value |
|
|
|
|
Don’t forget that MMS technologies deliver on the overarching suite value proposition: a robust solution within one integrated offering. Without an MMS in play, organizations in need of this functionality are forced to piece together point solutions (or ad hoc management). This not only increases costs but also is an integration nightmare for IT.
1.1 | 1.2 | 1.3 | ||
| Understand the MMS Market | Structure the Project | Gather MMS Requirements |
Sample Project Overview[Organization] plans to select and implement a marketing management suite in order to introduce better campaign management to the business’ processes. This procurement and implementation of an MMS tool will enable the business to improve the efficiency and effectiveness of marketing campaign execution. This project will oversee the assessment and shortlisting of MMS vendors, selection of an MMS tool, the configuration of the solution, and the implementation of the technology into the business environment. Rationale Behind the ProjectConsider the business drivers behind the interest in MMS technology. Be specific to business units impacted and identify key considerations (both opportunities and risks). |
Business Drivers
|
Creating repeatable and streamlined marketing processes is a common overarching business objective that is driven by multiple factors. To ensure this objective is achieved, confirm that the primary drivers are following the implementation of the first automated marketing channels.
INPUT: Stakeholder user stories
OUTPUT: Understanding of ideal outcomes from MMS implementation
MATERIALS: Whiteboard and marker or sticky notes
PARTICIPANTS: Project sponsor, Project stakeholders, Business analysts, Business unit reps
| Improve | Reduce/Eliminate | KPIs |
| Multichannel marketing | Duplication of effort | Number of customer interaction channels supported |
| Social integration | Process inefficiencies | Number of social signals received (likes, shares, etc.) |
| … | … | … |
If you do not have a well-defined CXM strategy, leverage Info-Tech’s research to Build a Strong Technology Foundation for Customer Experience Management.
This blueprint focuses on complete, integrated marketing management suitesAn integrated suite is a single product that is designed to assist with multiple marketing processes. Information from these suites is deeply connected to the core CRM. Changing a piece of information for one process will update all affected. |
![]() |
A point solution typically interfaces with a single customer interaction channel with minimal CRM integration. Why use a marketing point solution?
Refer to Phase 2 for a bird’s-eye view of the point solution marketplace. |
Marketing Point Solutions
|
![]()
Adopt an MMS if:
|
Bypass an MMS if:
|
Using an MMS is ideal for organizations with multiple brands and product portfolios (e.g. consumer packaged goods). Ad hoc management and email marketing services are best for small organizations with a client base that requires only bare bones engagement.
Use Info-Tech’s MMS Readiness Assessment Checklist to determine if your organization has sufficient process and campaign maturity to warrant the investment in a consolidated marketing management suite.
Sections of the Tool:
|
INFO-TECH DELIVERABLE
Complete the MMS Readiness Assessment Checklist by following the instructions in Activity 1.2.3. |
1.2.3 30 minutes
INPUT: MMS foundation, MMS strategy
OUTPUT: Readiness remediation approach, Validation of MMS project readiness
MATERIALS: Info-Tech’s MMS Readiness Assessment Checklist
PARTICIPANTS: Project sponsor, Core project team
1.1 | 1.2 | 1.3 | ||
| Understand the MMS Market | Structure the Project | Gather MMS Requirements |
USE CASES |
While an organization may be product- or service-centric, most fall into one of the three use cases described on this slide. |
1) Marketing AutomationWorkflow ManagementManaging complex marketing campaigns and building and tracking marketing workflows are the mainstay responsibilities of brand managers and other senior marketing professionals. In this category, we evaluated vendors that provide marketers with comprehensive tools for marketing campaign automation, workflow building and tracking, lead management, and marketing resource planning for campaigns that need to reach a large segment of customers. Omnichannel ManagementThe proliferation of marketing channels has created significant challenges for many organizations. In this use case, we executed a special evaluation of vendors that are well suited for the intricacies of juggling multiple channels, particularly mobile, social, and email marketing. |
2) Marketing IntelligenceSifting through data from a myriad of sources and coming up with actionable intelligence and insights remains a critical activity for marketing departments, particularly for market researchers. In this category, we evaluated solutions that aggregate, analyze, and visualize complex marketing data from multiple sources to allow decision makers to execute informed decisions. 3) Social MarketingThe proliferation of social networks, customer data, and use cases has made ad hoc social media management challenging. In this category we evaluated vendors that bring uniformity to an organization’s social media capabilities and contribute to a 360-degree customer view. |
1.3.1 30 minutes
INPUT: Use-case breakdown
OUTPUT: Project use-case alignments
Materials: Whiteboard, markers
Participants: Project manager, Core project team (optional)
The use-case view of vendor and product performance provides multiple opportunities for vendors to fit into your application architecture depending on their product and market performance. The use cases selected are based on market research and client demand.
Determining your use case is crucial for:
The following slides illustrate how the three most common use cases (marketing automation, marketing intelligence, and social marketing) align with business needs. As shown by the case studies, the right MMS can result in great benefits to your organization.
| Marketing Need | Manage customer experience across multiple channels | Manage multiple campaigns simultaneously | Integrate web-enabled devices (IoT) into marketing campaigns | Run and track email marketing campaigns |
![]() |
||||
| Corresponding Feature | End-to-end management of email marketing | Visual workflow editor | Customer journey mapping | Business rules engine | A/B tracking |
CASE STUDY | Industry: Entertainment | Source: Marketo |
ChallengeThe Portland Trail Blazers, an NBA franchise, were looking to expand their appeal beyond the city of Portland and into the greater Pacific Northwest Region. The team’s management group also wanted to showcase the full range of events that were hosted in the team’s multipurpose stadium. The Trail Blazers were looking to engage fans in a more targeted fashion than their CRM allowed for. Ultimately, they hoped to move from “batch and blast” email campaigns to an automated and targeted approach. | SolutionThe Trail Blazers implemented an MMS that allowed it to rapidly build different types of campaigns. These campaigns could be executed across a variety of channels and target multiple demographics at various points in the fan journey. Contextual ads were implemented using the marketing suite’s automated customer journey mapping feature. Targeted ads were served based on a fan’s location in the journey and interactions with the Trail Blazers’ online collateral. | ResultsThe automated campaigns led to a 75% email open rate, which contributed to a 96% renewal rate for season ticket holders – a franchise record. Other benefits resulting from the improved conversion rate included an increased cohesion between the Trail Blazers’ marketing, analytics, and ticket sales operations. |
![]()
| Marketing Need | Capture marketing- and customer-related data from multiple sources | Analyze large quantities of marketing data | Visualize marketing-related data in a manner that is easy for decision makers to consume | Perform trend and predictive analysis |
![]() |
||||
| Corresponding Feature | Integrate data across customer segments | Analysis through machine learning | Assign attributers to unstructured data | Displays featuring data from external sources | Create complex customer data visualizations |
CASE STUDY | Industry: Retail | Source: SAS |
ChallengeWomen’s apparel retailer Chico’s FAS was looking to capitalize on customer data from in-store and online experiences. Chico’s hoped to consolidate customer data from multiple online and brick-and-mortar retail channels to get a complete view of the customer. Doing so would satisfy Chico’s need to create more highly segmented, cost-effective marketing campaigns | SolutionChico’s selected an MMS with strong marketing intelligence, analysis, and data visualization capability. The MMS could consolidate and analyze customer and transactional information. The suite’s functionality enabled Chico’s marketing team to work directly with the data, without help from statisticians or IT staff. | ResultsThe approach to marketing indigence led to customers getting deals on products that were actually relevant to them, increasing sales and brand loyalty. Moreover, the time it took to perform data consolidation decreased dramatically, from 17 hours to two hours, allowing the process to be performed daily instead of weekly. |
![]()
| Marketing Need | Understand customers' likes and dislikes | Manage and analyze social media channels like Facebook and Twitter | Foster a conversation around specific products | Engage international audiences through regional messaging apps |
![]() |
||||
| Corresponding Feature | Social listening capabilities | Tools for curating customer community content | Ability to aggregate social data | Integration with popular social networks | Ability to conduct trend reporting |
CASE STUDY | Industry: Life Sciences | Source: Adobe |
ChallengeBayer, a Fortune 500 health and life sciences company, was looking for a new way to communicate its complex medical breakthroughs to the general public. The decision was made to share the science behind its products via social channels in order to generate excitement. Bayer needed tools to publish content across a variety of social media platforms while fostering conversations that were more focused on the science behind products. | SolutionBased on the requirements, Bayer decided that an MMS would be the best fit. After conducting a market scan, the company selected an MMS with a comprehensive social media suite. The suite included tools for social listening and moderation and tools to guide conversations initiated by both marketers and customers. | ResultsThe MMS provided Bayer with the toolkit to engage its audience. Bayer took control of the conversation about its products by serving potential customers with relevant video content on social media. Its social strategy coupled with advanced engagement tools resulted in new business opportunities and more than 65,000 views on YouTube and more than 87,000 Facebook views in a single month. |
| REQUIREMENTS GATHERING
Info-Tech’s requirements gathering framework is a comprehensive approach to requirements management that can be scaled to any size of project or organization. This framework ensures that the application created will capture the needs of all stakeholders and deliver business value. Develop and right-size a proven standard operating procedure for requirements gathering with Info-Tech’s blueprint Build a Strong Approach to Business Requirements Gathering. |
![]() |
| Requirements Gathering Methodology
Requirements Gathering Blueprint Slide 25: Understand the best-practice framework for requirements gathering for enterprise applications projects. |
Requirements Gathering SOP
Requirements Gathering Blueprint Activities 1.2.2-1.2.5, 2.1.1, 2.1.2, 3.1.1, 3.2.1, 4.1.1-4.1.3, 4.2.2: Consolidate outputs to right-size a best-practice SOP for your organization. |
Project Level Selection Tool
Requirements Gathering Blueprint Activity 1.2.4: Determine project-level selection guidelines to inform the due diligence required in your MMS requirements gathering. |
1.3.2 Varies
INPUT: MMS tool user expertise, MMS Requirements Picklist Tool
OUTPUT: A list of needs from the MMS tool user perspective
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: MMS users in the organization, MMS selection committee
Download the MMS Requirements Picklist Tool to help with completing this activity.
The return on investment (ROI) and perceived value of the organization’s marketing solution will be a critical indication of the likelihood of success of the suite’s selection and implementation.
| EXAMPLE METRICS |
MMS and Technology AdoptionMarketing Performance Metrics |
|
| Average revenue gain per campaign | Quantity and quality of marketing insights | |
| Average time to execute a campaign | Customer acquisition rates | |
| Savings from automated processes | Marketing cycle times | |
User Adoption and Business Feedback Metrics |
||
| User satisfaction feedback | User satisfaction survey with the technology | |
| Business adoption rates | Application overhead cost reduction | |
Even if marketing metrics are difficult to track right now, the implementation of an MMS brings access to valuable customer intelligence from data that was once kept in silos.
![]() |
|
1.2.1 |
![]() |
Align the CXM strategy value proposition to MMS capabilities
Our facilitator will help your team identify the IT CXM strategy and marketing goals. The analyst will then work with the team to map the strategy to technological drivers available in the MMS market. |
1.3.2 |
![]() |
Define the needs of MMS users
Our facilitator will work with your team to identify user requirements for the MMS Requirements Picklist Tool. The analyst will facilitate a discussion with your team to prioritize identified requirements. |
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 2.1: Analyze and Shortlist MMS Vendors | |
Start with an analyst kick-off call:
|
|
Then complete these activities…
|
|
With these tools & templates:
|
|
Phase 2 Results:
|
|
2.1 |
| Analyze and Shortlist MMS Vendors |
![]()
Loosely Tied TogetherOriginally the sales and marketing enterprise application space was highly fragmented, with disparate best-of-breed point solutions patched together. Soon after, vendors in the late 1990s started bundling automation technologies into a single suite offering. Marketing capabilities of CRM suites were minimal at best and often restricted to web and email only. Limited to Large EnterprisesMany vendors started to combine all marketing tools into a single, comprehensive marketing suite, but cost and complexity limited them to large enterprises and marketing agencies. Best-of-breed solutions targeting new channels and new goals, like closed-loop sales and marketing, continued driving new marketing software genres, like dedicated lead management suites. |
“In today’s volatile business environment, judgment built from past experience is increasingly unreliable. With consumer behaviors in flux, once-valid assumptions (e.g. ‘older consumers don’t use Facebook or send text messages’) can quickly become outdated.” (SAS Magazine) |
As the market evolves, capabilities that were once cutting edge become default and new functionality becomes differentiating. Some features, like basic CRM integration, have become table stakes capabilities. Focus on advanced analytics features and omnichannel integration capabilities to get the best fit for your requirements.
AI and Machine LearningVendors are beginning to offer AI capabilities across MMS for data-driven customer engagement scoring and social listening insights. Machine learning capability is being leveraged to determine optimal customer journey and suggest next steps to users. Marketplace FragmentationThe number of players in the marketing application space has grown exponentially. The majority of these new vendors offer point solutions rather than full-blown marketing suites. Fragmentation is leading to tougher choices when looking to augment an existing platform with specific functionality. Improving Application IntegrationMMS vendors are fostering deeper integrations between their marketing products and core CRM products, leading to improved data hygiene. At the same time, vendors are improving flexibility in the marketing suite so that new channels can be added easily. Greater Self-ServiceVendors have an increased emphasis on application usability. Their goal is to enable marketers to execute campaigns without relying on specialists. |
“There’s a firehose of customer data coming at marketers today, and with more interconnected devices emerging (wearables, smart watches, etc.), cultivating a seamless customer experience is likely to grow even more challenging. Building out a data-driven marketing strategy and technology stack that enables you to capture behaviors across channels is key.” (IBM, Ideas for Exceeding Customer Expectations) |

VENDOR PROFILESReview the MMS Vendor Evaluation |
![]() |
![]()
TABLE STAKES
| What does this mean?The products assessed in these vendor profiles meet, at the very least, the requirements outlined as table stakes. Many of the vendors go above and beyond the outlined table stakes; some even do so in multiple categories. This section aims to highlight the products’ capabilities in excess of the criteria listed here. Info-Tech InsightIf table stakes are all you need from your MMS, determine whether your existing CRM platform already satisfies your requirements. Otherwise, dig deeper to find the best price-to-value ratio for your needs. |
Almost – or equally – as important as evaluating vendor feature capabilities is the need to evaluate vendor viability and non-functional aspects of the MMS. Include an evaluation of the following criteria in your vendor scoring methodology:
| Vendor Attribute | Description |
| Vendor Stability and Variability | The vendor’s proven ability to execute on constant product improvement, deliberate strategic direction, and overall commitment to research and development efforts in responding to emerging trends. |
| Security Model | The potential to integrate the application to existing security models and the vendor's approach to handling customer data. |
| Deployment Style | The choice to deploy a single or multi-tenant SaaS environment via a perpetual license. |
| Ease of Customization | The relative ease with which a system can be customized to accommodate niche or industry-specific business or functional needs. |
| Vendor Support Options | The availability of vendor support options, including selection consulting, application development resources, implementation assistance, and ongoing support resources. |
| Size of Partner Ecosystem | The quantity of enterprise applications and third-party add-ons that can be linked to the MMS, as well as the number of system integrators available. |
| Ease of Data Integration | The relative ease with which the system can be integrated with an organization’s existing application environment, including legacy systems, point solutions, and other large enterprise applications. |
Evaluate vendor capabilities, not just product capabilities. An MMS is typically a long-term commitment; ensure that your organization is teaming up with a vendor or provider that you feel you can work well with and depend on.
Evaluation MethodologyThese product features were assessed as part of the classification of vendors into use cases. In determining use-case leaders and players, select features were considered based on best alignment with the use case. |
|
![]()
Evaluation MethodologyThese product features were assessed as part of the classification of vendors into use cases. In determining use-case leaders and players, select features were considered based on best alignment with the use case. |
|
Review the use-case scenarios relevant to your organization’s use case to identify a vendor’s fit to your organization’s MMS needs.
|
![]() |
Understand your organization’s size and whether it falls within the product’s market focus.
|
![]() |
| Review the differentiating features to identify where the application performs best. | ![]() |
| Colors signify a feature’s performance. | ![]() |
![]() |
FUNCTIONAL SPOTLIGHT
Creative Cloud Integration: To make for a more seamless cross-product experience, projects can be sent between Marketing Cloud and Creative Cloud apps such as Photoshop and After Effects. Sensei: Adobe has revamped its machine learning and AI platform in an effort to integrate AI into all of its marketing applications. Sensei includes data from Microsoft in a new partnership program. Anomaly Detection: Adobe’s Anomaly Detection contextualizes data and provides a statistical method to determine how a given metric has changed in relation to previous metrics. |
||||||||||
USE-CASE PERFORMANCE
|
MARKET FOCUS
|
||||||||||
| Adobe’s goal with Marketing Cloud is to help businesses provide customers with cohesive, seamless experiences by surfacing customer profiles in relevant situations quickly. Adobe Marketing Cloud has traditionally been used in the B2C space but has seen an increase in B2C use cases driven by the finance and technology sectors. | FEATURES
![]() |
| Employees (2018): 17,000 | Presence: Global | Founded: 1982 | NASDAQ: ADBE |
![]()
![]() | FUNCTIONAL SPOTLIGHT Content Optimization System (COS): The fully integrated system stores assets and serves them to their designated channels at relevant times. The COS is integrated into HubSpot's marketing platform. Email Automation: HubSpot provides basic email that can be linked to a specific part of an organization’s marketing funnel. These emails can also be added to pre-existing automated workflows. Email Deliverability Tool: HubSpot identifies HTML or content that will be flagged by spam filters. It also validates links and minimizes email load times. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| Hubspot’s primary focus has been on email marketing campaigns. It has put effort into developing solid “click not code” email marketing capabilities. Also, Hubspot has an official integration with Salesforce for expanded operations management and analytics capabilities. | FEATURES
![]() |
| Employees (2018): 1,400 | Presence: Global | Founded: 2006 | NYSE: HUBS |
![]()
![]() | FUNCTIONAL SPOTLIGHT Watson: IBM is leveraging its popular Watson AI brand to generate marketing insights for automated campaigns. Weather Effects: Set campaign rules based on connections between weather conditions and customer behavior relative to zip code made by Watson. Real-Time Personalization: IBM has made efforts to remove campaign interaction latency and optimize live customer engagement by acting on information about what customers are doing in the current moment. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| IBM has remained ahead of the curve by incorporating its well-known AI technology throughout Marketing Cloud. The application’s integration with the wide array of IBM products makes it a powerful tool for users already in the IBM ecosystem. | FEATURES
![]() |
| Employees (2018): 380,000 | Presence: Global | Founded: 1911 | NYSE: IBM |
![]()
![]() | FUNCTIONAL SPOTLIGHT Content AI: Marketo has leveraged its investments in machine learning to intelligently fetch marketing assets and serve them to customers based on their interactions with a campaign. Email A/B Testing: To improve lead generation from email campaigns, Marketo features the ability to execute A/B testing for customized campaigns. Partnership with Google: Marketo is now hosted on Google’s cloud platform, enabling it to provide support for larger enterprise clients and improve GDPR compliance. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| Marketo has strong capabilities for lead management but has recently bolstered its analytics capabilities. Marketo is hoping to capture some of the analytics application market share by offering tools with varying complexity and to cater to firms with a wide range of analytics needs. | FEATURES
![]() |
| Employees (2018): 1,000 | Presence: Global | Founded: 2006 | Private Corporation |
![]()
![]() | FUNCTIONAL SPOTLIGHT Data Visualization: To make for a more seamless cross-product experience, marketing projects can be sent between Marketing Cloud and Creative Cloud apps such as Dreamweaver. ID Graph: Use ID Graph to unite disparate data sources to form a singular profile of leads, making the personalization and contextualization of campaigns more efficient. Interest-Based Messaging: Pause a campaign to update a segment or content based on aggregated customer activity and interaction data. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| Oracle Marketing Cloud is known for its balance between campaigns and analytics products. Oracle has taken the lead on expanding its marketing channel mix to include international options such as WeChat. Users already using Oracle’s CRM/CEM products will derive the most value from Marketing Cloud. | FEATURES
![]() |
| Employees (2018): 138,000 | Presence: Global | Founded: 1977 | NYSE: ORCL |
![]()
![]() | FUNCTIONAL SPOTLIGHT Einstein: Salesforce is putting effort into integrating AI into all of its applications. The Einstein AI platform provides marketers with predictive analytics and insights into customer behavior. Mobile Studio: Salesforce has a robust mobile marketing offering that encompasses SMS/MMS, in-app engagement, and group messaging platforms. Journey Builder: Salesforce created Journey Builder, which is a workflow automation tool. Its user-friendly drag-and-drop interface makes it easy to automate responses to customer actions. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| Salesforce Marketing Cloud is primarily used by organizations in the B2C space. It has strong Sales Cloud CRM integration. Pardot is positioning itself as a tool for sales teams in addition to marketers. | FEATURES
![]() |
| Employees (2018): 1,800 | Presence: Global | Founded: 2000 | NYSE: CRM |
![]()
![]() | FUNCTIONAL SPOTLIGHT Engagement Studio: Salesforce is putting marketing capabilities in the hands of sales reps by giving them access to a team email engagement platform. Einstein: Salesforce’s Einstein AI platform helps marketers and sales reps identify the right accounts to target with predictive lead scoring. Program Steps: Salesforce developed a distinct own workflow building tool for Pardot. Workflows are made of “Program Steps” that have the functionality to initiate campaigns based on insights from Einstein. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| Pardot is Salesforce’s B2B marketing solution. Pardot has focused on developing tools that enable sales teams and marketers to work in lockstep in order to achieve lead-generation goals. Pardot has deep integration with Salesforce’s CRM and customer service management products. | FEATURES
![]() |
| Employees (2018): 1,800 | Presence: Global | Founded: 2000 | NYSE: CRM |
![]()
![]() | FUNCTIONAL SPOTLIGHT CMO Dashboard: The specialized dashboard is aimed at providing overviews for the executive level. It includes the ability to coordinate marketing activities and project budgets, KPIs, and timelines. Loyalty Management: SAP features in-app tools to manage campaigns specifically geared toward customer loyalty with digital coupons and iBeacons. Customer Segmentation: SAP’s predictive capabilities dynamically suggest relevant customer profiles for new campaigns. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| SAP Hybris Marketing Cloud optimizes marketing strategies in real time with accurate attribution and measurements. SAP’s operations management capabilities are robust, including the ability to view consolidated data streams from ongoing marketing plans, performance targets, and budgets. | FEATURES
![]() |
| Employees (2018): 84,000 | Presence: Global | Founded: 1972 | NYSE: SAP |
![]()
![]() | FUNCTIONAL SPOTLIGHT Activity Map: A user-friendly workflow builder that can be used to execute campaigns. Multiple activities can be simultaneously A/B tested within the Activity Map UI. The outcome of the test can automatically adjust the workflow. Spots: A native digital asset manager that can store property that is part of existing and future campaigns. Viya: A framework for fully integrating third-party data sources into SAS Marketing Intelligence. Viya assists with pairing on-premises databases with a cloud platform for use with the SAS suite. | ||||||||||
USE-CASE PERFORMANCE
| MARKET FOCUS
| ||||||||||
| SAS has been a leading BI and analytics provider for more than 35 years. Rooted in statistical analysis of data, SAS products provide forward-looking strategic insights. Organizations that require extensive customer intelligence capabilities and the ability to “slice and dice” segments should have SAS on their shortlist. | FEATURES
![]() |
| Employees (2018): 14,000 | Presence: Global | Founded: 1976 | Private Corporation |
Additional vendors in the MMS market: |
|
![]() |
![]() |
See the next slides for suggested point solutions. |
|
Web experience management (WXM) and social media management platforms (SMMP) act in concert with your MMS to execute complex campaigns.
| Social Media Management
Info-Tech’s SMMP selection guide enables you to find a solution that satisfies your objectives across marketing, sales, public relations, HR, and customer service. Create a unified framework for driving successful implementation and adoption of your SMMP that fully addresses CRM and marketing automation integration, end-user adoption, and social analytics with Info-Tech’s blueprint Select and Implement a Social Media Management Platform. |
![]() |
| Web Experience Management
Info-Tech’s approach to WXM ensures you have the right suite of tools for web content management, experience design, and web analytics. Put your best foot forward by conducting due diligence as the selection project advances. Ensure that your organization will see quick results with Info-Tech’s blueprint Select and Implement a Web Experience Management Solution. |
![]() |
POINT SOLUTION PROFILESReview this cursory list of point solutions by use caseConsider point solutions if a full suite is not required |
![]() |




Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
| Step 3.1: Select Your MMS | Step 3.2: Communicate the Decision to Stakeholders |
Start with an analyst kick-off call:
|
Review findings with analyst:
|
Then complete these activities…
|
Then complete these activities…
|
With these tools & templates:
|
With these tools & templates:
|
Phase 3 Results
|
|
3.1 |
3.2 |
|
| Select Your MMS | Communicate Decision to Stakeholders |
3.1.1 30 minutes
INPUT: Organizational use-case fit
OUTPUT: MMS vendor shortlist
Materials: Info-Tech’s MMS use cases, Info-Tech’s vendor profiles, Whiteboard, markers
Participants: Core project team
3.1.2 MMS Request for Proposal Template
| Use the MMS Request for Proposal Template as a step-by-step guide on how to request interested vendors to submit written proposals that meet your set of requirements. If interested in bidding for your project, vendors will respond with a description of the techniques they would employ to address your organizational challenges and meet your requirements, along with a plan of work and detailed budget for the project. The RFP is an important piece of setting and aligning your expectations with the vendors’ product offerings. Make sure to address the following elements in the RFP: Sections of the Tool:
| INFO-TECH DELIVERABLE Complete the MMS Request for Proposal Template by following the instructions in Activity 3.1.3. |
3.1.3 1-2 hours
INPUT: Business requirements document, Procurement procedures
OUTPUT: MMS RFP
Materials: Internal RFP tools or templates (if available), Info-Tech’s MMS Request for Proposal Template (optional)
Participants: Procurement SMEs, Project manager, Core project team (optional)
Vendor demonstrations are an integral part of the selection process. Having clearly defined selection criteria will help with setting up relevant demos as well as inform the vendor scorecards.
| EXAMPLE EVALUATION CRITERIA | ![]() | |
Functionality (30%)
| Ease of Use (25%)
| |
Cost (15%)
| Vendor (15%)
| |
Technology (15%)
| Info-Tech InsightBase your vendor evaluations not on the capabilities of the solutions but instead on how the solutions align with your organization’s process automation requirements and considerations. | |
Examine how the vendor’s solution performs against your evaluation framework.
Vendor demonstrations create a valuable opportunity for your organization to confirm that the vendor’s claims in the RFP are actually true.
A display of the vendor’s functional capabilities and its execution of the scenarios given in your demo script will help to support your assessment of whether a vendor aligns with your MMS requirements.
3.1.4 1-2 hours
INPUT: Business requirements document, Logistical considerations, Usage scenarios by functional area
OUTPUT: MMS demo script
Materials: Info-Tech’s MMS Vendor Demo Script
Participants: Procurement SMEs, Core project team
Challenge vendor project teams during product demonstrations. Asking the vendor to make adjustments or customizations on the fly will allow you to get an authentic feel of product capability and flexibility, as well as of the degree of adaptability of the vendor project team. Ask the vendor to demonstrate how to do things not listed in your user scenarios, such as change system visualizations or design, change underlying data, add additional datasets, demonstrate analytics capabilities, or channel specific automation.
MMS Vendor Demo Script
| Customize and use Info-Tech’s MMS Vendor Demo Script to help identify how a vendor’s solution will fit your organization’s particular business capability needs. This tool assists with outlining logistical considerations for the demo itself and the scenarios with which the vendors should script their demonstration. Sections of the Tool:
Info-Tech Best PracticeAvoid providing vendors with a rigid script for product demonstration; instead, provide user scenarios. Part of the value of a vendor demonstration is the opportunity to assess whether or not the vendor project team has a solid understanding of your organization’s MMS challenges and requirements and can work with your team to determine the best solution possible. A rigid script may result in your inability to assess whether the vendor will adjust for and scale with your project and organization as a technology partner. | INFO-TECH DELIVERABLE Use the MMS Vendor Demo Script by following the instructions in Activity 3.1.4. |
Design a procurement process that is robust, ruthless, and reasonable. Rooting out bias during negotiation is vital to making unbiased vendor selections.
| Vendor Selection
Info-Tech’s approach to vendor selection gets you to design a procurement process that is robust, ruthless, and reasonable. This approach enables you to take control of vendor communications. Implement formal processes with an engaged team to achieve the right price, the right functionality, and the right fit for the organization with Info-Tech's blueprint Implement a Proactive and Consistent Vendor Selection Process. |
![]() |
| Vendor Negotiation
Info-Tech’s SaaS negotiation strategy focuses on taking control of implementation from the beginning. The strategy allows you to work with your internal stakeholders to make sure they do not team up with the vendor instead of you. Reach an agreement with your vendor that takes into account both parties’ best interests with Info-Tech’s blueprint Negotiate SaaS Agreements That Are Built to Last. |
![]() |
3.1 |
3.2 |
|
| Select Your MMS | Communicate Decision to Stakeholders |
Ensure traceability from the selected tool to the needs identified in the first phase. Internal stakeholders must understand the reasoning behind the final selection and see the alignment to their defined requirements and needs.
| Document the selection process to show how the selected tool aligns to stakeholder needs:
|
Documentation will assist with:
|
3.2.1 1 week
INPUT: MMS tool selection committee expertise
OUTPUT: Decision to invest or not invest in an MMS tool
Materials: Note-taking materials, Whiteboard or flip chart, markers
Participants: MMS tool selection committee
Documenting the process of how the selection decision was made will avoid major headaches down the road. Without a documented process, internal stakeholders and even vendors can challenge and discredit the selection process.

Adobe Systems Incorporated. “Bayer builds understanding, socially.” Adobe.com, 2017. Web.
IBM Corporation, “10 Key Marketing Trends for 2017.” IBM.com, 2017. Web.
Marketo, Inc. “The Definitive Guide to Marketing Automation.” Marketo.com, 2013. Web.
Marketo, Inc. “NBA franchise amplifies its message with help from Marketo’s marketing automation technology.” Marketo.com, 2017. Web.
Salesforce Pardot. “Marketing Automation & Your CRM: The Dynamic Duo.” Pardot.com, 2017. Web.
SAS Institute Inc. “Marketing Analytics: How, why and what’s next.” SAS Magazine, 2013. Web.
SAS Institute Inc. “Give shoppers offers they’ll love.” SAS.com, 2017. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Our concise executive brief shows you why building a service catalog is a good idea for your company. We'll show you our methodology and the ways we can help you in handling this.
Minimize the risks from attrition through an effective knowledge transfer process.
Our launch phase will walk you through the charter template, build help a balanced team, create your change message and communication plan to obtain buy-in from all your organization's stakeholders.
Group enterprise services which you offer to everyone in the company, logically together.
These services apply only to one business line. Other business users should not see them in the catalog.
Complete this chart to allow the business to pick what services to include in the service catalog. It also allows you to extend the catalog with technical services by including IT-facing services. Of course, separated-out only for IT.
A priority is created when external factors hold strong synergy with internal goals and an organization responds by committing resources to either avert risk or seize opportunity. These are the priorities identified in the report:
Update your strategic roadmap to include priorities that are critical and relevant for your organization based on a balance of external and internal factors.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Discover Info-Tech’s five priorities for CIOs in 2022.
Hear directly from our contributing experts as they discuss their case studies with Brian Jackson.
|
Info-Tech’s 2022 Tech Trends survey asked CIOs for their top three priorities. Cluster analysis of their open-ended responses shows four key themes:
|
Info-Tech’s Tech Trends 2022 survey was conducted between August and September 2021 and collected a total of 475 responses from IT decision makers, 123 of which were at the C-level. Fourteen countries and 16 industries are represented in the survey.
Info-Tech’s IT Talent Trends 2022 survey was conducted between September and October 2021 and collected a total of 245 responses from IT decision makers, 44 of which were at the C-level. A broad range of countries from around the world are represented in the survey.
Panels of former CIOs at Info-Tech focused on interpreting tech trends data and relating it to client experiences. Panels were conducted between November 2021 and January 2022.
Info-Tech’s CEO-CIO Alignment program helps CIOs align with their supervisors by asking the right questions to ensure that IT stays on the right path. It determines how IT can best support the business’ top priorities and address the gaps in your strategy. In 2021, the benchmark was formed by 107 different organizations.
Info-Tech’s Management and Governance Diagnostic helps IT departments assess their strengths and weaknesses, prioritize their processes and build an improvement roadmap, and establish clear ownership of IT processes. In 2021, the benchmark was formed by data from 320 different organizations.
Priority: “The fact or condition of being regarded or treated as more important than others.” (Lexico/Oxford)
Trend: “A general direction in which something is developing or changing.” (Lexico/Oxford)
Visit Info-Tech’s Trends & Priorities Research Center
Deliver solutions that create equity between remote workers and office workers and make collaboration a joy.
In 2020, CIOs adapted to the pandemic’s disruption to offices by investing in capabilities to enable remote work. With restrictions on gathering in offices, even digital laggards had to shift to an all-remote work model for non-essential workers.
Most popular technologies already invested in to facilitate better collaboration
In 2022, the focus shifts to solving problems created by the new hybrid operating model where some employees are in the office and some are working remotely. Without the ease of collaborating in a central hub, technology can play a role in reducing friction in several areas:
In most organizations, a hybrid model is being implemented. Only 14.9% of organizations are planning for almost everyone to return to the office, and only 9.9% for almost everyone to work remotely.
Elizabeth ClarkCIO, Harvard Business School"I want to create experiences that are sticky. That keep people coming back and engaging with their colleagues." |
|
Listen to the Tech Insights podcast:
Frictionless hybrid working: How the Harvard Business School did it

The renovated classrooms integrate all students, whether they are participating remotely or in person. (Image courtesy of Harvard Business School.)
CIOs and their direct supervisors both ranked internal collaboration tools as being a “critical need to adopt” in 2021, according to Info-Tech’s CEO-CIO Alignment Benchmark Report.
Ninety-seven percent of IT practitioners plan to invest in technology to facilitate better collaboration between employees in the office and outside the office by the end of 2022, according to Info-Tech’s 2022 Tech Trends survey.
“We got so many nice compliments, which you don’t get in IT all the time. You get all the complaints, but it’s a rare case when people are enthusiastic about something that was delivered.” (Elizabeth Clark, CIO, Harvard Business School)
New normal: HBS has found its new default operating model for the classroom and is extending its solution to its operating environment.
Improved CX: The high-quality experience for students has helped avoid attrition despite the challenges of the pandemic.
Engaged employees: The IT team is also engaged and feels connected to the mission of the school.
A custom Zoom room brings together multiple different views of the classroom into one single experience for remote students. (Image courtesy of Harvard Business School.)
Align with your organization’s goals for collaboration and customer interaction, with the target of high satisfaction for both customers and employees. Invest in capital projects to improve the fidelity of conference rooms, develop and test a new way of working, and increase IT capacity to alleviate pressure points.
Foster both asynchronous and synchronous collaboration approaches to avoid calendars filling up with videoconference meetings to get things done and to accommodate workers contributing from across different time zones.
“We’ll always have hybrid now. It’s opened people’s eyes and now we’re thinking about the future state. What new markets could we explore?” (Elizabeth Clark, CIO, Harvard Business School)
Run Better Meetings
Hybrid, virtual, or in person – set meeting best practices that support your desired meeting norms.
Prepare People Leaders for the Hybrid Work Environment
Set hybrid work up for success by providing people leaders with the tools they need to lead within the new model.
Hoteling and Hot-Desking: A Primer
What you need to know regarding facilities, IT infrastructure, maintenance, security, and vendor solutions for desk hoteling and hot-desking.
“Human Resources Management” gap between importance and effectiveness
Info-Tech Research Group Management and Governance Diagnostic Benchmark 2021
Mitigate the damage of successful ransomware intrusions and make recovery as painless as possible.
Cybersecurity is always top of mind for CIOs but tends to be deprioritized due to other demands related to digital transformation or due to cost pressures. That’s the case when we examine our data for this report.
Cybersecurity ranked as the fourth-most important priority by CIOs in Info-Tech’s 2022 Tech Trends survey, behind business process improvement, digital transformation, and modernization. Popular ways to prepare for a successful attack include creating offline backups, purchasing insurance, and deploying new solutions to eradicate ransomware.
CIOs and their direct supervisors ranked “Manage IT-Related Security” as the third-most important top IT priority on Info-Tech’s CEO-CIO Alignment Benchmark for 2021, in support of business goals to manage risk, comply with external regulation, and ensure service continuity.
Most popular ways for organizations to prepare for the event of a successful ransomware attack:
Whatever priority an organization places on cybersecurity, when ransomware strikes, it quickly becomes a red alert scenario that disrupts normal operations and requires all hands on deck to respond. Sophisticated attacks executed at wide scale demonstrate that security can be bypassed without creating an alert. After that’s accomplished, the perpetrators build their leverage by exfiltrating data and encrypting critical systems.
CIOs can plan to mitigate ransomware attacks in several constructive ways:
50% of all organizations spent time and money specifically to prevent ransomware in the past year. (Info-Tech Tech Trends 2022 Survey)
John DoeCIO, mid-sized manufacturing firm in the US"I want to create experiences that are sticky. That keep people coming back and engaging with their colleagues." | ![]() |
Listen to the Tech Insights podcast:
Close call with ransomware: a CIO recounts a near security nightmare
“Now we take the approach that if someone does get in, we're going to find them out.” (John Doe, CIO, “The Firm”)
Organizations should consider how much a ransomware attack on critical systems would cost them if they were down for a minimum of 24-48 hours. Plan to invest an amount at least equal to the costs of that downtime.
Implementing across-the-board multi-factor authentication reduces chances of infection and is cheap, with enterprise solutions ranging from $2 to $5 per user on average. Be strict and deny access when connections don’t authenticate.
“You'll never stop everything from getting into the network. You can still focus on stopping the bad actors, but then if they do make it in, make sure they don't get far.” (John Doe, CIO, “The Firm”)
Real-time security: While The Firm is still investing in prevention-based security, it is also developing its real-time detection and response capabilities. When ransomware makes it through the cracks, it wants to know as soon as possible and stop it.
Leadership commitment: The C-suite is taking the experience as a wake-up call that more investment is required in today’s threat landscape. The Firm rates security more highly as an overall organizational goal, not just something for IT to worry about.
The Firm now uses multi-factor authentication as part of its employee sign-on process. For employees, authenticating is commonly achieved by using a mobile app that receives a secret code from the issuer.
In Info-Tech’s CEO-CIO Alignment Benchmark for 2021, the business goal of “Manage Risk” was the single biggest point of disagreement between CIOs and their direct supervisors. CIOs rank it as the second-most important business goal, while CEOs rank it as sixth-most important.
Organizations should align on managing risk as a top priority given the severity of the ransomware threat. The threat actors and nature of the attacks are such that top leadership must prepare for when ransomware hits. This includes halting operations quickly to contain damage, engaging third-party security forensics experts, and coordinating with government regulators.
Cybersecurity strategies may be challenged to be effective without creating some friction for users. Organizations should look beyond multi-layer prevention strategies and lean toward quick detection and response, spending evenly across prevention, detection, and response solutions.
Create a Ransomware Incident Response Plan
Don’t be the next headline. Determine your current readiness, response plan, and projects to close gaps.
Simplify Identity and Access Management
Select and implement IAM and produce vendor RFPs that will contain the capabilities you need, including multi-factor authentication.
Cybersecurity Series Featuring Sandy Silk
More from Info-Tech’s Senior Workshop Director Sandy Silk in this video series created while she was still at Harvard University.
Gap between CIOs and CEOs in points allocated to “Manage risk” as a top business goal
Avoid being a victim of “The Great Resignation” by putting employees at the center of an experience that will engage them with clear career path development, purposeful work, and transparent feedback.
In 2021, many workers decided to leave their jobs. Working contexts were disrupted by the pandemic and that saw non-essential workers sent home to work, while essential workers were asked to continue to come into work despite the risks of COVID-19. These disruptions may have contributed to many workers reevaluating their professional goals and weighing their values differently. At the same time, 2021 saw a surging economy and many new job opportunities to create a talent-hungry market. Many workers could have been motivated to take a new opportunity to increase their salary or receive other benefits such as more flexibility.
IT may be less affected than other departments by this trend. Info-Tech’s 2022 IT Talent Trends Report shows that on average, estimated turnover rate in IT is lower than the rest of the organization. Almost half of respondents estimated their organization’s voluntary turnover rate was 10% or higher. Only 30% of respondents estimate that IT’s voluntary turnover rate is in the same range. However, CIOs working in industries with the highest turnover rates will have to work to keep their workers engaged and satisfied, as IT skills are easily transferred to other industries.
49% ranked “enabling learning & development within IT” as high priority, more than any other single challenge. (IT Talent Trends 2022 Survey, N=227)
Jeff PreviteExecutive Vice-President of IT, CrossCountry Mortgage“We have to get to know the individual at a personal level … Not just talking about the business, but getting to know the person." |
|
Listen to the Tech Insights podcast:
How a financial services company dodged ‘The Great Resignation’
“It’s come down to a culture shift. Folks have an idea of where we’re headed as an organization, where we’re headed as an IT team, and how their role contributes to that.” (Jeff Previte, EVP of IT, CrossCountry Mortgage)
Almost six in ten Talent Trends survey respondents identified salary and compensation as the reason that employees resigned in the past year. Organizations looking to engage employees must first pay a fair salary according to market and industry conditions.
Professional development and opportunity for innovative work are the next two most common reasons for resignations. Organizations must ensure they create enough capacity to allow workers time to spend on development.
“Building our own solution created an element of engagement. There was a sense of ownership that the team had in thinking through this.” (Jeff Previte, CrossCountry Mortgage)
The Great Maturation: IT staff turnover rate dropped to 10-12% and IT talent is developing on the job to improve the department’s overall skill level. More IT staff on hand and more engaged workers mean IT can deliver higher maturity level results.
Alignment achieved: Connecting IT’s initiatives to the vision of the C-suite creates a clear purpose for IT in its initiatives. Staff understand what they need to achieve to progress their careers and can grow while they work.
Employees from CrossCountry Mortgage headquarters assist with a drive-thru distribution event for the Cleveland Food Bank on Dec. 17, 2021. (Image courtesy of CrossCountry Mortgage.)
The Great Resignation trend is bringing attention to employee engagement and staff retention. IT departments are busier than ever during the pandemic as they work overtime to keep up with a remote workforce and new security threats. At the same time, IT talent is among the most coveted on the market.
CIOs need to develop a people-first approach to improve the employee experience. Beyond compensation, IT workers need clarity in terms of their career paths, a direct connection between their work and the goals of the organization, and time set aside for professional development.
Info-Tech’s 2021 benchmark for “Leadership, Culture & Values” shows that most organizations rate this capability very highly (9) but see room to improve on their effectiveness (6.9).
IT Talent Trends 2022
See how IT talent trends are shifting through the pandemic and understand how themes like The Great Resignation has impacted IT.
McLean & Company’s Modernize Performance Management
Customize the building blocks of performance management to best fit organizational needs to impact individual and organizational performance, productivity, and engagement.
Redesign Your IT Organizational Structure
Define future-state work units, roles, and responsibilities that will enable the IT organization to complete the work that needs to be done.
“Leadership, Culture & Values” gap between importance and effectiveness
Info-Tech Research Group Management and Governance Diagnostic Benchmark 2021
Position yourself to buy or build a platform that will enable new automation opportunities through seamless integration.
When it’s said that digital transformation accelerated during the pandemic, what’s really meant is that processes that were formerly done manually became automated through software. In responses to the Tech Trends survey, CIOs say digital transformation was more of a focus during the pandemic, and eight in ten CIOs also say they shifted more than 20% of their organization’s processes to digital during the pandemic. Automating tasks through software can be called digitalization.
Most organizations became more digitalized during the pandemic. But how they pursued it depends on their IT maturity. For digital laggards, partnering with a technology services platform is the path of least resistance. For sophisticated innovators, they can consider building a platform to address the specific needs of their business process. Doing so requires the foundation of an existing “digital factory” or innovation arm where new technologies can be tested, proofs of concept developed, and external partnerships formed. Patience is key with these efforts, as not every investment will yield immediate returns and some will fail outright.
Build it or buy it, platform participants integrate with their existing systems through application programming interfaces (APIs). Organizations should determine their platform strategies based on maturity, then look to integrate the business processes that will yield the most gains.
68% of CIOs say digital transformation became much more of a focus for their organization during the pandemic (Info-Tech Tech Trends 2022 Survey)
Bob CrozierChief Architect, Allianz Technology & Global Head of Blockchain, Allianz Technology SE"Smart contracts are really just workflows between counterparties." |
|
Listen to the Tech Insights podcast:
How Allianz took a blockchain platform from pilot to 1 million transactions
Exploring emerging technology for potential use cases is difficult for staff tasked with running day-to-day operations. Organizations serious about innovation create a separate team that can focus on “moonshot” projects and connect with external partners.
Automation of new business processes often requires a high upfront initial investment for a long-term efficiency gain. A proof of concept should demonstrate clear business value that can be repeated often and for a long period.
“My next project has to deliver in the tens of millions of value in return. The bar is high and that’s what it should be for a business of our size.” (Bob Crozier, Allianz)
Deliver your own SaaS: Allianz Technology built its blockchain-based claims settlement platform and its subsidiaries consume it as software as a service. The platform runs on a distributed architecture across Europe, with each node running the same version of the software. Operating entities can also integrate their own systems to the platform via APIs and further automate business processes such as billing.
Ready to scale: After processing one million transactions, the international claims settlement platform is proven and ready to add more participants. Crozier sees auto repair shops and auto manufacturers as the next logical users.
Allianz is a shareholder of the Blockchain Insurance Industry Initiative (B3i). It is providing a platform used by a group of insurance companies in the commercial and reinsurance space.
Allianz was able to build a platform for its group of European subsidiaries because of its established digital factory and commitment to innovation. Allianz Technology is at the “innovate” level of IT maturity, allowing it to create a platform that subsidiaries can integrate with via APIs. For firms that are lower on the IT maturity scale, buying a platform solution is the better path to automation. These firms will be concerned with integrating their legacy systems to platforms that can reduce the friction of their operating environments and introduce modern new capabilities.
Accelerate Your Automation Processes
Integrate automation solutions and take the first steps to building an automation suite.
Build Effective Enterprise Integration on the Back of Business Process
From the backend to the frontlines – let enterprise integration help your business processes fly.
Evolve Your Business Through Innovation
Innovation teams are tasked with the responsibility of ensuring that their organizations are in the best position to succeed while the world is in a period of turmoil, chaos, and uncertainty.
“Innovation” gap between importance and effectiveness Info-Tech Research Group Management and Governance Diagnostic Benchmark 2021
Be ready to either lead or support initiatives to meet the criteria of new ESG reporting mandates and work toward disclosure reporting solutions.
Humans are putting increasing pressure on the planet’s natural environment and creating catastrophic risks as a result. Efforts to mitigate these risks have been underway for the past 30 years, but in the decade ahead regulators are likely to impose more strict requirements that will be linked to the financial value of an organization. Various voluntary frameworks exist for reporting on environmental, social, and governance (ESG) or corporate social responsibility (CSR) metrics. But now there are efforts underway to unify and clarify those standards.
The most advanced effort toward a global set of standards is in the environmental area. At the United Nations’ COP26 summit in Scotland last November, the International Sustainability Standards Board (ISSB) announced its headquarters (Frankfurt) and three other international office locations (Montreal, San Francisco, and London) and its roadmap for public consultations. It is working with an array of voluntary standards groups toward a consensus.
In Info-Tech’s 2022 Tech Trends survey, two-thirds of CIOs say their organization is committed to reducing greenhouse gas emissions, yet only 40% say their organizational leadership is very concerned with reducing those emissions. CIOs will need to consider how to align organizational concern with internal commitments and new regulatory pressures. They may investigate new real-time reporting solutions that could serve as a competitive differentiator on ESG.
67% of CIOs say their organization is committed to reducing greenhouse gases, with one-third saying that commitment is public. (Info-Tech Tech Trends 2022 Survey)
40% of CIOs say their organizational leadership is very concerned with reducing greenhouse gas emissions.
David W. DormanChairman of the board, CVS Health“ESG is a question of what you do in the microcosm of your company to make sure there is a clear, level playing field – that there is a color-blind, gender-blind meritocracy available – that you are aware that not in every case can you achieve that without really focusing on it. It’s not going to happen on its own. That’s why our commitments have real dollars behind them and real focus behind them because we want to be the very best at doing them.” |
|
Listen to the Tech Insights podcast:
CVS Health chairman David Dorman on healthcare's hybrid future
CVS Health established a new steering committee of senior leaders in 2020 to oversee ESG commitments. It designs its corporate social responsibility strategy, Transform Health 2030, by aligning company activities in four key areas: healthy people, healthy business, healthy planet, and healthy community. The strategy aligns with the United Nations’ Sustainable Development Goals. In alignment with these goals, CVS identifies material topics where the company has the most ability to make an impact. In 2020, its top three topics were:
Material TopicAccess to quality health care |
Material TopicPatient and customer safety |
Material TopicData protection and privacy |
Technology InitiativeMinuteClinic’s Virtual Collaboration for NursesCVS provided Apple iPads compliant with the Health Insurance Portability and Accountability Act (HIPAA) to clinics in a phased approach, providing training to more than 700 providers in 26 states by February 2021. Nurses could use the iPads to attend virtual morning huddles and access clinical education. Nurses could connect virtually with other healthcare experts to collaborate on delivering patient care in real-time. The project was able to scale across the country through a $50,000 American Nurses Credentialing Center Pathway Award. (Wolters Kluwer Health, Inc.) |
Technology InitiativeMinuteClinic’s E-ClinicMinuteClinics launched this telehealth solution in response to the pandemic, rolling it out in three weeks. The solution complemented video visits delivered in partnership with the Teladoc platform. Visits cost $59 and are covered by Aetna insurance plans, a subsidiary of CVS Health. It hosted more than 20,000 E-Clinic visits through the end of 2020. CVS connected its HealthHUBs to the solution to increase capacity in place of walk-in appointments and managed patients via phone for medication adherence and care plans. CVS also helped behavioral health providers transition patients to virtual visits. (CVS Health) |
Technology InitiativeNext Generation Authentication PlatformCVS patented this solution to authenticate customers accessing digital channels. It makes use of the available biometrics data and contextual information to validate identity without the need for a password. CVS planned to extend the platform to voice channels as well, using voiceprint technology. The solution prevents unauthorized access to sensitive health data while providing seamless access for customers. (LinkedIn) |
While 83% of businesses state support for the Sustainable Development Goals outlined by the Global Reporting Initiative (GRI), only 40% make measurable commitments to their goals.
The GRI recommends organizations not only align their activities with sustainable development goals but also demonstrate contributions to specific targets in reporting on the positive actions they carry out. (GRI, “State of Progress: Business Contributions to the SDGS.”)
“We end up with a longstanding commitment to diversity because that’s what our customer base looks like.” (David Dorman, CVS Health)
iPads for collaboration: Healthcare practitioners in the MinuteClinic Virtual Collaboration initiative agreed that it improved the use of interprofessional teams, working well virtually with others, and improved access to professional resources (Wolters Kluwer Health, Inc.)
Remote healthcare: Saw a 400% increase in MinuteClinic virtual visits in 2020 (CVS Health).
Verified ID: The Next Generation Authentication platform allowed customers to register for a COVID-19 vaccination appointment. CVS has delivered more than 50 million vaccines (LinkedIn).
CVS Health is making use of digital channels to connect its customers and health practitioners to a services platform that can supplement visits to a retail or clinic location to receive diagnostics and first-hand care.
The risks posed to organizations and wider society are becoming more severe, driving a transition from voluntary frameworks for ESG goals to a mandatory one that’s enforced by investors and governments. Organizations will be expected to tie their core activities to a defined set of ESG goals and maintain a balance sheet of their positive and negative impacts. CIOs should become experts in ESG disclosure requirements and recommend the steps needed to meet or exceed competitors’ efforts. If a leadership vacuum for ESG accountability exists, CIOs can either seek to support their peers that are likely to become accountable or take a leadership role in overseeing the area. CIOs should start working toward solutions that deliver real-time reporting on ESG goals to make reporting frictionless.
“If you don’t have ESG oversight at the highest levels of the company, it won’t wind up getting the focus. That’s why we review it at the Board multiple times per year. We have an annual report, we compare how we did, what we intended to do, where did we fall short, where did we exceed, and where we can run for daylight to do more.” (David Dorman, CVS Health)
ESG Disclosures: How Will We Record Status Updates on the World We Are Creating?
Prepare for the era of mandated environmental, social, and governance disclosures.
Private Equity and Venture Capital Growing Impact of ESG Report
Learn about how the growing impact of ESG affects both your organization and IT specifically, including challenges and opportunities, with expert assistance.
“Business Intelligence and Reporting” gap between importance and effectiveness
Info-Tech Research Group Management and Governance Diagnostic Benchmark 2021
Elizabeth ClarkCIO, Harvard Business School | ![]() | Jeff PreviteExecutive Vice-President of IT, CrossCountry Mortgage | ![]() | |
Bob CrozierChief Architect, Allianz Technology & Global Head of Blockchain, Allianz Technology SE | ![]() | David W. DormanChairman of the Board, CVS Health | ![]() |
|
![]() ![]() ![]() ![]() ![]() ![]() ![]() ![]()
|
“2020 Corporate Social Responsibility Report.” CVS Health, 2020, p. 127. Web.
“Adversary: Doppel Spider - Threat Actor.” Crowdstrike Adversary Universe, 2021. Accessed 29 Dec. 2021.
“Aetna CVS Health Success Story.” HYPR, n.d. Accessed 6 Feb. 2022.
Baig, Aamer. “The CIO agenda for the next 12 months: Six make-or-break priorities.” McKinsey Digital, 1 Nov. 2021. Web.
Ball, Sarah, Kristene Diggins, Nairobi Martindale, Angela Patterson, Anne M. Pohnert, Jacinta Thomas, Tammy Todd, and Melissa Bates. “2020 ANCC Pathway Award® winner.” Wolters Kluwer Health, Inc., 2021. Accessed 6 Feb. 2022.
“Canadian Universities Propose Designs for a Central Bank Digital Currency.” Bank of Canada, 11 Feb. 2021. Accessed 14 Dec. 2021.
“Carbon Sequestration in Wetlands.” MN Board of Water and Soil Resources, n.d. Accessed 15 Nov. 2021.
“CCM Honored as a NorthCoast 99 Award Winner.” CrossCountry Mortgage, 1 Dec. 2021. Web.
Cheek, Catherine. “Four Things We Learned About the Resignation Wave–and What to Do Next.” Visier Inc. (blog), 5 Oct. 2021. Web.
“Companies Using Hyperledger Fabric, Market Share, Customers and Competitors.” HG Insights, 2022. Accessed 25 Jan. 2022.
“IFRS Foundation Announces International Sustainability Standards Board, Consolidation with CDSB and VRF, and Publication of Prototype Disclosure Requirements.” IFRS, 3 Nov. 2021. Web.
“IT Priorities for 2022: A CIO Report.” Mindsight, 28 Oct. 2021. Web.
“Job Openings and Labor Turnover Survey.” Databases, Tables & Calculators by Subject, U.S. Bureau of Labor Statistics, 2022. Accessed 9 Feb. 2022.
Kumar, Rashmi, and Michael Krigsman. “CIO Planning and Investment Strategy 2022.” CXOTalk, 13 Sept. 2021. Web.
Leonhardt, Megan. “The Great Resignation Is Hitting These Industries Hardest.” Fortune, 16 Nov. 2021. Accessed 7 Jan. 2022.
“Most companies align with SDGs – but more to do on assessing progress.” Global Reporting Initiative (GRI), 17 Jan. 2022. Web.
Navagamuwa, Roshan. “Beyond Passwords: Enhancing Data Protection and Consumer Experience.” LinkedIn, 15 Dec. 2020.
Ojo, Oluwaseyi. “Achieving Digital Business Transformation Using COBIT 2019.” ISACA, 19 Aug. 2019. Web.
“Priority.” Lexico.com, Oxford University Press, 2021. Web.
Riebold, Jan, and Yannick Bartens. “Reinventing the Digital IT Operating Model for the ‘New Normal.’” Capgemini Worldwide, 3 Nov. 2020. Web.
Samuels, Mark. “The CIO’s next priority: Using the tech budget for growth.” ZDNet, 1 Sept. 2021. Accessed 1 Nov. 2021.
Sayer, Peter. “Exclusive Survey: CIOs Outline Tech Priorities for 2021-22.” CIO, 5 Oct. 2021. Web.
Shacklett, Mary E. “Where IT Leaders Are Likely to Spend Budget in 2022.” InformationWeek, 10 Aug. 2021. Web.
“Table 4. Quits Levels and Rates by Industry and Region, Seasonally Adjusted - 2021 M11 Results.” U.S. Bureau of Labor Statistics, Economic News Release, 1 Jan. 2022. Accessed 7 Jan. 2022.
“Technology Priorities CIOs Must Address in 2022.” Gartner, 19 Oct. 2021. Accessed 1 Nov. 2021.
Thomson, Joel. Technology, Talent, and the Future Workplace: Canadian CIO Outlook 2021. The Conference Board of Canada, 7 Dec. 2021. Web.
“Trend.” Lexico.com, Oxford University Press, 2021. Web.
Vellante, Dave. “CIOs signal hybrid work will power tech spending through 2022.” SiliconANGLE, 25 Sept. 2021. Web.
Whieldon, Esther, and Robert Clark. “ESG funds beat out S&P 500 in 1st year of COVID-19; how 1 fund shot to the top.” S&P Global Market Intelligence, April 2021. Accessed Dec. 2021.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Get your desktop and mobile device support teams out of firefighting mode by identifying the real problem.
Improve the day-to-day operations of your desktop and mobile device support teams through role definition, training, and process standardization.
Stop using management tools and techniques from the Windows XP era. Save yourself, and your technicians, from needless pain.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify how unified endpoint management (UEM) can improve the lives of the end user and of IT.
Cutting through the vendor hype and aligning with business needs.
1.1 Identify benefits you can provide to stakeholders.
1.2 Identify business and IT goals in order to prioritize benefits.
1.3 Identify how to achieve benefits.
1.4 Define goals based on desired benefits.
Executive presentation
Ensure that your teams have a consistent approach to end-user device management.
Developed a standard approach to roles and responsibilities, to training, and to device management processes.
2.1 Align roles to your environment.
2.2 Assign architect-, engineer-, and administrator-level responsibilities.
2.3 Rationalize your responsibility matrix.
2.4 Ensure you have the necessary skills.
2.5 Define Tier 2 processes, including patch deployment, emergency patch deployment, device deployment, app deployment, and app packaging.
List of roles involved in end-user device management
Responsibility matrix for end-user device management
End-user device management training plan
End-user device management standard operating procedure
Workflows and checklists of end-user device management processes
Modernize the toolset used by IT to manage end-user devices.
Saving time and resources for many standard device management processes.
3.1 Define the core image for each device/OS.
3.2 Define app packages.
3.3 Gather action items for improving the support technologies.
3.4 Create a roadmap for improving end-user device management.
3.5 Create a communication plan for improving end-user device management.
Core image outline
Application package outline
End-user device management roadmap
End-user device management communication plan
A cost-optimized security budget is one that has the greatest impact on risk for the least amount of money spent.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This phase will help you assess the efficacy of your current technology and service providers.
This phase will help you assess if layoffs are necessary.
This phase will help you revise the pending process-based initiatives in your security strategy.
Organizational redesigns frequently fail when it comes to being executed. This leads to:
Organizational redesigns fail during implementation primarily because they do not consider the change management required to succeed.
Implementing your organizational design with good change management practices is more important than defining the new organizational structure.
Implementation is often negatively impacted due to:
When good change management practices are used and embedded into the implementation process:
Invest change management for your IT redesign.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
The best IT organizational structure will still fail to be implemented if the organization does not leverage and use good change management practices. Consider practices such as aligning the structure to a meaningful vision, preparing leadership, communicating frequently, including employees, and measuring adoption to succeed at organizational redesign implementation.
Taking regular pulse checks of employees and managers during the transition will enable IT Leaders to focus on the right practices to enable adoption.
|
After helping hundreds of organizations across public and private sector industries redesign their organizational structure, we can say there is one thing that will always doom this effort: A failure to properly identify and implement change management efforts into the process. Employees will not simply move forward with the changes you suggest just because you as the CIO are making them. You need to be prepared to describe the individual benefits each employee can expect to receive from the new structure. Moreover, it has to be clear why this change was needed in the first place. Redesign efforts should be driven by a clear need to align to the organization’s vision and support the various objectives that will need to take place. Most organizations do a great job defining a new organizational structure. They identify a way of operating that tells them how they need to align their IT capabilities to deliver on strategic objectives. What most organizations do poorly is invest in their people to ensure they can adopt this new way of operating. Brittany Lutes Info-Tech Research Group |
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
Organizational redesigns frequently fail when it comes to being executed. This leads to:
Organizational redesigns fail during implementation primarily because they do not consider the change management required to succeed. |
Implementation of the organizational redesign is often impacted when:
Essentially, implementation is impacted when change management is not included in the redesign process. |
When good change management practices are used and embedded into the implementation process:
Invest in change management for your IT redesign. |
Info-Tech Insight
Implementing your organizational design with good change management practices is more important than defining the new organizational structure.
McKinsey reported less than 25% of organizational redesigns are successful. Which is worse than the average change initiative, which has a 70% failure rate.
The value of the organizational redesign efforts is determined by the percentage of individuals who adopt the changes and operate in the desired way of working.
When organizations properly use organizational design processes, they are:
4× more likely to delight customers
13× more effective at innovation
27× more likely to retain employees
Don’t doom your organizational redesign with poor change management
Only 17% of frontline employees believe the lines of communication are open.
43% Percentage of organizations that are ineffective at the organizational design methodology.
"Organizational transformation efforts rarely fail because of bad design, but rather from lack of sufficient attention to the transition from the old organization to the new one."
|
Entirely New Teams Additions, reductions, or new creations. The individuals that make up a functional team can shift. |
New Team Members As roles become defined, some members might be required to shift and join already established groups. |
New Responsibilities The capabilities individuals will be accountable or responsible for become defined. |
New Ways of Operating From waterfall to Agile, collaborative to siloed, your operating model provides insight into the ways roles will engage one another. |
Situation
On July 26th, 2022, employees at Shopify – an eCommerce platform – were communicated to by their CEO that a round of layoffs was about to take place. Effective that day, 1,000 employees or 10% of the workforce would be laid off.
In his message to staff, CEO Tobi Lutke admitted he had assumed continual growth in the eCommerce market when the COVID-19 pandemic forced many consumers into online shopping. Unfortunately, it was clear that was not the case.
In his communications, Tobi let people know what to expect throughout the day, and he informed people what supports would be made available to those laid off. Mainly, employees could expect to see a transparent approach to severance pay; support in finding new jobs through coaching, connections, or resume creation; and ongoing payment for new laptops and internet to support those who depend on this connectivity to find new jobs.
Results
Unlike many of the other organizations (e.g. Wayfair and Peloton) that have had to conduct layoffs in 2022, Shopify had a very positive reaction. Many employees took to LinkedIn to thank their previous employer for all that they had learned with the organization and to ask their network to support them in finding new opportunities. Below is a letter from the CEO:
And align the structure to execute on those drivers.
“The goal is to align your operating model with your strategy, so it directly supports your differentiating capabilities.”
– PWC, 2017.
Info-Tech Insight
A trending organizational structure or operating model should never be the driver for an organizational redesign.
Technical leaders are common in IT, but people leaders are necessary during the implementation of an organizational structure.
“Successful organizational redesign is dependent on the active involvement of different managerial levels."
– Marianne Livijn, “Managing Organizational Redesign: How Organizations Relate Macro and Micro Design.”
Info-Tech Insight
47% of direct reports do not agree that their leader is demonstrating the change behaviors. Often, a big reason is that many middle-managers do not understand their own attitudes and beliefs about the change.
Build a Better Manager: Basic Management Skills
Build a Better Manager: Personal Leadership
Include employees in the conversation to get the most out of your change management.
"Details about the new organization, along with details of the selection process, should be communicated as they are finalized to all levels of the organization.”
Info-Tech Insight
The project manager of the organizational redesign should not be the communicator. The CIO and the employees’ direct supervisor should always be the communicators of key change messages.
|
← Business-Mandated Organizational Redesign |
Enable Alignment & Increased Effectiveness |
IT-Driven & Strategic Organizational Redesign → |
|---|---|---|
|
Reduction in roles Cost savings Requires champions who will maintain employee morale throughout Communicate with key individuals ahead of time |
Restructure of IT roles Increase effectiveness Lean on managers & supervisors to provide consistent messaging Communicate the individual benefits of the change |
Increase in IT Roles Alignment to business model Frequent and ongoing communication from the beginning Collaborate with IT groups for input on best structure |
Old-school approaches to organizational redesign have argued employee engagement is a hinderance to success – it’s not.
"To enlist employees, leadership has to be willing to let things get somewhat messy, through intensive, authentic engagement and the involvement of employees in making the transformation work."
Info-Tech Insight
Despite the persistent misconceptions, including employees in the process of a redesign reduces uncertainty and rumors.
Only 22% of organizations include the employee experience as a part of the design process
| 1 | 2 | 3 |
|---|---|---|
| Monitor IT Employee Experience |
When Prosci designed their Change Impact Analysis, they identified the ways in which roles will be impacted across 10 different components:
Engaging employees in the process so that they can define how their role might be impacted across these 10 categories not only empowers the employee, but also ensures they are a part of the process. Source: Prosci, 2019. |
Conduct an employee pulse survey See the next slide for more information on how to create and distribute this survey. |
Process to conduct survey:
Both employee adoption and the transformation of the IT structure need to be measured during implementation
“Think about intentionally measuring at the moments in the change storyline where feedback will allow leaders to make strategic decisions and interventions.”
Info-Tech Insight
Getting 100% adoption from employees is unlikely. However, if employee adoption is not sitting in the 80-90% range, it is not recommended that you move forward with the next phase of the transformation.
| Driver Goal | Measurement | Key Performance Indicator (KPI) |
|---|---|---|
| Workforce Challenges and Increased Effectiveness | Employee Engagement | The change in employee engagement before, during, and after the new organizational structure is communicated and implemented. |
| Increased Effectiveness | Alignment of Demand to Resources | Does your organization have sufficient resources to meet the demands being placed on your IT organization? |
| Increased Effectiveness and Workforce Challenges | Role Clarity | An increase in role clarity or a decrease in role ambiguity. |
|
Increased Effectiveness |
Reduction in Silos |
Employee effectiveness increases by 27% and efficiency by 53% when provided with role clarity (Effectory, 2019). |
| Increased Effectiveness | Reduction in Silos | Frequency of communication channels created (scrum meetings, Teams channels, etc.) specific to the organizational structure intended to reduce silos. |
| Operating in a New Org. Structure | Change Adoption Rate | The percentage of employees who have adopted their defined role within the new organizational chart in 3-, 6-, and 12-month increments. |
| Workforce Challenges | Turnover Rate | The number of employees who voluntarily leave the organization, citing the organizational redesign. |
| Workforce Challenges | Active Resistors | The number of active resistors anticipated related to the change in organizational structure versus the number of active resistors that actually present themselves to the organizational restructuring. |
| New Capabilities Needed | Gap in Capability Delivery | The increase in effectiveness in delivering on new capabilities to the IT organization. |
| Operating in a New Org. Structure | Change Adoption Rate | The percentage of employees who found the communication around the new organizational structure clear, easy to understand, and open to expressing feedback. |
| Lack of Business Understanding or Increased Effectiveness | Business Satisfaction with IT | Increase in business satisfaction toward IT products and services. |
| Workforce Challenges | Employee Performance | Increase in individual employee performances on annual/bi-annual reviews. |
| Adoption | Pulse Assessment | Increase in overall adoption scores on pulse survey. |
| Adoption | Communication Effectiveness | Reduction in the number of employees who are still unsure why the changes are required. |
| Adoption | Leadership Training | Percentage of members of leadership attending training to support their development at the managerial level. |
Stop treating the two interchangeably.
Because frankly they didn’t need it
“Only if you have your employees in mind can you implement change effectively and sustainably.”
Recommended action steps:
Info-Tech Insight
OCM is often not included or used due to a lack of understanding of how it differs from project management.
And an additional five experts across a variety of organizations who wish to remain anonymous.
Info-Tech Research Group
| Amanda Mathieson | Research Director | Heather Munoz | Executive Counselor | Valence Howden | Principal Research Director | |
| Ugbad Farah | Research Director | Lisa Hager Duncan | Executive Counselor | Alaisdar Graham | Executive Counselor | |
| Carlene McCubbin | Practice Lead | |||||
|
|
|
Aronowitz, Steven, et al. “Getting Organizational Design Right,” McKinsey, 2015. Web.
Ayers, Peg. “5 Ways to Engage Your Front-Line Staff.” Taylor Reach Group, 2019. Web.
Bushard, Brian, and Carlie Porterfield. “Meta Reportedly Scales Down, Again – Here Are the Major US Layoffs This Year.” Forbes, September 28, 2022. Web.
Caruci, Ron. “4 Organizational Design Issues that Most Leaders Misdiagnose.” Harvard Business Review, 2019.
“Change Management – And Why It Has to Change.” Creaholic Pulse Feedback. Web.
“Communication Checklist for Achieving Change Management.” Prosci, 27 Oct. 2022. Web.
“Defining Change Impact.” Prosci. 29 May 2019. Web.
“The Definitive Guide To Organization Design.” The Josh Bersin Company, 2022.
Deshler, Reed. “Five Reasons Organizational Redesigns Fail to Deliver.” AlignOrg. 28 Jan. 2020. Web.
The Fit for Growth Mini Book. PwC, 12 Jan. 2017.
Helfand, Heidi. Dynamic Reteaming: The Art and Wisdom of Changing Teams. 2nd ed., O’Reilly Media, 2020.
Jackson, Courtney. “7 Reasons Why Organizational Structures Fail.” Scott Madden Consultants. Web.
Livijn, Marianne. Managing Organizational Redesign: How Organizations Relate Macro and Micro Design. Doctoral dissertation. Department of Management, Aarhus University, 2020.
Lutke, Tobias. “Changes to Shopify’s Team.” Shopify. 26 July 2022.
McKinsey & Company. “How Do We Manage the Change Journey?” McKinsey & Company.2020.
Pijnacker, Lieke. “HR Analytics: Role Clarity Impacts Performance.” Effectory, 29 Sept. 2019. Web.
Tompkins, Teri C., and Bruce G. Barkis. “Conspiracies in the Workplace: Symptoms and Remedies.” Graziadio Business Review, vol. 21, no. 1, 2021.Web.
“Understanding Organizational Structures.” SHRM,2022.
Watkins, Michael D., and Janet Spencer. “10 Reasons Why Organizational Change Fails.” I by IMD, 10 March 2021. Web.
Wilson, Bradley. “Employee Survey Questions: The Ultimate Guide.” Perceptyx, 1 July 2020. Web.
Analysts do not feel empowered to challenge requirements to deliver a better outcome. This alongside underlying data quality issues prevents the creation of accurate and helpful information. Graphic representations do not provide meaningful and actionable insights.
As organizations strive to become more data-driven, good storytelling with data visualization supports growing corporate data literacy and helps analysts in providing insights that improves organization's decision-making and value-driving processes, which ultimately boosts business performance.
Follow a step-by-step guide to address the business bias of tacet experience over data facts and increase audience's understanding and acceptance toward data solutions.
Save the lost hours and remove the challenges of reports and dashboards being disregarded due to ineffective usage.
Gain insights from data-driven recommendations and have decision support to make informed decisions.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Here is our step-by-step process of getting value out of effective storytelling with data visualization:
This storytelling whiteboard canvas is a template that will help you create your visualization story narrative by:
Data visualization refers to graphical representations of data which help an audience understand. Without good storytelling, however, these representations can distract an audience with enormous amounts of data or even lead them to incorrect conclusions.
Good storytelling with data visualization involves identifying the business problem, exploring potential drivers, formulating a hypothesis, and creating meaningful narratives and powerful visuals that resonate with all audiences and ultimately lead to clear actionable insights.
Follow Info-Tech's step-by-step approach to address the business bias of tacit experience over data facts, improve analysts' effectiveness and support better decision making.

Ibrahim Abdel-Kader
Research Analyst,
Data, Analytics, and Enterprise Architecture

Nikitha Patel
Research Specialist,
Data, Analytics, and Enterprise Architecture

Ruyi Sun
Research Specialist,
Data, Analytics, and Enterprise Architecture
This research is designed for
This research will also assist
This research will help you
This research will help them
| Your Challenge | Common Obstacles | Info-Tech's Approach |
As analysts, you may experience some critical challenges when presenting a data story.
|
Some common roadblocks may prevent you from addressing these challenges.
|
|
Info-Tech Insight
As organizations strive to become more data-driven, good storytelling with data visualization supports growing corporate data literacy and helps analysts provide insights that improve organizational decision-making and value-driving processes, which ultimately boosts business performance.
Data storytelling is gaining wide recognition as a tool for supporting businesses in driving data insights and making better strategic decisions.
92% of respondents agreed that data storytelling is an effective way of communicating or delivering data and analytics results.
87% of respondents agreed that if insights were presented in a simpler/clearer manner, their organization's leadership team would make more data-driven decisions.
93% of respondents agreed that decisions made based on successful data storytelling could potentially help increase revenue.
Source: Exasol, 2021
Despite organizations recognizing the value of data storytelling, issues remain which cannot be remedied solely with better technology.
61% Top challenges of conveying important insights through dashboards are lack of context (61%), over-communication (54%), and inability to customize contents for intended audiences (46%).
49% of respondents feel their organizations lack storytelling skills, regardless of whether employees are data literate.
Source: Exasol, 2021
Info-Tech Insight
Storytelling is a key component of data literacy. Although enterprises are increasingly investing in data analytics software, only 21% of employees are confident with their data literacy skills. (Accenture, 2020)
To get a complete view of the field you want to explore, please refer to the following Info-Tech resources:
Select and Implement a Reporting and Analytics Solution
Build a Data Architecture Roadmap

Info-Tech Insight
As organizations strive to become more data-driven, good storytelling with data visualization supports growing corporate data literacy and helps analysts provide insights that improve organizational decision-making and value-driving processes, which ultimately boosts business performance.
| Member Benefits | Business Benefits |
|---|---|
|
|
| DIY Toolkit | Guided Implementation | Workshop | Consulting |
|---|---|---|---|
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Diagnostics and consistent frameworks are used throughout all four options.
The most successful information security strategies are:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Your security strategy should not be based on trying to blindly follow best practices but on a holistic risk-based assessment that is risk aware and aligns with your business context. Use this storyboard to augment your security strategy by ensuring alignment with business objectives, assessing your organization's risk and stakeholder expectations, understanding your current security state, and prioritizing initiatives and a security roadmap.
Use this tool to formally identify business goals and customer and compliance obligations and make explicit links to how security initiatives propose to support these business interests. Then define the scope and boundaries for the security strategy and the risk tolerance definitions that will guide future security risk decisions.
Security pressure posture analysis helps your organization assess your real security context and enables you to invest in the right security functions while balancing the cost and value in alignment with business strategies. Security pressure sets the baseline that will help you avoid over-investing or under-investing in your security functions.
Effective security planning should not be one size fits all – it must consider business alignment, security benefit, and resource cost. To enable an effective security program, all areas of security need to be evaluated closely to determine where the organization sits currently and where it needs to go in the future.
Use this communication deck template to present the results of the security strategy to stakeholders, demonstrate the progression from the current state to the future state, and establish the roadmap of the security initiatives that will be implemented. This information security communication deck will help ensure that you’re communicating effectively for your cause.
A charter is an essential document for defining the scope and purpose of security. Without a charter to control and set clear objectives for this committee, the responsibility of security governance initiatives will likely be undefined within the enterprise, preventing the security governance program from operating efficiently. This template can act as the foundation for a security charter to provide guidance to the governance of information security.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand business and IT strategy and plans.
Defined security obligations, scope, and boundaries.
1.1 Define business and compliance.
1.2 Establish security program scope.
1.3 Analyze the organization’s risk and stakeholder pressures.
1.4 Identify the organizational risk tolerance level.
Security obligations statement
Security scope and boundaries statement
Defined risk tolerance level
Risk assessment and pressure analysis
Define the information security target state.
Set goals and Initiatives for the security strategy in line with the business objectives.
2.1 Assess current security capabilities.
2.2 Identify security gaps.
2.3 Build initiatives to bridge the gaps.
Information security target state
Security current state assessment
Initiatives to address gaps
Continue assessing current security capabilities.
Identification of security gaps and initiatives to bridge them according to the business goals.
3.1 Identify security gaps.
3.2 Build initiatives to bridge the maturity gaps.
3.3 Identify initiative list and task list.
3.4 Define criteria to be used to prioritize initiatives.
Completed security current state assessment
Task list to address gaps
Initiative list to address gaps
Prioritize criteria
Create a plan for your security strategy going forward.
Set path forward to achieving the target state for the business through goal cascade and gap initiatives.
4.1 Conduct cost/benefit analysis on initiatives.
4.2 Prioritize gap initiatives based on cost and alignment with business.
4.3 Build an effort list.
4.4 Determine state times and accountability.
4.5 Finalize security roadmap and action plan.
4.6 Create communication plan.
Information security roadmap
Draft communication deck
Finalize deliverables.
Consolidate documentation into a finalized deliverable that can be used to present to executives and decision makers to achieve buy-in for the project.
5.1 Support communication efforts.
5.2 Identify resources in support of priority initiatives.
Security strategy roadmap documentation
Detailed cost and effort estimates
Mapping of Info-Tech resources against individual initiatives
Set your security strategy up for success.
“Today’s rapid pace of change in business innovation and digital transformation is a call to action to information security leaders.
Too often, chief information security officers find their programs stuck in reactive mode, a result of years of mounting security technical debt. Shifting from a reactive to proactive stance has never been more important. Unfortunately, doing so remains a daunting task for many.
While easy to develop, security plans premised on the need to blindly follow ‘best practices’ are unlikely to win over many stakeholders. To be truly successful, an information security strategy needs to be holistic, risk-aware, and business-aligned.”
Research Director – Security, Risk & Compliance
Info-Tech Research Group
The most successful information security strategies are:
Fifty-eight percent of companies surveyed that experienced a breach were small businesses.
Eighty-nine percent of breaches have a financial or espionage motive.
Source: Ponemon Institute, “2019 Global Cost of Data Breach Study”
of businesses have experienced an external threat in the last year.
of IT professionals consider security to be their number one priority.
of organizations claimed to have experienced an insider attack in the previous 12 months. 1
of businesses believe the frequency of attacks is increasing. 2
Effective IT leaders approach their security strategy from an understanding that attacks on their organization will occur. Building a strategy around this assumption allows your security team to understand the gaps in your current approach and become proactive instead of being reactive.
Sources: 1 Kaspersky Lab, “Global IT Security Risks Survey”; 2 CA Technologies, “Insider Threat 2018 Report”
Sources: 1 Accenture, “2019 The Cost of Cyber Crime Study”; 2,3 Verizon, “2019 Data Breach Investigations Report”
New threat trends in information security aren’t new.
Previously understood attacks are simply an evolution of prior implementations, not a revolution.
Traditionally, most organizations are not doing a good-enough job with security fundamentals, which is why attackers have been able to use the same old tricks.
However, information security has finally caught the attention of organizational leaders, presenting the opportunity to implement a comprehensive security program.
Source: Ponemon Institute, “2019 Cost of a Data Breach Study: Global Overview”
Personal records tend to be the most compromised data types, while databases tend to be the most frequently involved asset in breaches.
Source: Verizon, “2019 Data Breach Investigations Report”
An attacker must be successful only once. The defender – you – must be successful every time.
Indicates Info-Tech tools included in this blueprint.
An information security strategy model that is:
|
Value to the business |
Outcome |
|
|---|---|---|
|
Best-of-breed security strategy |
Have documentation that paints a picture of the road to compliance. Integrate your framework with your risk tolerance and external pressures. |
Be ready for future changes by aligning your security strategy to security framework best practices. |
|
Address the nature of your current information security |
Eliminate gaps in process and know what is in scope for your security strategy. Learn what pressures your business and industry are under. |
Gain insight into your current state, allowing you to focus on high-value projects first, transitioning towards a target state. |
|
Highlight overlooked functions of your current security strategy |
Build a comprehensive security program that brings to light all aspects of your security program. |
Instead of pursing ad hoc projects, know what needs work and how to prioritize your pressing security issues. |
|
Create a tangible roadmap to your target state |
Create a plan for your future state of information security. Refer to and update your target state as your business needs change. |
Document your current progress and path forward in the future. Know your goals and requirements, codified in a living document. |
|
Use our prepopulated deliverables to fast track your progress |
Let Info-Tech do the work for you. With completed deliverables, have tangible documents to convey your business needs. |
A comprehensive set of deliverables with concrete, defensible data to justify any business changes. |
|
A living security strategy |
Pivot and change prioritization to meet the needs of your security deficits. |
Future-proof your security strategy for any contingency. |
Evolve the security program to be more proactive by leveraging Info-Tech’s approach to building a security strategy.
Over time, experience incremental value from your initial security strategy. Through continual updates your strategy will evolve but with less associated effort, time, and costs.
These estimates are based on experiences with Info-Tech clients throughout the creation of this blueprint.
Present your findings in a prepopulated document that can summarizes all key findings of the blueprint.
Define the business, customer, and compliance alignment for your security program.
Determine your organization’s security pressures and ability to tolerate risk.
Use our best-of-breed security framework to perform a gap analysis between your current and target states.
Ensure the development and management of your security policies meet the broader program vision.
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
What does a typical Guided Implementation on this topic look like?
|
Day 1 |
Day 2 |
Day 3 |
Day 4 |
Day 5 |
|
|---|---|---|---|---|---|
|
Activities |
Assess Security Requirements |
Perform a Gap Analysis |
Complete the Gap Analysis |
Develop Roadmap |
Communicate and Implement |
|
1.1 Understand business and IT strategy and plans 1.2 Define business and compliance requirements 1.3 Establish the security program scope 1.4 Analyze the organization’s risks and stakeholder pressures 1.5 Identify the organizational risk tolerance level |
2.1 Define the information security target state 2.2 Assess current security capabilities 2.3 Identify security gaps 2.4 Build initiatives to bridge the gaps |
3.1 Continue assessing current security capabilities 3.2 Identify security gaps 3.3 Build initiatives to bridge the maturity gaps 3.4 Identify initiative list and task list 3.5 Define criteria to be used to prioritize initiatives |
4.1 Conduct cost/benefit analysis on initiatives 4.2 Prioritize gap initiatives based on cost, time, and alignment with the business 4.3 Build effort map 4.4 Determine start times and accountability 4.5 Finalize security roadmap and action plan 4.6 Create communication plan |
5.1 Finalize deliverables 5.2 Support communication efforts 5.3 Identify resources in support of priority initiatives |
|
|
Deliverables |
1.Security obligations statement 2.Security scope and boundaries statement 3.Defined risk tolerance level 4.Risk assessment and pressure analysis |
1.Information security target state 2.Security current state assessment 3.Initiatives to address gaps |
1.Completed security current state assessment 2.Task list to address gaps address gaps 4.Prioritization criteria
|
1.Information security roadmap 2.Draft communication deck |
1.Security strategy roadmap documentation 2.Detailed cost and effort estimates 3.Mapping of Info-Tech resources against individual initiatives |
Founded over 100 years ago, Credit Service Company (CSC)* operates in the United States with over 40 branches located across four states. The organization services over 50,000 clients.
Increased regulations, changes in technology, and a growing number of public security incidents had caught the attention of the organization’s leadership. Despite awareness, an IT and security strategy had not been previously created. Management was determined to create a direction for the security team that aligned with their core mission of providing exceptional service and expertise.
During the workshop, the IT team and Info-Tech analysts worked together to understand the organization’s ideal state in various areas of information security. Having a concise understanding of requirements was a stepping stone to beginning to develop CSC’s prioritized strategy.
Over the course of the week, the team created a document that concisely prioritized upcoming projects and associated costs and benefits. On the final day of the workshop, the team effectively presented the value of the newly developed security strategy to senior management and received buy-in for the upcoming project.
*Some details have been changed for client privacy.
1.1 Define goals and scope of the security strategy.
1.2 Assess your organization’s current inherent security risks.
1.3 Determine your organization’s stakeholder pressures for security.
1.4 Determine your organization’s risk tolerance.
1.5 Establish your security target state.
Once you have identified your primary and secondary business goals, as well as the corresponding security alignment goals, record them in the Information Security Requirements Gathering Tool. The tool provides an activity status that will let you know if any parts of the tool have not been completed.
1. Record your identified primary and secondary business goals in the Goals Cascade tab of the Information Security Requirements Gathering Tool.
Use the drop-down lists to select an appropriate goal or choose “Other.” If you do choose “Other,” you will need to manually enter an appropriate business goal.
2. For each of your business goals, select one to two security alignment goals. The tool will provide you with recommendations, but you can override these by selecting a different goal from the drop-down lists.
A common challenge for security leaders is how to express their initiatives in terms that are meaningful to business executives. This exercise helps to make an explicit link between what the business cares about and what security is trying to accomplish.
Applies to public companies that have registered equity or debt securities within the SEC to guarantee data integrity against financial fraud.
Applies to any organization that processes, transmits, or stores credit card information to ensure cardholder data is protected.
Applies to the healthcare sector and protects the privacy of individually identifiable healthcare information.
Applies to the healthcare sector and widens the scope of privacy and security protections available under HIPAA.
Applies to private sector organizations that collect personal information in Canada to ensure the protection of personal information in the course of commercial business.
National Institute of Standards and Technology; a non-regulatory agency that develops and publicizes measurement
Center for Internet Security – 20 Critical Security Controls; foundational set of effective cybersecurity practices.
An information security management system framework outlining policies and procedures.
An information technology and management and governance framework.
A common security framework for organizations that use or hold regulated personal health information.
It is important to know at the outset of the strategy: what are we trying to secure?
This includes physical areas we are responsible for, types of data we care about, and departments or IT systems we are responsible for.
This also includes what is not in scope. For some outsourced services or locations, you may not be responsible for their security. In some business departments, you may not have control of security processes. Ensure that it is made explicit at the outset what will be included and what will be excluded from security considerations.
The primary location(s) where business operations are carried out. Usually leased or owned by the business.
These are secondary offices that can be normal business offices or home offices. These locations will have a VPN connection and some sort of tenant.
These are redundant data center sites set up for additional space, equipment, and bandwidth.
This includes all remaining instances of employees or contractors using a VPN to connect.
Various vendors and clients have dedicated VPN connections that will have some control over infrastructure (whether owed/laaS/other).
These are many physical locations that are directly managed. These are high-risk locations with many personal and services, resulting in many possible vulnerabilities and attack vectors.
These are on the edge of the physical scope, and thus, in scope of the security strategy. These include remote locations, remote access connections, etc.
Networks of third-party users are within physical scope and need defined security requirements and definitions of how this varies per user.
Mostly privately owned mobile devices with either on-network or remote access.
These are systems that are wholly owned or managed by your organization.
IT is almost always the admin of these systems. Generally they are hosted on premises. All securitization through methods such as patching or antivirus is done and managed by your IT department.
These are systems with a lot of uncertainties because the vendor or service provided is either not known or what they are doing for security is not fully known.
These systems need to be secured regardless, but supplier and vendor relationship management becomes a major component of how to manage these systems. Often, each system has varying levels of risk based on vendor practices.
You likely have a good understanding of control for these systems, but they may not be fully managed by you (i.e. ownership of the infrastructure). These systems are often hosted by third parties that do some level of admin work.
A main concern is the unclear definition of responsibility in maintaining these systems. These are managed to some degree by third parties; it is challenging for your security program to perform the full gamut of security or administrative functions.
There are often systems that are unowned and even unknown and that very few people are using. These apps can be very small and my not fall under your IT management system framework. These systems create huge levels of risk due to limited visibility.
For example, unapproved (shadow IT) file sharing or cloud storage applications would be unknown and unowned.
Understanding your organization’s security risks is critical to identifying the most appropriate level of investment into your security program. Organizations with more security risks will need more a mature security program to mitigate those risks.
At this point, we want to frame risk tolerance in terms of business impact. Meaning, what kinds of impacts to the business would we be able to tolerate and how often? This will empower future risk decisions by allowing the impact of a potential event to be assessed, then compared against the formalized tolerance. We will consider impact from three perspectives:
The disruption or degradation of business/organizational processes.
The breach of confidentiality, privacy, or integrity of data/information.
The disruption or degradation of the ability to return to conditions prior to a security incident.
|
Questions to ask |
Description |
|---|---|
|
Is there a hard-dollar impact from downtime? |
This refers to when revenue or profits are directly impacted by a business disruption. For example, when an online ordering system is compromised and shut down, it affects sales, and therefore, revenue. |
|
Is regulatory compliance a factor? |
Depending on the circumstances of the vulnerabilities, it can be a violation of compliance obligations that would cause significant fines. |
|
Are any critical services dependent on this asset? |
Functional dependencies are sometimes not obvious, and assets that appear marginal can have huge impacts on critical services. |
|
Is there a health or safety risk? |
Some operations are critical to health and safety. For example, medical organizations have operations that are necessary to ensure uninterrupted critical health services. An exploited vulnerability that impacts these operations can have life and death consequences. |
It is crucial to keep in mind that you care about a risk scenario impact to the main business processes.
For example, imagine a complete functional loss of the corporate printers. For most businesses, even the most catastrophic loss of printer function will have a small impact on their ability to carry out the main business functions.
On the flip side, even a small interruption to email or servers could have a large functional impact on business processes.
A low risk tolerance will require a stronger information security program to ensure that operational security risk in the organization is minimized. If this tool reports that your risk tolerance is low, it is recommended that you review the results with your senior stakeholders to ensure agreement and support for the security program.
Download the Information Security Pressure Analysis Tool
Maturity models are very effective for determining information security target states. This table provides general descriptions for each maturity level. As a group, consider which description most accurately reflects the ideal target state for information security in your organization.
Higher target states require more investment to attain. It is critical to ensure that all key stakeholders agree on the security target state. If you set a target state that aims too high, you may struggle to gain support and funding for the strategy. Taking this opportunity to ensure alignment from the start will pay off dividends in future.
Below are some of the primary requirements that influenced CSC’s initial strategy development.
Regulatory: Numerous regulations and compliance requirements as a financial institution (PCI, FFIEC guidance).
Customer: Implicitly assumes personal, financial, and health information will be kept secure.
Define and implement dynamic information security program that understands and addresses the business’ inherent pressure, requirements (business, regulatory, and customer), and risk tolerance.
Estimated Time: 30-60 minutes
Info-Tech’s security framework uses a best-of-breed approach to leverage and align with most major security standards, including:
A best-of-breed approach ensures holistic coverage of your information security program while refraining from locking you in to a specific compliance standard.
Estimated Time: 30 minutes
Review the Setup tab of the Information Security Gap Analysis Tool. This tab contains several configurable settings that should be customized to your organization. For now, the three settings you will need to modify are:
Estimated Time: 8-16 hours
To help determine appropriate current and target maturity levels, refer to the example below for the control “Email communication is filtered for spam and potential malicious communications.”
There is no centrally managed spam filter. Spam may be filtered by endpoint email clients.
DEVELOPING 02
There is a secure email gateway. However, the processes for managing it are not documented. Administrator roles are not well defined. Minimal fine-tuning is performed, and only basic features are in use.
There is a policy and documented process for email security. Roles are assigned and administrators have adequate technical training. Most of the features of the solution are being used. Rudimentary reports are generated, and some fine-tuning is performed.
Metrics are produced to measure the effectiveness of the email security service. Advanced technical features of the solution have been implemented and are regularly fine-tuned based on the metrics.
There is a dedicated email security administrator with advanced technical training. Custom filters are developed to further enhance security, based on relevant cyber threat intelligence. Email security metrics feed key risk indicators that are reported to senior management.
Estimated Time: 8-16 hours
Estimated Time: 8-16 hours
Use the Gap Assessment Dashboard to map your progress. As you fill out the Gap Analysis Tool, check with the Dashboard to see the difference between your current and target state.
Use the color-coded legend to see how large the gap between your current and target state is. The legend can be customized further if desired.
Security domains that appear white have not yet been assessed or are rated as “N/A.”
Estimated Time: 4-8 hours
Estimated Time: 4-8 hours
Estimated Time: 1-2 hours
For each of the gap closure actions, optionally enter an estimated gap closure percentage to indicate how effective the action will be in fully closing the gap.
Completing this step will populate the “Security Roadmap Progression” diagram in the Results tab, which will provide a graphic illustration of how close to your target state you will get based upon the roadmap.
This phase will walk you through the following activities:
Estimated Time: 2-4 hours
Estimated Time: 1-2 hours
Tasks are not meant to be managed to the same degree that initiatives will be. However, they are still important. It is recommended that you develop a process for tracking these tasks to completion.
Estimated Time: 2-3 hours
In the example below, we see three gap closure actions within the Security Culture and Awareness domain being consolidated into a single initiative “Develop security awareness program.”
We can also see one gap closure action within the same domain being grouped with two actions from the Security Policies domain into another initiative “Update security policies.”
As you go through this exercise, you may find that some actions that you previously categorized as tasks could be consolidated into an initiative.
Estimated Time: 30 minutes
Estimated Time: 1-2 hours
Estimated Time: 30 minutes
Make sure that your ranges allow for differentiation between initiatives to enable prioritization. For instance, if you set your ranges too low, all your initiatives will be assessed as high cost, providing no help when you must prioritize them.
Estimated Time: 30 minutes
Some organizations prefer to use the “Security Benefit” criteria to demonstrate how well each initiative supports specific compliance goals.
Estimated Time: 1-2 hours
Estimated Time: 30 minutes
Industry: Financial Services
Source: Info-Tech Research Group
Estimated Time: 2-3 hours
Estimated Time: 30 minutes
An effort map is a tool used for the visualization of a cost/benefit analysis. It is a quadrant output that visually shows how your gap initiatives were prioritized. In this example, the initiative “Update Security Policies” was assessed as low cost/effort (3) and high benefit (10).
Estimated Time: 60 minutes
Use an iterative approach. Most organizations tend to put too many initiatives into wave 1. Be realistic about what you can accomplish and take several passes at the exercise to achieve a balance.
Estimated Time: 30 minutes
Any initiatives that are currently in progress should be assigned to Wave 0.
Estimated Time: 1-3 hours
Download the Information Security Gap Analysis Tool
Estimated Time: 1-2 Hours
Use the Owner column to help identify resourcing constraints. If a single individual is responsible for many different initiatives that are planned to start at the same time, consider staggering those initiatives.
Estimated Time: 30-60 minutes
Estimated Time: 30 minutes
Often, internal stakeholders will ask the question “If we do everything on this roadmap, will we be at our target state?” This diagram will help answer that question.
Estimated Time: 30 minutes
This phase will walk you through the following activities:
Estimated Time: 1-3 hours
Estimated Time: 1-2 hours
Consider developing multiple versions of the deck for different audiences. Senior management may only want an executive summary, whereas the CIO may be more interested in the methodology used to develop the strategy.
Developing an information security strategy is only half the job. For the strategy to be successful, you will need to garner support from key internal stakeholders. These may include the CIO, senior executives, and business leaders. Without their support, your strategy may never get the traction it needs. When building your communication deck and planning to present to these stakeholders, consider the following:
If you have already fully engaged your key stakeholders through the requirements gathering exercises, presenting the strategy will be significantly easier. The stakeholders will have already bought in to the business goals, allowing you to show how the security strategy supports those goals.
Reinforce the concept that a security strategy is an effort to enable the organization to achieve its core mission and goals and to protect the business only to the degree that the business demands. It is important that stakeholders understand this point.
Estimated Time: 1-3 hours
Estimated Time: 1-3 hours
A security charter is a formalized and defined way to document the scope and purpose of your security program. It will define security governance and allow it to operate efficiently through your mission and vision.
Info-Tech has many resources that can help you quickly and effectively implement most of your initiatives. Talk to your account manager to learn more about how we can help your strategy succeed.
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.
Contact your account representative for more information.
workshops@infotech.com
1-888-670-8889
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.
To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
The following are sample activities that will be conducted by Info-Tech analysts with your team:
Use our best-of-breed security framework to perform a gap analysis between your current and target states.
Define the business, customer, and compliance alignment for your security program.
A unified security operations process actively transforms security events and threat information into actionable intelligence, driving security prevention, detection, analysis, and response processes, addressing the increasing sophistication of cyberthreats, and guiding continuous improvement.
This blueprint will walk through the steps of developing a flexible and systematic security operations program relevant to your organization.
Your security governance and management program needs to be aligned with business goals to be effective.
This approach also helps to provide a starting point to develop a realistic governance and management program.
This project will guide you through the process of implementing and monitoring a security governance and management program that prioritizes security while keeping costs to a minimum.
Don’t reinvent the wheel by reassessing your security program using a new framework.
Instead, use the tools in this blueprint to align your current assessment outcomes to required standards.
“2015 Cost of Data Breach Study: United States.” Sponsored by IBM. Ponemon Institute, May 2015. Web.
“2016 Cost of Cyber Crime Study & the Risk of Business Innovation.” Ponemon Institute, Oct. 2016. Web. 25 Oct. 2016.
“2016 Cost of Data Breach Study: Global Analysis.” Ponemon Institute, June 2016. Web. 26 Oct. 2016.
“2016 Data Breach Investigations Report.” Verizon, 2016. Web. 25 Oct. 2016.
“2016 NowSecure Mobile Security Report.” NowSecure, 2016. Web. 5 Nov. 2016.
“2017 Cost of Cyber Crime Study.” Ponemon Institute, Oct. 2017. Web.
“2018 Cost of Data Breach Study: Global Overview.” Ponemon Institute, July 2018. Web.
“2018 Data Breach Investigations Report.” Verizon, 2018. Web. Oct. 2019.
“2018 Global State of Information Security Survey.” CSO, 2017. Web.
“2018 Thales Data Threat Report.” Thales eSecurity, 2018. Web.
“2019 Data Breach Investigations Report.” Verizon, 2020. Web. Feb. 2020.
“2019 Global Cost of a Data Breach Study.” Ponemon Institute, Feb. 2020. Web.
“2019 The Cost of Cyber Crime Study.” Accenture, 2019. Web Jan 2020.
“2020 Thales Data Threat Report Global Edition.” Thales eSecurity, 2020. Web. Mar. 2020.
Ben Salem, Malek. “The Cyber Security Leap: From Laggard to Leader.” Accenture, 2015. Web. 20 Oct. 2016.
“Cisco 2017 Annual Cybersecurity Report.” Cisco, Jan. 2017. Web. 3 Jan. 2017.
“Cyber Attack – How Much Will You Lose?” Hewlett Packard Enterprise, Oct. 2016. Web. 3 Jan. 2017.
“Cyber Crime – A Risk You Can Manage.” Hewlett Packard Enterprise, 2016. Web. 3 Jan. 2017.
“Global IT Security Risks Survey.” Kaspersky Lab, 2015. Web. 20 October 2016.
“How Much Is the Data on Your Mobile Device Worth?” Ponemon Institute, Jan. 2016. Web. 25 Oct. 2016.
“Insider Threat 2018 Report.” CA Technologies, 2018. Web.
“Kaspersky Lab Announces the First 2016 Consumer Cybersecurity Index.” Press Release. Kaspersky Lab, 8 Sept. 2016. Web. 3 Jan. 2017.
“Kaspersky Lab Survey Reveals: Cyberattacks Now Cost Large Businesses an Average of $861,000.” Press Release. Kaspersky Lab, 13 Sept. 2016. Web. 20 Oct. 2016.
“Kaspersky Security Bulletin 2016.” Kaspersky Lab, 2016. Web. 25 Oct. 2016.
“Managing Cyber Risks in an Interconnected World: Key Findings From the Global State of Information Security Survey 2015.” PwC, 30 Sept. 2014. Web.
“Measuring Financial Impact of IT Security on Business.” Kaspersky Lab, 2016. Web. 25 Oct. 2016.
“Ponemon Institute Releases New Study on How Organizations Can Leapfrog to a Stronger Cyber Security Posture.” Ponemon Institute, 10 Apr. 2015. Web. 20 Oct. 2016.
“Predictions for 2017: ‘Indicators of Compromise’ Are Dead.” Kaspersky Lab, 2016. Web. 4 Jan. 2017.
“Take a Security Leap Forward.” Accenture, 2015. Web. 20 Oct. 2016.
“Trends 2016: (In)security Everywhere.” ESET Research Laboratories, 2016. Web. 25 Oct. 2016.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Describe your application vision and set the right modernization expectations with your stakeholders.
Focus your modernization efforts on the business opportunities that your stakeholders care about.
Describe your modernization initiatives and build your modernization tactical roadmap.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discuss the goals of your application modernization initiatives
Define your digital application vision and priorities
List your modernization principles
Clear application modernization objectives and high priority value items
Your digital application vision and attributes
Key principles that will guide your application modernization initiatives
1.1 State Your Objectives
1.2 Characterize Your Digital Application
1.3 Define Your Modernization Principles
Application modernization objectives
Digital application vision and attributes definitions
List of application modernization principles and guidelines
Identify the value streams and business capabilities that will benefit the most from application modernization
Conduct a change tolerance assessment
Build your modernization strategic roadmap
Understanding of the value delivery improvements modernization can bring
Recognizing the flexibility and tolerance of your organization to adopt changes
Select an approach that best fits your organization’s goals and capacity
2.1 Identify the Opportunities
2.2 Define Your Modernization Approach
Value streams and business capabilities that are ideal modernization opportunities
Your modernization strategic roadmap based on your change tolerance and modernization approach
Identify the most appropriate modernization technique and the scope of changes to implement your techniques
Develop an actionable tactical roadmap to complete your modernization initiatives
Clear understanding of what must be changed to the organization and application considering your change tolerance
An achievable modernization plan
3.1 Shortlist Your Modernization Techniques
3.2 Roadmap Your Modernization Initiatives
Scope of your application modernization initiatives
Your modernization tactical roadmap
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Lay down the foundations for security risk management, including roles and responsibilities and a defined risk tolerance level.
Define frequency and impact rankings then assess the risk of your project.
Catalog an inventory of individual risks to create an overall risk profile.
Communicate the risk-based conclusions and leverage these in security decision making.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Build the foundation needed for a security risk management program.
Define roles and responsibilities of the risk executive.
Define an information security risk tolerance level.
Clearly defined roles and responsibilities.
Defined risk tolerance level.
1.1 Define the security executive function RACI chart.
1.2 Assess business context for security risk management.
1.3 Standardize risk terminology assumptions.
1.4 Conduct preliminary evaluation of risk scenarios to determine your risk tolerance level.
1.5 Decide on a custom risk factor weighting.
1.6 Finalize the risk tolerance level.
1.7 Begin threat and risk assessment.
Defined risk executive functions
Risk governance RACI chart
Defined quantified risk tolerance and risk factor weightings
Determine when and how to conduct threat and risk assessments (TRAs).
Complete one or two TRAs, as time permits during the workshop.
Developed process for how to conduct threat and risk assessments.
Deep risk analysis for one or two IT projects/initiatives.
2.1 Determine when to initiate a risk assessment.
2.2 Review appropriate data classification scheme.
2.3 Identify system elements and perform data discovery.
2.4 Map data types to the elements.
2.5 Identify STRIDE threats and assess risk factors.
2.6 Determine risk actions taking place and assign countermeasures.
2.7 Calculate mitigated risk severity based on actions.
2.8 If necessary, revisit risk tolerance.
2.9 Document threat and risk assessment methodology.
Define scope of system elements and data within assessment
Mapping of data to different system elements
Threat identification and associated risk severity
Defined risk actions to take place in threat and risk assessment process
Complete one or two TRAs, as time permits during the workshop.
Deep risk analysis for one or two IT projects/initiatives, as time permits.
3.1 Continue threat and risk assessment activities.
3.2 As time permits, one to two threat and risk assessment activities will be performed as part of the workshop.
3.3 Review risk assessment results and compare to risk tolerance level.
One to two threat and risk assessment activities performed
Validation of the risk tolerance level
Collect, analyze, and aggregate all individual risks into the security risk register.
Plan for the future of risk management.
Established risk register to provide overview of the organizational aggregate risk profile.
Ability to communicate risk to other stakeholders as needed.
4.1 Begin building a risk register.
4.2 Identify individual risks and threats that exist in the organization.
4.3 Decide risk responses, depending on the risk level as it relates to the risk tolerance.
4.4 If necessary, revisit risk tolerance.
4.5 Identify which stakeholders sign off on each risk.
4.6 Plan for the future of risk management.
4.7 Determine how to present risk to senior management.
Risk register, with an inventory of risks and a macro view of the organization’s risk
Defined risk-based initiatives to complete
Plan for securing and managing the risk register
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Follow the seven steps outlined in this blueprint to design a VIP support model that best suits your organization, then communicate and evaluate the service to ensure it delivers results.
This template is designed to assist with documenting your service desk procedures for handling VIP or executive tickets. It can be adapted and customized to reflect your specific support model and procedures.
This Visio template provides an example of a VIP support process, with every step involved in resolving or fulfilling VIP service desk tickets. Use this as an example to follow and a template to document your own process.
This template can be customized to use as an executive presentation to communicate and market the service to VIP users and ensure everyone is on the same page.
Research Director,
Infrastructure & Operations
Info-Tech Research Group
In a perfect world, executives wouldn’t need any special treatment because the service desk could rapidly resolve every ticket, regardless of the submitter, keeping satisfaction levels high across the board.
But we know that’s not the case for most organizations. Executives and VIPs demand higher levels of service because the reality in most companies is that their time is worth more. And any IT leader who’s had a VIP complain about their service knows that their voice also carries more weight than that of a regular dissatisfied user.
That said, most service desks feel strapped for resources and don’t know how to improve service for VIPs without sacrificing service to the rest of the organization.
The key is to stop being reactive to VIP demands and formalize your VIP service procedures so that you can properly set expectations for the service, monitor and measure it, and continually evaluate it to make changes if necessary.
A VIP offering doesn’t have to mean a white glove concierge service, either – it could simply mean prioritizing VIP tickets differently. How do you decide which level of service to offer? Start by assessing your specific needs based on demand, gather requirements from relevant stakeholders, choose the right approach to fit your business needs and capabilities, clearly define and document all aspects of the service then communicate it so that everyone is on the same page as to what is in and out of scope, and continually monitor and evaluate the service to make changes and improvements as needed.
Your Challenge
|
Common Obstacles
|
Info-Tech's Approach
|
The reality for most organizations is that VIPs need special treatment. But providing VIP service shouldn’t come at the expense of good service delivery for the rest of the organization. To be successful with your approach, formalize the VIP offering to bring consistency and clear expectations for both users and the IT staff delivering the service.
Providing VIP support helped this company grow |
Allocating a dedicated VIP technician slowed down service delivery for this company |
|
Situation |
A SaaS company looking to build and scale its services and customers decided to set up a VIP support program, which involved giving their most valuable customers white glove treatment to ensure they had a great experience, became long-term customers, and thus had a positive influence on others to build up the company’s customer base. | VIPs were receiving executive-level support with a dedicated person for VIP tickets. The VIPs were happy with the service, but the VIP technician’s regular work was frequently impeded by having to spend most of her time doing white glove activities. The service desk found that in some cases, more critical work was slipping as a result of prioritizing all executive tickets. |
Resolution |
First, they defined who would receive VIP support, then they clearly defined the service, including what VIP support
includes, who gets the service, and what their SLAs for service are. They found that the program was an effective way to
focus their limited resources on the customers with the highest value potential to increase sales. While this model differs from an IT service desk VIP support program, the principles of dedicating resources to provide elevated support to your most important and influential customers for the benefit and growth of the company as a whole remain the same. |
The service desk decided to remove the VIP function. They demonstrated that the cost per contact was too high for dedicated executive support, and reallocating that dedicated technician to the service desk would improve the resolution time of all business incidents and requests. VIPs could still receive prioritized support through the escalation process, but they would contact the regular service desk with their issues. VIPs approved the change, and as a result of removing the dedicated support function, the service desk reduced average incident resolution times by 28% and request fulfillment times by 33%. |
Service Desk VIP Procedures TemplateUse this template to assist with documenting your service desk procedures for handling VIP or executive tickets. |
VIP Support Process Workflow ExampleUse this Visio template to document your process for resolving or fulfilling VIP tickets, from when the ticket is submitted to when it’s closed. |
VIP Support Service Communication TemplateUse this template to customize your executive presentation to communicate and market the service to VIP users. |
The reality for most organizations is that VIPs need special treatment. But providing VIP service shouldn’t be at the expense of good service delivery for the rest of the organization. To be successful with your approach, formalize the VIP offering to bring consistency and clear expectations for both users and the IT staff delivering the service.
Insight 1 |
VIP service doesn’t have to mean concierge service. There are different levels and models of VIP support that range in cost and level of service provided. Carefully evaluate your needs and capacity to choose the approach that works best for your organization. |
Insight 2 |
This service is for your most valued users, so design it right from the start to ensure their satisfaction. Involve stakeholders from the beginning, incorporate their feedback and requirements, keep them well-informed about the service, and continually collect and act on feedback to deliver the intended value. |
Insight 3 |
Intentional, continual monitoring and measurement of the program must be part of your strategy. If your metrics or feedback show that something isn’t working, fix it. If you find that the perceived value isn’t worth the high cost of the program, make changes. Even if everything seems to be working fine, identify ways to improve it or make it more efficient. |
Step overview:
VIP support from the service desk usually refers to an elevated level of service (i.e. faster, after-hours, off-site, and/or with more experienced resources) that is provided to those at the executive level of the organization.
A VIP typically includes executives across the business (e.g. CIO, CEO, CxO, VPs) and sometimes the executive assistants who work directly with them. However, it can also include non-executive-level but critical business roles in some organizations.
The level of VIP service provided can differ from receiving prioritization in the queue to having a dedicated, full-time technician providing “white glove” service.
You don’t have to use the term “VIP”, as long as you clearly define the terms you are using. Some organizations use the term “VIR” to refer to very important roles rather than people, and some define “critical users” to reflect who should receive prioritized service, for example.
VIP tickets are prioritized in the same way as every other ticket – with an assessment by impact and urgency. This allows every ticket to be prioritized appropriately according to how big the impact of the issue is and how quickly it needs to be resolved – regardless of who the submitter is. This means that VIPs with very urgent issues will still receive immediate support, as would a non-VIP user with a critical issue.
Don’t design a VIP service solely out of fear that VIPs will be unhappy with the standard level of support the service desk provides. In some cases, it is better to focus your efforts on improving your standard support for everyone rather than only for a small percentage of users, especially if providing that elevated VIP support would further deteriorate service levels for the rest of the organization.
If you’re already informally bumping VIP tickets up the queue, this may be the most appropriate model for you. Bring formalization to your process by clearly defining exactly where VIP tickets fit in your prioritization matrix to ensure they are handled consistently and that VIPs are aware of the process.
This type of model is essential in many large enterprises where the success of the company can depend on VIPs having access to dedicated support to minimize downtime as much as possible. However, it also requires the highest level of planning and dedication to get right. Without carefully documented processes and procedures and highly trained staff to support the model, it will fail to deliver the expected benefits.
Step overview:
Analyze your ticket data and reports to understand how well you’re currently meeting SLAs, your average response and resolution times, and the volume and type of requests you get from VIPs in order to understand the need for changing your current model. If you don’t have the ticket data to inform your assessment, leverage Info-Tech’s Service Desk Ticket Analysis Tool.
Use this tool to identify trends and patterns in your ticket data. The ticket summary dashboard contains multiple reports analyzing how tickets come in, who requests them, who resolves them, and how long it takes to resolve them.
If you need help understanding how well your current staff is able to handle your current ticket volume, leverage Info-Tech’s Service Desk Staffing Calculator to analyze demand and ticket volume trends. While not specifically designed to analyze VIP tickets, you could run the assessment separately for VIP volume if you have that data available.
Use this tool to help you estimate the optimal resource allocation to support your demand over time.
Follow your organization’s requirements gathering process to identify and prioritize stakeholders, conduct stakeholder interviews, and identify, track, and prioritize their requirements and expectations for service delivery.
If your organization does not have a defined requirements gathering process or template, leverage Info-Tech tools and templates:
The Improve Requirements Gathering blueprint can be adapted from software requirements gathering to service desk.
The PMO Requirements Gathering Tool can be adapted from interviewing stakeholders on their PMO requirements to service desk requirements.
Don’t guess at what your VIPs need or want – ask them and involve them in the service design. Many IT leaders sacrifice overall service quality to prioritize VIPs, thinking they expect immediate service. However, they later find out that the VIPs just assumed the service they were receiving was the standard service and many of their issues can wait.
Info-Tech's CIO Business Vision program is a low-effort, high-impact program that will give you detailed report cards on the organization’s satisfaction with IT’s core services. Use these insights to understand your key business stakeholders, find out what is important to them, and improve your interactions.
Info-Tech’s End User Satisfaction Program helps you measure end-user satisfaction and importance ratings of core IT services, IT communications, and business enablement to help you decide which IT service capabilities need to be addressed to meet the demands of the business.
Learn more about Info-Tech’s CIO Business Vision or End User Satisfaction Program .
Step overview:
The table below is a rough guide for how the results of your assessments may line up to the most appropriate model for your organization:

If you’re in the position of deciding how to improve service to VIPs, it’s unlikely that you will end up choosing the “same service” model. If your data analysis tells you that you are currently meeting every metric target for all users, this may actually indicate that you’re overstaffed at the service desk.
Step overview:
When a designated VIP user contacts the service desk with a question, incident, or service request, their ticket will be prioritized over non-VIP tickets following the prioritization matrix. This process has been designed in accordance with business needs and requirements, as defined VIP users have more urgent demands on their time and the impact of downtime is greater as it has the potential to impact the business. However, all tickets, VIP tickets included, must still be prioritized by impact and urgency. Incidents that are more critical will still be resolved before VIP tickets in accordance with the prioritization process.
VIP support is a team of dedicated field technicians available to provide an elevated level of service including deskside support for executives and designated VIP users. VIP users have the ability to contact the VIP support service through a dedicated phone number and will receive expedited ticket handling and resolution by dedicated Tier 2 specialists with experience dealing with executives and their unique needs and requirements. This process has been designed in accordance with business needs and requirements.
Use a visual workflow to document the process for resolving or fulfilling VIP tickets, from when the ticket is submitted to when it gets closed.
Your workflow should address the following:
Use the VIP Support Process Workflow Example as a template to map out your own process.
Define all aspects of the service so that every VIP request will follow the same standardized process and VIPs will have clear expectations for the service they receive. This may include:
If VIP user requests receive enhanced priority, for example, define exactly how those requests should be prioritized using your prioritization matrix. An example is found below and in the Service Desk VIP Procedures Template.
This template is designed to assist with documenting your service desk procedures for handling VIP or executive tickets. The template is not meant to cover all possible VIP support models but is an example of one support model only. It should be adapted and customized to reflect your specific support model and procedures.
Download the Service Desk VIP Procedures Template
Step overview:
If you did your due diligence, the VIP service launch won’t be a surprise to executives. However, it’s critical to
continue the engagement and communicate the details of the service well to ensure there are no misperceptions about the
service when it launches.
This step isn’t only for the launch of new services. Even if you’re enhancing or right-sizing an existing VIP service, take the opportunity to market the improvements, remind users of the correct processes, and collect feedback.
This template can be customized to use as an executive presentation to communicate and market the service to VIP users. It includes:
If you’re launching a dedicated concierge service for VIPs, highlight the exclusivity of the service in your marketing to draw users in. For example, if eligible VIPs get a separate number to call, expedited SLAs, or access to more tenured service desk experts, promote this added value of the service.
Download the VIP Support Service Communication Template
Step overview:
Targeted metrics to evaluate the success of the VIP program will be critical to understanding and demonstrating whether the service is delivering the intended value. Track key metrics to:
If your data definitively shows the VIP offering delivers enhanced service levels, publish these results to business leadership. A successful VIP service is a great accomplishment to market and build credibility for the service desk.
Download Define Service Desk Metrics that Matter and the Service Desk Metrics Workbook for help defining CSFs, KPIs, and key metrics
Step overview:
Executives are happy, resolution times are on target – now what? Even if everything seems to be working well, never stop monitoring, measuring, and evaluating the service. Not only can metrics change, but there can also always be ways to improve service.
Download Info-Tech’s Build a Continual Improvement Program blueprint to help you build a process around continual improvement, and use the Continual Improvement Register tool to help you identify and prioritize improvement initiatives.
Don’t limit your continual improvement efforts to the VIP service. Once you’ve successfully elevated the VIP service, look to how you can apply elements of that service to elevate support to the rest of the organization. For example, through providing a roaming service desk, a concierge desk, a Genius-Bar-style walk-in service, etc.
This project will help you build and improve essential service desk processes, including incident management, request fulfillment, and knowledge management to create a sustainable service desk.
This project will help you build a strategy to shift service support left to optimize your service desk operations and increase end-user satisfaction.
This project will help you build a continual improvement plan for the service desk to review key processes and services and manage the progress of improvement initiatives.
This project will help you deliver a targeted customer service training program to your IT team to enhance their customer service skills when dealing with end users, improve overall service delivery, and increase customer satisfaction.
Munger, Nate. “Why You Should Provide VIP Customer Support.” Intercom, 13 Jan. 2016. Accessed Jan. 2023.
Ogilvie, Ryan. “We Did Away With VIP Support and Got More Efficient.” HDI, 17 Sep. 2020. Accessed Jan. 2023.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
From choosing the right data for the right problem to evaluating your progress toward data-driven people decisions, follow these steps to build your foundation to people analytics.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Determine your approach for cutting costs.
Identify the cost-cutting initiatives and design your roadmap.
Communicate your roadmap to the business and attain approval.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine your cost-optimization stance.
Build momentum with quick wins.
Understand the internal and external drivers behind your cost-cutting mandate and the types of initiatives that align with it.
1.1 Develop SMART project metrics.
1.2 Dissect the mandate.
1.3 Identify your cost-cutting stance.
1.4 Select and implement quick wins.
1.5 Plan to report progress to Finance.
Project metrics and mandate documentation
List of quick-win initiatives
Create the plan for your cost-cutting initiatives.
Choose the correct initiatives for your roadmap.
Create a sensible and intelligent roadmap for the cost-cutting initiatives.
2.1 Identify cost-cutting initiatives.
2.2 Select initiatives.
2.3 Build a roadmap.
High-level cost-cutting initiatives
Cost-cutting roadmap
Finalize the cost-cutting plan and present it to the business.
Attain engagement with key stakeholders.
3.1 Customize your cost-cutting plan.
3.2 Create stakeholder engagement plans.
3.3 Monitor cost savings.
Cost-cutting plan
Stakeholder engagement plan
Cost-monitoring plan
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Evaluate the current state, stakeholder capacity, and target audience of engagement actions.
Review impact to engagement drivers in order to prioritize and select tactics for addressing each.
Designate owners of tactics, select measurement tools and cadence, and communicate engagement actions.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Even where there is limited control, you can define an incident response plan to streamline notification, assessment, and implementation of workarounds.
At a minimum, IT’s responsibility is to identify and communicate risk to senior leadership. That starts with a vendor review to identify SLA and overall resilience gaps.
The examples illustrate different approaches to incident response depending on the criticality of the service and options available.
Summarize cloud services risk, mitigation options, and incident response for senior leadership.
If you think cloud means you don’t need a response plan, then get your resume ready.
|
Most organizations are now recognizing that they can’t ignore the risk of a cloud outage or data loss, and the challenge is “what can I do about it?” since there is limited control. If you still think “it’s in the cloud, so I don’t need to worry about it,” then get your resume ready. When O365 goes down, your executives are calling IT, not Microsoft, for an answer of what’s being done and what can they do in the meantime to get the business up and running again. The key is to recognize what you can control and what actions you can take to evaluate and mitigate risk. At a minimum, you can ensure senior leadership is aware of the risk and define a plan for how you will respond to an incident, even if that is limited to monitoring and communicating status. Often you can do more, including defining IT workarounds, backing up your SaaS data for additional protection, and using business process workarounds to bridge the gap, as illustrated in the case studies in this blueprint. Frank Trovato Info-Tech Research Group |
As more applications are migrated to cloud-based services, disaster recovery (DR) and business continuity plans (BCP) must include an understanding of cloud risks and actions to mitigate those risks. This includes evaluating vendor and service reliability and resilience, security measures, data protection capabilities, and technology and business workarounds if there is a cloud outage or incident.
Use the risk assessments and cloud service incident response plans developed through this blueprint to supplement your DRP and BCP as well as further inform your crisis management plans (e.g. account for cloud risks in your crisis communication planning).
Overall Business Continuity Plan |
||
|---|---|---|
IT Disaster Recovery Plan A plan to restore IT application and infrastructure services following a disruption. Info-Tech’s Disaster Recovery Planning blueprint provides a methodology for creating the IT DRP. Leverage this blueprint to validate and provide inputs for your IT DRP. |
BCP for Each Business Unit A set of plans to resume business processes for each business unit. Info-Tech’s Develop a Business Continuity Plan blueprint provides a methodology for creating business unit BCPs as part of an overall BCP for the organization. |
Crisis Management Plan A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage. Info-Tech’s Implement Crisis Management Best Practices blueprint provides a framework for planning a response to any crisis, from health and safety incidents to reputational damage. |
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
|
|
Info-Tech Insight
Asking vendors about their DRP, BCP, and overall resilience has become commonplace. Expect your vendors to provide answers so you can assess risk. Furthermore, your vendor may have additional offerings to increase resilience or recommendations for third parties who can further assist your goals of improving cloud service resilience.
Provide leadership with a summary of cloud risk, downtime workarounds implemented, and additional data protection.

Cloud Services Incident Risk and Mitigation Review Tool Use this tool to gather vendor input, evaluate vendor SLAs and overall resilience, and track your own risk mitigation efforts.
|
SaaS Incident Response Workflows Use the examples in this document as a model to develop your own incident response workflows for cloud outages or data loss.
|
Identify options to mitigate risk
Create an incident response plan
Assess risk
Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
Assess your cloud risk | Identify options to mitigate risk | Create an incident response plan |
A few cloud outage examples:
Cloud availability
High-level challenges and resilience options:
Plan for resilience
High-level challenges and resilience options:
Note: The rest of this blueprint is focused primarily on SaaS resilience due to the challenges listed here. For other cloud services, leverage traditional DR strategies and vendor management to mitigate risk (as summarized on the previous slides).
The activities on the next two slides will evaluate risk through two approaches:
Activity 1: Estimate potential impact of downtime and data loss to quantify the risk and determine which cloud services are most critical and need to be prioritized. This is done through a business impact analysis that assesses:
|
Activity 2: Review the vendor to identify risks and gaps. Specifically, evaluate the following:
|
1-3 hours

| Materials |
|---|
|
| Participants |
|
1-3 hours
Use the Cloud Services Incident Risk and Mitigation Review Tool as follows:

| Materials |
|---|
|
| Participants |
|
Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
Assess your cloud risk | Identify options to mitigate risk | Create an incident response plan |
Some SaaS solutions have plenty of resilience options; others not so much
Risk
|
Options to mitigate risk (not an exhaustive list):
|
Risk
| Options to mitigate risk (not an exhaustive list):
|
Example baseline standard for cloud risk mitigation
Embed risk mitigation standards into existing IT operations
Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
Assess your cloud risk | Identify options to mitigate risk | Create an incident response plan |
1-3 hours
|
Example SaaS Incident Response Workflow Excerpt ![]() |
Materials |
|
||
| Participants | ||
|
If either critical SaaS dependency fails, the following plan is executed:
Criticality justified a failover option
The Annual Day of Giving generates over 50% of fundraising for the year. It’s critically dependent on two SaaS solutions that host the donation page and payment processing.
To mitigate the risk, the organization implemented the ability to failover to an alternate “environment” – much like a traditional DR solution – supported by workarounds to manage data collection.
Daily exports from a SaaS-hosted donations site reduce potential data loss:
Protecting your data gives you options
For critical data, do you want to rely solely on the vendor’s default backup strategy?
If your SaaS vendor is hit by ransomware or if their backup frequency doesn’t meet your needs, having your own data backup gives you options.
It can also support business process workarounds that need to access that data while waiting for SaaS recovery.
To enable a more accurate payroll workaround, the following is done:
BCP can bridge the gap
When leadership looks to IT to mitigate cloud risk, include BCP in the discussion.
Payroll is a good example where the best recovery option might be a business continuity workaround.
IT often still has a role in business continuity workarounds, as in this case study: specifically, providing a solution to modify and convert the payroll data to an ACH file.
1-3 hours
|
Example tabletop planning results excerpt with gaps identified
|
Materials |
|
||
| Participants | ||
|
1-3 hours
|
Cloud Services Resilience Summary – Table of Contents ![]() |
Materials |
|
||
| Participants | ||
|
Get an objective assessment of your DRP program and recommendations for improvement.
Create a Right-Sized Disaster Recovery Plan
Close the gap between your DR capabilities and service continuity requirements.
Develop a Business Continuity Plan
Streamline the traditional approach to make BCP development manageable and repeatable.
Implement Crisis Management Best Practices
Don’t be another example of what not to do. Implement an effective crisis response plan to minimize the impact on business continuity, reputation, and profitability.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Begin the data warehouse foundation by defining the project and governance teams, as well as reviewing supporting data management practices.
Using the business activities as a guide, develop a data model, data architecture, and technology plan for a data warehouse foundation.
Start developing a data warehouse program by defining how users will interact with the new data warehouse environment.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify the members of the foundation project team.
Define overarching statements and define success factors/risks.
Outline basic project governance.
Defined membership, roles, and responsibilities involved in the foundation project.
Establishment of a steering committee as a starting point for the data warehouse program.
1.1 Identify foundation project team and create a RACI chart.
1.2 Understand what a data warehouse can and cannot enable.
1.3 Define critical success factors, key performance metrics, and project risks.
1.4 Develop rough timelines for foundation project completion.
1.5 Define the current and future states for key data management practices.
Job Descriptions and RACI
Data Warehouse Steering Committee Charter
Data Warehouse Foundation Project Plan
Work Breakdown Structure
Define the information needs of the business and its key processes.
Create the components that will inform an appropriate data model.
Design a data warehouse architecture model.
Clear definition of business needs that will directly inform the data and architecture models.
2.1 Understand the most fundamental needs of the business.
2.2 Define the data warehouse vision, mission, purpose, and goals.
2.3 Detail the most important operational, tactical, and ad hoc activities the data warehouse should support.
2.4 Link the processes that will be central to the data warehouse foundation.
2.5 Walk through the four-column model and business entity modeling as a starting point for data modeling.
2.6 Create data models using the business data glossary and data classification.
2.7 Identify master data elements to define dimensions.
2.8 Design lookup tables based on reference data.
2.9 Create a fit-for-purpose data warehousing model.
Data Warehouse Program Charter
Data Warehouse Vision and Mission
Documentation of Business Processes
Business Entity Map
Business Data Glossary
Data Classification Scheme
Data Warehouse Architecture Model
Create a plan for governing your data warehouse efficiently and effectively.
Documentation of current standard operating procedures.
Identified members of a data warehouse center of excellence.
3.1 Develop a technology capability map to visualize your desired state.
3.2 Establish a data warehouse center of excellence.
3.3 Create a data warehouse foundation roadmap.
3.4 Define data warehouse service level agreements.
3.5 Create standard operating procedures.
Technology Capability Map
Project Roadmap
Service Level Agreement
Data Warehouse Standard Operating Procedure Workbook
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Create a clear project vision that outlines the goals and objectives for the HRIS strategy. Subsequently, construct an HRIS business model that is informed by enablers, barriers, and the organizational, IT, and HR needs.
Gather high-level requirements to determine the ideal future state. Explore solution alternatives and choose the path that is best aligned with the organization's needs.
Identify roadmap initiatives. Prioritize initiatives based on importance and effort.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the importance of creating an HRIS strategy before proceeding with software selection and implementation.
Learn why a large percentage of HRIS projects fail and how to avoid common mistakes.
Set expectations for the HRIS strategy and understand Info-Tech’s HRIS methodology.
Complete a project charter to gain buy-in, build a project team, and track project success.
A go/no-go decision on the project appropriateness.
Project stakeholders identified.
Project team created with defined roles and responsibilities.
Finalized project charter to gain buy-in.
1.1 Set a direction for the project by clarifying the focus.
1.2 Identify the right stakeholders for your project team.
1.3 Identify HRIS needs, barriers, and enablers.
1.4 Map the current state of your HRIS.
1.5 Align your business goals with your HR goals and objectives.
Project vision
Defined project roles and responsibilities
Completed HRIS business model
Completed current state map and thorough understanding of the HR technology landscape
Strategy alignment between HR and the business
Gain a thorough understanding of the HRIS-related pains felt throughout the organization.
Use stakeholder-identified pains to directly inform the HRIS strategy and long-term solution.
Visualize your ideal processes and realize the art of the possible.
Requirements to strengthen the business case and inform the strategy.
The art of the possible.
2.1 Requirements gathering.
2.2 Sketch ideal future state processes.
2.3 Establish process owners.
2.4 Determine guiding principles.
2.5 Identify metrics.
Pain points classified by data, people, process, and technology
Ideal future process vision
Assigned process owners, guiding principles, and metrics for each HR process in scope
Brainstorm and prioritize short- and long-term HRIS tasks.
Understand next steps for the HRIS project.
3.1 Create a high-level implementation plan that shows dependencies.
3.2 Identify risks and mitigation efforts.
3.3 Finalize stakeholder presentation.
Completed implementation plan
Completed risk management plan
HRIS stakeholder presentation
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Begin your journey by understanding whether Salesforce is the right CRM. Also proactively approach Salesforce licensing by understanding which information to gather and assessing the current state and gaps.
Review current products and licensing models to determine which licensing models will most appropriately fit the organization's environment.
Review Salesforce’s contract types and assess which best fits the organization’s licensing needs.
Conduct negotiations, purchase licensing, finalize a licensing management strategy, and enhance your CRM with a Salesforce partner.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Assess current state and align goals; review business feedback.
Interview key stakeholders to define business objectives and drivers.
Have a baseline for whether Salesforce is the right solution.
Understand Salesforce as a solution.
Examine all CRM options.
1.1 Perform requirements gathering to review Salesforce as a potential solution.
1.2 Gather your documentation before buying or renewing.
1.3 Confirm or create your Salesforce licensing team.
1.4 Meet with stakeholders to discuss the licensing options and budget allocation.
Copy of your Salesforce Master Subscription Agreement
RASCI Chart
Salesforce Licensing Purchase Reference Guide
Review product editions and licensing options.
Review add-ons and licensing rules.
Understand how licensing works.
Discuss licensing rules and their application to your current environment.
Determine the product and license mix that is best for your requirements.
2.1 Determine the editions, licenses, and add-ons for your Salesforce CRM solution.
2.2 Calculate total cost of ownership.
2.3 Use the Salesforce Discount Calculator to ensure you are getting the discount you deserve.
2.4 Meet with stakeholders to discuss the licensing options and budget allocation.
Salesforce CRM Solution
Salesforce TCO Calculator
Salesforce Discount Calculator
Salesforce Licensing Purchase Reference Guide
Review terms and conditions of Salesforce contracts.
Review vendors.
Determine if MSA or term agreement is best.
Learn what specific terms to negotiate.
3.1 Perform a T&Cs review and identify key “deal breakers.”
3.2 Decide on an agreement that nets the maximum benefit.
Salesforce T&Cs Evaluation Tool
Salesforce Licensing Purchase Reference Guide
Finalize the contract.
Discuss negotiation points.
Discuss license management and future roadmap.
Discuss Salesforce partner and implementation strategy.
Discuss negotiation strategies.
Learn about licensing management best practices.
Review Salesforce partner options.
Create an implementation plan.
4.1 Know the what, when, and who to negotiate.
4.2 Control the flow of communication.
4.3 Assign the right people to manage the environment.
4.4 Discuss Salesforce partner options.
4.5 Discuss implementation strategy.
4.6 Meet with stakeholders to discuss licensing options and budget allocation.
Salesforce Negotiation Strategy
Vendor Communication Management Plan
RASCI Chart
Info-Tech’s Core CRM Project Plan
Salesforce Licensing Purchase Reference Guide
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Determine the stakeholders for an IT department of a singular initiative.
Use the guidance of this section to analyze stakeholders on both a professional and personal level.
Use Info-Tech’s guiding principles of stakeholder management to direct how to best engage key stakeholders.
Use real-life experiences from Info-Tech’s analysts to understand how to use and apply stakeholder management techniques.
Exploring the enterprise collaboration marketspace is difficult. The difficulty in finding a suitable collaboration tool is that there are many ways to collaborate, with just as many tools to match.
Map your organizational goals to the administration features available in the Office 365 console. Your governance should reflect your requirements.
The result is a defined plan for controlling Office 365 by leveraging hard controls to align Microsoft’s toolset with your needs and creating acceptable use policies and communication plans to highlight the impact of the transition to Office 365 on the end-user population.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Develop a list of organizational goals that will enable you to leverage the Office 365 toolset to its fullest extent while also implementing sensible governance.
Use Info-Tech's toolset to build out controls for OneDrive, SharePoint, and Teams that align with your organizational goals as they relate to governance.
Communicate the results of your Office 365 governance program using Info-Tech's toolset.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Develop a plan to assess the capabilities of the Office 365 solution and select licensing for the product.
Office 365 capability assessment (right-size licensing)
Acceptable Use Policies
Mapped Office 365 controls
1.1 Review organizational goals.
1.2 Evaluate Office 365 capabilities.
1.3 Conduct the Office 365 capability assessment.
1.4 Define user groups.
1.5 Finalize licensing.
List of organizational goals
Targeted licensing decision
Leverage the Office 365 governance framework to develop and refined governance priorities.
Build a SharePoint acceptable use policy and define SharePoint controls.
Refined governance priorities
List of SharePoint controls
SharePoint acceptable use policy
2.1 Explore the Office 365 Framework.
2.2 Conduct governance priorities refinement exercise.
2.3 Populate the Office 365 control map (SharePoint).
2.4 Build acceptable use policy (SharePoint).
Refined governance priorities
SharePoint control map
Sharepoint acceptable use policy
Implement governance priorities for OneDrive and Teams.
Clearly defined acceptable use policies for OneDrive and Teams
List of OneDrive and Teams controls
3.1 Populate the Office 365 Control Map (OneDrive).
3.2 Build acceptable use policy (OneDrive).
3.3 Populate the Office 365 Control Map (Teams).
3.4 Build acceptable use policy (Teams).
OneDrive controls
OneDrive acceptable use policy
Teams controls
Teams acceptable use policy
Build a plan to communicate coming changes to the productivity environment.
Communication plan covering SharePoint, Teams, and OneDrive
4.1 Build SharePoint one pager.
4.2 Build OneDrive one pager.
4.3 Build Teams one pager.
4.4 Finalize communication plan.
SharePoint one pager
OneDrive one pager
Teams one pager
Overall finalized communication plan
Finalize deliverables and plan post-workshop communications.
Completed Office 365 governance plan
Finalized deliverables
5.1 Completed in-progress deliverables from previous four days.
5.2 Set up review time for workshop deliverables and to discuss next steps.
5.3 Validate governance with stakeholders.
Completed acceptable use policies
Completed control map
Completed communication plan
Completed licensing decision
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Not all security programs need to be the same. A service-aligned security resourcing strategy will put organizations in the best position to respond to current and future service demands and address business needs as they evolve over time.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This storyboard will help you to determine your security resourcing needs using a service-based approach.
Use this tool to build your security service portfolio and to determine resourcing needs to meet your service demand.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify the roles needed to implement and deliver your organization’s security services.
A security services portfolio allows you to assign job roles to each service, which is the first step towards determining resourcing needs. Improve employee engagement and satisfaction with clearly defined job roles, responsibilities, and service levels.
1.1 Assess security needs and business pressures.
1.2 Define security job roles.
1.3 Define security services and assign ownership.
Security Roles Definition
Security Services Portfolio
Estimate the actual demand for security resources and determine how to allocate resources accordingly.
Allocate resources more effectively across your Security and Risk teams.
Raise the profile of your security team by aligning security service offerings with the demands of the business.
2.1 Estimate current and future demand.
2.2 Review demand summary.
2.3 Allocate resources where they are needed the most.
Demand Estimates
Resourcing Plan
When defining roles, consider the competencies needed to deliver your security services. Make sure to account for this need in your resource planning.
Leverage the NCWF to establish the building blocks of a capable and ready cybersecurity workforce to effectively identify, recruit, develop and maintain cybersecurity talent.
3.1 Identify skills needed for planned initiatives.
3.2 Prioritize your skill requirements.
3.3 Assign work roles to the needs of your target environment.
3.4 Discuss the NICE cybersecurity workforce framework.
3.5 Develop technical skill requirements for current and future work roles.
Prioritized Skill Requirements and Associated Roles
Create a development plan to train and upskill your employees to address current and future service requirements.
Skill needs are based on the strategic requirements of a business-aligned security program.
4.1 Continue developing technical skill requirements for current and future work roles.
4.2 Conduct current workforce skills assessment.
4.3 Develop a plan to acquire skills.
4.4 Discuss training and certification opportunities for staff.
4.5 Discuss next steps for closing the skills gap.
4.6 Debrief.
Role-Based Skills Gaps
Workforce Development Plan
![]()
|
Organizations have a critical need for skilled cybersecurity resources as the cyberthreat landscape becomes more complex. This has put a strain on many security teams who must continue to meet demand for an increasing number of security services. To deliver services well, we first need to determine what are the organization’s key security requirements. While benchmarks can be useful for quick peer-to-peer comparisons to determine if we are within the average range, they tend to make all security programs seem the same. This can lead to misguided investments in security services and personnel that might be better used elsewhere. Security teams will be most successful when organizations take a personalized approach to security, considering what must be done to lower risk and operate more efficiently and effectively. |
|
|
Logan Rohde Senior Research Analyst, Security Info-Tech Research Group |
Isabelle Hertanto Principal Research Director, Security Info-Tech Research Group |
|
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
|
|
Not all security programs need to be the same. A service-aligned security resourcing strategy will put organizations in the best position to respond to current and future service demands and address business needs as they evolve over time.
Every organization is unique and will need different security research allocations aligned with their business needs.
“The number of priorities that CISOs have continues to grow, but if everything is a priority, nothing is. It’s important to focus on the ones that deliver the most value to your organization and that are synchronized with the overall business strategy.”
Paige H. Adams
Global CISO at Zurich
Insurance
59% of organizations report taking 3-6+ months to fill a vacant cybersecurity position.
30% report IT knowledge as the most prevalent skills gap in today’s cybersecurity professionals.
|
1. Determine Security Service Portfolio Offerings |
2. Plan for Mandatory Versus Discretionary Demand |
3. Define Your Resourcing Model |
|
|---|---|---|---|
|
Phase Steps |
1 Gather Requirements and Define Roles 1.2 Choose Security Service Offerings |
2.1 Assess Demand |
3.1 Review Demand Summary 3.2 Develop an Action Plan |
|
Phase Outcomes |
Security requirements Security service portfolio |
Service demand estimates Service hour estimates |
Three-year resourcing plan |
|
Security programs should be designed to address unique business needs. A service-aligned security resourcing strategy will put organizations in the best position to respond to current and future service demands and address business needs as they evolve over time. |
||
|
Watch out for role creep. It may be tempting to assign tasks to the people who already know how to do them, but we should consider which role is most appropriate for each task. If all services are assigned to one or two people, we’ll quickly use up all their time. |
Time estimates will improve with practice. It may be difficult to estimate exactly how long it takes to carry out each service at first. But making the effort to time your activities each quarter will help you to improve the accuracy of your estimates incrementally. |
Start recruiting well in advance of need. Security talent can be difficult to come by, so make sure to begin your search for a new hire three to six months before your demand estimates indicate the need will arise. |
|
People and skills are both important. As the services in your portfolio mature and become more complex, remember to consider the skills you will need to be able to provide that service. Make sure to account for this need in your resource planning and keep in mind that we can only expect so much from one role. Therefore, hiring may be necessary to keep up with the diverse skills your services may require. |
Make sure your portfolio reflects reality. There’s nothing wrong with planning for future state, but we should avoid using the portfolio as a list of goals. |
|
Use this tool to build your security services portfolio, estimate demand and hours needed, and determine FTE requirements.
Security Resources Planning Workbook
The Security Resources Planning Workbook will be used to:
|
IT Benefits |
Business Benefits |
|
|
|
Metric |
Expected Improvement |
|
Level of business satisfaction with IT security |
You can expect to see a 20% improvement in your IT Security Business Satisfaction Diagnostic. |
|
Reports on key performance indicators and service level objectives |
Expect to see a 40% improvement in security service-related key performance indicators and service level objectives. |
|
Employee engagement scores |
You can expect to see approximately a 10% improvement in employee engagement scores. |
|
Changes in rates of voluntary turnover |
Anticipating demand and planning resources accordingly will help lower employee turnover rates due to burnout or stress leave by as much as 10%. |
47% of cybersecurity professionals said that stress and burnout has become a major issue due to overwork, with most working over 41 hours a week, and some working up to 90.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” | “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” | “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” | “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.” |
| Phase 1 | Phase 2 | Phase 3 |
|
Call #1: Scope requirements, objectives, and your specific drivers. |
Call #2: Discuss roles and duties. Call #3: Build service portfolio and assign ownership. |
Call #4: Estimate required service hours. Call #5: Review service demand and plan for future state. |
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is 4 to 6 calls over the course of 2 to 3 months.
Contact your account representative for more information.
workshops@infotech.com1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
|
Define Roles and Select Services |
Estimate Current and Future Demand |
Identify Required Skills |
Future Planning |
Next Steps and |
|
|
Activities |
1.1 Assess Security Needs and Business Pressures. 1.2 Define Security Job Roles. 1.3 Define Security Services and Assign Ownership. |
2.1 Estimate Current and Future Demand. 2.2 Review Demand Summary. 2.3 Allocate Resources Where They Are Needed the Most. |
3.1 Identify Skills Needed Skills for Planned Initiatives. 3.2 Prioritize Your Skill Requirements. 3.3 Assign Work Roles to the Needs of Your Target Environment. 3.4 Discuss the NICE Cybersecurity Workforce Framework. 3.5 Develop Technical Skill Requirements for Current and Future Work Roles. |
4.1 Continue Developing Technical Skill Requirements for Current and Future Work Roles. 4.2 Conduct Current Workforce Skills Assessment. 4.3 Develop a Plan to Acquire Skills. 4.4 Discuss Training and Certification Opportunities for Staff. 4.5 Discuss Next Steps for Closing the Skills Gap. 4.6 Debrief. |
5.1 Complete In-Progress Deliverables From Previous Four Days. 5.2 Set Up Review Time for Workshop Deliverables and to Discuss Next steps. |
| Deliverables |
|
|
|
|
Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
1.1 Gather Requirements and Define Roles 1.2 Choose Security Service Offerings | 2.1 Assess Demand | 3.1 Determine Resourcing Status |
This phase involves the following participants:
Activities
1.1.1 Assess Business Needs and Pressures
1.1.2 Define Security Roles
This step involves the following participants:
Outcomes of this step
1 hour
| Input | Output |
|
|
| Materials | Participants |
|
|
The security services you will provide to the organization should be based on its unique business requirements and pressures, which will make certain services more applicable than others. Use this exercise to get an idea of what those business drivers might be.
1-2 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Security Resources Planning Workbook
Watch out for role creep. It may be tempting to assign tasks to the people who already know how to do them, but we should consider which role is most appropriate for each task. If all services are assigned to one or two people, we’ll quickly use up all their time.
Cybersecurity is a rapidly evolving discipline and security teams from all over are reporting challenges related to training and upskilling needed to keep pace with the developments of the threat landscape.
95% Security leaders who agree the cybersecurity skills gap has not improved over the last few years.*
44% Security leaders who say the skills gap situation has only gotten worse.*
When defining roles, consider the competencies needed to deliver your security services. Use Info-Tech’s blueprint Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan to help you determine the required skillsets for each role.
As the services in your portfolio mature and become more complex, remember to consider the skills you need and will need to be able to provide that service. Make sure to account for this need in your resource planning and keep in mind that we can only expect so much from one role. Therefore, hiring may be necessary to keep up with the diverse skills your services may require.
Download blueprint Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan
Activities
1.2.1 Define Security Services and Role Assignments
This step involves the following participants:
2-4 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Security Resources Planning Workbook
Use Info-Tech's best-of-breed Security Framework to develop a comprehensive baseline set of security service areas.
Security Strategy and Governance Model
Compliance Obligations
CISO Accountabilities
Consider each of the requirement categories developed in Step 1.1.1 against the taxonomy and service domain here. If there is a clear need to add this service, use the drop-down list in the “Include in Catalog” column to indicate “Yes.” Mark un-needed services as “No.”
Make sure your portfolio reflects current state and approved plans. There’s nothing wrong with planning for the future, but we should avoid using the portfolio as a list of goals.
|
Phase 1 |
Phase 2 |
Phase 3 |
|---|---|---|
|
1.1 Gather Requirements and Define Roles 1.2 Choose Security Service Offerings |
2.1 Assess Demand |
3.1 Determine Resourcing Status |
This phase involves the following participants:
Activities
2.1.1 Estimate Current and Future Demand
This step involves the following participants:
Outcomes of this step
2-4 hours
Note: For continuous services (i.e. 24/7 security log monitoring), use the length of the work shift for estimating the Hours to Complete and the corresponding number of shifts per year for Mandatory Demand estimates. Example: For an 8-hour shift, there are 3 shifts per day at 365 days/year, resulting in 1,095 total shifts per year.
Download the Security Resources Planning Workbook
| Input | Output |
|
|
| Materials | Participants |
|
|
Time estimates will improve over time. It may be difficult to estimate exactly how long it takes to carry out each service at first. But making the effort to time your activities each quarter will help you to improve the accuracy of your estimates incrementally.
Every service may have a mix of mandatory and discretionary demands. Understanding and differentiating between these types of demand is critical to developing an efficient resourcing plan.
|
Mandatory Demand Mandatory demand refers to the amount of work that your team must perform to meet compliance obligations and critical business and risk mitigation requirements. Failure to meet mandatory demand levels will have serious consequences, such as regulatory fines or the introduction of risks that far exceed risk tolerances. This is work you cannot refuse. |
|
Discretionary Demand Discretionary demand refers to the amount of work the security team is asked to perform that goes above and beyond your mandatory demand. Discretionary demand often comes in the form of ad hoc requests from business units or the IT department. Failure to meet discretionary demand levels usually has limited consequences, allowing you more flexibility to decide how much of this type of work you can accept. |
|
Service Name |
Mandatory Demand Example |
Discretionary Demand Example |
|---|---|---|
|
Penetration Testing |
PCI compliance requires penetration testing against all systems within the cardholder data environment annually (currently 2 systems per year). |
Business units request ad hoc penetration testing against non-payment systems (expected 2-3 systems per year). |
|
Vendor Risk Assessments |
GDPR compliance requires vendor security assessments against all third parties that process personal information on our behalf (expected 1-2 per quarter). |
IT department has requested that the security team conduct vendor security assessments for all cloud services, regardless of whether they store personal information (expected 2-3 assessments per quarter). |
|
e-Discovery and Evidence Handling |
There is no mandatory demand for this service. |
The legal department occasionally asks the security team to assist with e-Discovery requests (expected demand 1-2 investigations per quarter). |
Phase 1 | Phase 2 | Phase 3 |
|---|---|---|
1.1 Gather Requirements and Define Roles 1.2 Choose Security Service Offerings | 2.1 Assess Demand | 3.1 Determine Resourcing Status |
This phase involves the following participants:
Activities
3.1.1 Review Demand Summary
3.1.2 Fill Resource Gaps
This step involves the following participants:
Outcomes of this step
1-2 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Download the Security Resources Planning Workbook
Info-Tech Insight
Start recruiting well in advance of need. Security talent can be difficult to come by, so make sure to begin your search for a new hire three to six months before your demand estimates indicate the need will arise.
2-4 hours
Outsourcing provides access to tools and talent that would otherwise be prohibitively expensive. Typical reasons for outsourcing security operations include:
Given the above, three different models have emerged for the operational security organization:
|
1. Outsourced SecOps A fully outsourced Security Operations Center, managed and governed by a smaller in-house team |
2. Balanced Hybrid In-house operational security staff with some reliance on managed services |
3. In-House SecOps A predominantly in-house security team, augmented by a small managed services contract |
Once you have determined that further outsourcing is needed, go back and adjust the status in your service portfolio. Use Info-Tech's blueprint Develop Your Security Outsourcing Strategy to determine the right approach for your business needs.
“The workforce of the future needs to be agile and adaptable, enabled by strong partnerships with third-party providers of managed security services. I believe these hybrid models really are the security workforce of the future.”
– Senior Manager, Cybersecurity at EY
Download blueprint Develop Your Security Outsourcing Strategy
Choose the right model for your organization’s size, risk tolerance, and process maturity level. For example, it might make more sense for larger enterprises with low risk tolerance to grow their internal teams and build in-house capability.
Resourcing challenges are often addressed more directly by increased spending. However, for a lot of organizations, this just isn’t possible. While there is no magic solution to resolve resource constraints and small budgets, the following tactics should be considered as a means to reduce the hours required for the services your team provides.
|
Upskill Your Staff If full-scale training is not an option, see if there are individual skills that could be improved to help improve time to completion for your services. Use Info-Tech's blueprint Close the InfoSec Skills Gap to determine which skills are needed for your security team. |
Improve Process Familiarity In some organizations, especially low-maturity ones, problems can arise simply because there is a lack of familiarity with what needs to be done. Review the process, socialize it, and make sure your staff can execute in within the target time allotment. |
Add Technology Resourcing crunch or not, technology can help us do things better. Investigate whether automation software might help to shave a few hours off a given service. Use Info-Tech's blueprint Build a Winning Business Process Automation Playbook to optimize and automate your business processes with a user-centric approach. |
|
Download the blueprint Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan |
Download the blueprint Build a Winning Business Process Automation Playbook |
Every minute counts. While using these strategies may not solve every resourcing crunch you have, they can help put you in the best position possible to deliver on your commitments for each service.
Cybersecurity skills are in high demand; practitioners are few. The reality is that experienced security personnel have a lot of opportunities. While we cannot control for the personal reasons employees leave jobs, we can address the professional reasons that cause them to leave.
|
Fair wage |
Reasonable expectations |
Provide training |
Defined career path |
|---|---|---|---|
|
It’s a sellers’ market for cybersecurity skills these days. Higher-paying offers are one of the major reasons security leaders leave their jobs (ISSA, 2021). |
Many teams lose out on good talent simply because they have unrealistic expectations, seeking 5+ years experience for an entry-level position, due to misalignment with HR (TECHNATION, 2021). |
Technology is changing (and being adopted) faster than security professionals can train on it. Ongoing training is needed to close these gaps (ISO, 2021). |
People want to see where they are now, visualize where they will be in the future, and understand what takes to get there. This helps to determine what types of training and specialization are necessary (DigitalGuardian, 2020). |
Use Info-Tech’s blueprint Build a Strategic IT Workforce Plan to help staff your security organization for success.
Download blueprint Build a Strategic IT Workforce Plan
You have now successfully identified your business and security drivers, determined what services your security program will provide, and determined your resourcing plan to meet these demands over the next three years.
As needs change at your organization, don’t forget to re-evaluate the decisions you’ve made. Don’t forget that outsourcing a service may be the most reliable way to provide and resource it. However, this is just one tool among many that should be considered, along with upskilling, process improvement/familiarity, and process automation.
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.
Contact your account representative for more information.
workshops@infotech.com
1-888-670-8889
|
George Al-Koura CISO Ruby Life |
|
Brian Barniner Head of Decision Science and Analytics ValueBridge Advisors |
|
Tracy Dallaire CISO / Director of Information Security McMaster University |
|
Ricardo Johnson Chief Information Security Officer Citrix |
|
Ryan Rodriguez Senior Manager, Cyber Threat Management EY |
|
Paul Townley VP Information Security and Personal Technology Owens Corning |
13 Anonymous Contributors
Cost-Optimize Your Security Budget
Develop Your Security Outsourcing Strategy
Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan
2021 Voice of the CISO Report.” Proofpoint, 2021. Web.
“2022 Voice of the CISO.” Proofpoint, 2022. Web.
Brook, Chris. “How to Find and Retain Skilled Cybersecurity Talent.” DigitalGuardian, 17 Sep. 2020. Web.
“Canadian Cybersecurity Skills Framework” TECHNATION Canada, April 2020. Web.
“Cybersecurity Skills Crisis Continues for Fifth Year, Perpetuated by Lack of Business Investment.” ISSA, 28 July 2021. Web.
“Cybersecurity Workforce, National Occupational Standard.” TECHNATION Canada, April 2020. Web.
Naden, Clare. “The Cybersecurity Skills Gap: Why Education Is Our Best Weapon against Cybercrime.” ISO, 15 April 2021. Web.
Purse, Randy. “Four Challenges in Finding Cybersecurity Talent And What Companies Can Do About It.” TECHNATION Canada, 29 March 2021. Web.
Social-Engineer. “Burnout in the Cybersecurity Community.” Security Boulevard, 8 Dec. 2021. Web.
“State of Cybersecurity 2020.” ISACA, 2020. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify what skills will be needed in your future state.
Align role requirements with future initiative skill needs.
Acquire skills based on the impact of the five key factors.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine the skills needed in your workforce and align them to your organization’s security roadmap.
Insight on what skills your organization will need in the future.
1.1 Understand the importance of aligning security initiatives skill needs with workforce requirements.
1.2 Identify needed skills for future initiatives.
1.3 Prioritize the initiative skill gaps.
Security Initiative Skills Guide
Skills Gap Prioritization Tool
Identify and create technical skill requirements for key work roles that are needed to successfully execute future initiatives.
Increased understanding of the NICE Cybersecurity Workforce Framework.
Standardization of technical skill requirements of current and future work roles.
2.1 Assign work roles to the needs of your future environment.
2.2 Discuss the NICE Cybersecurity Workforce Framework.
2.3 Develop technical skill requirements for current and future work roles.
Skills Gap Prioritization Tool
Technical Skills Workbook
Current Workforce Skills Assessment
Assess your current workforce against their role’s skill requirements.
Discuss five key factors that aid acquiring skills.
A method to acquire skills in future roles.
3.1 Continue developing technical skill requirements for current and future work roles.
3.2 Conduct Current Workforce Skills Assessment.
3.3 Discuss methods of acquiring skills.
3.4 Develop a plan to acquire skills.
Technical Skills Workbook
Current Workforce Skills Assessment
Current Workforce Skills Assessment
Technical Skills Workbook
Current Workforce Skills Assessment
Technical Skills Workbook
Current Workforce Skills Assessment
Assist with communicating the state of the skill gap in your organization.
Strategy on how to acquire skills needs of the organization.
4.1 Review skills acquisition plan.
4.2 Discuss training and certification opportunities for staff.
4.3 Discuss next steps for closing the skills gap.
4.4 Debrief.
Technical Skills Workbook
IT and OT are both very different complex systems. However, significant benefits have driven OT to be converged to IT. This results in IT security leaders, OT leaders and their teams' facing challenges in:
Info-Tech’s approach in preparing for IT/OT convergence in the planning phase is coordination and collaboration of IT and OT to
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Info-Tech provides a three-phase framework of secure IT/OT convergence, namely Plan, Enhance, and Monitor & Optimize. The essential steps in Plan are to:
This tool serves as a repository for information about the organization, compliance, and other factors that will influence your IT/OT convergence.
A critical step in secure IT/OT convergence is populating a RACI (Responsible, Accountable, Consulted, and Informed) chart. The chart assists you in organizing roles for carrying out convergence steps and ensures that there are definite roles that different individuals in the organization must have. Complete this tool to assign tasks to suitable roles.
IT/OT convergence is less of a convergence and more of a migration. The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.
In the past, OT systems were engineered to be air gapped, relying on physical protection and with little or no security in design, (e.g. OT protocols without confidentiality properties). However, now, OT has become dependent on the IT capabilities of the organization, thus OT inherits IT’s security issues, that is, OT is becoming more vulnerable to attack from outside the system. IT/OT convergence is complex because the culture, policies, and rules of IT are quite foreign to OT processes such as change management, and the culture, policies, and rules of OT are likewise foreign to IT processes.
A secure IT/OT convergence can be conceived of as a negotiation of a strong treaty between two systems: IT and OT. The essential initial step is to begin with communication between IT and OT, followed by necessary components such as governing and managing OT security priorities and accountabilities, converging security controls between IT and OT environments, assuring compliance with regulations and standards, and establishing metrics for OT security.
|
Ida Siahaan
Research Director, Security and Privacy Practice Info-Tech Research Group |
| Your Challenge
IT and OT are both very different complex systems. However, significant benefits have driven OT to converge with IT. This results in IT security leaders, OT leaders, and their teams facing challenges with:
|
Common Obstacles
|
Info-Tech’s Approach
Info-Tech’s approach in preparing for IT/OT convergence (i.e. the Plan phase) is coordination and collaboration of IT and OT to:
|
Returning to isolated OT is not beneficial for the organization, so IT and OT need to learn to collaborate, starting with communication to build trust and to overcome their differences. Next, negotiation is needed on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.
| OT systems were built with no or little security design
90% of organizations that use OT experienced a security incident. (Fortinet, 2021. Ponemon, 2019.) |
![]() (Source: Fortinet, 2021.) |
Lack of visibility
86% of OT security-related service engagements lack complete visibility of OT network in 2021 (90% in 2020, 81% in 2019). (Source: “Cybersecurity Year In Review” Dragos, 2022.) |
| 2000 Target: Australian sewage plant. Method: Insider attack. Impact: 265,000 gallons of untreated sewage released. |
2012 Target: Middle East energy companies. Method: Shamoon. Impact: Overwritten Windows-based systems files. |
2014 Target: German Steel Mill. Method: Spear-phishing. Impact: Blast furnace failed to shut down. |
2017 Target: Middle East safety instrumented system (SIS). Method: TRISIS/TRITON. Impact: Modified SIS ladder logic. |
2022 Target: Viasat’s KA-SAT network. Method: AcidRain. Impact: Significant loss of communication for the Ukrainian military, which relied on Viasat’s services. |
|
||||
| 1903 Target: Marconi wireless telegraph presentation. Method: Morse code. Impact: Fake message sent “Rats, rats, rats, rats. There was a young fellow of Italy, Who diddled the public quite prettily.” |
2010 Target: Iranian uranium enrichment plant. Method: Stuxnet. Impact: Compromised programmable logic controllers (PLCs). |
2013 Target: ICS supply chain. Method: Havex. Impact: Remote Access Trojan (RAT) collected information and uploaded data to command-and-control (C&C) servers |
2016 Target: Ukrainian power grid. Method: BlackEnergy. Impact: For 1-6 hours, power outages for 230,000 consumers. |
2021 Target: Colonial Pipeline. Method: DarkSide ransomware. Impact: Compromised billing infrastructure halted the pipeline operation. |
(Source: US Department of Energy, 2018.
”Significant Cyber Incidents,” CSIS, 2022
MIT Technology Review, 2022.)
Most OT incidents start with attacks against IT networks and then move laterally into the OT environment. Therefore, converging IT and OT security will help protect the entire organization.
Case StudyHorizon Power |
|
INDUSTRY
|
SOURCE
|
|
Horizon Power is the regional power provider in Western Australia and stands out as a leader not only in the innovative delivery of sustainable power, but also in digital transformation. Horizon Power is quite mature in distributed energy resource management; moving away from centralized generation to decentralized, community-led generation, which reflects in its maturity in converging IT and OT. Horizon Power’s IT/OT convergence journey started over six years ago when advanced metering infrastructure (AMI) was installed across its entire service area – an area covering more than one quarter of the Australian continent. In these early days of the journey, the focus was on leveraging matured IT approaches such as adoption of cloud services to the OT environment, rather than converging the two. Many years later, Horizon Power has enabled OT data to be more accessible to derive business benefits such as customer usage data using data analytics with the objective of improving the collection and management of the OT data to improve business performance and decision making. The IT/OT convergence meets legislation such as the Australian Energy Sector Cyber Security Framework (AESCSF), which has impacts on the architectural layer of cybersecurity that support delivery of the site services. |
Results
The lessons learned in converging IT and OT from Horizon Power were:
|
Convergence Elements
|
Target Groups
|
Security Components
|
Plan |
|
Governance Compliance |
Enhance |
|
Security strategy Risk management Security policies and procedures IR, DR, and BCP |
Monitor &
|
|
Awareness and cross-training Architecture and controls |
|
Plan Outcomes
|
Plan Benefits
|
||||
To initiate communication between the IT and OT teams, it is important to understand how the two groups are different and to build trust to find a holistic approach which overcomes those differences.
| Info-Tech InsightOT interfaces with the physical world while IT system concerns more on cyber world. Thus, the two systems have different properties. The challenge is how to create strategic collaboration between IT and OT based on negotiation, and this needs top-down support. Identifying organization goals is the first step in aligning your secure IT/OT convergence with your organization’s vision.
|
Input: Corporate, IT, and OT strategies
Output: Your goals for the security strategy
Materials: Secure IT/OT Convergence Requirements Gathering Tool
Participants: Executive leadership, OT leader, IT leader, Security leader, Compliance, Legal, Risk management
Download the Secure IT/OT Convergence Requirements Gathering Tool
Refer to the Secure IT/OT Convergence Framework when filling in the following elements.
It is important to know at the outset of the strategy: What are we trying to secure in IT/OT convergence ?
This includes physical areas we are responsible for, types of data we care about, and departments or IT/OT systems we are responsible for.
Physical Scope and Boundaries
|
IT Systems Scope and Boundaries
|
Organizational Scope and Boundaries
|
OT Systems Scope and Boundaries
|
|
Refer to the Secure IT/OT Convergence Framework when filling in the following elements:
|
Input: List of relevant stakeholders
Output: Roles and responsibilities for the secure IT/OT convergence program
Materials: Secure IT/OT Convergence RACI Chart Tool
Participants: Executive leadership, OT leader, IT leader, Security leader
There are many factors that impact an organization’s level of effectiveness as it relates to IT/OT convergence. How the two groups interact, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, it is imperative in the planning phase to identify stakeholders who are:
Download the Secure IT/OT Convergence RACI Chart Tool
Define responsible, accountable, consulted, and informed (RACI) stakeholders.
|
Info-Tech Insight
The roles and responsibilities should be clearly defined. For example, IT network should be responsible for the communication and configuration of all access points and devices from the remote client to the control system DMZ, and controls engineering should be responsible from the control system DMZ to the control system. |
To establish governance and build an IT/OT cross-functional team, it is important to understand the operation of OT systems and their interactions with IT within the organization, e.g. ad hoc, centralized, decentralized.
To determine IT/OT convergence maturity level, Info-Tech provides the IT/OT Convergence Self-Evaluation Tool.
To switch the focus from confidentiality and integrity to safety and availability for OT system, it is important to have a common language such as the Purdue model for technical communication.
|
Level 5: Enterprise Network Level 4: Site Business Level 3.5: DMZ Level 3: Site Operations Level 2: Area Supervisory Control Level 1: Basic Control Level 0: Process |
|
Source:
|
|
![]() (Source: Cooksley, 2021) |
|
Refer to the “Goals Cascade” tab of the Secure IT/OT Convergence Requirements Gathering Tool.
|
|
Readiness checklist for secure IT/OT convergence
People
|
Process
|
Technology
|
(Source: “Grid Modernization: Optimize Opportunities And Minimize Risks,” Info-Tech)
To update security strategy, it is important to actively encourage visible sponsorship across management and to provide regular updates.
![]() (Source: NIST SP 800-82 Rev.3, “Guide to Operational Technology (OT) Security,” NIST, 2022.) |
|
The need for asset and threat taxonomy
|
![]() (Source: ENISA, 2018.) |
|
The White House released an Executive Order on Improving the Nation’s Cybersecurity (EO 14028) in 2021 that establishes new requirements on the scope of protection and security policy such that it must include both IT and OT. |
This example of a policy hierarchy features templates from Info-Tech’s Develop and Deploy Security Policies and Identify the Best Framework for Your Security Policies research.
A proactive approach to security is important, so actions such as updating and testing the incident response plan for OT are a must. (“Cybersecurity Year In Review” Dragos, 2022.)
|
“Cybersecurity staff are feeling burnout and stressed to the extent that many are considering leaving their jobs.” (Danny Palmer, ZDNET News, 2022) |
|
“One area regularly observed by Dragos is a weakness in overall cyber readiness and training tailored specific to the OT environment.” (“Assessing Operational Technology,” Dragos, 2022.) |
Specific cybersecurity certification of ICS/SCADA
Other relevant certification schemes
Safety Certifications
|
(Source: ENISA, 2015.)
|
|
(Source: “Purdue Enterprise Reference Architecture (PERA) model,” ISA-99.)
|
|
|
Role of security metrics in a cybersecurity program (EPRI, 2017.)
|
OT interfaces with the physical world. Thus, metrics based on risks related with life, health, and safety are crucial. These metrics motivate personnel by making clear why they should care about security. (EPRI, 2017.)
|
The impact of security on the business can be measured in various metrics such as operational metrics, service level agreements (SLAs), and financial metrics. (BMC, 2022.)
|
Early detection will lead to faster remediation and less damage. Therefore, metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability. (Dark Reading, 2022)
|
The metrics for the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.
|
Build an Information Security StrategyInfo-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations. This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap. |
Preparing for Technology Convergence in ManufacturingInformation technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication. Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration. |
Implement a Security Governance and Management ProgramYour security governance and management program needs to be aligned with business goals to be effective. This approach also helps provide a starting point to develop a realistic governance and management program. This project will guide you through the process of implementing and monitoring a security governance and management program that prioritizes security while keeping costs to a minimum. |
|
Assante, Michael J. and Robert M. Lee. “The Industrial Control System Cyber Kill Chain.” SANS Institute, 2015. “Certification of Cyber Security Skills of ICS/SCADA Professionals.” European Union Agency for Cybersecurity (ENISA), 2015. Web. Cooksley, Mark. “The IEC 62443 Series of Standards: A Product Manufacturer‘s Perspective.” YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022. “Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017. “Cybersecurity and Physical Security Convergence.” Cybersecurity and Infrastructure Security Agency (CISA). Accessed 19 May 2022. “Cybersecurity in Operational Technology: 7 Insights You Need to Know,” Ponemon, 2019. Web. “Developing an Operational Technology and Information Technology Incident Response Plan.” Public Safety Canada, 2020. Accessed 6 Sep. 2022. |
Gilsinn, Jim. “Assessing Operational Technology (OT) Cybersecurity Maturity.” Dragos, 2021. Accessed 02 Sep. 2022. “Good Practices for Security of Internet of Things.” European Union Agency for Cybersecurity (ENISA), 2018. Web. Greenfield, David. “Is the Purdue Model Still Relevant?” AutomationWorld. Accessed 1 Sep. 2022 Hemsley, Kevin E., and Dr. Robert E. Fisher. “History of Industrial Control System Cyber Incidents.” US Department of Energy (DOE), 2018. Accessed 29 Aug. 2022. “ICS Security Related Working Groups, Standards and Initiatives.” European Union Agency for Cybersecurity (ENISA), 2013. Killcrece, Georgia, et al. “Organizational Models for Computer Security Incident Response Teams (CSIRTs).” Software Engineering Institute, CMU, 2003. Liebig, Edward. “Security Culture: An OT Survival Story.” Dark Reading, 30 Aug. 2022. Accessed 29 Aug. 2022. |
|
O'Neill, Patrick. “Russia Hacked an American Satellite Company One Hour Before the Ukraine Invasion.” MIT Technology Review, 10 May 2022. Accessed 26 Aug. 2022. Palmer, Danny. “Your Cybersecurity Staff Are Burned Out – And Many Have Thought About Quitting.” Zdnet, 08 Aug. 2022. Accessed 19 Aug. 2022. Pathak, Parag. “What Is Threat Management? Common Challenges and Best Practices.” SecurityIntelligence, 23 Jan. 2020. Web. Raza, Muhammad. “Introduction To IT Metrics & KPIs.” BMC, 5 May 2022. Accessed 12 Sep. 2022. “Recommended Practice: Developing an Industrial Control Systems Cybersecurity Incident Response Capability.” Department of Homeland Security (DHS), Oct. 2009. Web. Sharma, Ax. “Sigma Rules Explained: When and How to Use Them to Log Events.” CSO Online, 16 Jun. 2018. Accessed 15 Aug. 2022. |
“Significant Cyber Incidents.” Center for Strategic and International Studies (CSIS). Accessed 1 Sep. 2022. Tom, Steven, et al. “Recommended Practice for Patch Management of Control Systems.” Department of Homeland Security (DHS), 2008. Web. “2021 ICS/OT Cybersecurity Year In Review.” Dragos, 2022. Accessed 6 Sep. 2022. “2021 State of Operational Technology and Cybersecurity Report,” Fortinet, 2021. Web. Zetter, Kim. “Pre-Stuxnet, Post-Stuxnet: Everything Has Changed, Nothing Has Changed.” Black Hat USA, 08 Aug. 2022. Accessed 19 Aug. 2022. |
|
Jeff Campbell
Manager, Technology Shared Services Horizon Power, AU Jeff Campbell has more than 20 years' experience in information security, having worked in both private and government organizations in education, finance, and utilities sectors. Having focused on developing and implementing information security programs and controls, Jeff is tasked with enabling Horizon Power to capitalize on IoT opportunities while maintaining the core security basics of confidentiality, integrity and availability. As Horizon Power leads the energy transition and moves to become a digital utility, Jeff ensures the security architecture that supports these services provides safer and more reliable automation infrastructures. |
Christopher Harrington
Chief Technology Officer (CTO) Carolinas Telco Federal Credit Union Frank DePaola
Kwasi Boakye-Boateng
|
IT communications are often considered ineffective and unengaging. This is demonstrated by the:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This blueprint not only provides the tools and techniques for planning, composing, and delivering effective communications, but also walks you through practical exercises. Practice and perfect your communication, composition, and delivery skills for any IT initiative.
Communication concepts and exercises that teach you how to plan, compose, and deliver effective communications. The deck includes practical tools, techniques, and skills practice.
This communications planner is a tool that accompanies the Effective IT Communications blueprint and the Communicate Any IT Initiative Facilitation Deck so that you can plan your communications, view your deliverables, and compose your pitch all in one document.
A tool for identifying stakeholders and conducting an analysis to understand their degree of influence or impact.
| Your Challenge | Common Obstacles | Info-Tech’s Approach |
Communicating about your initiative is when the work really begins. Many organizations struggle with:
|
Some of the challenges IT faces when it comes to communicating its initiatives includes:
|
For every IT initiative you have going forward, focus on following these three steps:
|
Info-Tech Insight
Every IT employee can be a great communicator; it just takes a few consistent steps, the right tools, and a dedication to practicing communicating your message.
The Info-Tech difference:
27.8% of organizations are not satisfied with IT communications.
25.8% of business stakeholders are not satisfied with IT communications.
Source: Info-Tech Diagnostic Programs; n=34,345 business stakeholders within 604 organizations
The bottom line? Stakeholders for any initiative need to be communicated with often and well. When stakeholders become dissatisfied with IT’s communication, it can lead to an overall decrease in satisfaction with IT.
“Nothing gets done properly if it's not communicated well.”
-- Nastaran Bisheban, CTO KFC Canada
Introduction
Review effective communications.
Plan
Plan your communications using a strategic tool.
Compose
Create your own message.
Deliver
Practice delivering your own message.
| 1. Plan Strategic Communications | 2. Compose a Compelling Message | 3. Deliver Messages Effectively | |
|---|---|---|---|
| Step Activities |
|
|
|
| Step Outcomes | Establish an easy-to-read view of the key communications that need to take place related to your initiative or change. | Practice writing a pitch that conveys the message in a compelling and easy-to-understand way. | Practice delivering the pitch. Ensure there is authenticity in the delivery while still maintaining the audience’s attention. |
We recommend considering this blueprint a natural add-on to any completed Info-Tech blueprint, whether it is completed in the DIY fashion or through a Guided Implementation or workshop.
Communication Planner
A single place to plan and compose all communications related to your IT initiative.
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.
Facilitation Guide
A step-by-step guide to help your IT organization develop a communication plan and practice composing and delivering key messages.
Stakeholder Analysis
An ability to assess all stakeholders based on impact, influence, and involvement.
| Morning | Afternoon | |
|---|---|---|
| Activities | Plan Strategic Communications for Your Initiative
| Compose and Deliver a Compelling Message
|
| Deliverables |
|
|
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
| Goal | Key Performance Indicator (KPI) | Related Resource |
| Obtain board buy-in for IT strategic initiatives. | X% of IT initiatives that were approved to be funded. Number of times that technical initiatives were asked to be explained further. |
Using our Board Presentation Review |
| Ensure stakeholders feel engaged during initiatives. | X% of business leadership satisfied with the statement “IT communicates with your group effectively.” | Using the CIO Business Vision Diagnostic |
| End users know what IT initiatives are going to impact the products or services they use. | X% of end users that are satisfied with communications around changing services or applications. | Using the End-User Satisfaction Survey |
| Project stakeholders receive sufficient communication throughout the initiative. | X% overall satisfaction with the quality of the project communications. | Using the PPM Customer Satisfaction Diagnostic |
| Employees are empowered to perform on IT initiatives. | X% satisfaction employees have with statement “I have all the resources and information I need to do a great job.” | Using the Employee Engagement Diagnostic Program |
Activities
1.1 Define the Change
1.2 Determine Target Audience
1.3 Communication Outcomes
1.4 Clarify the Key Message(s)
1.5 Identify the Owner and Messenger(s)
1.6 Select the Right Channels
1.7 Establish a Frequency and Time Frame
1.8 Obtain Feedback and Improve
1.9 Finalize the Calendar
Communicate Any IT Initiative Effectively
Phase1 > Phase 2 > Phase 3
This step involves the following participants:
Varies based on those who would be relevant to your initiative.
Outcomes of this step
Create an easy-to-follow communications plan to ensure that the right message is sent to the right audience using the right medium and frequency.
Incremental Change:
|
Transitional Change:
|
Transformational Change:
|
Examples:
|
Examples:
|
Examples:
|
Invest time at the start of the project to develop a detailed understanding of the impact of the change. This will help to create a plan that will simplify the change and save time in the end. Evaluate the impact from a people, process, and technology perspective.
Leverage a design thinking principle: Empathize with the stakeholder – what will change?
People
Process
Technology
30 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
Audience
Stakeholders (either groups or individuals) who will receive the communication.
Message
Information communicated to impacted stakeholders. Must be rooted in a purpose or intent.
Messenger
Person who delivers the communication to the audience. The communicator and owner are two different things.
Channel
Method or channel used to communicate to the audience.
The target audience always includes groups and individuals who are directly impacted by the change and may also include those who are change adjacent.
Define the target audience: Identify which stakeholders will be the target audience of communications related to the initiative. Stakeholders can be single individuals (CFO) or groups (Applications Team).
Stakeholders to consider:
20 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
1 hour
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Stakeholder Management Analysis Tool
For each target audience, there will be an overall goal on why they need to be communicated with. This outcome or purpose is often dependent on the type of influence the stakeholder wields within the organization as well as the type of impact the change or initiative will have. Depending on the target audience, consider each of the communication outcomes listed below.
| Communicating Across the Organization | Communicating Up to Board or Executives | Communicating Within IT |
|---|---|---|
|
|
|
30 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
| What are key messages? |
|
| How to establish key messages: | Ground key messages in organizational strategy and culture. These should be the first places you look to determine the organization’s key messages:
|
Key messages should be clear, concise, and consistent (Porter, 2014). The intent is to convey important information in a way that is relatable and memorable, to promote reinforcement, and ultimately, to drive action.
Info-Tech Insight
Empathizing with the audience is key to anticipating and addressing objections as well as identifying benefits. Customize messaging based on audience attributes such as work model (e.g. hybrid), anticipated objections, what's in it for me? (WIIFM), and specific expectations.
25 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
Messages must be communicated by a variety of individuals across the organization. Select the messenger depending on the message characteristics (e.g. audience, message, medium). The same messenger can be used for a variety of messages across different mediums.
Personal impact messages should be delivered by an employee's direct supervisor.
Organizational impact messages and rationale should be delivered by senior leaders in the affected areas.
Recent research by Prosci found employees prefer to hear personal messages from their direct manager and organizational messages from the executive leadership team.
Fifty percent of respondents indicated the CEO as the preferred messenger for organizational change messages.
For each audience, message, and medium, review whether the message is personal or organizational to determine which messengers are best.
The number and seniority of messengers involved depends on the size of the change:
Communication Owner
Single person
Accountable for the communication message and activities
Oversees that the communication does not contradict other communications
Validates the key messages to be made
Communication Messenger(s)
Single person or many people
Responsible for delivering the intended message
Engages the target audience in the communication
Ensures the key messages are made in a consistent and clear manner
30 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
| First question: Should the communication be delivered in-person or not? | ||
|---|---|---|
| Types of channels | In-Person | Paper-Based or Tech-Enabled |
| Questions to consider |
|
|
| Two-way interaction | Supplement in-person communications with paper-based or tech-enabled communications to provide follow-up and consistency (Government of Nova Scotia). | Tech-enabled communications allow the sender to deliver messages when they do not co-locate with the receiver. That said, make sure paper-based communications are provided to those without regular access to a computer. |
Consider accessibility when communicating change – not all employees will have access to the same mediums. To ensure inclusivity, strategically plan which mediums to use to reach the entire audience.
| Medium | Description | Key Messages | When to Use |
|---|---|---|---|
| One-on-One Meetings | Individual meetings between managers and their direct reports to ensure they understand the change, can express any concerns, and obtain feedback or recommendations. |
|
|
| Team Meeting | A meeting of a work unit or department. Can be virtual, in person, or a combination. Led by the work unit or department head/manager. |
|
|
| Electronic communication sent to the audience’s company emails, or in the absence of that, to their personal emails. |
|
|
| Medium | Description | Key Messages | When to Use |
|---|---|---|---|
| Town Hall | Virtual or in-person meeting where senior leadership shares information with a wide audience about the change and answers questions. |
|
|
| Roadshow | A series of meetings where senior leadership or the change champion travels to different geographic locations to hold town halls adapted to each location’s audience. |
|
|
| Medium | Description | Key Messages | When to Use |
|---|---|---|---|
| Intranet | An internal company website that a large number of employees can access at any time. |
|
|
| Training | Scheduled blocks of time for the team to learn new skills and behaviors needed to successfully adapt to the change. |
|
|
| Video Message | A prerecorded short video clip designed for either simultaneous broadcast or just-in-time viewing. Can be sent over email or mobile or uploaded to a company portal/intranet. |
|
|
| Medium | Description | Key Messages | When to Use |
|---|---|---|---|
| Shift Turnover Meeting | A meeting between teams or departments when a shift changes over; sometimes called a shift report. Used to communicate any relevant information from the outgoing shift to the incoming shift members. |
|
|
| Company Newsletter | Electronic or hardcopy newsletter published by the company. Contains timely updates on company information. |
|
|
| Sign/Poster | Digital or paper-based sign, graphic, or image. Includes posters, screensavers, etc. |
|
|
20 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
| 01 Identify and prioritize | 02 Prepare for initiative | 03 Create a communication plan | 04 Implement change | 05 Sustain the desired outcome |
|---|---|---|---|---|
| Before | During | After | ||
|
|
|
|
|
| Where communication needs to happen | ||||
Don’t forget: Cascade messages down through the organization to ensure those who need to deliver messages have time to internalize the change before communicating it to others. Include a mix of personal and organizational messages, but where possible, separate personal and organizational content into different communications.
“When goals are talked about weekly, teams are nearly 3X more likely to feel confident hitting them.”
– Hypercontext, 2022
Info-Tech Insight
Communications made once will always fail. Ensure there is a frequency appropriate for every communication — or do not expect the desired outcome.
30 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
Prior to the strategy rollout, make sure you have also established feedback mechanisms to collect feedback on both the messages delivered and how they were delivered. Some ways to collect feedback include:
Feedback Mechanisms:
There are two types of metrics that can be used to measure the impact of an internal communications strategy and progress toward strategy goals. These metrics are used to measure both outputs and outcomes.
| Select metrics measuring both: | |
|---|---|
| Tactical Effectiveness (Outputs) | Strategic Effectiveness (Outcomes) |
|
|
20 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
2 hours
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
Activities
2.1 Craft a Pitch
2.2 Revise the Pitch
This step involves the following participants:
Varies based on those who would be relevant to your initiative.
Outcomes of this step
Ability to create a clear, concise, and consistent message using best practices and a pitch framework.
Communication Any IT Initiative Effectively
Phase 1 > Phase 2 > Phase 3
Info-Tech Insight
Time is a non-renewable resource. The message crafted must be considered a value-add communication to your audience.
| Be Consistent | Be Clear |
|---|---|
|
|
| Be Relevant | Be Concise |
|
|
Draft core messages communicating information consistent with the high-level communications plan. This includes the overall goal of communications, key messaging, specifics related to the change action, and customizations for each audience. It’s also important to:
| Key Components of a Good Pitch | |
| Purpose of the pitch | What are you asking for? What is the desired outcome of the conversation? What three things do you want the audience to take away? |
| Speak to what matters to them | Who is your audience and what are their biggest challenges today? What do they care? What is the “so what”? Humanize it. Start with an example of a real person. |
| Sell the improvement | How is your solution going to solve that problem? Is your solution a pain killer or vitamin? |
| Show real value | How will your solution create real value? How can that be measured? Give an example. |
| Discuss potential fears | Identify and alleviate fears the stakeholder may have in working with you. Think about what they think now and what you want them to think. |
| Have a call to action | Identify what your ask is. What are you looking for from the stakeholder? Listen and respond. |
| Follow up with a thank-you | Did you ensure that the participants’ time was respected and appreciated? Be genuine and sincere. |
To effectively communicate change, answer questions before they’re asked, whenever possible. To do this, outline at each stage of the change process what’s happening next for the audience and answer other anticipated questions. Pair key questions with core messages in change communications.
Examples of key questions by change stage include:
| What is changing? When is the change expected? Who will be championing the change? What are the change expectations? Will I have input into how the change is happening? What’s happening next? |
Why are we changing? Why is the change happening now? What are the risks of not changing? What will be new? What’s in it for me? What training will be available? Who will be impacted? How will I be impacted? How will my team be impacted? What’s happening next? |
Who should I contact with questions or concerns? How will I be updated? How can I access more information? Will the previous process be available throughout the new process implementation? What needs to be done and what needs to stop to succeed? Will I be measured on this change? What’s happening next? |
How can I access more information? Will this change be added to key performance indicators? How did the change implementation go? What’s happening next? |
| Before change | During change | After change | |
|---|---|---|---|
| Prepare for change | Create change action and communication plan | Implement change | Sustain the change |
20 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
10 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download the Communication Planner Tool
Activities
3.1 Deliver Your Pitch
3.2 Refine and Deliver Again
This step involves the following participants:
Varies based on those who would be relevant to your initiative.
Outcomes of this step
Ability to deliver the pitch in a manner that is clear and would be understood by the specific stakeholder the pitch is intended for.
Communicate Any IT Initiative Effectively
Phase 1 > Phase 2 > Phase 3
Using voice and body
Think about the message you are trying to convey and how your body can support that delivery. Hands, stance, and frame all have an impact on what might be conveyed.
If you want your audience to lean in and be eager about your next point, consider using a pause or softer voice and volume.
Be professional and confident
State the main points of your presentation confidently. While this should be obvious, it is essential. Your audience should be able to clearly see that you believe the points you are stating.
Present in a way that is genuine to you and your voice. Whether you have an energetic personality or a calm and composed personality, the presentation should be authentic to you.
Connect with your audience
Look each member of the audience in the eye at least once during your presentation. Avoid looking at the ceiling, the back wall, or the floor. Your audience should feel engaged – this is essential to keeping their attention.
Avoid reading from your slides. If there is text on a slide, paraphrase it while maintaining eye contact.
Info-Tech Insight
You are responsible for the response of your audience. If they aren’t engaged, it is on you as the communicator.
Sample A:
Sample B:
20 minutes
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
1 hour
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Info-Tech Insight
Whether the CIO or a service desk technician, delivering a presentation is a fear for every role in IT. Prepare your communication to help overcome the fears that are within your control.
Anuja Agrawal
National Communications Director
PwC
Anuja is an accomplished global communications professional, with extensive experience in the insurance, banking, financial, and professional services industry in Asia, the US, and Canada. She is currently the National Communications Director at PwC Canada. Her prior work experience includes communication leadership roles at Deutsche Bank, GE, Aviva, and Veritas. Anuja works closely with senior business leaders and key stakeholders to deliver measurable results and effective change and culture building programs. Anuja has experience in both internal and external communications, including strategic leadership communication, employee engagement, PR and media management, digital and social media, M&A/change and crisis management. Anuja believes in leveraging digital tools and technology-enabled solutions combined with in-person engagement to help improve the quality of dialogue and increase interactive communication within the organization to help build an inclusive culture of belonging.
Nastaran Bisheban
Chief Technology Officer
KFC Canada
A passionate technologist and seasoned transformational leader. A software engineer and computer scientist by education, a certified Project Manager that holds an MBA in Leadership with Honors and Distinction from University of Liverpool. A public speaker on various disciplines of technology and data strategy with a Harvard Business School executive leadership program training to round it all. Challenges status quo and conventional practices; is an advocate for taking calculated risk and following the principle of continuous improvement. With multiple computer software and project management publications she is a strategic mentor and board member on various non-profit organizations. Nastaran sees the world as a better place only when everyone has a seat at the table and is an active advocate for diversity and inclusion.
Heidi Davidson
Co-founder & CEO
Galvanize Worldwide and Galvanize On Demand
Dr. Heidi Davidson is the Co-Founder and CEO of Galvanize Worldwide, the largest distributed network of marketing and communications experts in the world. She also is the Co-Founder and CEO of Galvanize On Demand, a tech platform that matches marketing and communications freelancers with client projects. Now with 167 active experts, the Galvanize team delivers startup advisory work, outsourced marketing, training, and crisis communications to organizations of all sizes. Before Galvanize, Heidi spent four years as part of the turnaround team at BlackBerry as the Chief Communications Officer and SVP of Corporate Marketing, where she helped the company move from a device manufacturer to a security software provider.
Eli Gladstone
Co-Founder
Speaker Labs
Eli is a Co-Founder of Speaker Labs. He has spent over 6 years helping countless individuals overcome their public speaking fears and communicate with clarity and confidence. When he's not coaching others on how to build and deliver the perfect presentation, you'll probably find him reading some weird books, teaching his kids how to ski or play tennis, or trying to develop a good enough jumpshot to avoid being a liability on the basketball court.
Francisco Mahfuz
Keynote Speaker & Storytelling Coach
Francisco Mahfuz has been telling stories in front of audiences for a decade, and even became a National Champion of public speaking. Today, Francisco is a keynote speaker and storytelling coach and offers communication training to individuals and international organisations, and has worked with organisations like Pepsi, HP, the United Nations, Santander and Cornell University. He's the author of Bare: A Guide to Brutally Honest Public Speaking, the host of The Storypowers Podcast, and he’s been part of the IESE MBA communications course since 2020. He's received a BA in English Literature from Birkbeck University in London.
Sarah Shortreed
EVP & CTO
ATCO Ltd.
Sarah Shortreed is ATCO’s Executive Vice President and Chief Technology Officer. Her responsibilities include leading ATCO’s Information Technology (IT) function as it continues to drive agility and collaboration throughout ATCO’s global businesses and expanding and enhancing its enterprise IT strategy, including establishing ATCO’s technology roadmap for the future. Ms. Shortreed's skill and expertise are drawn from her more than 30-year career that spans many industries and includes executive roles in business consulting, complex multi-stakeholder programs, operations, sales, customer relationship management and product management. She was recently the Chief Information Officer at Bruce Power and has previously worked at BlackBerry, IBM and Union Gas. She sits on the Board of Governors for the University of Western Ontario and is the current Chair of the Chief Information Officer (CIO) Committee at the Conference Board of Canada.
Eric Silverberg
Co-Founder
Speaker Labs
Eric is a Co-Founder of Speaker Labs and has helped thousands of people build their public speaking confidence and become more dynamic and engaging communicators. When he's not running workshops to help people grow in their careers, there's a good chance you'll find him with his wife and dog, drinking Diet Coke and rewatching iconic episodes of the reality TV show Survivor! He's such a die-hard fan, that you'll probably see him playing the game one day.
Stephanie Stewart
Communications Officer & DR Coordinator
Info Security Services Simon Fraser University
Steve Strout
President
Miovision Technologies
Mr. Strout is a recognized and experienced technology leader with extensive experience in delivering value. He has successfully led business and technology transformations by leveraging many dozens of complex global SFDC, Oracle and/or SAP projects. He is especially adept at leading what some call “Project Rescues” – saving people’s careers where projects have gone awry; always driving "on-time and on-budget.“ Mr. Strout is the current President of Miovision Technologies and the former CEO and board member of the Americas’ SAP Users’ Group (ASUG). His wealth of practical knowledge comes from 30 years of extensive experience in many CxO and executive roles at some prestigious organizations such as Vonage, Sabre, BlackBerry, Shred-it, The Thomson Corporation (now Thomson Reuters) and Morris Communications. Served on Boards including Customer Advisory Boards of Apple, AgriSource Data, Dell, Edgewise, EMC, LogiSense, Socrates.ai, Spiro Carbon Group, and Unifi.
Info-Tech Research Group Contributors:
Sanchia Benedict, Research Lead
Koula Bouloukos, Production Manager
Antony Chan, Executive Counsellor
Janice Clatterbuck, Executive Counsellor
Ahmed Jowar, Research Specialist
Dave Kish, Practice Lead
Nick Kozlo, Senior Research Analyst
Heather Leier Murray, Senior Research Analyst
Amanda Mathieson, Research Director
Carlene McCubbin, Practice Lead
Joe Meier, Executive Counsellor
Andy Neill, AVP, Research
Thomas Randall, Research Director
Plus an additional two contributors who wish to remain anonymous.
During a crisis it is important to communicate to employees through messages that convey calm and are transparent and tailored to your audience. Use the Crisis Communication Guides to:
Use this guide to equip leadership to communicate in times of crisis.
Gallo, Carmine. "How Great Leaders Communicate." Harvard Business Review. 23 November 2022.
Gallup. State of the American Workplace Report. Washington, D.C.: Gallup, 6 February 2020.
Guthrie, Georgina. “Why Good Internal Communications Matter Now More than Ever.” Nulab. 15 Dec. 2021.
Hypercontext. “The State of High Performing Teams in Tech 2022.” Hypercontext. 2022.
Lambden, Duncan. “The Importance of Effective Workplace Communication – Statistics for 2022.” Expert Market. 13 June 2022.
McCreary, Gale & WikiHow. “How to Measure the Effectiveness of Communication: 14 Steps.” WikiHow.
Nowak, Marcin. “Top 7 Communication Problems in the Workplace.” MIT Enterprise Forum CEE, 2021.
Nunn, Philip. “Messaging That Works: A Unique Framework to Maximize Communication Success.” iabc.
Picincu, Andra. “How to Measure Effective Communications.” Small Business Chron. 12 January 2021.
Price. David A. “Pixar Story Rules.”
Prosci. “Best Practices in Change Management 2020 Edition.” Prosci, 2020.
Roberts, Dan. “How CIOs Become Visionary Communicators.” CIO, 2019.
Schlesinger, Mark. “Why building effective communication skill in IT is incredibly important.”
Skills Framework for the Information Age, “Mapping SFIA Levels of Responsibilities to Behavioural Factors.” Skills Framework for the Information Age, 2021.
St. James, Halina. Talk It Out. Podium, 2005.
TeamState. “Communication in the Workplace Statistics: Importance and Effectiveness in 2022.” TeamStage, 2022.
Walters, Katlin. “Top 5 Ways to Measure Internal Communication.” Intranet Connections, 30 May 2019.
Under the best of circumstances, mainframe systems are complex, expensive, and difficult to scale. In today’s world, applications written for mainframe legacy systems also present significant operational challenges to customers compounded by the dwindling pool of engineers who specialize in these outdated technologies. Many organizations want to migrate their legacy applications to the cloud but to do so they need to go through a lengthy migration process that is made more challenging by the complexity of mainframe applications.
The most common tactic is for the organization to better realize their z/Series options and adopt a strategy built on complexity and workload understanding. To make the evident, obvious, the options here for the non-commodity are not as broad as with commodity server platforms and the mainframe is arguably the most widely used and complex non-commodity platform on the market.
This research will help you:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This blueprint will help you assess the fit, purpose, and price; develop strategies for overcoming potential challenges; and determine the future of z/Series for your organization.
Use this tool to play with the pre-populated values or insert your own amounts to compare possible database decisions, and determine the TCO of each. Note that common assumptions can often be false; for example, open-source Cassandra running on many inexpensive commodity servers can actually have a higher TCO over six years than a Cassandra environment running on a larger single expensive piece of hardware. Therefore, calculating TCO is an essential part of the database decision process.
“A number of market conditions have coalesced in a way that is increasingly driving existing mainframe customers to consider running their application workloads on alternative platforms. In 2020, the World Economic Forum noted that 42% of core skills required to perform existing jobs are expected to change by 2022, and that more than 1 billion workers need to be reskilled by 2030.” – Dale Vecchio
Your Challenge |
It seems like anytime there’s a new CIO who is not from the mainframe world there is immediate pressure to get off this platform. However, just as there is a high financial commitment required to stay on System Z, moving off is risky and potentially more costly. You need to truly understand the scale and complexity ahead of the organization. |
|---|---|
Common Obstacles |
Under the best of circumstances, mainframe systems are complex, expensive, and difficult to scale. In today’s world, applications written for mainframe legacy systems also present significant operational challenges to customers compounded by the dwindling pool of engineers who specialize in these outdated technologies. Many organizations want to migrate their legacy applications to the cloud, but to do so they need to go through a lengthy migration process that is made more challenging by the complexity of mainframe applications. |
Info-Tech Approach |
The most common tactic is for the organization to better realize its z/Series options and adopt a strategy built on complexity and workload understanding. To make the evident, obvious: the options here for the non-commodity are not as broad as with commodity server platforms and the mainframe is arguably the most widely used and complex non-commodity platform on the market. |
Problem statement: The z/Series remains a vital platform for many businesses and continues to deliver exceptional reliability and performance and play a key role in the enterprise. With the limited and aging resources at hand, CIOs and the like must continually review and understand their migration path with the same regard as any other distributed system roadmap. |
This research is designed for: IT strategic direction decision makers. IT managers responsible for an existing z/Series platform. Organizations evaluating platforms for mission critical applications. |
This research will help you:
|
Good Luck.
![]() |
Modernize the mainframe … here we go again. Prior to 2020, most organizations were muddling around in “year eleven of the four-year plan” to exit the mainframe platform where a medium-term commitment to the platform existed. Since 2020, it appears the appetite for the mainframe platform changed. Again. Discussions mostly seem to be about what the options are beyond hardware outsourcing or re-platforming to “cloud” migration of workloads – mostly planning and strategy topics. A word of caution: it would appear unwise to stand in front of the exit door for fear of being trampled. Hardware expirations between now and 2025 are motivating hosting deployments. Others are in migration activities, and some have already decommissioned and migrated but now are trying to rehab the operations team now lacking direction and/or structure. |
Darin Stahl |
Thinking of modernizing your mainframe can cause you angst so grab a fidget spinner and relax because we have you covered!
External Business Pressures:
Internal Considerations:
With multiple control points to be addressed, care must be taken to simplify your options while addressing all concerns to ease operational load.
Dating back to 2011, Darin Stahl has been the primary z/Series subject matter expert within the Infrastructure & Operations Research team. Below represents the percentage of calls, per industry, where z/Series advisory has been provided by Darin*: 37% - State Government 19% - Insurance 11% - Municipality 8% - Federal Government 8% - Financial Services 5% - Higher Education 3% - Retail 3% - Hospitality/Resort 3% - Logistics and Transportation 3% - Utility Based on the Info-Tech call history, there is a consistent cross section of industry members who not only rely upon the mainframe but are also considering migration options. |
Note:Of course, this only represents industries who are Info-Tech members and who called for advisory services about the mainframe. There may well be more Info-Tech members with mainframes who have no topic to discuss with us about the mainframe specifically. Why do we mention this? We caution against suggesting things like, ”somewhat less than 50% of mainframes live in state data centers” or any other extrapolated inference from this data. Our viewpoint and discussion is based on the cases and the calls that we have taken over the years. *37+ enterprise calls were reviewed and sampled. |
For most workloads “scale out" (e.g. virtualized cloud or IaaS ) is going to provide obvious and quantifiable benefits. However, with some workloads (extremely large analytics or batch processing ) a "scale up" approach is more optimal. But the scale up is really limited to very specific workloads. Despite some assumptions, the gains made when moving from scale up to scale out are not linear. Obviously, when you scale out from a performance perspective you experience a drop in what a single unit of compute can do. Additionally, there will be latency introduced in the form of network overhead, transactions, and replication into operations that were previously done just bypassing object references within a single frame. Some applications or use cases will have to be architected or written differently (thinking about the high-demand analytic workloads at large scale). Remember the “grid computing” craze that hit us during the early part of this century? It was advantageous for many to distribute work across a grid of computing devices for applications but the advantage gained was contingent on the workload able to be parsed out as work units and then pulled back together through the application. There can be some interesting and negative consequences for analytics or batch operations in a large scale as mentioned above. Bottom line, as experienced previously with Microfocus mainframe ports to x86, the batch operations simply take much longer to complete. |
Big Data Considerations*:
|
Below is a summary of concerns regarding core mainframe skills:
|
The Challenge An aging workforce, specialized skills, and high salary expectations
The In-House Solution: Build your mentorship program to create a viable succession plan
|
Migrate to another platform |
Use a hosting provider |
Outsource |
Re-platform (cloud/vendors) |
Reinvest |
|---|---|---|---|---|
There are several challenges to overcome in a migration project, from finding an appropriate alternative platform to rewriting legacy code. Many organizations have incurred huge costs in the attempt, only to be unsuccessful in the end, so make this decision carefully. |
Organizations often have highly sensitive data on their mainframes (e.g. financial data), so many of these organizations are reluctant to have this data live outside of their four walls. However, the convenience of using a hosting provider makes this an attractive option to consider. |
The most common tactic is for the organization to adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house. |
A customer can “re-platform” the non-commodity workload into public cloud offerings or in a few offerings |
If you’re staying with the mainframe and keeping it in-house, it’s important to continue to invest in this platform, keep it current, and look for opportunities to optimize its value. |
If this sounds like your organization, it’s time to do the analysis so you can decide and get clarity on the future of the mainframe in your organization.
|
*3 of the top 4 challenges related to shortfalls of alternative platforms
|
*Source: Maximize the Value of IBM Mainframes in My Business |
Potential for reduced costs
Reliable infrastructure and experienced staff
So, what are the risks?
The most common tactic is for the organization to adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house. The options here for the non-commodity (z/Series, IBM Power platforms, for example) are not as broad as with commodity server platforms. More confusingly, the term “outsourcing” for these can include: |
Traditional/Colocation – A customer transitions their hardware environment to a provider’s data center. The provider can then manage the hardware and “system.” Onsite Outsourcing – Here a provider will support the hardware/system environment at the client’s site. The provider may acquire the customer’s hardware and provide software licenses. This could also include hiring or “rebadging” staff supporting the platform. This type of arrangement is typically part of a larger services or application transformation. While low risk, it is not as cost-effective as other deployment models. Managed Hosting – A customer transitions their legacy application environment to an off-prem hosted multi-tenanted environment. It will provide the most cost savings following the transition, stabilization, and disposal of existing environment. Some providers will provide software licensing, and some will also support “Bring Your Own,” as permitted by IBM terms for example. |
Info-Tech Insight Technical debt for non-commodity platforms isn’t only hardware based. Moving an application written for the mainframe onto a “cheaper” hardware platform (or outsourced deployment) leaves the more critical problems and frequently introduces a raft of new ones. |
While the majority of the coded functionality (JCLs, programs, etc.) migrate easily, there will be a need to re-code or re-write objects – especially if any object, code, or location references are not exactly the same in the new environment. Micro Focus has solid experience in this but if consider it within the context of an 80/20 rule (the actual metrics might be much better than that), meaning that some level of rework would have to be accomplished as an overhead to the exercise. Build that thought into your thinking and business case. |
AWS Cloud
Azure Cloud
Micro Focus COBOL (Visual COBOL)
|
Yeah, a complication for this situation is the legacy code. While re-platforming/re-hosting non-COBOL code is not new, we have not had many member observations compared to the re-platforming/re-hosting of COBOL functionality initiatives. That being said, there are a couple of interesting opportunities to explore. |
NTT Data Services (GLOBAL)
ModernSystems (or ModSys) has relevant experience.
ATOS, as a hosting vendor mostly referenced by customers with global locations in a short-term transition posture, could be an option. Lastly, the other Managed Services vendors with NATURAL and Adabas capabilities: |
*92% of organizations that added capacity said TCO is lower than for commodity servers (compared to 50% of those who did not add capacity) |
*63% of organizations that added capacity said finding resources is not very difficult (compared to 42% of those who did not add capacity) |
![]() |
![]() |
| Temporary workaround. This would align with a technical solution allowing the VASM files to be accessed using platforms other than on mainframe hardware (Micro Focus or other file store trickery). This can be accomplished relatively quickly but does run the risk of technology obsolesce for the workaround at some point in the future. Bulk conversion. This method would involve the extract/transform/load of the historical records into the new application platform. Often the order of the conversion is completed on work newest to oldest (the idea is that the newest historical records would have the highest likelihood of an access need), but all files would be converted to the new application and the old data store destroyed. Forward convert, which would have files undergo the extract/transform/load conversion into the new application as they are accessed or reopened. This method would keep historical records indefinitely or until they are converted – or the legal retention schedule allows for their destruction (hopefully no file must be kept forever). This could be a cost-efficient approach since the historical files remaining on the VSAM platform would be shrunk over time based on demand from the district attorney process. The conversion process could be automated and scripted, with a QR step allowing for the records to be deleted from the old platform. |
Info-Tech Insight It is not usual for organizations to leverage options #2 and #3 above to move the functionality forward while containing the scope creep and costs for the data conversions. |
Note: Enterprise job scheduling is a topic with low member interest or demand. Since our published research is driven by members’ interest and needs, the lack of activity or member demand would obviously be a significant influence into our ability to aggregate shared member insight, trends, or best practices in our published agenda.
|
|
✓ Advanced Systems Concepts ✓ BMC ✓ Broadcom ✓ HCL ✓ Fortra |
✓ Redwood ✓ SMA Technologies ✓ StoneBranch ✓ Tidal Software ✓ Vinzant Software |
Creating vendor profiles will help quickly filter the solution providers that directly meet your z/Series needs.
ActiveBatch
| Workload Management: | ||
Summary Founded in 1981, ASCs ActiveBatch “provides a central automation hub for scheduling and monitoring so that business-critical systems, like CRM, ERP, Big Data, BI, ETL tools, work order management, project management, and consulting systems, work together seamlessly with minimal human intervention.”* URL Coverage: Global |
Amazon EC2 Hadoop Ecosystem IBM Cognos DataStage IBM PureData (Netezza) Informatica Cloud Microsoft Azure Microsoft Dynamics AX Microsoft SharePoint Microsoft Team Foundation Server |
Oracle EBS Oracle PeopleSoft SAP BusinessObjects ServiceNow Teradata VMware Windows Linux Unix IBM i |
*Advanced Systems Concepts, Inc.
Control-M
Workload Management: | ||
Summary Founded in 1980, BMCs Control-M product “simplifies application and data workflow orchestration on premises or as a service. It makes it easy to build, define, schedule, manage, and monitor production workflows, ensuring visibility, reliability, and improving SLAs.”* URL bmc.com/it-solutions/control-m.html Coverage: Global | AWS Azure Google Cloud Platform Cognos IBM InfoSphere DataStage SAP HANA Oracle EBS Oracle PeopleSoft BusinessObjects | ServiceNow Teradata VMware Windows Linux Unix IBM i IBM z/OS zLinux |
*BMC
Atomic Automation
Autosys Workload Automation
Workload Management: | ||
Summary Broadcom offers Atomic Automation and Autosys Workload Automation which ”gives you the agility, speed and reliability required for effective digital business automation. From a single unified platform, Atomic centrally provides the orchestration and automation capabilities needed accelerate your digital transformation and support the growth of your company.”* URL broadcom.com/products/software/automation/automic-automation broadcom.com/products/software/automation/autosys Coverage: Global
| Windows MacOS Linux UNIX AWS Azure Google Cloud Platform VMware z/OS zLinux System i OpenVMS Banner Ecometry | Hadoop Oracle EBS Oracle PeopleSoft SAP BusinessObjects ServiceNow Teradata VMware Windows Linux Unix IBM i |
Workload Automation
Workload Management: | |||
Summary “HCL Workload Automation streamlined modelling, advanced AI and open integration for observability. Accelerate the digital transformation of modern enterprises, ensuring business agility and resilience with our latest version of one stop automation platform. Orchestrate unattended and event-driven tasks for IT and business processes from legacy to cloud and kubernetes systems.”* URL hcltechsw.com/workload-automation Coverage: Global
| Windows MacOS Linux UNIX AWS Azure Google Cloud Platform VMware z/OS zLinux System i OpenVMS IBM SoftLayer IBM BigInsights | IBM Cognos Hadoop Microsoft Dynamics 365 Microsoft Dynamics AX Microsoft SQL Server Oracle E-Business Suite PeopleSoft SAP ServiceNow Apache Oozie Informatica PowerCenter IBM InfoSphere DataStage Salesforce BusinessObjects BI | IBM Sterling Connect:Direct IBM WebSphere MQ IBM Cloudant Apache Spark |
JAMS Scheduler
Workload Management: | ||
Summary Fortra’s “JAMS is a centralized workload automation and job scheduling solution that runs, monitors, and manages jobs and workflows that support critical business processes. JAMS reliably orchestrates the critical IT processes that run your business. Our comprehensive workload automation and job scheduling solution provides a single pane of glass to manage, execute, and monitor jobs—regardless of platforms or applications.”* URL Coverage: Global
| OpenVMS OS/400 Unix Windows z/OS SAP Oracle Microsoft Infor Workday AWS Azure Google Cloud Compute ServiceNow Salesforce | Micro Focus Microsoft Dynamics 365 Microsoft Dynamics AX Microsoft SQL Server MySQL NeoBatch Netezza Oracle PL/SQL Oracle E-Business Suite PeopleSoft SAP SAS Symitar |
*JAMS
Redwood SaaS
Workload Management: | ||
Summary Founded in 1993 and delivered as a SaaS solution, ”Redwood lets you orchestrate securely and reliably across any application, service or server, in the cloud or on-premises, all inside a single platform. Automation solutions are at the core of critical business operations such as forecasting, replenishment, reconciliation, financial close, order to cash, billing, reporting, and more. Enterprises in every industry — from manufacturing, utility, retail, and biotech to healthcare, banking, and aerospace.”* URL Coverage: Global
| OpenVMS OS/400 Unix Windows z/OS SAP Oracle Microsoft Infor Workday AWS Azure Google Cloud Compute ServiceNow Salesforce | Github Office 365 Slack Dropbox Tableau Informatica SAP BusinessObjects Cognos Microsoft Power BI Amazon QuickSight VMware Xen Kubernetes |
Robot Scheduler
Workload Management: | |
Summary “Robot Schedule’s workload automation capabilities allow users to automate everything from simple jobs to complex, event-driven processes on multiple platforms and centralize management from your most reliable system: IBM i. Just create a calendar of when and how jobs should run, and the software will do the rest.”* URL fortra.com/products/job-scheduling-software-ibm-i Coverage: Global
| IBM i (System i, iSeries, AS/400) AIX/UNIX Linux Windows SQL/Server Domino JD Edwards EnterpriseOne SAP Automate Schedule (formerly Skybot Scheduler) |
OpCon
Workload Management: | |||
Summary Founded in1980, SMA offers to “save time, reduce error, and free your IT staff to work on more strategic contributions with OpCon from SMA Technologies. OpCon offers powerful, easy-to-use workload automation and orchestration to eliminate manual tasks and manage workloads across business-critical operations. It's the perfect fit for financial institutions, insurance companies, and other transactional businesses.”* URL Coverage: Global | Windows Linux Unix z/Series IBM i Unisys Oracle SAP Microsoft Dynamics AX Infor M3 Sage Cegid Temenos | FICS Microsoft Azure Data Management Microsoft Azure VM Amazon EC2/AWS Web Services RESTful Docker Google Cloud VMware ServiceNow Commvault Microsoft WSUS Microsoft Orchestrator | Java JBoss Asysco AMT Tuxedo ART Nutanix Corelation Symitar Fiserv DNA Fiserv XP2 |
Universal Automation Center (UAC)
Workload Management: | |||
Summary Founded in 1999, ”the Stonebranch Universal Automation Center (UAC) is an enterprise-grade business automation solution that goes beyond traditional job scheduling. UAC's event-based workload automation solution is designed to automate and orchestrate system jobs and tasks across all mainframe, on-prem, and hybrid IT environments. IT operations teams gain complete visibility and advanced control with a single web-based controller, while removing the need to run individual job schedulers across platforms.”* URL stonebranch.com/it-automation-solutions/enterprise-job-scheduling Coverage: Global | Windows Linux Unix z/Series Apache Kafka AWS Databricks Docker GitHub Google Cloud Informatica | Jenkins Jscape Kubernetes Microsoft Azure Microsoft SQL Microsoft Teams PagerDuty PeopleSoft Petnaho RedHat Ansible Salesforce | SAP ServiceNow Slack SMTP and IMAP Snowflake Tableau VMware |
Workload Automation
Workload Management: | |||
Summary Founded in 1979, Tidal’s Workload Automation will “simplify management and execution of end-to-end business processes with our unified automation platform. Orchestrate workflows whether they're running on-prem, in the cloud or hybrid environments.”* URL Coverage: Global | CentOS Linux Microsoft Windows Server Open VMS Oracle Cloud Oracle Enterprise Linux Red Hat Enterprise Server Suse Enterprise Tandem NSK Ubuntu UNIX HPUX (PA-RISC, Itanium) Solaris (Sparc, X86) | AIX, iSeries z/Linux z/OS Amazon AWS Microsoft Azure Oracle OCI Google Cloud ServiceNow Kubernetes VMware Cisco UCS SAP R/3 & SAP S/4HANA Oracle E-Business | Oracle ERP Cloud PeopleSoft JD Edwards Hadoop Oracle DB Microsoft SQL SAP BusinessObjects IBM Cognos FTP/FTPS/SFTP Informatica |
Global ECS
Workload Management: | |
Summary Founded in 1987, Global ECS can “simplify operations in all areas of production with the GECS automation framework. Use a single solution to schedule, coordinate and monitor file transfers, database operations, scripts, web services, executables and SAP jobs. Maximize efficiency for all operations across multiple business units intelligently and automatically.”* URL Coverage: Global | Windows Linux Unix iSeries SAP R/3 & SAP S/4HANA Oracle, SQL/Server |
Activities:
This activity involves the following participants:
IT strategic direction decision makers
IT managers responsible for an existing z/Series platform
Organizations evaluating platforms for mission critical applications
Outcomes of this step:
This checkpoint process creates transparency around agreement costs with the business and gives the business an opportunity to re-evaluate its requirements for a potentially leaner agreement.
The Scale Up vs. Scale Out TCO Tool provides organizations with a framework for estimating the costs associated with purchasing and licensing for a scale-up and scale-out environment over a multi-year period. Use this tool to:
| ![]() |
Info-Tech InsightWatch out for inaccurate financial information. Ensure that the financials for cost match your maintenance and contract terms. | Use the Scale Up vs. Scale Out TCO Tool to determine your TCO options. |
Effectively Acquire Infrastructure Services
Acquiring a service is like buying an experience. Don’t confuse the simplicity of buying hardware with buying an experience.
Outsource IT Infrastructure to Improve System Availability, Reliability, and Recovery
There are very few IT infrastructure components you should be housing internally – outsource everything else.
Build Your Infrastructure Roadmap
Move beyond alignment: Put yourself in the driver’s seat for true business value.
Make the most of cloud for your organization.
Drive consensus by outlining how your organization will use the cloud.
Build a Strategy for Big Data Platforms
Know where to start and where to focus attention in the implementation of a big data strategy.
Improve your RFPs to gain leverage and get better results.
![]() |
Darin Stahl, Principal Research Advisor, Info-Tech Research Group Darin is a Principal Research Advisor within the Infrastructure Practice, and leveraging 38+ years of experience, his areas of focus include: IT Operations Management, Service Desk, Infrastructure Outsourcing, Managed Services, Cloud Infrastructure, DRP/BCP, Printer Management, Managed Print Services, Application Performance Monitoring/ APM, Managed FTP, non-commodity servers (z/Series, mainframe, IBM i, AIX, Power PC). |
![]() |
Troy Cheeseman, Practice Lead, Info-Tech Research Group Troy has over 25 years of IT management experience and has championed large enterprise-wide technology transformation programs, remote/home office collaboration and remote work strategies, BCP, IT DRP, IT Operations and expense management programs, international right placement initiatives, and large technology transformation initiatives (M&A). Additionally, he has deep experience working with IT solution providers and technology (cloud) start-ups. |
“AWS Announces AWS Mainframe Modernization.” Business Wire, 30 Nov. 2021.
de Valence, Phil. “Migrating a Mainframe to AWS in 5 Steps with Astadia?” AWS, 23 Mar. 2018.
Graham, Nyela. “New study shows mainframes still popular despite the rise of cloud—though times are changing…fast?” WatersTechnology, 12 Sept. 2022.
“Legacy applications can be revitalized with API.” MuleSoft, 2022.
Vecchio, Dale. “The Benefits of Running Mainframe Applications on LzLabs Software Defined Mainframe® & Microsoft Azure.” LzLabs Sites, Mar. 2021.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Plan out your employee engagement program and launch the Employee Experience Monitor survey for your team.
Interpret your Employee Experience Monitor results, understand what they mean in the context of your team, and involve your staff in brainstorming engagement initiatives.
Select engagement initiatives for maximal impact, create an action plan, and establish open and ongoing communication about engagement with your team.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Set up the EXM and collect a few months of data to build on during the workshop.
Arm yourself with an index of employee experience and candid feedback from your team to use as a starting point for your engagement program.
1.1 Identify EXM use case.
1.2 Identify engagement program goals and obstacles.
1.3 Launch EXM.
Defined engagement goals.
EXM online dashboard with three months of results.
To understand the current state of engagement and prepare to discuss the drivers behind it with your staff.
Empower your leadership team to take charge of their own team's engagement.
2.1 Review EXM results to understand employee experience.
2.2 Finalize focus group agendas.
2.3 Train managers.
Customized focus group agendas.
Establish an open dialogue with your staff to understand what drives their engagement.
Understand where in your team’s experience you can make the most impact as an IT leader.
3.1 Identify priority drivers.
3.2 Identify engagement KPIs.
3.3 Brainstorm engagement initiatives.
3.4 Vote on initiatives within teams.
Summary of focus groups results
Identified engagement initiatives.
Learn the characteristics of successful engagement initiatives and build execution plans for each.
Choose initiatives with the greatest impact on your team’s engagement, and ensure you have the necessary resources for success.
4.1 Select engagement initiatives with IT leadership.
4.2 Discuss and decide on the top five engagement initiatives.
4.3 Create initiative project plans.
4.4 Build detailed project plans.
4.5 Present project plans.
Engagement project plans.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the need for a DPO and what qualities to look for in a strong candidate.
Understand your data retention requirements under the GDPR. Develop the necessary documentation.
Understand your website or application’s GDPR requirements to inform users on how you process their personal data and how cookies are used. Develop the necessary documentation.
Organizations wishing to mature their IT financial management (ITFM) maturity often face the following obstacles:
No matter where you currently stand in your ITFM practice, there is always room for improvement. Hence, a maturity assessment should be viewed as a self-improvement tool that is only valuable if you are willing to act on it.
A mature ITFM practice leads to many benefits.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This research seeks to support IT leaders and ITFM practitioners in evaluating and improving their current maturity. It will help document both current and target states as well as prioritize focus areas for improvement.
This Excel workbook guides IT finance practitioners to effectively assess their IT financial management practice. Incorporate the visual outputs into your final executive presentation document. Key activities include context setting, completing the assessment, and prioritizing focus areas based on results.
Use this template to document your final ITFM maturity outputs, including the current and target states and your identified priorities.
Technology has been evolving throughout the years, increasing complexity and investments, while putting more stress on operations and people involved. As an IT leader, you are now entrusted to run your outfit as a business, sit at the executive table as a true partner, and be involved in making decisions that best suit your organization. Therefore, you have an obligation to fulfill the needs of your end customers and live up to their expectations, which is not an easy task.
IT financial management (ITFM) helps you generate value to your organization’s clientele by bringing necessary trade-offs to light, while driving effective dialogues with your business partners and leadership team.
This research will focus on Info-Tech’s approach to ITFM maturity, aiming for a state of continuous improvement, where an organization can learn and grow as it adapts to change. As the ITFM practice matures, IT and business leaders will be able to better understand one another and together make better business decisions, driven by data.
This client advisory presentation and accompanying tool seek to support IT leaders and ITFM practitioners in evaluating and improving their current maturity. It will help document both current and target states as well as prioritize focus areas for improvement.
|
Bilal Alberto Saab
Research Director, IT Financial Management Info-Tech Research Group |
ITFM is often discarded and not given enough importance and relevance due to the operational nature of IT, and the specialized skillset of its people, leading to several problems and challenges, such as:
Business-driven conversations around financials (spending, cost, revenue) are a rarity in IT due to several factors, including:
Mature your ITFM practice by activating the means to make informed business decisions.
Info-Tech’s methodology helps you move the dial by focusing on three maturity focus areas:
Influence your organization’s strategic direction by maturing your ITFM practice.
“ITFM embeds technology in financial management practices. Through cost, demand, and value, ITFM brings technology and business together, forging the necessary relationships and starting the right conversations to enable the best decisions for the organization.”
– Monica Braun, Research Director, Info-Tech Research Group
“Value is not the numbers you visualize on a chart, it’s the dialogue this data generates with your business partners and leadership team.”
– Dave Kish, Practice Lead, Info-Tech Research Group
In a technology-driven world, advances come at a price. With greater spending required, more complex and difficult conversations arise.
79% of respondents believe that decisions taking too long to make is either a significant or somewhat of a challenge (Flexera 2022 Tech Spend Pulse; N=501).
81% of respondents believe that ensuring spend efficiency (avoiding waste) is either a challenge or somewhat of a challenge (Flexera 2022 Tech Spend Pulse; N=501).
In today’s world, where organizations are driving customer experience through technology investments, having a seat at the table means IT leaders must be well versed in business language and practice, including solid financial management skills.
However, IT staff across all industries aren’t very confident in how well IT is doing in managing its finances. This becomes evident after looking at three core processes:
Recent data from 4,137 respondents to Info-Tech’s IT Management & Governance Diagnostic shows that while most IT staff feel that these three financial management processes are important, notably fewer feel that IT management is effective at executing on them.
IT leadership’s capabilities around fundamental cost data capture appear to be lagging, not to mention the essential value-added capabilities around optimizing costs and demonstrating IT’s contribution to business value.

Source: Info-Tech Research Group, IT Management & Governance Diagnostic, 2023.
Note: See Appendix A for maturity level definitions and descriptions.
Info-Tech identified three maturity focus areas, each containing three levers.
Identify where you stand across the nine maturity levers, detect the gaps, and determine your priorities as a first step to develop an improvement plan.
Note: See Appendix B for maturity level definitions and descriptions per lever.
Each step of this activity is accompanied by supporting deliverables to help you accomplish your goals.
Build your improvement plan and implement your initiatives to move the dial and climb the maturity ladder.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Diagnostics and consistent frameworks used throughout all four options |
|||
3 hours
Input: Understanding your context, objectives, and methodology
Output: ITFM maturity assessment stakeholders and their objectives, ITFM maturity assessment methodology, ITFM maturity assessment takers
Materials: 1a. Prepare for Assessment tab in the ITFM Maturity Assessment Tool
Participants: CIO/IT director, CFO/finance director, IT finance lead, IT audit lead, Other IT management
Download the IT Financial Management Maturity Assessment Tool
Refer to the example and guidelines below on how to document stakeholders, objectives, and methodology (table range: columns B to G and rows 8 to 15).
| Column ID | Input Type | Guidelines |
| B | Formula | Automatic calculation, no entry required. |
| C | Text | Enter the full name of each stakeholder on a separate row. |
| D | Text | Enter the job title related to each stakeholder. |
| E | Text | Enter the objective(s) related to each stakeholder. |
| F | Text | Enter the agreed upon methodology. |
| G | Text | Enter any notes or comments per stakeholder (optional). |
Download the IT Financial Management Maturity Assessment Tool
Refer to the example and guidelines below on how to document assessment takers (table range: columns B to E and rows 18 to 25).
| Column ID | Input Type | Guidelines |
| B | Formula | Automatic calculation, no entry required. |
| C | Text | Enter the full name of each assessment taker on a separate row. |
| D | Text | Enter the job title related to each stakeholder to identify which party is being represented per assessment taker. |
| E | Text | Enter any notes or comments per stakeholder (optional). |
Download the IT Financial Management Maturity Assessment Tool
3 hours
Input: Understanding of your ITFM current state and 12-month target state, ITFM maturity assessment results
Output: ITFM current- and target-state maturity levels, average scores, and variance, ITFM current- and target-state average scores, variance, and priority by maturity focus area and maturity lever
Materials: 1b. Glossary, 2a. Assess ITFM Foundation, 2b. Assess Mngt. & Monitoring, 2c. Assess Language, and 3. Assessment Summary tabs in the ITFM Maturity Assessment Tool
Participants: CIO/IT director, CFO/finance director, IT finance lead, IT audit lead, Other IT management
Download the IT Financial Management Maturity Assessment Tool
Refer to the example and guidelines below on how to complete the survey.
| Column ID | Input Type | Guidelines |
| B | Formula | Automatic calculation, no entry required. |
| C | Formula | Automatic calculation, no entry required: ITFM maturity statement to assess. |
| D, E | Dropdown | Select the maturity levels of your current and target states. One of five maturity levels for each statement, from “1. Nonexistent” (lowest maturity) to “5. Advanced” (highest maturity). |
| F, G, H | Formula | Automatic calculation, no entry required: scores associated with your current and target state selection, along with related variance (column G – column F). |
| I | Text | Enter any notes or comments per ITFM maturity statement (optional). |
Download the IT Financial Management Maturity Assessment Tool
Refer to the example and guidelines below on how to review your results.
| Column ID | Input Type | Guidelines |
| K | Formula | Automatic calculation, no entry required. |
| L | Formula | Automatic calculation, no entry required: Current State, Target State, and Variance entries. Please ignore the current state benchmark, it’s a placeholder for future reference. |
| M | Formula | Automatic calculation, no entry required: average overall maturity score for your Current State and Target State entries, along with related Variance. |
| N, O | Formula | Automatic calculation, no entry required: maturity level and related name based on the overall average score (column M), where level 1 corresponds to an average score less than or equal to 1.49, level 2 corresponds to an average score between 1.5 and 2.49 (inclusive), level 3 corresponds to an average score between 2.5 and 3.49 (inclusive), level 4 corresponds to an average score between 3.5 and 4.49 (inclusive), and level 5 corresponds to an average score between 4.5 and 5 (inclusive). |
| P, Q | Formula | Automatic calculation, no entry required: maturity definition and related description based on the maturity level (column N). |
Download the IT Financial Management Maturity Assessment Tool
Refer to the example and guidelines below on how to review your results per maturity focus area and maturity lever, then prioritize accordingly.
| Column ID | Input Type | Guidelines |
| B | Formula | Automatic calculation, no entry required. |
| C | Formula | Automatic calculation, no entry required: ITFM maturity focus area or lever, depending on the table. |
| D | Placeholder | Ignore this column because it’s a placeholder for future reference. |
| E, F, G | Formula | Automatic calculation, no entry required: average score related to the current state and target state, along with the corresponding variance per maturity focus area or lever (depending on the table). |
| H | Formula | Automatic calculation, no entry required: preliminary priority based on the average variance (column G), where Low corresponds to an average variance between 0 and 0.5 (inclusive), Medium corresponds to an average variance between 0.51 and 0.99 (inclusive), and High corresponds to an average variance greater than or equal to 1. |
| J | Dropdown | Select your final priority (Low, Medium, or High) per ITFM maturity focus area or lever, depending on the table. |
| K | Whole Number | Enter the appropriate rank based on your priorities; do not use the same number more than once. A whole number between 1 and 3 to rank ITFM maturity focus areas, and between 1 and 9 to rank ITFM maturity levers, depending on the table. |
Download the IT Financial Management Maturity Assessment Tool
3 hours
Input: ITFM maturity assessment results
Output: Customized ITFM maturity assessment report
Materials: 3. Assessment Summary tab in the ITFM Maturity Assessment Tool, ITFM Maturity Assessment Report Template
Participants: CIO/IT director, CFO/finance director, IT finance lead, IT audit lead, Other IT management
Download the IT Financial Management Maturity Assessment Tool
Refer to the example below on charts depicting different views of the maturity assessment results across the three focus areas and nine levers.
Download the IT Financial Management Maturity Assessment Tool
Refer to the example below on slides depicting different views of the maturity assessment results across the three maturity focus areas and nine maturity levers.
Slide 6: Edit levels based on your assessment results. Copy and paste the appropriate maturity level definition and description from slide 4.
Slide 7: Copy related charts from the assessment summary tab in the Excel workbook and remove the chart title. You can use the “Outer Offset: Bottom” shadow under shape effects on the chart.
Slide 8: Copy related charts from the assessment summary tab in the Excel workbook and remove the chart title and legend. You can use the “Outer Offset: Center” shadow under shape effects on the chart.
Download the IT Financial Management Maturity Assessment Report Template
Communicate your maturity results with stakeholders and develop an actionable ITFM improvement plan.
And remember, having informed discussions with your business partners and stakeholders, where technology helps propel your organization forward, is priceless!
|
Dave Kish
Practice Lead, ITFM Practice Info-Tech Research Group |
|
Jennifer Perrier
Principal Research Director, ITFM Practice Info-Tech Research Group |
|
Angie Reynolds
Principal Research Director, ITFM Practice Info-Tech Research Group |
|
Monica Braun
Research Director, ITFM Practice Info-Tech Research Group |
|
Rex Ding
Research Specialist, ITFM Practice Info-Tech Research Group |
|
Aman Kumari
Research Specialist, ITFM Practice Info-Tech Research Group |
|
Amy Byalick
Vice President, IT Finance Info-Tech Research Group |
Amy Byalick is an IT Finance practitioner with 15 years of experience supporting CIOs and IT leaders elevating the IT financial storytelling and unlocking insights. Amy is currently working at Johnson Controls as the VP, IT Finance, previously working at PepsiCo, AmerisourceBergen, and Jacobs. |
|
Carol Carr
Technical Counselor, Executive Services Info-Tech Research Group |
|
|
Scott Fairholm
Executive Counselor, Executive Services Info-Tech Research Group |
|
|
Gokul Rajan
Executive Counselor, Executive Services Info-Tech Research Group |
|
|
Allison Kinnaird
Practice Lead, Infrastructure & Operations Info-Tech Research Group |
|
|
Isabelle Hertanto
Practice Lead, Security & Privacy Info-Tech Research Group |
|
Achieve IT Spending Transparency
Mature your ITFM practice by activating the means to make informed business decisions. |
|
Build Your IT Cost Optimization Roadmap
Develop an IT cost optimization strategy based on your specific circumstances and timeline. |
Eby, Kate. “The Complete Guide to Organizational Maturity: Models, Levels, and Assessments.” Smartsheet, 8 June 2022. Web.
“Financial Management Maturity Model.” National Audit Office, n.d. Accessed 28 Apr. 2023.
“ITFM/TBM Program Maturity Guide.” Nicus Software, n.d. Accessed 28 Apr. 2023.
Jouravlev, Roman. "Service Financial Management: ITIL 4 Practice Guide." Axelos, 2020.
McCarthy, Seamus. “Financial Management Maturity Model: A Good Practice Guide.” Office of the Comptroller & Auditor General, 26 June 2018. Web.
“Principles for Effective Risk Data Aggregation and Risk Reporting.“ Bank for International Settlements, Jan. 2013. Web.
“Role & Influence of the Technology Decision-Maker 2022.” Foundry, 2022. Web.
Stackpole, Beth. “State of the CIO, 2022: Focus turns to IT fundamentals.” CIO, 21 March 2022. Web.
“Tech Spend Pulse.” Flexera, 2022. Web.
Maturity Level |
Definition |
Description |
| Nascent Level 1 |
Inability to consistently deliver financial planning services | ITFM practices are almost inexistent. Only the most basic financial tasks and activities are being performed on an ad hoc basis to fulfill the Finance department’s requests. |
| Cost Operator Level 2 |
Rudimentary financial planning capabilities. | ITFM activities revolve around minimizing the IT budget as much as possible. ITFM practices are not well defined, and IT’s financial view is limited to day-to-day technical operations.
IT is only involved in low complexity decision making, where financial conversations center on general ledger items and IT spending. |
| Trusted Coordinator Level 3 |
Enablement of business through cost-effective supply of technology. | ITFM activities revolve around becoming a proficient and cost-effective technology supplier to business partners.
ITFM practices are in place, with moderate coordination and adherence to execution. Various IT business units coordinate to produce a consolidated financial view focused on business services. IT is involved in moderate complexity decision making, as a technology subject matter expert, where financial conversations center on IT spending in relation to technology services or solutions provided to business partners. |
| Value Optimizer Level 4 |
Effective impact on business performance. | ITFM activities revolve around optimizing existing technology investments to improve both IT and business performance.
ITFM practices are well managed, established, documented, repeatable, and integrated as necessary across the organization. IT’s financial view tie technology investments to lines of business, business products, and business capabilities. Business partners are well informed on the technology mix and drive related discussion. IT is trusted to contribute to complex decision making around existing investments to cost-effectively plan initiatives, as well as enhance business performance. |
| Strategic Partner Level 5 |
Influence on the organization’s strategic direction. | ITFM activities revolve around predicting the outcome of new or potential technology investments to continuously optimize business performance.
ITFM practices are fully optimized, reviewed, and improved in a continuous and sustainable manner, and related execution is tracked by gathering qualitative and quantitative feedback. IT’s financial view is holistic and fully integrated with the business, with an outlook on innovation, growth, and strategic transformation. Business and IT leaders know the financial ramifications of every business and technology investment decision. IT is trusted to contribute to strategic decision making around potential and future investments to grow and transform the business. |
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to provide any type of financial insight. | ITFM tasks, activities, and functions are not being met in any way, shape, or form. |
| Cost Operator Level 2 | Ability to provide basic financial insights. | There is no dedicated ITFM team.
|
| Trusted Coordinator Level 3 | Ability to provide basic business insights. | A dedicated team is fulfilling essential ITFM tasks, activities, and functions.
|
| Value Optimizer Level 4 | Ability to provide valuable business driven insights. | A dedicated ITFM team with well-defined roles and responsibilities can provide effective advice to IT leaders, in a timely fashion, and positively influence IT decisions. |
| Strategic Partner Level 5 | Ability to influence both technology and business decisions. | A dedicated and highly specialized ITFM team is trusted and valued by both IT and Business leaders.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to ensure any adherence to rules and regulations. | ITFM frameworks, guidelines, policies, and procedures are not developed nor documented. |
| Cost Operator Level 2 | Ability to ensure basic adherence to rules and regulations. | Basic ITFM frameworks, guidelines, policies, and procedures are in place, developed on an ad hoc basis, with no apparent coherence or complete documentation. |
| Trusted Coordinator Level 3 | Ability to ensure compliance to rules and regulations, as well as accountability across ITFM processes. | Essential ITFM frameworks, guidelines, policies, and procedures are in place, coherent, and documented, aiming to (a) comply with rules and regulations, and (b) provide clear accountability. |
| Value Optimizer Level 4 | Ability to ensure compliance to rules and regulations, as well as structure, transparency, and business alignment across ITFM processes. | ITFM frameworks, guidelines, policies, and procedures are well defined, coherent, documented, and regularly reviewed, aiming to (a) comply with rules and regulations, (b) provide clear accountability, and (c) maintain business alignment. |
| Strategic Partner Level 5 | Ability to:
| ITFM frameworks, guidelines, policies, and procedures are complete, well defined, coherent, documented, continuously reviewed, and improved, aiming to (a) comply with rules and regulations, (b) provide clear accountability, (c) maintain business alignment, and (d) facilitate the decision-making process.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to deliver IT financial planning and performance output. | ITFM processes and tools are not developed nor documented. |
| Cost Operator Level 2 | Ability to deliver basic IT financial planning output. | Basic ITFM processes and tools are in place, developed on an ad hoc basis, with no apparent coherence or complete documentation. |
| Trusted Coordinator Level 3 | Ability to deliver accurate IT financial output and basic IT performance output in a consistent cadence. | Essential ITFM processes and tools are in place, coherent, and documented, aiming to (a) maintain integrity across activities, tasks, methodologies, data, and reports; (b) deliver IT financial planning and performance output needed by stakeholders; and (c) provide clear accountability. ITFM tools and processes are adopted by the ITFM team and some IT business units but are not fully integrated. |
| Value Optimizer Level 4 | Ability to deliver accurate IT financial planning and performance output at the needed level of detail to stakeholders in a consistent cadence. | ITFM processes and tools are complete, well defined, coherent, documented, continuously reviewed, and improved, aiming to (a) maintain integrity across activities, tasks, methodologies, data, and reports; (b) deliver IT financial planning and performance output needed by stakeholders; (c) provide clear accountability; and (d) facilitate decision-making. ITFM tools and processes are adopted by IT and business partners but are not fully integrated. |
| Strategic Partner Level 5 | Ability to:
| ITFM processes and tools are complete, well defined, coherent, documented, continuously reviewed, and improved, aiming to (a) maintain integrity across activities, tasks, methodologies, data, and reports; (b) deliver IT financial planning and performance output needed by stakeholders; (c) provide clear accountability; and (d) facilitate decision making.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to provide transparency across technology spending. | ITFM taxonomy and data model are not developed nor documented. |
| Cost Operator Level 2 | Ability to provide transparency and support IT financial planning data, analysis, and reporting needs of finance stakeholders. | ITFM taxonomy and data model are in place, developed on an ad hoc basis, with no apparent coherence or complete documentation, to comply with, and meet the needs of finance stakeholders. |
| Trusted Coordinator Level 3 | Ability to provide transparency and support IT financial planning and performance data, analysis, and reporting needs of IT and finance stakeholders. | ITFM taxonomy and data model are in place, coherent, and documented to meet the needs of IT and finance stakeholders. |
| Value Optimizer Level 4 | Ability to provide transparency and support IT financial planning and performance data, analysis, and reporting needs of IT, finance, business, and executive stakeholders. | ITFM taxonomy and data model are complete, well defined, coherent, documented, continuously reviewed, and improved, aiming to provide (a) a holistic view of IT spending and IT performance, (b) visibility and transparency, (c) flexibility, and (d) valuable insights to facilitate data driven decision making.
|
| Strategic Partner Level 5 | Ability to:
| ITFM taxonomy and data model are complete, well defined, coherent, documented, continuously reviewed, and improved, aiming to provide (a) a holistic view of IT spending and IT performance, (b) visibility and transparency, (c) flexibility, and (d) valuable insights to facilitate data driven decision making.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to provide accurate and complete across technology spending. | ITFM data needs and requirements are not understood. |
| Cost Operator Level 2 | Ability to provide accurate, but incomplete IT financial planning data to meet the needs of finance stakeholders. | Technology spending data is extracted, transformed, and loaded on an ad hoc basis to meet the needs of finance stakeholders. |
| Trusted Coordinator Level 3 | Ability to provide accurate and complete IT financial planning data to meet the needs of IT and finance stakeholders, but IT performance data remain incomplete. | IT financial planning data is extracted, transformed, and loaded in a regular cadence to meet the needs of IT and finance stakeholders.
|
| Value Optimizer Level 4 | Ability to provide accurate and complete IT financial planning and performance data to meet the needs of IT, finance, business, and executive stakeholders. | ITFM data needs and requirements are understood.
|
| Strategic Partner Level 5 | Ability to provide accurate and complete IT financial planning and performance data real time and when needed by IT, finance, business, and executive stakeholders. | ITFM data needs and requirements are understood.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to provide any type of financial insight. | ITFM analysis and reports are not developed nor documented. |
| Cost Operator Level 2 | Ability to provide basic financial insights. | IT financial planning analysis is conducted on an ad hoc basis to meet the needs of finance stakeholders. |
| Trusted Coordinator Level 3 | Ability to provide basic financial planning and performance insights to meet the needs of IT and finance stakeholders. | IT financial planning and performance analysis are methodical and rigorous, as defined in related control documents (guideline, policies, procedures, etc.).
|
| Value Optimizer Level 4 | Ability to provide practical insights and useful recommendations as needed by IT, finance, business, and executive stakeholders to facilitate business decision making around technology investments. | ITFM analysis and reports support business decision making around technology investments.
|
| Strategic Partner Level 5 | Ability to provide practical insights and useful recommendations as needed by IT, finance, business, and executive stakeholders to facilitate strategic decision making. | ITFM analysis and reports support strategic decision making.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability of organization stakeholders to communicate and understand each other. | The organization stakeholders including IT, finance, business, and executives do not understand one another, and cannot speak the same language. |
| Cost Operator Level 2 | Ability to understand business and finance requirements. | IT understands and meets business and financial planning requirements but does not communicate in a similar language.
|
| Trusted Coordinator Level 3 | Ability to understand the needs of different stakeholders including IT, finance, business, and executives and take part in decision making around technology spending. | The organization stakeholders including IT, finance, business, and executives understand each other’s needs, but do not communicate in a common language.
|
| Value Optimizer Level 4 | Ability to communicate in a common vocabulary across the organization and take part in business decision making around technology investments. | The organization stakeholders including IT, finance, business, and executives communicate in a common vocabulary and understand one another.
|
| Strategic Partner Level 5 | Ability to communicate in a common vocabulary across the organization and take part in strategic decision making. | The organization stakeholders including IT, finance, business, and executives communicate in a common vocabulary and understand one another.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability of organization stakeholders to acquire knowledge. | Educational resources are inexistent. |
| Cost Operator Level 2 | Ability to acquire financial knowledge and understand financial concepts. | IT leaders have access to educational resources to gain the financial knowledge necessary to perform their duties. |
| Trusted Coordinator Level 3 | Ability to acquire financial and business knowledge and understand related concepts. | IT leaders and their respective teams have access to educational resources to gain the financial and business knowledge necessary to perform their duties.
|
| Value Optimizer Level 4 | Ability to acquire knowledge, across technology, business, and finance as needed by different organization stakeholders, and the leadership understand concepts across these various domains. | Stakeholders including IT, finance, business, and executives have access to various educational resources to gain knowledge in different domains as needed.
|
| Strategic Partner Level 5 | Ability to acquire knowledge, and understand concepts across technology, business, and finance as needed by different organization stakeholders. | The organization promotes continuous learning through well designed programs including training, mentorship, and academic courses. Thus, stakeholders including IT, finance, business, and executives have access to various educational resources to gain knowledge in different domains as needed.
|
Maturity Level | Definition | Description |
| Nascent Level 1 | Inability to provide and foster an environment of collaboration and continuous improvement. | Stakeholders including IT, finance, business, and executives operate in silos, and collaboration between different teams is inexistent. |
| Cost Operator Level 2 | Ability to provide an environment of cooperation to meet the needs of IT, finance, and business leaders. | IT, finance, and business leaders cooperate to meet financial planning requirements as necessary to perform their duties. |
| Trusted Coordinator Level 3 | Ability to provide and foster an environment of collaboration across the organization. | IT, finance, and business collaborate on various initiatives. ITFM employees are trusted and supported by their stakeholders (IT, finance, and business). |
| Value Optimizer Level 4 | Ability to provide and foster an environment of collaboration and continuous improvement, where employees across the organization feel trusted, supported, empowered, and valued. | Stakeholders including IT, finance, business, and executives support and promote continuous improvement, transparency practices, and collaboration across the organization.
|
| Strategic Partner Level 5 | Ability to provide and foster an environment of collaboration and continuous improvement, where leaders are willing to change, and employees across the organization feel trusted, supported, empowered, and valued. | Stakeholders including IT, finance, business, and executives support and promote continuous improvement, transparency practices, and collaboration across the organization.
|
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Make the case for a web experience management suite and structure the WEM strategy project.
Identify the target state WEM strategy, assess current state, and identify gaps.
Build the WEM technology stack and create a web strategy initiatives roadmap.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Discuss the general project overview for the WEM selection.
Launch of your WEM selection project.
Development of your organization’s WEM requirements.
1.1 Facilitation of activities from the Launch the WEM Project and Collect Requirements phase, including project scoping and resource planning.
1.2 Conduct overview of the WEM market landscape, trends, and vendors.
1.3 Conduct process mapping for selected marketing processes.
1.4 Interview business stakeholders.
1.5 Prioritize WEM functional requirements.
WEM Procurement Project Charter
WEM Use-Case Fit Assessment
Plan the procurement and the implementation of the WEM solution.
Selection of a WEM solution.
A plan for implementing the selected WEM solution.
2.1 Complete marketing process mapping with business stakeholders.
2.2 Interview IT staff and project team, identify technical requirements for the WEM suite, and document high-level solution requirements.
2.3 Perform a use-case scenario assessment, review use-case scenario results, identify use-case alignment, and review the WEM Vendor Landscape vendor profiles and performance.
2.4 Create a custom vendor shortlist and investigate additional vendors for exploration in the marketplace.
2.5 Meet with project manager to discuss results and action items.
Vendor Shortlist
WEM RFP
Vendor Evaluations
Selection of a WEM Solution
WEM projected work break-down
Implementation plan
Framework for WEM deployment and CRM/Marketing Management Suite Integration
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Align on GTM vision and plan; craft initial strategy.
Confidence that market opportunity is sufficient.
Deeper buyer understanding to drive product design and messaging and launch campaign asset design.
Steering committee approval for next phase.
1.1 Outline a vision for GTM, roles required, identify Steering Committee lead, workstream leads, and teams.
1.2 Capture GTM strategy hypothesis by working through initial draft of the Go-to-Market Strategy Presentation and business case.
1.3 Capture team knowledge on buyer persona and journey and competitive SWOT.
1.4 Identify info./data gaps, sources, and plan for capturing/gathering including buyer interviews.
Documented Steering Committee and Working team.
Aligned on GTM vision and process.
Documented buyer persona and journey. Competitive SWOT analysis.
Document team knowledge on initial GTM strategy, buyer personas, and business case.
Identify Initial Business Case, Sales Forecast, and Launch Plan.
Confidence in size of market opportunity.
Alignment of Sales and Product on product forecast.
Assessment of marketing tech stack.
Initial business case.
2.1 Size Product Market Opportunity and initial revenue forecast.
2.2 Craft initial product hypothesis from buyer interviews including feature priorities, pricing, packaging, competitive differentiation, channel/route to market.
2.3 Craft initial launch campaign, product release and sales and CX readiness plans.
2.4 Identify launch budgets across each investment area.
2.5 Discuss initial product launch business case and key activities.
Product Serviceable Obtainable Market (SOM), Serviceable Available Market (SAM) and Total Available Market (TAM).
Definition of product-market fit, uniqueness, and competitive differentiation.
Preliminary campaign, targets, and readiness plans.
Incremental budgets for each key stakeholder area.
Preliminary product launch business case.
Develop final Launch plans and budgets in product and marketing.
Align Product release/launch plans with the marketing campaign for launch.
Understand incremental budgets from product and marketing for launch.
3.1 Apply product interviews to scope, MVP, roadmap, competitive differentiation, pricing, feature prioritization, routes to market, and sales forecast.
3.2 Develop a more detailed launch campaign plan complete with asset-types, messaging, digital plan to support buyer journey, media buy plan and campaign metrics.
Minimally Viable Product defined with feature prioritization. Product competitive differentiation documented Routes to market identified Sales forecast aligned with product team expectations.
Marketing campaign launch plan Content marketing asset-creation/acquisition plan Campaign targets and metrics.
Develop final Launch Plans and budgets for remaining areas.
Align Product release/launch plans with the marketing campaign for launch.
Understand incremental budgets from Product and Marketing for launch.
4.1 Develop detailed launch/readiness plans with final budgets for: Sales enablement , Sales training, Tech stack, Customer onboarding & success, Product marketing, AR, PR, Corp Comms/Internal Comms, Customer Events, Employee Events, etc.
Detailed launch plans, budgets for Product Marketing, Sales, Customer Success, and AR/PR/Corp. Comms.
To gain approval to move to Build and Launch phases.
Align business case with Steering Committee expectations
Approvals to Build and Launch targeted offering
5.1 Review final launch/readiness plans with final budgets for all key areas.
5.2 Move all key findings into Steering Committee presentation slides.
5.3 Present to Steering Committee; receive feedback.
5.4 Incorporate Steering Committee feedback; update finial business case.
Combined budgets across all areas. Final launch/readiness plans.
Final Steering Committee-facing slides.
Final approvals for Build and Launch.
| Section | Title |
| 1 | Executive Brief
|
| 2 | Build baseline market, buyer, and competitive insights
|
| 3 | Design initial product and business case
|
| 4 | Align stakeholder plans to prep for build
|
A successful go-to-market (GTM) strategy aligns marketing, product, sales and customer success, sees decision making based on deep buyer understanding, and tests many basic assumptions often overlooked in today’s agile-driven product development/management environment.
The disciplines you build using our methodology will not only support your team’s effort building and launching more successful products, but also can be modified for use in other strategic initiatives such as branding, M&A integration, expanding into new markets, and other initiatives that require a cross-functional and multidisciplined process.
|
Jeff Golterman
|
An ineffective go-to-market strategy is often a root cause of:
|
Hurdles to go-to-market success include:
|
Apply SoftwareReviews approach for greater GTM success.
Our blueprint is designed to help you:
|
Creating a compelling go-to-market strategy, and keeping it current, is a critical software company function – as important as financial strategy, sales operations, and even corporate business development – given its huge impact on the many drivers of sustainable growth.
A GTM Strategy is not all art and not all science but requires both. Software leaders will establish a set of core capabilities upon which they will plan, build, launch and manage product success. Executives, when resourcing their GTM strategies, will begin with:
|
|
|
SoftwareReviews Advisory Insight:
Marketers who get GTM Strategy “right” give themselves a 50% greater chance of Build and Launch success.
“Figuring out a Go-to-Market approach is no trivial exercise – it separates the companies that will be successful and sustainable from those that won’t.” (Harvard Business Review)
Marketers – Large and Small – will further test their GTM Strategy strength by asking “Are we missing any of the following?”
SoftwareReviews Advisory Insight:
Marketers will go through the GTM Strategy process together across all disciplines at least once in order to establish a consistent process, make key foundational decisions (e.g. tech stack, channel strategy, pricing structure, etc.), and assess strengths and weaknesses to be addressed. Future releases to existing products don’t need to be re-thought but instead check-listed against prior foundational decisions.
Is Your GTM Strategy Led and Staffed Properly?
Our research shows a more effective GTM Strategy delivers key benefits, including:
SoftwareReviews Advisory Insight:
|
“Go-to-Market Strategies aren’t just for new products or services, they can also be used for:
And while each GTM strategy is unique, there are a series of steps that every product marketer should follow.” (Product Marketing Alliance) |
Marketers, in order to optimize a go-to-market strategy, will:
This research is designed for:
|
This research will help you:
|
This research will also assist:
|
This research will help them:
|
1 |
Build baseline market, buyer, and competitive insights
Sizing your opportunity, building deep buyer understanding, competitive differentiation, and routes to market are fundamental first steps. |
|
2 |
Design initial product and business case
Validate positioning and messaging against brand, develop packaging and pricing, and develop digital approach, launch campaign approach and supporting budgets across all areas. |
|
3 |
Align stakeholder plans to prep for build
Rationalize product release and concept to sales/financial plan and further develop customer success, PR/AR, MarTech, and analytics/metrics plans. |
| 1.Build baseline market, buyer, and competitive insights | 2. Design initial product and business case | 3. Align stakeholder plans to prep for build | |
| Phase Steps |
|
|
|
| Phase Outcomes |
|
|
|
Having an updated and compelling go-to-market strategy is a critical capability – as important as financial strategy, sales operations, and even corporate business development – given its huge impact on the many drivers of sustainable growth.
Many marketers experiencing the value of the GTM Steering Committee extend its use into a “Product and Pricing Council” (PPC) in order to move product-related decision making from ad-hoc to structured, and to reinforce GTM Strategy guardrails and best practices across the company.
Marketers that collaborate closely with Marketing Ops., Sales Ops., and IT early in the process of a go-to-market strategy will be best able to assess whether current website/digital, marketing applications, CRM/sales automation apps, and tools can support the complete Go-to-Market process effectively.
Marketers will go through the GTM Strategy process together across all disciplines at least once in order to establish a consistent process, make key foundational decisions (e.g. tech stack, channel strategy, pricing structure, etc.), and assess strengths and weaknesses to be addressed.
Future releases to existing products don’t need be re-thought but instead check-listed against prior foundational decisions.
Marketers who get GTM Strategy “right” give themselves a 50% greater chance of build and launch success.
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
Key deliverable:
Go-to-Market Strategy Presentation TemplateCapture key findings for your GTM Strategy within the Go-to-Market Strategy Presentation Template.
|
Go-to-Market Strategy RACI and Launch Checklist WorkbookIncludes a RACI model and launch checklist that helps scope your working team’s roles and responsibilities. |
|
Go-to-Market Strategy Cost Budget and Revenue Forecast WorkbookCapture launch incremental costs that, when weighed against the forecasted revenue, illustrate gross margins as a crucial part of the business case. |
|
Product Market Opportunity SizingWhile not a deliverable of this blueprint per se, the Product Market Opportunity blueprint is required. |
|
This blueprint calls for downloading the following additional blueprint: | ||
Buyer Persona and Journey blueprintWhile not a deliverable of this blueprint per se, the Buyer Persona and Journey blueprint is required |
|
|||
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
| Included within advisory membership | Optional add-ons | ||
A Guided Implementation (GI) is a series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization.
For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst.
Your engagement managers will work with you to schedule analyst calls.
What does our GI on Build a More Effective Go-to-Market Strategy look like?
Build baseline market, buyer, and competitive insights |
Design initial product and business case |
Align stakeholder plans to prep for build |
| Call #1: Share GTM vision and outline team activities for the GTM Strategy process. Plan next call – 1 week.
Call #2: Outline product market opportunity approach and steps to complete. Plan next call – 1 week. Call #3: Hold a series of inquiries to do a modernization check on tech stack. Plan next call – 2 weeks. Call #4: Discuss buyer interview process, persona, and journey steps. Plan next call – 2 weeks. Call #5: Outline competitive differentiation analysis, routes to market, and review of to-date business case. Plan next call – 1 week. |
Call #6: Discuss brand strength/weakness, pricing, and packaging approach. Plan next call – 3 weeks.
Call #7: Outline needs to craft assets with right messaging across campaign launch plan and budget. Outline needs to create plans and budgets across rest of marketing, sales, CX, and product. Plan next call – 1 week. Call #8: Review template and approach for initial business case and sales and product alignment. Plan next call – 1 week. Call #9: Review initial business case and launch plans across marketing, sales, CX, and product. Plan next call – 1 week. |
Call #10: Discuss plans/needs/budgets for tech stack modernization. Plan next call – 3 days.
Call #11: Discuss plans/needs/budgets for CX readiness for launch. Plan next call – 3 days. Call #12: Discuss plans/needs/budgets for digital readiness for launch. Plan next call – 3 days. Call #13: Discuss plans/needs/budgets for marketing and sales readiness for launch. Plan next call – 3 days. Call #14: Review final business case and coach on Steering Committee Presentation. Plan next call – 1 week. |
A Go-to-Market Workshop Overview |
Contact your engagement manager for more information. |
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
Align on GTM Vision & Plan, Craft Initial Strategy |
Identify Initial Business Case, Sales Forecast and Launch Plan |
Develop Launch Plans (i of ii) |
Develop Launch Plans (ii of ii) |
Present Final Business Case to Steering Committee |
|
| Activities |
1.1 Outline a vision for GTM and roles required, identify Steering Committee lead, workstream leads, and teams. 1.2 Capture GTM strategy hypothesis by working through initial draft of GTM Strategy Presentation and business case. 1.3 Capture team knowledge on buyer persona and journey and competitive SWOT. 1.4 Identify information/data gaps and sources and plan for capturing/gathering including buyer interviews. Plan next day 2-3 weeks after buyer persona/journey interviews. |
2.1 Size product market opportunity and initial revenue forecast. 2.2 Craft initial product hypothesis from buyer interviews including feature priorities, pricing, packaging, competitive differentiation, and channel/route to market. 2.3 Craft initial launch campaign, product release, sales, and CX readiness plans. 2.4 Identify launch budgets across each investment area. 2.5 Discuss initial product launch business case and key activities. Plan next day 2-3 weeks after product hypothesis-validation interviews with customers and prospects. |
3.1 Apply product interviews to scope, MVP, and roadmap competitive differentiation, pricing, feature prioritization, routes to market and sales forecast. 3.2 Develop more detailed launch campaign plan complete with asset-types, messaging, digital plan to support buyer journey, media buy plan and campaign metrics. |
4.1 Develop detailed launch/readiness plans with final budgets for:
|
5.1 Review final launch/readiness plans with final budgets for all key areas. 5.2 Move all key findings up into Steering Committee presentation slides. 5.3 Present to Steering Committee, receive feedback. 5.4 incorporate Steering Committee feedback; update finial business case. |
| Deliverables |
|
|
|
|
|
| Phase 1
1.1 Select Steering Cmte/team, build aligned vision for GTM 1.2 Buyer personas, journey, initial messaging 1.3 Build initial product hypothesis 1.4 Size market opportunity 1.5 Outline digital/tech requirements 1.6 Competitive SWOT 1.7 Select routes to market 1.8 Craft GTM Strategy deck |
Phase 2
2.1 Brand consistency check 2.2 Formulate packaging and pricing 2.3 Craft buyer-valid product concept 2.4 Build campaign plan and targets 2.5 Develop cost budgets across all areas 2.6 Draft product business case 2.7 Update GTM Strategy deck |
Phase 3
3.1 Assess tech/tools support for all GTM phases 3.2 Outline sales enablement and Customer Success plan 3.3 Build awareness plan 3.4 Finalize business case 3.5 Final GTM Plan deck |
| Go-to-Market Strategy Presentation Template | Go-to-Market Strategy RACI and Launch Checklist Workbook | Buyer Persona and Journey blueprint | Product Market Opportunity Sizing Workbook |
|
|
|
|
Use the Go-to-Market Strategy Presentation Template to document the results from the following activities:
|
Use the Go-to-Market Strategy RACI and Launch Checklist Workbook to:
|
Use the Buyer Persona and Journey blueprint to:
|
Use the Product Market Opportunity Sizing blueprint to:
|
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Input: Steering Committee interviews, Recognition of Steering Committee interest
Output: List of GTM Strategy stakeholders as Steering Committee members
Materials: Following slide outlining the key responsibilities required of the Steering Committee members, A high-Level timeline of GTM Strategy phases and key milestone meetings
Participants: CMO, sponsoring executive, Functional leads - Marketing, Product Marketing, Product Management, Sales, Customer Success
SoftwareReviews Advisory Insight:
Go To Market Steering Committee’s can become an important ongoing body to steer overall product, pricing and other GTM decisions. Some companies have done so by adding the CEO and CFO to this committee and designated it as a permanent body that meets monthly to give go/no decisions to “all things product related” across all products and business units. Leaders that use this tool well, stay aligned, demonstrate consistency across business units and leverage outcomes across business units to drive greater scale.
Understand that aligning key stakeholders around the way your company goes to market is an essential company function.
| Title | Key Roles Supporting an Effective Go-to-Market Strategy |
| Go-to-Market Strategy Sponsor |
|
| Go-to-Market Strategy Program Manager |
|
| Functional Workstream Leads |
|
| Digital, Marketing/Sales Ops/IT Team |
|
| Steering Committee |
|
Download the Go-to-Market Strategy Presentation Template
Download the Go-to-Market Strategy RACI and Launch Checklist Workbook |
Success improves when you align & assign
|
Consider the skills and knowledge required for GTM Strategy as well as build and launch functions when choosing teams.
Work with functional leaders to select workstream leads
Workstream leads should be strong in collaboration, coordination of effort among others, knowledgeable about their respective function, and highly organized as they may be managing a team of colleagues within their function to deliver their responsible portion of GTM.
Required Skills/Knowledge
|
Suggested Functions
|
| Roles Required in Successful GTM Strategy | |
| For SMB companies, as employees wear many different hats, assign people that have the requisite skills and knowledge vs. the role title. |
|
Download the Go-to-Market Strategy RACI and Launch Checklist Workbook
Input: Stakeholders and leaders across the various functions outlined to the left
Output: List of go-to-market strategy team members
Materials: Go-to-Market Strategy Workbook
Participants: Initiative Manager, CMO, Sponsoring executive, Departmental Leads – Sales, Marketing, Product Marketing, Product Management (and others), Marketing Applications Director, Senior Digital Business Analyst
Download the Go-To-Market Strategy RACI and Launch Checklist Workbook
1 hour
GTM Program Managers:
Download the Go-to-Market Strategy Presentation Template
Input: N/A
Output: Team understanding of an effective go-to-market strategy, team roles and responsibilities and initial product and launch concept.
Materials: The Build a More Effective Go-to-Market Strategy Executive Brief
Participants: GTM Program Manager, CMO, Sponsoring executive, Workstream leads
Go to the Build a More Effective Go-to-Market Strategy Executive Brief
Program managers will:
Program managers & workstream leads will:
![]() Download the Go-to-Market Strategy RACI and Launch Checklist Workbook | Continuous improvement is enabled with a repeatable process
|
Work with your workstream leads to see them develop a detailed project plan that spans all their deliverables for a GTM Strategy
|
Using the Go-to-Market Strategy Presentation:
3-4 hours Initial, 1-2 hours weekly
|
Download the Go-to-Market Strategy Presentation Template
Download the Go-To-Market Strategy RACI and Launch Checklist Workbook
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Documenting buyer personas has several essential benefits to marketing, sales, and product teams:
|
“It’s easier buying gifts for your best friend or partner than it is for a stranger, right? You know their likes and dislikes, you know the kind of gifts they’ll have use for, or the kinds of gifts they’ll get a kick out of. Customer personas work the same way. By knowing what your customer wants and needs, you can present them with content targeted specifically to those wants and needs.” (Emma Bilardi, Product Marketing Alliance, July 8, 2020) |
A well defined buyer persona enables us to:
| Functional – “to find them” | ||||
| Job Role | Titles | Org Chart Dynamics | Buying Center | Firmographics |
| Emotive – “what they do and jobs to be done” | |||
| Initiatives – What programs/projects the persona is tasked with and what are their feelings and aspirations about these initiatives? Motivations? Build credibility? Get promoted? | Challenges – Identify the business issues, problems, and pain points, that impede attainment of objectives. What are their fears, uncertainties, and doubts about these challenges? | Buyer need – They may have multiple needs; which need is most likely met with the offering? | Terminology – What are the keywords/phrases they organically use to discuss the buyer need or business issue? |
| Decision Criteria – “how they decide” | |
| Buyer role – List decision-making criteria and power level. The five common buyer roles are champion, influencer, decision maker, user, and ratifier (purchaser/negotiator). | Evaluation and decision criteria – The lens, either strategic, financial, or operational, through which the persona evaluates the impact of purchase. |
| Solution Attributes – “what the ideal solution looks like” | ||||||
| Steps in “Jobs to be Done” | Elements of the “Ideal Solution” | Business outcomes from ideal solution | Opportunity scope – other potential users | Acceptable price for value delivered | Alternatives that see consideration | Solution sourcing – channel, where to buy |
| Behavioral Attributes – “how to approach them successfully” | ||
| Content preferences – List the persona’s content preferences, could be blog, infographic, demo, video, or other, vs. long-form assets (e.g. white paper, presentation, analyst report). | Interaction preferences – Which among in-person meetings, phone calls, emails, video conferencing, conducting research via web, mobile, and social. | Watering holes – Which physical or virtual places do they go to network or exchange info with peers e.g. LinkedIn, etc. |
If you haven’t re-mapped buyer journeys recently, you may be losing to competitors that have. Leaders re-map buyer journeys frequently.
SoftwareReviews Advisory Insight:
|
“Two out of three B2B buyers today prefer remote human interactions or digital self service.
And during August 2020-February 2021, use of digital self service leapt by 10%” (McKinsey & Company, 2021.) |
A lack of buyer persona and journey understanding is frequently the root cause of the following symptoms:
These challenges are often attributed to messaging and talk tracks that fail to resonate with prospects and products that fail to meet the needs of targeted buyers. SoftwareReviews Advisory Insight:
|
“Forty-four percent of B2B marketers have already discovered the power of personas.” (Boardview, 2016.) |
12 - 15 Hours, over course of 2-3 weeks
Input: Insights from Sellers, Insights from customers and prospects
Output: Completed slides outlining buyer persona, buyer journey, overall product concept, and detailed features and capabilities needed
Materials: Create a Buyer Persona and Journey blueprint, Go-to-Market Strategy Presentation
Participants: Product management lead, GTM Program Manager, Select sellers, Workstream leads that wish to participate in interviews
Download the Go-to-Market Strategy Presentation Template
Download the Create a Buyer Journey and Persona Journey blueprint
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
2 Hours
Input: Insights from Sellers, Insights from customers and prospects
Output: Completed slides outlining product concept and detailed features and capabilities needed
Materials: Go-to-Market Strategy Presentation
Participants: Product management lead, GTM Program Manager, Select sellers, Workstream leads that wish to participate in interviews
Download the Go-to-Market Strategy Presentation Template
At this early stage, summarize findings from concept interviews to guide further discovery, as well as go-to-market concepts and initial campaign concepts in upcoming steps.
Job Function AttributesTarget Persona(s):
Firmographics:
|
Emotive AttributesInitiative descriptions: Buyer description of project/program/initiative. What terms used? Business issues: What are the business issues related to this initiative? How is this linked to a CEO-level mission-critical priority? Key challenges: What business/process hurdles need to be overcome? Pain points: What are the pain points to the business/personally in their role related to the challenges that drove them to seek a solution? Success motivations: What motivates our persona to be successful in this area? |
Solution and OpportunitySteps to do the job: What are the needed steps to do this job today? Key features and capabilities: What are the key solution elements the buyer sees in the ideal solution? (See additional detail slide with prioritized features.) Key business outcomes: In business terms, what value (e.g. cost/time/FTE savings, deals won, smarter, etc.) is expected by implementing this solution? Other users/opportunities: Are there other users in the role team/company that would benefit from this solution? |
Pricing/PackagingWhat is an acceptable price to pay for this solution? Based on financial benefits and ROI hurdles, what’s a good price to pay? A high price? What are packaging options? Any competitive pricing to compare? |
Alternatives/CompetitionWhat are alternatives to this solution: How else would you solve this problem? Are there other solutions you’ve investigated? |
Channel PreferencesWhere would it be most convenient to buy?: Direct from provider? Channel partner/reseller? Download from the web? |
Decision Criteria AttributesDecision maker – Role, criteria/decision lens:
|
Behavioral AttributesInteraction preferences: Best way for us to reach this role? Email? At events? Texting? Video calls? Content types: Which content types (specifics; videos, short blog/article, longer whitepapers, etc.) help us stay educated about this initiative area? Content sources: What news, data, and insight sources (e.g. specifics) do you use to stay abreast of what’s important for this initiative area? |
Update the Go-to-Market Strategy Presentation with findings from Sales and customer/prospect interviews.
Ask buyers during interviews, as outlined in the Buyer Persona and Journey blueprint, to describe and rate key features by need. You will also review with buyers during the GTM Build phase, so it’s important to establish high priority features now.
|
|
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Your goal is to assess whether or not the opportunity is significantly sized and if you are well positioned to capture it
Download the Product Market Opportunity Sizing Workbook
SoftwareReviews Advisory Insight:
Product marketers that size the product market opportunity and account for the limitations posed by competitors, current sales coverage, brand permission, and awareness, provide their organizations with valuable insights into which inhibitors to growth should be addressed.
Your goal is two-fold: Determine the target market size, and develop a realistic 12–24 month forecast to support your business case
Download the Product Market Opportunity Sizing Workbook Download the Go-to-Market Strategy Presentation Template |
“Segmentation, targeting and positioning are the three pillars of modern marketing. Great segmentation is the bedrock for GTM success but is overlooked by so many.” (Product Marketing Alliance) |
Designing your go-to-market strategy does not require a robust customer experience management (CXM) platform, but implementing your strategy during the next steps of Go-to-Market – Build then Launch – certainly does.
Review info-Tech’s CXM blueprint to build a more complete, end-to-end customer interaction solution portfolio that encompasses CRM alongside other critical components.
The CXM blueprint also allows you to develop strategic requirements for CRM based on customer personas and external market analysis called for during your GTM Strategy design.
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Taking buyer needs ratings from step 1.3, assess your current and key competitive capabilities against buyer needs for both feature and non-feature capabilities. Incorporate into your initial product hypothesis.
Request from your SoftwareReviews Engagement Manager the “Importance vs. Satisfaction” analysis for your product(s) feature and non-feature capabilities under consideration for your GTM Strategy
| Satisfaction | ||
| Fix | Promote | |
| Importance |
Low Satisfaction
These features are important to their market and will highlight any differentiators to avoid market comparison.
|
High Satisfaction
These are real strengths for the organization and should be promoted as broadly as possible.
|
Low Satisfaction
These features are not important for the market and are unlikely to drive sales if marketing material focuses on them. Rationalize investment in these areas.
|
High Satisfaction
Features are relatively strong, so highlight that these features can meet customer needs
|
|
| Review | Maintain | |
Overall Category Product Feature Satisfaction Importance
(Optional for clients with buyer reviews and key competitive reviews within target product category.)
Example: ERP “Vendor A” ratings and recommended key actions. Incorporate this analysis into your product concept if updating an existing solution. Have versions of the below run for specific competitors.
Features in the “Fix” quadrant should be addressed in this GTM Strategy cycle.
Features in the “Review” quadrant are low in both buyer satisfaction and importance, so vendors are wise to hold on further investments and instead focus on “Fix.”
Features in the “Promote” quadrant are high in buyer importance and satisfaction, and should be called out in marketing and selling.
Features in the “Maintain” quadrant are high in buyer satisfaction, but lower in importance than other features – maintain investments here.
(Optional for clients with buyer reviews and key competitive reviews within target product category.)
Example: ERP “Vendor A” capabilities ratings and recommended key actions. Incorporate this analysis into your product concept for non-feature areas if updating an existing solution. Have versions of the below run for specific competitors.
Capabilities in the “Fix” quadrant should be addressed in this GTM Strategy cycle.
Capabilities in the “Review” quadrant are low in both buyer satisfaction and importance, so vendors are wise to hold on further investments and instead focus on “Fix.”
Capabilities in the “Promote” quadrant are high in buyer importance and satisfaction, and should be called out in marketing and selling.
Capabilities in the “Maintain” quadrant are high in buyer satisfaction, but lower in importance than other features – maintain investments here.
(Optional for clients with buyer reviews and key competitive reviews within target product category.)
Combining internal competitive knowledge with insights from buyer interviews and buyer reviews; establish which key features that will competitively differentiate your product when delivered
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Capture buyer channel preferences in Step 1.3, and research alternatives using the following framework
Inside vs. Field Sales – Selling software during COVID has taught us that you can successfully sell software using virtual conferencing tools, social media, the telephone, and even texting and webchat – so is the traditional model of field/territory-based sellers being replaced with inside/virtual sellers who can either work at home, or is there a benefit to being in the office with colleagues?
Solutions vs. Individual Products – Do your buyers prefer to buy a complete solution from a channel partner or a solutions integrator that puts all the pieces together, and can handle training and servicing, for a more complete buyer solution?
Channel Partner vs. Build Sales Force – Are there channel partners that, given your product is targeting a new buyer with whom you have no relationship, can leverage their existing relationships, quicken adoption of your products, and lower your cost of sales?
Fully Digital – Is your application one where users can get started for free then upgrade with more advanced features without the use of a field or inside sales person? Do you possess the e-commerce platform to support this?
While there are other considerations beyond the above to consider, decide which channel approach will work best for this GTM Strategy.
“One estimate is that for every dollar a firm spends on its SaaS platform, it spends four times that amount with systems integrators and other channel partners.
And as technologies are embedded inside other products, services, and solutions, effective selling requires more partners.
Salesforce, for example, is recruiting thousands of new partners, while Microsoft is reportedly adding over 7,000 partners each month.” (HBR, 2021)
Phase 1 - Formulate a hypothesis and run discovery on key fundamentals
| Step 1.1 | Step 1.2 | Step 1.3 | Step 1.4 | Step 1.5 | Step 1.6 | Step 1.7 | Step 1.8 |
Download the Go-to-Market Strategy Presentation Template
| Phase 1 1.1 Select Steering Cmte/team, build aligned vision for GTM 1.2 Buyer personas, journey, initial messaging 1.3 Build initial product hypothesis 1.4 Size market opportunity 1.5 Outline digital/tech requirements 1.6 Competitive SWOT 1.7 Select routes to market 1.8 Craft GTM Strategy deck | Phase 2 2.1 Brand consistency check 2.2 Formulate packaging and pricing 2.3 Craft buyer-valid product concept 2.4 Build campaign plan and targets 2.5 Develop cost budgets across all areas 2.6 Draft product business case 2.7 Update GTM Strategy deck | Phase 3 3.1 Assess tech/tools support for all GTM phases 3.2 Outline sales enablement and Customer Success plan 3.3 Build awareness plan 3.4 Finalize business case 3.5 Final GTM Plan deck |
| Go-to-Market Strategy Presentation Template | Go-to-Market Strategy RACI and Launch Checklist Workbook | Buyer Persona and Journey blueprint | Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook |
![]() | ![]() | ![]() | ![]() |
Use the Go-to-Market Strategy Presentation Template to document the results from the following activities:
| Use the Go-to-Market Strategy RACI and Launch Checklist Workbook to:
| Use the Buyer Persona and Journey blueprint to:
| Use the Go-to-Market Cost Budget and Revenue Forecast Workbook to:
|
Share messaging documented with the buyer journey with branding/creative and/or Marketing VP/CMO to ensure consistency with overall corporate messaging. Use the “Brand Diagnostic” on the following slide as a quick check.
For those marketers that see the need for a re-brand, please:
Download the Go-to-Market Strategy Presentation Template
Later during the Build phase of GTM, marketing assets, digital platforms, sales enablement, and sales training will be created where actual messaging can be written with brand guidelines aligned.
This step is to assess whether you we need to budget extra funds for any rebranding.
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
| Re-think tossing a new product into the same old marketing engine. Ask if your branding today and on this new offering needs help.
If you answer “no” to any of the following questions, you may need to re-think your brand. Does your brand:
|
“Nailing an impactful brand identity is a critical part of Growth Marketing. Without a well-crafted and maintained brand identity, your marketing will always feel flat and one-dimensional.” (Lean Labs, 2021) |
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
Download the Go-to-Market Strategy Presentation Template | Refer to the findings from buyer persona interviews
|
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
Download the Go-to-Market Strategy Presentation Template | “Innovation opportunities almost always come from understanding a company’s worst customers or customers it doesn’t serve” (Harvard Business School Press, 1997) |
Download the Go-to-Market Strategy Presentation Template | Refer to the findings from buyer persona interviews |
Your buyer interviews – whether during earlier steps or here during product concept validation – will give specific answers to all areas in green text below. Understanding channels, asset-types, and crafting your key messaging are essential for next steps.
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
2 hours
On the following Awareness and Lead Gen Engine slide:
On the Product and Launch Concept slides:
Download the Go-to-Market Strategy Presentation Template | “Only 32% of marketers – and 29% of B2B marketers – said the process of planning campaigns went very well. Just over half were sure they had selected the right business goal for a given marketing project and only 42% were confident they identified the right audience – which is, of course, a critical determinant for achieving success.” (MIT Sloan Management Review) |
Promote release in line with company story
Receive analyst feedback pre-launch and brief with final releases messaging/positioning
Download the Go-to-Market Strategy Presentation Template
We advise setting a target for the launch campaign. Here is a suggested approach:
Download the Go-to-Market Strategy Presentation Template | “Marketing should quantify its contribution to the business. One metric many clients have found valuable is Marketing Influenced Wins (MIW). Measured by what % of sales wins had a last-touch marketing attribution, marketers in the 30% – 40% MIW range are performing well.” (SoftwareReviews Advisory Research) |
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Note that in the Align Step – Step 3, you will see your workstream leads each develop their individual contributions to both the launch plan as well a budget.
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
Your goal: Earn more than you spend! This projection of estimated gross margins should be part of your product launch business case. The GTM initiative lead and workstream leads are charged with estimating incremental costs, and product and sales must work together on the revenue forecast.
Net ReturnWe estimate our 12 month gross profit to be …. Quarterly RevenuesBased on sales forecast, our quarterly/monthly revenues are …. Estimated ExpensesIncremental up-front costs are expected to be …. |
|
|
Product Business Case Checklist:
|
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Phase 2 – Validate designs with buyers and solidify product business case
| Step 2.1 | Step 2.2 | Step 2.3 | Step 2.4 | Step 2.5 | Step 2.6 | Step 2.7 |
Download the Go-to-Market Strategy Presentation Template
| Phase 1 1.1 Select Steering Cmte/team, build aligned vision for GTM 1.2 Buyer personas, journey, initial messaging 1.3 Build initial product hypothesis 1.4 Size market opportunity 1.5 Outline digital/tech requirements 1.6 Competitive SWOT 1.7 Select routes to market 1.8 Craft GTM Strategy deck | Phase 2 2.1 Brand consistency check 2.2 Formulate packaging and pricing 2.3 Craft buyer-valid product concept 2.4 Build campaign plan and targets 2.5 Develop cost budgets across all areas 2.6 Draft product business case 2.7 Update GTM Strategy deck | Phase 3 3.1 Assess tech/tools support for all GTM phases 3.2 Outline sales enablement and Customer Success plan 3.3 Build awareness plan 3.4 Finalize business case 3.5 Final GTM Plan deck |
| Go-to-Market Strategy Presentation Template | Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook |
|
|
Use the Go-to-Market Strategy Presentation Template to document the results from the following activities:
|
Use the Go-to-Market Cost Budget and Revenue Forecast Workbook to:
|
Phase 3 – Align functional plans with a compelling business case for product build
| Step 3.1 | Step 3.2 | Step 3.3 | Step 3.4 | Step 3.5 |
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Phase 3 – Align functional plans with a compelling business case for product build
| Step 3.1 | Step 3.2 | Step 3.3 | Step 3.4 | Step 3.5 |
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Phase 3 – Align functional plans with a compelling business case for product build
| Step 3.1 | Step 3.2 | Step 3.3 | Step 3.4 | Step 3.5 |
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook
Download the Go-to-Market Strategy Presentation Template
Phase 3 – Align functional plans with a compelling business case for product build
| Step 3.1 | Step 3.2 | Step 3.3 | Step 3.4 | Step 3.5 |
Go to the Go-to-Market Budget Workbook as outlined in prior steps and document final incremental costs and projected revenues and summarize within the Go-to-Market Strategy Presentation. Download the Go-to-Market Strategy Cost Budget and Revenue Forecast Workbook Download the Go-to-Market Strategy Presentation Template | Product Build and Launch Business Case Checklist:
|
Phase 3 – Align functional plans with a compelling business case for product build
| Step 3.1 | Step 3.2 | Step 3.3 | Step 3.4 | Step 3.5 |
Download the Go-to-Market Strategy Presentation Template
By guiding your team through the Go-to-Market planning process applied to an actual GTM Strategy, you have built an important set of capabilities that underpins today’s well-managed software companies. By following the step-by-step process outlined in this blueprint, you have delivered a host of benefits that include the following:
Therefore, developing the capabilities to manage a complex go-to-market strategy is akin to building company scalability and is sought after as a professional development opportunity that each executive should have on his/her résumé.
Contact your account representative for more information.
Acosta, Danette. “Average Customer Retention Rate by Industry.” Profitwell.com. Accessed Jan. 2022.
Ashkenas, Ron, and Patrick Finn. “The Go-To-Market Approach Startups Need to Adopt.” Harvard Business Review, June 2016. Accessed Jun. 2021.
Bilardi, Emma. “ How to Create Buyer Personas.” Product Marketing Alliance, July 2020. Accessed Dec. 2021.
Cespedes, Frank V. “Defining a Post-Pandemic Channel Strategy.” Harvard Business Review, Apr. 2021. Accessed Jul. 2021.
Chapman, Lawrence. “A Visual Guide to Product Launches.” Product Marketing Alliance. Accessed Jul. 2021.
Chapman, Lawrence. “Everything You Need To Know About Go-To-Market Strategies.” Product Marketing Alliance. Accessed Jul. 2021.
Christiansen, Clayton. “The Innovators Dilemma.” Harvard Business School Press, 1997.
Drzewicki, Matt. “Digital Marketing Maturity: The Path to Success.” MIT Sloan Management Review. Accessed Dec. 2021.
“Go-To-Market Refresher,” Product Marketing Alliance. Accessed Jul. 2021
Harrison, Liz; Dennis Spillecke, Jennifer Stanley, and Jenny Tsai. “Omnichannel in B2B sales: The new normal in a year that has been anything but.” McKinsey & Company, 15 March, 2021. Accessed Dec. 2021.
Jansen, Hasse. “Buyer Personas – 33 Mind Blowing Stats.” Boardview, 19 Feb. 2016. Accessed Jan. 2022.
Scott, Ryan. “Creating a Brand Identity: 20 Questions to Consider.” Lean Labs, Jun 2021. Accessed Jul. 2021.
Smith, Michael L., and James Erwin. “Role and Responsibility Charting (RACI).” DOCSearch. Accessed Jan. 2022. Web.
“What is the Total Addressable Market (TAM).” Corporate Finance Institute (CFI), n.d. Accessed Jan. 2022.
|
Create a Buyer Persona and Journey
|
|
Optimize Lead Generation With Lead Scoring
|
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Our concise executive brief explains to you the challenges associated with the organizational redesign. We'll show you our methodology and the ways we can help you in completing this.
The design principles will govern your organizational redesign; Align the principles with your business strategy.
Your operating model must account for the company's nuances and culture.
Go from an operating model to the structure fit for your company.
Change does not come easy. People will be anxious. Craft your communications to address critical concerns and obtain buy-in from the organization. If the reorganization will be painful, be up-front on that, and limit the time in which people are uncertain.
Today, we're talking about a concept that’s both incredibly simple and dangerously overlooked: the single point of failure, or SPOF for short.
Imagine you’ve built an impenetrable fortress. It has high walls, a deep moat, and strong gates. But the entire fortress can only be accessed through a single wooden bridge. That bridge is your single point of failure. If it collapses or is destroyed, your magnificent fortress is completely cut off. It doesn't matter how strong the rest of it is; that one weak link renders the entire system useless.
In your work, your team, and your processes and technology, these single bridges are everywhere. A SPOF is any part of a system that, if it stops working, will cause the entire system to shut down. It’s the one critical component, the one indispensable person, or the one vital process that everything else depends on.
When you identify and fix these weak points you aren't being pessimistic; you're fixing the very foundation of something that can withstand shocks and surprises. It’s about creating truly resilient systems and teams, not just seemingly strong ones. So, let’s explore where these risks hide and what you can do about them.
For those of you who know me, saying something like this feels at odds with who I am. And yet, it's one of the most common and riskiest areas in any organization. Human single points of failure don't happen because of malicious intent. They typically grow out of good intentions, hard work, and necessity. But the result is the same: a fragile system completely dependent on an individual.
We all know a colleague like this. The “hero” is the one person who has all the answers. When a critical system goes down at 3 AM, they're the only one who can fix it. They understand the labyrinthine codebase nobody else dares to touch. They have the historical context for every major decision made in the last decade. On the surface, this person is invaluable. Management loves them because they solve problems. The team relies on them because they’re a walking encyclopedia.
But here’s the inconvenient truth: your hero is your biggest liability.
This isn’t their fault. They likely became the hero by stepping up when no one else would or could. The hero may actually feel like they are the only ones qualified to handle the issue because “management” does not take the necessary actions to train other people. Or “management” places other priorities. Be aware, this is a perception thing. The manager is very likely to be very concerned about the well-being of their employee. (I'm taking "black companies", akin to black sites, out of the equation for a moment and concentrating on generally healthy workplaces.) The hero will likely feel a strong bond to their environment. Also, every hero is different. There is a single point of failure, but not a single type of person. Every person has a different driver.
I watched a YouTube video by a famous entrepreneur the other day. And she said something that triggered a response in me, because it sows the seeds of the hero. She said, Would you rather have an employee who just fixes it, handles it, and deals with it? Or an employee that talks about it? Obviously, the large majority will take the person behind door number 1. I would too. But then you need to step up as a manager, as an owner, as an executive, and enforce knowledge sharing.
If you channel all critical knowledge and capabilities through one person, if you let this person become your go-to specialist for everything, you've created a massive SPOF. What happens when your hero gets sick, takes a well deserved two week vacation to a place with no internet, or leaves the company for a new opportunity? The system grinds to a halt. A minor issue becomes a major crisis because the only person who can fix it is unavailable.
This overreliance doesn't just create a risk; it stifles growth. Other team members don't get the opportunity to learn and develop new skills because the hero is always there to swoop in and save the day. The answer? I guess that depends on your situation and what your ability is to keep this person happy without alienating the rest of the team. The answer may lie in the options discussed later in the article around KPIs.
A step beyond the individual hero is the team that acts as a collective SPOF. This is the team that “protects” its know how. They might use complex, undocumented tools, speak in a language of acronyms only they understand, or resist any attempts to standardize their processes. They've built a silo around their work, making themselves indispensable as a unit.
Unlike the hero, this often comes from a place of perceived self preservation. If they are the only ones who understand how something works, their jobs are secure, right? But this behavior is incredibly damaging to the organization's resilience. Not to mention that it is just plain wrong. The team becomes inundated with requests for new features, but also for help in solving incidents. The result in numerous instances is that the team succeeds in neither. Next the manager is called to the senior management because the business is complaining that things don't progress as expected.
This team thus has become a bottleneck. Any other team that needs to interact with their system is completely at their mercy. Progress slows to a crawl, dependent on their availability and willingness to cooperate. Preservation has turned into survival.
The real root cause at the heart of both the hero and the knowledge hoarding team is a failure of knowledge management. When information isn't shared, documented, and made accessible, you are actively choosing to create single points of failure. We'll dive deeper into building a robust knowledge sharing culture in a future article, but for now, recognize that knowledge kept in one person's or team's head is a disaster waiting to happen.
People aren't the only source of fragility. The way you build and manage your technology stacks can easily create critical SPOFs that leave you vulnerable. These are often less obvious at first, but they can cause dangerous failures when they finally break.
Let's start with the most straightforward technical SPOF: the single node setup. Imagine you have a critical application like maybe your company's main website or an internal database. If you run that entire application on one single server (a single “node”), you've created a classic SPOF.
It’s like a restaurant with only one chef. If that chef goes home, the kitchen closes. It doesn't matter how many waiters or tables you have. If that single server experiences a hardware failure, a software crash, or even just needs to be rebooted for an update, your entire service goes offline. There is no failover. The service is simply down until that one machine is fixed, patched or rebooted.
You need to set up your systems so that when one node goes down, the other takes over. This is not just something for large enterprises. SMEs must do the same. I've had numerous calls from business owners who did something to their web server or system and now “it doesn't work!” Not only are they down, now they have to call me and I then must arrange for subject matter experts to fix it immediately. Typically at a cost much larger than if they had set up their system with active, warm or even cold standbys.
Another major risk comes from an overreliance on closed, proprietary technologies. This happens when you build a core part of your business on a piece of software or hardware that you don't control and can't inspect. It’s a “black box.” You know what it’s supposed to do, but you have no idea how it does it, and you can’t fix it if it breaks. When something goes wrong, you are completely at the mercy of the company that created it. You have to submit a support ticket and wait.
This is actually relatable to the next chapter, please follow along and take the advice there.
Closely related to closed technology is the concept of vendor lock-in. This is a subtle but powerful SPOF. It happens when you become so deeply integrated with a single vendor's ecosystem that the cost and effort of switching to a competitor are impossibly high. Your vendor effectively becomes a strategic single point of failure. Your ability to innovate, control costs, and pivot your strategy is now tied to the decisions of another company.
This may even run afoul of legal standards. In Europe, we have the DORA and NIS2 regulations. DORA specifically mandates that companies have exit plans for their systems, starting with their critical and important functions. Functions refers to business services, to be clear.
But we get there so easily. The native functions of AWS, Azure and Google Cloud, just to name a few, are very enticing to use. They offer convenience, low code, and performance on tap. It's just that, once you integrate deeply with them, you are taken, hook, line, and sinker. And then you have people like me, or worse, your regulator, who demands “What is your exit plan?”
Identifying your single points of failure is the first step. The real work is in systematically eliminating them. This isn't about a single, massive project; it's about building new habits and principles into your daily work. Here's a playbook I think you can start using today.
The cure for depending on one person is to create a culture where knowledge is fluid and shared by default. Your goal is to move from individual heroics to collective resilience.
Mandate real vacations. This might sound strange, but one of the best ways to reveal and fix a “hero” problem is to make sure your hero takes a real, disconnected vacation. This isn't a punishment; it's a benefit to them and a necessary stress test for the team. It forces others to step up and document their processes in preparation. The first time will be painful, but it gets easier each time as the team builds its own knowledge.
Adopt the “teach, don't just do” rule. Coach your senior experts to see their role as multipliers. When someone asks them a question, their first instinct should be to show, not just to do. This can be a five minute screen sharing session, grabbing a colleague to pair program on a fix, or taking ten minutes to write down the answer in a shared knowledge base so it never has to be asked again.
Many companies have knowledge sharing solutions in place. Take a moment to actually use them. Prepare for when new people come into the company. Have a place where they can get into the groove and learn the heart beat of the company. There is a reason why the Madonna song is so captivating to so many people. Getting into the groove elevates you. And the same thing happens in your company.
Rotate responsibilities and run "game days". Actively move people around. Let a developer handle support tickets for a week to understand common customer issues. Have your infrastructure expert sit with the product team. Also, create “game days” where you simulate a crisis. For example: "Okay team, our lead developer is 'on vacation' today. Let's practice a full deployment without them.” This makes learning safe and proactive.
Celebrate team success, not individual firefighting. Shift your praise and recognition. Instead of publicly thanking a single person for working all night to resolve a problem, celebrate the team that built a system so resilient it didn't break in the first place. Reward the team that wrote excellent documentation that allowed a junior member to solve a complex issue. Culture follows what you celebrate. At the same time, if the team does not pony up, definitely praise the person and follow up with the team to fix this.
Host internal demos and tech talks. Create a regular, informal forum where people can share what they're working on. This could be a “brown bag lunch” session or a Friday afternoon demo. It demystifies what other teams are doing, breaks down silos, and encourages people to ask questions in a low pressure environment.
Remunerate sharing. Make sharing knowledge a bonus-eligible key performance indicator. The more sharing an expert does, with their peers acknowledging this, the more the expert earns. You can easily incorporate this into your peer feedback system.
Run DRP exercises without your top engineers: This is taking a leap of faith, and I would never recommend this until all of the above are in place and proven.
The core principle here is to assume failure will happen and to design for it. A resilient system isn't one where parts never fail, but one where the system as a whole keeps working even when they do.
Embrace the rule of three. This is a simple but powerful guideline. For critical data, aim to have three copies on two different types of media, with one copy stored off-site (or in a different cloud region). For critical services, aim for at least three instances running in different availability zones. This simple rule protects you from a wide range of common failures.
Automate everything you can. Every manual process is a potential SPOF. It relies on a person remembering a series of steps perfectly, often under pressure. Automate your testing, your deployments, your server setup, and your backup procedures. Scripts are consistent and repeatable; tired humans at 3 AM are not.
Use health checks and smart monitoring. It's not enough to have a backup server; you need to know that it's healthy and ready to take over. Implement automated health checks that constantly monitor your primary and redundant systems. Your monitoring should alert you the moment a backup component fails, not just when the primary one does.
Practice chaos engineering. Don't wait for a real failure to test your resilience. Intentionally introduce failures in a controlled environment. This is known as chaos engineering. Start small. What happens if you turn off a non-critical service during work hours? Does the system handle it gracefully? Does the team know how to respond? This turns a potential crisis into a planned, educational drill.
Your resilience also depends on the choices you make about the technology and partners you rely on. The goal is to maintain control over your destiny.
Build abstraction layers. Instead of having your application code talk directly to a specific vendor's service, create an intermediary layer that you control. This “abstraction layer” acts as a buffer. If you ever need to switch vendors, you only have to update your abstraction layer, not your entire application. It’s more work up front but gives you immense flexibility later.
Make “ease of exit” a key requirement. When you evaluate a new technology or vendor, make portability a primary concern. Ask tough questions: How do we get our data out? What is the process for migrating to a competitor? Is the technology based on open standards? Run a small proof of concept to test how hard it would be to leave before you commit fully.
Consider a multi-vendor strategy. For your most critical dependencies, like cloud hosting, avoid going all in on a single provider if you can. Using services from two or more vendors is an advanced strategy, but it provides the ultimate protection against a massive, platform wide outage or unfavorable changes in pricing or terms.
You will never be “ready.” Building resilience by eliminating single points of failure isn't a one time project you can check off a list. It’s a continuous process. New SPOFs will emerge as your systems evolve, people change roles, and your business grows.
The key is to make this thinking a part of your culture. Make “What's the bus factor for this project?” a regular question in your planning meetings. Make redundancy and documentation a non negotiable requirement for new systems. By constantly looking for the one thing that can bring everything down, you can build teams and technology that don't just survive shocks—they eat them for breakfast.
Your newly hybrid workplace will include virtual, hybrid, and physical meetings, presenting several challenges:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the problem before you try to fix it. Before you can improve meetings, you need to understand what your norms and challenges currently are.
Document meeting roles, expectations, and how meetings should run. Decide what kind of meeting delivery model to use and develop a training program.
Always be consulting with users: early in the process to set a benchmark, during and after every meeting to address immediate concerns, and quarterly to identify trends and deeper issues.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the current state of meetings in your organization.
What you need to keep doing and what you need to change
1.1 Brainstorm meeting types.
1.2 Document meeting norms.
1.3 Document and categorize meeting challenges.
Documented challenges with meetings
Meeting norms
Desired changes to meeting norms
Review and implement meeting best practices.
Defined meeting best practices for your organization
2.1 Document meeting roles and expectations.
2.2 Review common meeting challenges and identify best practices.
2.3 Document when to use a hybrid meeting, virtual meeting, or an in-person meeting.
2.4 Develop a training program.
Meeting roles and expectations
List of meeting best practices
Guidelines to help workers choose between a hybrid, virtual, or in-person meeting
Training plan for meetings
Identify opportunities to improve meeting technology.
A strategy for improving the underlying technologies and meeting spaces
3.1 Empower virtual meeting attendees.
3.2 Optimize spaces for hybrid meetings.
3.3 Build a team of meeting champions.
3.4 Iterate to build and improve meeting technology.
3.5 Guide users toward each technology.
Desired improvements to meeting rooms and meeting technology
Charter for the team of meeting champions
Communications Guide Poster
Build a chatbot that creates value for your business
Read our concise Executive Brief to find out why you building a chatbot proof of concept is a good idea, review our methodology, and understand the four ways we can support you to successfully complete this project. Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Build the right metrics to measure the success of your chatbot POC
Architect the chatbot to maximize business value
Now take your chatbot proof of concept to production
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
State the success criteria of your application management practice through defined objectives and metrics. Assess your maturity.
Structure your application management governance model with the right process and roles. Inject product ownership into your practice.
Build your application management optimization roadmap to achieve your target state.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
State the success criteria of your application management practice through defined objectives and metrics.
Assess your maturity.
Grounded stakeholder expectations
Application management maturity and identification of optimization opportunities
1.1 Set your objectives.
1.2 Assess your maturity.
Application management objectives and metrics
Application management maturity and optimization opportunities
Structure your application management governance model with the right process and roles.
Inject product ownership into your practice.
Management approach aligned to product value and criticality
Management techniques to govern the product backlog
Target-state application management process and roles
2.1 Select your management approach.
2.2 Manage your single product backlog.
2.3 Optimize your management process.
2.4 Define your management roles.
Application management approach for each application
Product backlog management practices
Application management process
Application management roles and responsibilities and communication flow
Build your application management optimization roadmap to achieve your target state.
Optimization opportunities
Application management optimization roadmap
3.1 Build your optimization roadmap.
Application management optimization roadmap
During peak business hours, I witnessed a straightforward database field addition bring down a whole e-commerce platform. It was meant to be standard procedure, the type of “standard change” that is automatically approved because we have performed it innumerable times.
Adding a field to the end of a table and having applications retrieve data by field name instead of position made the change itself textbook low-impact. There is no need to alter the application or the functional flow. This could have been problematic in the past if you added a field in the middle of the list and it affected the values of other fields, but adding it at the end? That ought to have been impenetrable.
However, it wasn't.
Before I tell you what went wrong, let me explain why this is important to all of the IT professionals who are reading this.
Over the past three decades, industry data has repeatedly supported what this incident taught me: our presumptions about “safe” changes are frequently our greatest weakness. Upon reviewing the ITIL research, I was not surprised to learn that failed changes, many of which were categorized as “standard” or “low-risk,” are responsible for about 80% of unplanned outages.
When you look more closely, the numbers become even more concerning. Since I've been following the Ponemon Institute's work for years, I wasn't surprised to learn that companies with well-established change management procedures have 65% fewer unscheduled outages. The paradox surprised me: many of these “mature” procedures still operate under the premise that safety correlates with repetition.
What I had been observing in the field for decades was confirmed when Gartner released their research showing that standard changes are responsible for almost 40% of change-related incidents. The very changes we consider safe enough to avoid thorough review subtly create some of our greatest risks. IBM's analysis supports the pattern I've seen in innumerable organizations: standard changes cause three times as much business disruption due to their volume and our decreased vigilance around them, whereas emergency changes receive all the attention and scrutiny.
Aberdeen Group data indicates that the average cost of an unplanned outage has increased to $300,000 per hour, with change-related failures accounting for the largest category of preventable incidents. This data makes the financial reality stark.
What precisely went wrong with the addition of that database field that caused our e-commerce platform to crash?
We were unaware that the addition of this one field would cause the database to surpass an internal threshold, necessitating a thorough examination of its execution strategy. In its algorithmic wisdom, the database engine determined that the table structure had changed enough to necessitate rebuilding its access and retrieval mechanisms. Our applications relied on high-speed requests, and the new execution plan was terribly unoptimized for them.
Instead of completing quotes or purchases, customers were spending minutes viewing error pages. All applications began to time out while they awaited data that just wasn't showing up in the anticipated amounts of time. Thousands of transactions were impacted by a single extra field that should have been invisible to the application layer.
The field addition itself was not the primary cause. We assumed that since we had made similar adjustments dozens of times previously, this one would also act in the same way. Without taking into account the hidden complexities of database optimization thresholds, we had categorized it as a standard change based on superficial similarities.
My approach to standard changes was completely altered by this experience, and it is now even more applicable in DevOps-driven environments. Many organizations use pipeline deployments, which produce a standard change at runtime. It's great for speed and reliability, but it can easily fall into the same trap.
However, I have witnessed pipeline deployments result in significant incidents for non-code-related reasons. Due to timing, resource contention, or environmental differences that weren't noticeable in earlier runs, a deployment that performed flawlessly in development and staging abruptly fails in production. Although the automation boosts our confidence, it may also reveal blind spots.
Over the course of thirty years, I have come to the unsettling realization that there is no such thing as a truly routine change in complex systems. Every modification takes place in a slightly different setting, with varying environmental factors, data states, and system loads. What we refer to as “standard changes” are actually merely modifications with comparable processes rather than risk profiles.
For this reason, I support contextual change management. We must consider the system state, timing, dependencies, and cumulative effect of recent changes rather than just categorizing them based on their technical features. After three other changes have changed the system's behavior patterns, a change made at two in the morning on a Sunday with little system load is actually different from the same change made during peak business hours.
Effective change advisory boards must therefore go beyond assessing individual changes separately. I've worked with organizations where the change board carefully considered and approved each modification on its own merits, only to find that the cumulative effect of seemingly unrelated changes led to unexpected interactions and stress on the system. The most developed change management procedures I've come across mandate that their advisory boards take a step back and look at the whole change portfolio over a specified period of time. They inquire whether we are altering the database too frequently during a single maintenance window. Could there be unanticipated interactions between these three different application updates? What is the total resource impact of this week's approved changes?
It's the distinction between forest management and tree management. While each change may seem logical individually, when combined, they can create situations beyond the scope of any single change assessment.
Having worked in this field for thirty years, I've come to the conclusion that our greatest confidences frequently conceal our greatest vulnerabilities. Our primary blind spots frequently arise from the changes we've made a hundred times before, the procedures we've automated and standardized, and the adjustments we've labeled as “routine.”
Whether we should slow down our deployment pipelines or stop using standard changes is not the question. In the current competitive environment, speed and efficiency are crucial. The issue is whether we are posing the appropriate queries before carrying them out. Are we taking into account not only what the change accomplishes but also when it occurs, what else is changing at the same time, and how our systems actually look right now?
I've discovered that the phrase “we've done this before” is more dangerous in IT operations than “what could go wrong?” Because, despite what we may believe, we never actually perform the same action twice in complex systems.
Here is what I would like you to think about: which everyday modifications are subtly putting your surroundings at risk? Which procedures have you standardized or automated to the extent that you no longer challenge their presumptions? Most importantly, when was the last time your change advisory board examined your changes as a cohesive portfolio of system modifications rather than as discrete items on a checklist?
Remember that simple addition to a database field the next time you're tempted to accept a standard change. The most unexpected outcomes can occasionally result from the most routine adjustments.
I'm always up for a conversation if you want to talk about your difficulties with change management.
Digital Marketers working with an outdated or bad SEO strategy often see:
Most marketers fail in their SEO efforts because they focus on creating content for computers, not people.
Using the SoftwareReviews methodology, digital marketers are able to break up their SEO project and data into bite-sized, actionable steps that focus on long-term improvement. Our methodology includes:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Update your on-page SEO strategy with competitively relevant keywords.
Most marketers fail in their SEO efforts because they focus on creating content for computers, not people.
Leading search engine optimization methods focus on creating and posting relevant keyword-rich content, not just increasing page rank. Content and keywords should move a buyer along their journey, close a sale, and develop long-term relationships. Unfortunately, many SEO specialists focus on computers, not the buyer. What's even more concerning is that up to 70% of SaaS businesses have already been impacted by outdated and inefficient SEO techniques. Poor strategies often focus on ballooning SEO metrics in the short-term instead of building the company's long-term PageRank.
Best-in-class digital marketers stop chasing the short-term highs and focus on long-term growth. This starts with developing a competitive keyword strategy and updating website content with the new keywords.
SEO is a large topic, so we have broken the strategy into small, easy-to-implement steps, taking the guesswork out of how to use the data from SEO tools and giving CMOs a solid path to increase their SEO results.
Terra Higginson
Marketing Research Director
SoftwareReviews
Digital marketers working with an outdated or bad SEO strategy often see:
Search algorithms change all the time, which means that the strategy is often sitting on the sifting sands of technology, making SEO strategies quickly outdated.
Digital marketers are responsible for developing and implementing a competitive SEO strategy but increasingly encounter the following obstacles:
Using the SoftwareReviews methodology, digital marketers are able to break up their SEO project and data into bite-sized, actionable steps that focus on long-term improvement. Our methodology includes:
Our methodology will take a focused step-by-step strategy in a series of phases that will increase PageRank and competitive positioning.
The difference between good and bad SEO techniques.
| Common Good SEO Techniques |
Common Poor |
|---|---|
|
|
Search Volume: this measures the number of times a keyword is searched for in a certain time period. Target keywords with a volume of between 100-100,000. A search volume greater than 100,000 will be increasingly difficult to rank (A Beginner's Guide to Keyword Search Volume, 2022, Semrush).
Keyword Difficulty: the metric that quantifies how difficult it will be to rank for a certain keyword. The keyword difficulty percentage includes the number of competitors attempting to rank for the same keyword, the quality of their content, the search intent, backlinks, and domain authority (Keyword Difficulty: What Is It and Why Is It Important? 2022, Semrush).
Intent: this metric focuses on the intent of the user's search. All search intent is categorized into Informational, Commercial, Navigational, and Transactional (What Is Search Intent? A Complete Guide, 2022, Semrush).
On-Page SEO: refers to the practice of search engine optimizing elements of your site such as title tags, internal links, HTML code, URL optimization, on-page content, images, and user experience.
Off-Page SEO: refers to the practice of optimizing brand awareness (What Is Off-Page SEO? A Comprehensive Guide, 2022, Semrush).
H1: HTML code that tells a search engine the title of the page (neilpatel.com).
SEO Tool: A subscription-based all-in-one search engine optimization MarTech tool.
Google's mission is to organize the world's information and make it universally accessible and useful… We believe Search should deliver the most relevant and reliable information available.
– An excerpt from Google's mission statement
Digital marketers with SEO problems will often see the following issues:
The best place to hide a dead body is on page two of the search results.
– Huffington Post
SEO is a helpful activity when it's applied to people-first content. However, content created primarily for search engine traffic is strongly correlated with content that searchers find unsatisfying.
– Google Search Central Blog
61%
61% of marketers believe that SEO is the key to online success.
Source: Safari Digital
437%
Updating an existing title tag with an SEO optimised one can increase page clicks by more than 437%.
Source: Safari Digital
What type of content is the user searching for? Align your keyword to the logical search objective.
This term categorizes search intent for when a user wants to inform or educate themselves on a specific topic.
This term categorizes search intent for when a user wants to do research before making a purchase.
This term categorizes search intent for when a user wants to purchase something.
This term categorizes search intent for when a user wants to find a specific page.
| 1. Competitive Analysis & Keyword Discovery | 2. On-Page Keyword Optimization | |
|---|---|---|
| Phase Steps |
|
|
| Phase Outcomes |
|
|
| Phase 1 | Phase 2 | ||||
|---|---|---|---|---|---|
|
Call #1: Identify your current SEO keyword strategy. |
Call #2: Discuss how to start a competitive keyword analysis. |
Call #4: Discuss how to build the list of target keywords. |
Call #6: Discuss keyword optimization of the product & services pages. |
Call #8: (optional) Schedule a call to update every three to six months. |
|
|
Call #3: Discuss the results of the competitive keyword analysis. |
Call #5: Discuss which pages to update with new target keywords. |
Call #7: Review final page content and tags. |
Call #9: Schedule a call for SEO Phase 2: On-Page Technical Refinement. |
||
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between 8 to 12 calls over the course of 1 to 2 months.
| Phase 1 | Phase 2 | ||||
|---|---|---|---|---|---|
|
Call #1: Identify your current SEO keyword strategy. |
Call #2: Discuss how to start a competitive keyword analysis. |
Call #4: Discuss how to build the list of target keywords. |
Call #6: Discuss keyword optimization of the product & services pages. |
Call #8: (optional) Schedule a call to update every three to six months. |
|
|
Call #3: Discuss the results of the competitive keyword analysis. |
Call #5: Discuss which pages to update with new target keywords. |
Call #7: Review final page content and tags. |
Call #9: Schedule a call for SEO Phase 2: On-Page Technical Refinement. |
||
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between 8 to 12 calls over the course of 1 to 2 months.
| Included Within an Advisory Membership | Optional Add-Ons | ||
|---|---|---|---|
| DIY Toolkit | Guided Implementation | Workshop | Consulting |
| "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." | "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." | "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." | "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project." |
Best-in-class SEO practitioners focus on people-first content, not computer-first content. Search engine algorithms continue to focus on how to rank better content first, and a strategy that moves your buyers through the funnel in a logical and cohesive way will beat any SEO trick over the long run.
A good SEO strategy uses competitive research to carve out white space and give them a competitive edge in an increasingly difficult ranking algorithm. An understanding of the ideal client profile and the needs of their buyer persona(s) sit as a pre-step to any good SEO strategy.
By optimizing the on-page strategy with competitively relevant keywords that target your ideal client profile, marketers are able to take an easy first step at improving the SEO content strategy.
If you don't understand the strategy of your SEO practitioner, you are in trouble. Marketers need to work hand in hand with their SEO specialists to quickly uncover gaps, create a strategy that aligns with the buyer persona(s), and execute the changes.
The quality of the prospect that your SEO efforts bring to your site is more important than the number of people brought to your site.
If not, stop here, and we can help you define your buyer persona and journey, as well as your ideal client profile before moving forward with SEO Phase 1.
Use your SEO tool to research keywords and find the following:
Use a quality tool like SEMRush to obtain SEO data.
Use your SEO tool to research keywords and find the following:
Use a quality tool like SEMRush to obtain SEO data.
Duplicate this page so that you have a separate page for each URL from Step 4
Date last optimized:
mm/dd/yyyy
Council, Y. "Council Post: The Rundown On Black Hat SEO Techniques And Why You Should Avoid Them." Forbes, 2022. Accessed September 2022.
"Our approach – How Google Search works." Google Search. Accessed September 2022.
"The Best Place to Hide a Dead Body is Page Two of Google." HuffPost, 2022. Accessed September 2022.
Patel, Neil. "How to Create the Perfect H1 Tag for SEO." neilpatel.com. Accessed September 2022.
Schwartz, B. "Google algorithm updates 2021 in review: Core updates, product reviews, page experience and beyond." Search Engine Land, 2022. Accessed September 2022.
Schwartz, B. "Google algorithm updates 2021 in review: Core updates, product reviews, page experience and beyond." Search Engine Land, 2022. Accessed September 2022.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Deciding which service desk metrics to track and how to analyze them can be daunting. Use this deck to narrow down your goal-oriented metrics as a starting point and set your own benchmarks.
For each metric, consider adding the relevant overall goal, audience, cadence, and action. Use the audience and cadence of the metric to split your tracked metrics into various dashboards. Your final list of metrics and reports can be added to your service desk SOP.
When establishing a suite of metrics to track, it’s tempting to start with the metrics measured by other organizations. Naturally, benchmarking will enter the conversation. While benchmarking is useful, measuring you organization against others with a lack of context will only highlight your failures. Furthermore, benchmarks will highlight the norm or common practice. It does not necessarily highlight best practice.
Keeping the limitations of benchmarking in mind, establish your own metrics suite with action-based metrics. Define the audience, cadence, and actions for each metric you track and pair them with business goals. Measure only what you need to.
Slowly improve your metrics process over time and analyze your environment using your own data as your benchmark.
Benedict Chang
Research Analyst, Infrastructure & Operations
Info-Tech Research Group
Info-Tech Insight
Identify the metrics that serve a real purpose and eliminate the rest. Establish a formal review process to ensure metrics are still valid, continue to provide the answers needed, and are at a manageable and usable level.
Current Metrics Suite
19% Effective
36% Some Improvement Necessary
45% Significant Improvement Necessary
Source: Info-Tech Research Group’s CEO/CIO Alignment Diagnostic, 2019; N=622

Source: Info-Tech Research Group’s CEO/CIO Alignment Diagnostic, 2019; N=622
They can be the first step to reach an end goal, but if benchmarks are observed in isolation, it will only highlight your failures.
This does not account for all the unique variables that make up an IT organization.
For example, benchmarks that include cost and revenue may include organizations that prioritize first-call resolution (FCR), but the variables that make up this benchmark model will be quite different within your own organization.
Info-Tech Insight
Benchmarks reflect the norm and common practice, not best practice.
Being above or below the norm is neither a good nor a bad thing.
Determining what the results mean for you depends on what’s being measured and the unique factors, characteristics, and priorities in your organization.
If benchmark data is a priority within your IT organization, you may look up organizations like MetricNet, but keep the following in mind:
Review the collected benchmark data
See where IT organizations in your industry typically stand in relation to the overall benchmark.
Assess the gaps
Large gaps between yourself and the overall benchmark could indicate areas for improvement or celebration. Use the data to focus your analysis, develop deeper self-awareness, and prioritize areas for potential concern.
Benchmarks are only guidelines
The benchmark source data may not come from true peers in every sense. Each organization is different, so always explore your unique context when interpreting any findings.
Use metrics that drive productive change and improvement. Track only what you need to report on.
Ensure each metric aligns with the desired business goal, is action-based, and includes the answers to what, why, how, and who.
Establish internal benchmarks by analyzing the trends from your own data to set baselines.
Act on the results of your metrics by adjusting targets and measuring success.
Audience - Who is this metric tracked for?
Goal - Why are you tracking this metric? This can be defined along with the CSFs and KPIs.
Cadence - How often are you going to view, analyze, and action this metric?
Action - What will you do if this metric spikes, dips, trends up, or trends down?
Critical success factors (CSFs) are high-level goals that help you define the direction of your service desk. Key performance indicators (KPIs) can be treated as the trend of metrics that will indicate that you are moving in the direction of your CSFs. These will help narrow the data you have to track and action (metrics).
CSFs, or your overall goals, typically revolve around three aspects of the service desk: time spent on tickets, resources spent on tickets, and the quality of service provided.
| Critical success factor | Key performance indicator |
|---|---|
| High End-User Satisfaction | Increasing CSAT score on transactional surveys |
| High end-user satisfaction score | |
| Proper resolution of tickets | |
| Low time to resolve | |
| Low Cost per Ticket | Decreasing cost per ticket (due to efficient resolution, FCR, automation, self-service, etc.) |
| Improve Access to Self-Service (tangential to improve customer service) | High utilization of knowledgebase |
| High utilization of portal |
Download the Service Desk Metrics Workbook
Example metrics:
| Critical success factor | Key performance indicator | Metric | Cadence | Audience | Action |
|---|---|---|---|---|---|
| High End-User Satisfaction | Increasing CSAT score on transactional surveys | Monthly average of ticket satisfaction scores | Monthly | Management | Action low scores immediately, view long-term trends |
| High end-user satisfaction score | Average end-user satisfaction score from annual survey | Annually | IT Leadership | View IT satisfaction trends to align IT with business direction | |
| Proper resolution of tickets | Number of tickets reopened | Weekly | Service Desk Technicians | Action reopened tickets, look for training opportunities | |
| SLA breach rate | Daily | Service Desk Technicians | Action reopened tickets, look for training opportunities | ||
| Low time to resolve | Average TTR (incidents) | Weekly | Management | Look for trends to monitor resources | |
| Average TTR by priority | Weekly | Management | Look for TTR solve rates to align with SLA | ||
| Average TTR by tier | Weekly | Management | Look for improperly escalated tickets or shift-left opportunities |
Download the Service Desk Metrics Workbook
Example metrics:
| Metric | Who Owns the Data? | Efforts to Track? | Dashboards |
|---|---|---|---|
| Monthly average of ticket satisfaction scores | Service Desk | Low | Monthly Management Meeting |
| Average end-user satisfaction score | Service Desk | Low | Leadership Meeting |
| Number of tickets reopened | Service Desk | Low | Weekly Technician Standup |
| SLA breach rate | Service Desk | Low | Daily Technician Standup |
| Average TTR (incidents) | Service Desk | Low | Weekly Technician Standup |
| Average TTR by priority | Service Desk | Low | Weekly Technician Standup |
| Average TTR by tier | Service Desk | Low | Weekly Technician Standup |
| Average TTR (SRs) | Service Desk | Low | Weekly Technician Standup |
| Number of tickets reopened | Service Desk | Low | Daily Technician Standup |
Download the Service Desk Metrics Workbook
Metrics are typically focused on transactional efficiency and process effectiveness and not what was achieved against the customers’ need and satisfaction.
Understand the relationships between performance and metrics management to provide the end-to-end service delivery picture you are aiming to achieve.
ITSM solutions offer an abundance of metrics to choose from. The most common ones are typically built into the reporting modules of the tool suite.
Do not start tracking everything. Choose metrics that are specifically aligned to your organization’s desired business outcomes.
Don’t ignore the correlation and context between the suites of metrics chosen and how one interacts and affects the other.
Measuring metrics in isolation may lead to an incomplete picture or undesired technician behavior. Tension metrics help complete the picture and lead to proper actions.
An arbitrary target on a metric that is consistently met month over month is useless. Each metric should inform the overall performance by combining capable service level management and customer experience programs to prove the value IT is providing to the organization.
This project will help you build and improve essential service desk processes, including incident management, request fulfillment, and knowledge management, to create a sustainable service desk.
Take Control of Infrastructure and Operations Metrics
Make faster decisions and improve service delivery by using the right metrics for the job.
Analyze Your Service Desk Ticket Data
Take a data-driven approach to service desk optimization.
IT Diagnostics: Build a Data-Driven IT Strategy
Our data-driven programs ask business and IT stakeholders the right questions to ensure you have the inputs necessary to build an effective IT strategy.
Info-Tech’s approach to establishing and sustaining effective data governance is anchored in the strong alignment of organizational value streams and their business capabilities with key data governance dimensions and initiatives. Info-Tech's approach will help you:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Data governance is a strategic program that will help your organization control data by managing the people, processes, and information technology needed to ensure that accurate and consistent data policies exist across varying lines of the business, enabling data-driven insight. This research will provide an overview of data governance and its importance to your organization, assist in making the case and securing buy-in for data governance, identify data governance best practices and the challenges associated with them, and provide guidance on how to implement data governance best practices for a successful launch.
This workbook will help your organization understand the business and user context by leveraging your business capability map and value streams, develop data use cases using Info-Tech's framework for building data use cases, and gauge the current state of your organization's data culture.
This business needs gathering activity will highlight and create relevant use cases around data-related problems or opportunities that are clear and contained and, if addressed, will deliver value to the organization. This template provides a framework for data requirements and a mapping methodology for creating use cases.
This tool will help your organization plan the sequence of activities, capture start dates and expected completion dates, and create a roadmap that can be effectively communicated to the organization.
Use this template to document information about key data assets such as data definition, source system, possible values, data sensitivity, data steward, and usage of the data.
This template will help get the backing required to get a data governance project rolling. The program charter will help communicate the project purpose, define the scope, and identify the project team, roles, and responsibilities.
This policy establishes uniform data governance standards and identifies the shared responsibilities for assuring the integrity of the data and that it efficiently and effectively serves the needs of your organization.
Use this exemplar to understand how to establish data governance in your organization. Follow along with the sections of the blueprint Establish Data Governance and complete the document as you progress.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify key business data assets that need to be governed.
Create a unifying vision for the data governance program.
Understand the value of data governance and how it can help the organization better leverage its data.
Gain knowledge of how data governance can benefit both IT and the business.
1.1 Establish business context, value, and scope of data governance at the organization
1.2 Introduction to Info-Tech’s data governance framework
1.3 Discuss vision and mission for data governance
1.4 Understand your business architecture, including your business capability map and value streams
1.5 Build use cases aligned to core business capabilities
Sample use cases (tied to the business capability map) and a repeatable use case framework
Vision and mission for data governance
Assess which data contains value and/or risk and determine metrics that will determine how valuable the data is to the organization.
Assess where the organization currently stands in data governance initiatives.
Determine gaps between the current and future states of the data governance program.
Gain a holistic understanding of organizational data and how it flows through business units and systems.
Identify which data should fall under the governance umbrella.
Determine a practical starting point for the program.
2.1 Understand your current data governance capabilities and maturity
2.2 Set target-state data governance capabilities
Current state of data governance maturity
Definition of target state
Determine strategic initiatives and create a roadmap outlining key steps required to get the organization to start enabling data-driven insights.
Determine timing of the initiatives.
Establish clear direction for the data governance program.
Step-by-step outline of how to create effective data governance, with true business-IT collaboration.
3.1 Evaluate and prioritize performance gaps
3.2 Develop and consolidate data governance target-state initiatives
3.3 Define the role of data governance: data domain to data governance role mapping
Target-state data governance initiatives
Data domain to data governance role mapping
Consolidate the roadmap and other strategies to determine the plan of action from Day One.
Create the required policies, procedures, and positions for data governance to be sustainable and effective.
Prioritized initiatives with dependencies mapped out.
A clearly communicated plan for data governance that will have full business backing.
4.1 Identify and prioritize next steps
4.2 Define roles and responsibilities and complete a high-level RACI
4.3 Wrap-up and discuss next steps and post-workshop support
Initialized roadmap
Initialized RACI
Data governance does not sit as an island on its own in the organization – it must align with and be driven by your enterprise governance. As you build out data governance in your organization, it’s important to keep in mind that this program is meant to be an enabling framework of oversight and accountabilities for managing, handling, and protecting your company’s data assets. It should never be perceived as bureaucratic or inhibiting to your data users. It should deliver agreed-upon models that are conducive to your organization’s operating culture, offering clarity on who can do what with the data and via what means. Data governance is the key enabler for bringing high-quality, trusted, secure, and discoverable data to the right users across your organization. Promote and drive the responsible and ethical use of data while helping to build and foster an organizational culture of data excellence.
Crystal Singh
Director, Research & Advisory, Data & Analytics Practice
Info-Tech Research Group
The amount of data within organizations is growing at an exponential rate, creating a need to adopt a formal approach to governing data. However, many organizations remain uninformed on how to effectively govern their data. Comprehensive data governance should define leadership, accountability, and responsibility related to data use and handling and be supported by a well-oiled operating model and relevant policies and procedures. This will help ensure the right data gets to the right people at the right time, using the right mechanisms.
Organizations are faced with challenges associated with changing data landscapes, evolving business models, industry disruptions, regulatory and compliance obligations, and changing and maturing user landscape and demand for data. Although the need for a data governance program is often evident, organizations miss the mark when their data governance efforts are not directly aligned to delivering measurable business value. Initiatives should support key strategic initiatives, as well as value streams and their underlying business capabilities.
Info-Tech’s approach to establishing and sustaining effective data governance is anchored in the strong alignment of organizational value streams and their business capabilities with key data governance dimensions and initiatives. Organizations should:
Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face elevated operating costs, missed opportunities, eroded stakeholder satisfaction, and increased business risk.
As you embark on establishing data governance in your organization, it’s vital to ensure from the get-go that you define the drivers and business context for the program. Data governance should never be attempted without direction on how the program will yield measurable business value.
“Data processing and cleanup can consume more than half of an analytics team’s time, including that of highly paid data scientists, which limits scalability and frustrates employees.” – Petzold, et al., 2020
“The productivity of employees across the organization can suffer.” – Petzold, et al., 2020
Respondents to McKinsey’s 2019 Global Data Transformation Survey reported that an average of 30% of their total enterprise time was spent on non-value-added tasks because of poor data quality and availability. – Petzold, et al., 2020
78% of companies (and 92% of top-tier companies) have a corporate initiative to become more data-driven. – Alation, 2020
But despite these ambitions, there appears to be a “data culture disconnect” – 58% of leaders overestimate the current data culture of their enterprises, giving a grade higher than the one produced by the study. – Fregoni, 2020
Respond to industry disruptors
Optimize the way you serve your stakeholders and customers
Develop products and services to meet ever-evolving needs
Manage operations and mitigate risk
Data Disengaged
You have a low appetite for data and rarely use data for decision making.
Data Enabled
Technology, data architecture, and people and processes are optimized and supported by data governance.
Data Driven
You are differentiating and competing on data and analytics; described as a “data first” organization. You’re collaborating through data. Data is an asset.
Data governance is an enabling framework of decision rights, responsibilities, and accountabilities for data assets across the enterprise.
Data governance is:
If done correctly, data governance is not:
Conformance: Establishing data governance to meet regulations and compliance requirements.
Performance: Establishing data governance to fuel data-driven decision making for driving business value and managing and mitigating business risk.
“Albert Einstein is said to have remarked, ‘The world cannot be changed without changing our thinking.’ What is clear is that the greatest barrier to data success today is business culture, not lagging technology. “– Randy Bean, 2020
“It is not enough for companies to embrace modern data architectures, agile methodologies, and integrated business-data teams, or to establish centers of excellence to accelerate data initiatives, when only about 1 in 4 executives reported that their organization has successfully forged a data culture.”– Randy Bean, 2020
Data-driven culture = “data matters to our company”
Data debt is “the accumulated cost that is associated with the sub-optimal governance of data assets in an enterprise, like technical debt.”
Data debt is a problem for 78% of organizations.
40% of organizations say individuals within the business do not trust data insights.
66% of organizations say a backlog of data debt is impacting new data management initiatives.
33% of organizations are not able to get value from a new system or technology investment.
30% of organizations are unable to become data-driven.
Source: Experian, 2020
Only 3% of companies’ data meets basic quality standards. (Source: Nagle, et al., 2017)
Organizations suspect 28% of their customer and prospect data is inaccurate in some way. (Source: Experian, 2020)
Only 51% of organizations consider the current state of their CRM or ERP data to be clean, allowing them to fully leverage it. (Source: Experian, 2020)
35% of organizations say they’re not able to see a ROI for data management initiatives. (Source: Experian, 2020)
Make the available data governance tools and technology work for you:
While data governance tools and technologies are no panacea, leverage their automated and AI-enabled capabilities to augment your data governance program.
Put data governance into the context of the business:
Start substantiating early on how you are going to measure success as your data governance program evolves.
Key considerations:
Data Governance Leadership & Org Structure Definition
Define the home for data governance and other key roles around ownership and stewardship, as approved by senior leadership.
Data Governance Charter and Policies
Create a charter for your program and build/refresh associated policies.
Data Culture Diagnostic
Understand the organization’s current data culture, perception of data, value of data, and knowledge gaps.
Use Case Build and Prioritization
Build a use case that is tied to business capabilities. Prioritize accordingly.
Business Data Glossary
Build and/or refresh the business’ glossary for addressing data definitions and standardization issues.
Tools & Technology
Explore the tools and technology offering in the data governance space that would serve as an enabler to the program. (e.g. RFI, RFP).
Data governance leadership and sponsorship is key.
Ensure strategic business alignment.
Build and foster a culture of data excellence.
Evolve along the data journey.
Make data governance an enabler, not a hindrance.
Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face the impact of elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.
Data governance should not sit as an island in your organization. It must continuously align with the organization’s enterprise governance function. It shouldn’t be perceived as a pet project of IT, but rather as an enterprise-wide, business-driven initiative.
Ensure your data governance program delivers measurable business value by aligning the associated data governance initiatives with the business architecture. Leverage the measures of success or KPIs of the underlying business capabilities to demonstrate the value data governance has yielded for the organization.
Data governance remains the foundation of all forms of reporting and analytics. Advanced capabilities such as AI and machine learning require effectively governed data to fuel their success.
Tailor your data literacy program to meet your organization’s needs, filling your range of knowledge gaps and catering to your different levels of stakeholders. When it comes to rolling out a data literacy program, there is no one-size-fits-all solution. Your data literacy program is intended to fill the knowledge gaps about data, as they exist in your organization. It should be targeted across the board – from your executive leadership and management through to the subject matter experts across different lines of the business in your organization.
| 1. Build Business and User Context | 2. Understand Your Current Data Governance Capabilities | 3. Build a Target State Roadmap and Plan | |
|---|---|---|---|
| Phase Steps |
|
|
|
| Phase Outcomes |
|
|
|
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
Data Governance Planning and Roadmapping Workbook
Use the Data Governance Planning and Roadmapping Workbook as you plan, build, roll-out, and scale data governance in your organization.
Data Use Case Framework Template
This template takes you through a business needs gathering activity to highlight and create relevant use cases around the organization’s data-related problems and opportunities.
Business Data Glossary
Use this template to document the key data assets that are to be governed and create a data flow diagram for your organization.
Data Culture Diagnostic and Scorecard
Leverage Info-Tech’s Data Culture Diagnostic to understand how your organization scores across 10 areas relating to data culture.
Data Governance Planning and Roadmapping Workbook
In phases 1 and 2 of this blueprint, we will help you establish the business context, define your business drivers and KPIs, and understand your current data governance capabilities and strengths.
In phase 3, we will help you develop a plan and a roadmap for addressing any gaps and improving the relevant data governance capabilities so that data is well positioned to deliver on those defined business metrics.
"Our team, has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keeps us on track."
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."
| 1. Build Business and User context | 2. Understand Your Current Data Governance Capabilities | 3. Build a Target State Roadmap and Plan | |
|---|---|---|---|
| Best-Practice Toolkit |
|
|
|
| Guided Implementation |
|
|
|
| Phase Outcomes |
|
|
|
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is between 8 to 12 calls over the course of 4 to 6 months.
| Day 1 | Day 2 | Day 3 | Day 4 | |
|---|---|---|---|---|
| Establish Business Context and Value | Understand Current Data Governance Capabilities and Plot Target-State Levels | Build Data Domain to Data Governance Role Mapping | Formulate a Plan to Get to Your Target State | |
| Activities |
|
|
|
|
| Deliverables |
|
|
|
|
“When business users are invited to participate in the conversation around data with data users and IT, it adds a fundamental dimension — business context. Without a real understanding of how data ties back to the business, the value of analysis and insights can get lost.” – Jason Lim, Alation
This phase will guide you through the following activities:
This phase involves the following participants:
Activities
1.1.1 Identify Your Business Capabilities
1.1.2 Categorize Your Organization’s Key Business Capabilities
1.1.3 Develop a Strategy Map Tied to Data Governance
This step will guide you through the following activities:
Outcomes of this step
Gaining a sound understanding of your business architecture (value streams and business capabilities) is a critical foundation for establishing and sustaining a data governance program that delivers measurable business value.
Confirm your organization's existing business capability map or initiate the formulation of a business capability map:
Note: A business capability defines what a business does to enable value creation. Business capabilities are business terms defined using descriptive nouns such as “Marketing” or “Research and Development.” They represent stable business functions, are unique and independent of each other, and typically will have a defined business outcome.
Input
Output
Materials
Participants
For more information, refer to Info-Tech’s Document Your Business Architecture.
Value streams connect business goals to the organization’s value realization activities. These value realization activities, in turn, depend on data.
If the organization does not have a business architecture function to conduct and guide Activity 1.1.1, you can leverage the following approach:
Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.
Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face the possibilities of elevated operational costs, missed opportunities, eroded stakeholder satisfaction, negative impact to reputation and brand, and/or increased exposure to business risk.
Value streams connect business goals to the organization’s value realization activities.
Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.
For this value stream, download Info-Tech’s Info-Tech’s Industry Reference Architecture for Retail Banking.
Value streams connect business goals to the organization’s value realization activities.
Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.
For this value stream, download Info-Tech’s Industry Reference Architecture for Higher Education.
Value streams connect business goals to the organization’s value realization activities.
Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.
For this value stream, download Info-Tech’s Industry Reference Architecture for Local Government.
Value streams connect business goals to the organization’s value realization activities.
Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.
For this value stream, download Info-Tech’s Industry Reference Architecture for Manufacturing.
Value streams connect business goals to the organization’s value realization activities.
Value streams enable the organization to create or capture value in the market in which it operates by engaging in a set of interconnected activities.
For this value stream, download Info-Tech’s Industry Reference Architecture for Retail.
A business capability defines what a business does to enable value creation. Business capabilities represent stable business functions and typically will have a defined business outcome.
Business capabilities can be thought of as business terms defined using descriptive nouns such as “Marketing” or “Research and Development.”
If your organization doesn’t already have a business capability map, you can leverage the following approach to build one. This initiative requires a good understanding of the business. By working with the right stakeholders, you can develop a business capability map that speaks a common language and accurately depicts your business.
Working with the stakeholders as described above:
A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.
For more information, refer to Info-Tech’s Document Your Business Architecture.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.
Example business capability map for: Retail Banking
For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail Banking.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.
Example business capability map for: Higher Education
For this business capability map, download Info-Tech’s Industry Reference Architecture for Higher Education.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.
Example business capability map for: Local Government
For this business capability map, download Info-Tech’s Industry Reference Architecture for Local Government.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.
Example business capability map for: Manufacturing
For this business capability map, download Info-Tech’s Industry Reference Architecture for Manufacturing.
A business capability map can be thought of as a visual representation of your organization’s business capabilities and hence represents a view of what your data governance program must support.
Validate your business capability map with the right stakeholders, including your executive team, business unit leaders, and/or other key stakeholders.
Leverage your business capability map verification session with these key stakeholders as a prime opportunity to share and explain the role of data and data governance in supporting the very value realization capabilities under discussion. This will help to build awareness and visibility of the data governance program.
Example business capability map for: Retail
For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail.
Determine which capabilities are considered high priority in your organization.
This categorization/prioritization exercise helps highlight prime areas of opportunity for building use cases, determining prioritization, and the overall optimization of data and data governance.
Input
Output
Materials
Participants
For more information, refer to Info-Tech’s Document Your Business Architecture.
This exercise is useful in ensuring the data governance program is focused and aligned to support the priorities and direction of the business.
Example: Retail
For this business capability map, download Info-Tech’s Industry Reference Architecture for Retail.
Identify the strategic objectives for the business. Knowing the key strategic objectives will drive business-data governance alignment. It’s important to make sure the right strategic objectives of the organization have been identified and are well understood.
Guide to creating your map: Starting with strategic objectives, map the value streams that will ultimately drive them. Next, link the key capabilities that enable each value stream. Then map the data and data governance to initiatives that support those capabilities. This is one approach to help you prioritize the data initiatives that deliver the most value to the organization.
Input
Output
Materials
Participants
Download Info-Tech’s Data Governance Planning and Roadmapping Workbook
Start with the strategic objectives, then map the value streams that will ultimately drive them. Next, link the key capabilities that enable each value stream. Then map the data and data governance initiatives that support those capabilities. This process will help you prioritize the data initiatives that deliver the most value to the organization.
Example: Retail
For this strategy map, download Info-Tech’s Industry Reference Architecture for Retail.
Activities
1.2.1 Build High-Value Use Cases
This step will guide you through the following activities:
Outcomes of this step
One of the most important aspects when building use cases is to ensure you include KPIs or measures of success. You have to be able to demonstrate how the use case ties back to the organizational priorities or delivers measurable business value. Leverage the KPIs and success factors of the business capabilities tied to each particular use case.
This business needs-gathering activity will highlight and create relevant use cases around data-related problems or opportunities that are clear and contained and, if addressed, will deliver value to the organization.
Tip: Don’t conclude these use case discussions without substantiating what measures of success will be used to demonstrate the business value of the effort to produce the desired future state, as relevant to each particular use case.
Input
Output
Materials
Participants
Download Info-Tech’s Data Use Case Framework Template
Leveraging your business capability map, build use cases that align with the organization’s key business capabilities.
Consider:
Info-Tech’s Data Requirements and Mapping Methodology for Creating Use Cases
The resulting use cases are to be prioritized and leveraged for informing the business case and the data governance capabilities optimization plan.
Taken from Info-Tech’s Data Use Case Framework Template
This phase will guide you through the following activities:
This phase involves the following participants:
This step will guide you through the following activities:
Outcomes of this step
A well-defined data governance program will deliver:
The key components of establishing sustainable enterprise data governance, taken from Info-Tech’s Data Governance Framework:
The office of the chief data officer (CDO):
“Compared to most of their C-suite colleagues, the CDO is faced with a unique set of problems. The role is still being defined. The chief data officer is bringing a new dimension and focus to the organization: ‘data.’ ”
– Carruthers and Jackson, 2020
“The title matters. In my opinion, you can’t have a CDO without executive authority. Otherwise no one will listen.”
– Anonymous European CDO
“The reporting structure depends on who’s the ‘glue’ that ties together all these uniquely skilled individuals.”
– John Kemp, Senior Director, Executive Services, Info-Tech Research Group
Who are best suited to be data owners?
Data owners are typically senior business leaders with the following characteristics:
Data governance working groups:
Traditionally, data stewards:
Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.
Enabling business capabilities with data governance role definitions
“Generate excitement for data: When people are excited and committed to the vision of data enablement, they’re more likely to help ensure that data is high quality and safe.” – Petzold, et al., 2020
Operating Model
Defining your data governance operating model will help create a well-oiled program that sustainably delivers value to the organization and manages risks while building and fostering a culture of data excellence along the way. Some organizations are able to establish a formal data governance office, whether independent or attached to the office of the chief data officer. Regardless of how you are organized, data governance requires a home, a leader, and an operating model to ensure its sustainability and evolution.
Examples of focus areas for your operating model:
The key is to determine what style will work best in your organization, taking into consideration your organizational culture, executive leadership support (present and ongoing), catalysts such as other enterprise-wide transformative and modernization initiatives, and/or regulatory and compliances drivers.
Furthermore, communication with the wider organization of data producers, users, and consumers is one of the core elements of the overall data governance communications plan.
Communication is vital for ensuring acceptance of new processes, rules, guidelines, and technologies by all data producers and users as well as for sharing success stories of the program.
“Leading organizations invest in change management to build data supporters and convert the skeptics. This can be the most difficult part of the program, as it requires motivating employees to use data and encouraging producers to share it (and ideally improve its quality at the source)[.]” – Petzold, et al., 2020
Examples of focus areas for your operating model (continued):
Preparing people for change well in advance will allow them to take the steps necessary to adapt and reduce potential confrontation. By planning for and efficiently communicating any changes that a data governance initiative may bring, many initial issues can be resolved from the outset.
Attempting to implement change without an effective communications plan can result in disagreements over data control and stalemates between stakeholder units. The recommendations of the governance group must reflect the needs of all stakeholders or there will be pushback.
Aligning your data governance to the organization's value realization activities enables you to leverage the KPIs of those business capabilities to demonstrate tangible and measurable value. Use terms and language that will resonate with your senior business leadership.
Launching a data governance program will bring with it a level of disruption to the culture of the organization. That disruption doesn’t have to be detrimental if you are prepared to manage the change proactively and effectively.
“Data standards are the rules by which data are described and recorded. In order to share, exchange, and understand data, we must standardize the format as well as the meaning.” – U.S. Geological Survey
Examples of data policies:
“Organizational culture can accelerate the application of analytics, amplify its power, and steer companies away from risky outcomes.” – Petzold, et al., 2020
What does a healthy data culture look like?
Building a culture of data excellence.
Leverage Info-Tech’s Data Culture Diagnostic to understand your organization’s culture around data.
Contact your Info-Tech Account Representative for more information on the Data Culture Diagnostic
“People are at the heart of every culture, and one of the biggest challenges to creating a data culture is bringing everyone into the fold.” – Lim, Alation
“Companies that have succeeded in their data-driven efforts understand that forging a data culture is a relentless pursuit, and magic bullets and bromides do not deliver results.” – Randy Bean, 2020
There is a trusted, single source of data the whole company can draw from.
There’s a business glossary and data catalog and users know what the data fields mean.
Users have access to data and analytics tools. Employees can leverage data immediately to resolve a situation, perform an activity, or make a decision – including frontline workers.
Data literacy, the ability to collect, manage, evaluate, and apply data in a critical manner, is high.
Data is used for decision making. The company encourages decisions based on objective data and the intelligent application of it.
Data governance will support your organization’s ethical use and handling of data by facilitating definition around important factors, such as:
Activities
2.2.1 Gauge Your Organization’s Current Data Culture
This step will guide you through the following activities:
Outcomes of this step
Conduct a Data Culture Survey or Diagnostic
The objectives of conducting a data culture survey are to increase the understanding of the organization's data culture, your users’ appetite for data, and their appreciation for data in terms of governance, quality, accessibility, ownership, and stewardship. To perform a data culture survey:
Input
Output
Materials
Participants
Contact your Info-Tech Account Representative for details on launching a Data Culture Diagnostic.
“Achieving data success is a journey, not a sprint.” Companies that set a clear course, with reasonable expectations and phased results over a period of time, get to the destination faster.” – Randy Bean, 2020
This phase will guide you through the following activities:
This phase involves the following participants:
This step will guide you through the following activities:
Outcomes of this step
Key considerations:
Sample milestones:
Data Governance Leadership & Org Structure Definition
Define the home for data governance and other key roles around ownership and stewardship, as approved by senior leadership.
Data Governance Charter and Policies
Create a charter for your program and build/refresh associated policies.
Data Culture Diagnostic
Understand the organization’s current data culture, perception of data, value of data, and knowledge gaps.
Use Case Build and Prioritization
Build a use case that is tied to business capabilities. Prioritize accordingly.
Business Data Glossary/Catalog
Build and/or refresh the business’ glossary for addressing data definitions and standardization issues.
Tools & Technology
Explore the tools and technology offering in the data governance space that would serve as an enabler to the program. (e.g. RFI, RFP).
Define key roles for getting started.
Start small and then scale – deliver early wins.
Start understanding data knowledge gaps, building the program, and delivering.
Make the available data governance tools and technology work for you.
Sample data governance roadmap milestones:
Key Considerations:
Your organization’s value streams and the associated business capabilities require effectively governed data. Without this, you face elevated operational costs, missed opportunities, eroded stakeholder satisfaction, and exposure to increased business risk.
Enable business capabilities with data governance role definitions.
These are some of the data governance tools and technology players. Check out SoftwareReviews for help making better software decisions.
The data steward must be empowered and backed politically with decision-making authority, or the role becomes stale and powerless.
Ensuring compliance can be difficult. Data stewards may experience pushback from stakeholders who must deliver on the policies, procedures, and processes that the data steward enforces.
Because the data steward must enforce data processes and liaise with so many different people and departments within the organization, the data steward role should be their primary full-time job function – where possible.
However, in circumstances where budget doesn’t allow a full-time data steward role, develop these skills within the organization by adding data steward responsibilities to individuals who are already managing data sets for their department or line of business.
A stewardship role is generally more about managing the cultural change that data governance brings. This requires the steward to have exceptional interpersonal skills that will assist in building relationships across departmental boundaries and ensuring that all stakeholders within the organization believe in the initiative, understand the anticipated outcomes, and take some level of responsibility for its success.
Data governance initiatives must contain a strong organizational disruption component. A clear and concise communication strategy that conveys milestones and success stories will address the various concerns that business unit stakeholders may have.
By planning for and efficiently communicating any changes that a data governance initiative may bring, many initial issues can be resolved from the outset.
Governance recommendations will require significant business change. The redesign of a substantial number of data processes affecting various business units will require an overhaul of the organization’s culture, thought processes, and procedures surrounding its data. Preparing people for change well in advance will allow them to take the necessary steps to adapt and reduce potential confrontation.
Because a data governance initiative will involve data-driven business units across the organization, the governance team must present a compelling case for data governance to ensure acceptance of new processes, rules, guidelines, and technologies by all data producers and users.
Attempting to implement change without an effective communication plan can result in disagreements over data control and stalemates between stakeholder units. The recommendations of the governance group must reflect the needs of all stakeholders or there will be pushback.
Launching a data governance initiative is guaranteed to disrupt the culture of the organization. That disruption doesn’t have to be detrimental if you are prepared to manage the change proactively and effectively.
To create a strong vision for data governance, there must be participation from the business and IT. A common vision will articulate the state the organization wishes to achieve and how it will reach that state. Visioning helps to develop long-term goals and direction.
Once the vision is established, it must be effectively communicated to everyone, especially those who are involved in creating, managing, disposing, or archiving data.
The data governance program should be periodically refined. This will ensure the organization continues to incorporate best methods and practices as the organization grows and data needs evolve.
A successful data governance communications plan involves making the initiative visible and promoting staff awareness. Educate the team on how data is collected, distributed, and used, what internal processes use data, and how that data is used across departmental boundaries.
By demonstrating how data governance will affect staff directly, you create a deeper level of understanding across lines of business, and ultimately, a higher level of acceptance for new processes, rules, and guidelines.
A clear and concise communications strategy will raise the profile of data governance within the organization, and staff will understand how the program will benefit them and how they can share in the success of the initiative. This will end up providing support for the initiative across the board.
Focus on literacy and communication: include training in the communication plan. Providing training for data users on the correct procedures for updating and verifying the accuracy of data, data quality, and standardized data policies will help validate how data governance will benefit them and the organization.
The data governance program is responsible for continuously promoting the value of data to the organization. The data governance program should seek a variety of ways to educate the organization and data stakeholders on the benefit of data management.
Even if data policies and procedures are created, they will be highly ineffective if they are not properly communicated to the data producers and users alike.
There needs to be a communication plan that highlights how the data producer and user will be affected, what their new responsibilities are, and the value of that change.
To learn how to manage organizational change, refer to Info-Tech’s Master Organizational Change Management Practices.
It can be difficult to understand what a policy is, and what it is not. Start by identifying the differences between a policy and standards, guidelines, and procedures.
The following are key elements of a good policy:
| Heading | Descriptions |
|---|---|
| Purpose | Describes the factors or circumstances that mandate the existence of the policy. Also states the policy’s basic objectives and what the policy is meant to achieve. |
| Scope | Defines to whom and to what systems this policy applies. Lists the employees required to comply or simply indicates “all” if all must comply. Also indicates any exclusions or exceptions, i.e. those people, elements, or situations that are not covered by this policy or where special consideration may be made. |
| Definitions | Define any key terms, acronyms, or concepts that will be used in the policy. A standard glossary approach is sufficient. |
| Policy Statements | Describe the rules that comprise the policy. This typically takes the form of a series of short prescriptive and proscriptive statements. Sub-dividing this section into sub-sections may be required depending on the length or complexity of the policy. |
| Non-Compliance | Clearly describe consequences (legal and/or disciplinary) for employee non-compliance with the policy. It may be pertinent to describe the escalation process for repeated non-compliance. |
| Agreement | Confirms understanding of the policy and provides a designated space to attest to the document. |
Most organizations have problems with policy management. These include:
Technology should be used as a means to solve these problems and effectively monitor, enforce, and communicate policies.
Product Overview
myPolicies is a web-based solution to create, distribute, and manage corporate policies, procedures, and forms. Our solution provides policy managers with the tools they need to mitigate the risk of sanctions and reduce the administrative burden of policy management. It also enables employees to find the documents relevant to them and build a culture of compliance.
Some key success factors for policy management include:
myPolicies
Data policies are short statements that seek to manage the creation, acquisition, integrity, security, compliance, and quality of data. These policies vary amongst organizations, depending on your specific data needs.
Trust
Availability
Security
Compliance
Info-Tech’s Data Management Policy:
This policy establishes uniform data management standards and identifies the shared responsibilities for assuring the integrity of the data and that it efficiently and effectively serves the needs of the organization. This policy applies to all critical data and to all staff who may be creators and/or users of such data.
Info-Tech’s Data Entry Policy:
The integrity and quality of data and evidence used to inform decision making is central to both the short-term and long-term health of an organization. It is essential that required data be sourced appropriately and entered into databases and applications in an accurate and complete manner to ensure the reliability and validity of the data and decisions made based on the data.
Info-Tech’s Data Provenance Policy:
Create policies to keep your data's value, such as:
Info-Tech’s Data Integration and Virtualization Policy:
This policy aims to assure the organization, staff, and other interested parties that data integration, replication, and virtualization risks are taken seriously. Staff must use the policy (and supporting guidelines) when deciding whether to integrate, replicate, or virtualize data sets.
Although they can be highly subjective, metrics are extremely important to data governance success.
Policies are great to have from a legal perspective, but unless they are followed, they will not benefit the organization.
Review metrics on an ongoing basis with those data owners/stewards who are accountable, the data governance steering committee, and the executive sponsors.
Examples include:
Have a fundamental data definition model for the entire business to adhere to. Those in the positions that generate and produce data must follow the common set of standards developed by the steering committee and be accountable for the creation of valid, clean data.
By planning for and efficiently communicating any changes that a data governance initiative may bring, many initial issues can be resolved from the outset.
Governance recommendations will require significant business change. The redesign of a substantial number of data processes affecting various business units will require an overhaul of the organization’s culture, thought processes, and procedures surrounding its data. Preparing people for change well in advance will allow them to take the necessary steps to adapt and reduce potential confrontation.
Because a data governance initiative will involve data-driven business units across the organization, the governance team must present a compelling case for data governance to ensure acceptance of new processes, rules, guidelines, and technologies by all data producers and users.
Attempting to implement change without an effective communications plan can result in disagreements over data control and stalemates between stakeholder units. The recommendations of the governance group must reflect the needs of all stakeholders or there will be pushback.
Data governance initiatives will very likely bring about a level of organizational disruption. A clear and concise communications strategy that conveys milestones and success stories will address the various concerns that business unit stakeholders may have.
Launching a data governance program will bring with it a level of disruption to the culture of the organization. That disruption doesn’t have to be detrimental if you are prepared to manage the change proactively and effectively.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team. Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
The following are sample activities that will be conducted by Info-Tech analysts with your team:
Build Your Business and User Context
Work with your core team of stakeholders to build out your data governance strategy map, aligning data governance initiatives with business capabilities, value streams, and, ultimately, your strategic priorities.
Formulate a Plan to Get to Your Target State
Develop a data governance future state roadmap and plan based on an understanding of your current data governance capabilities, your operating environment, and the driving needs of your business.
Key to building and fostering a data-driven culture.
Streamline your data management program with our simplified framework.
Be the voice of data in a time of transformation.
| Name | Position | Company |
|---|---|---|
| David N. Weber | Executive Director - Planning, Research and Effectiveness | Palm Beach State College |
| Izabela Edmunds | Information Architect | Mott MacDonald |
| Andy Neill | Practice Lead, Data & Analytics | Info-Tech Research Group |
| Dirk Coetsee | Research Director, Data & Analytics | Info-Tech Research Group |
| Graham Price | Executive Advisor, Advisory Executive Services | Info-Tech Research Group |
| Igor Ikonnikov | Research Director, Data & Analytics | Info-Tech Research Group |
| Jean Bujold | Senior Workshop Delivery Director | Info-Tech Research Group |
| Rajesh Parab | Research Director, Data & Analytics | Info-Tech Research Group |
| Reddy Doddipalli | Senior Workshop Director | Info-Tech Research Group |
| Valence Howden | Principal Research Director, CIO | Info-Tech Research Group |
Alation. “The Alation State of Data Culture Report – Q3 2020.” Alation, 2020. Accessed 25 June 2021.
Allott, Joseph, et al. “Data: The next wave in forestry productivity.” McKinsey & Company, 27 Oct. 2020. Accessed 25 June 2021.
Bean, Randy. “Why Culture Is the Greatest Barrier to Data Success.” MIT Sloan Management Review, 30 Sept. 2020. Accessed 25 June 2021.
Brence, Thomas. “Overcoming the Operationalization Challenge with Data Governance at New York Life.” Informatica, 18 March 2020. Accessed 25 June 2021.
Bullmore, Simon, and Stuart Coleman. “ODI Inside Business – a checklist for leaders.” Open Data Institute, 19 Oct. 2020. Accessed 25 June 2021.
Canadian Institute for Health Information. “Developing and implementing accurate national standards for Canadian health care information.” Canadian Institute for Health Information. Accessed 25 June 2021.
Carruthers, Caroline, and Peter Jackson. “The Secret Ingredients of the Successful CDO.” IRM UK Connects, 23 Feb. 2017.
Dashboards. “Useful KPIs for Healthy Hospital Quality Management.” Dashboards. Accessed 25 June 2021.
Dashboards. “Why (and How) You Should Improve Data Literacy in Your Organization Today.” Dashboards. Accessed 25 June 2021.
Datapine. “Healthcare Key Performance Indicators and Metrics.” Datapine. Accessed 25 June 2021.
Datapine. “KPI Examples & Templates: Measure what matters the most and really impacts your success.” Datapine. Accessed 25 June 2021.
Diaz, Alejandro, et al. “Why data culture matters.” McKinsey Quarterly, Sept. 2018. Accessed 25 June 2021.
Everett, Dan. “Chief Data Officer (CDO): One Job, Four Roles.” Informatica, 9 Sept. 2020. Accessed 25 June 2021.
Experian. “10 signs you are sitting on a pile of data debt.” Experian. Accessed 25 June 2021.
Fregoni, Silvia. “New Research Reveals Why Some Business Leaders Still Ignore the Data.” Silicon Angle, 1 Oct. 2020.
Informatica. Holistic Data Governance: A Framework for Competitive Advantage. Informatica, 2017. Accessed 25 June 2021.
Knight, Michelle. “What Is a Data Catalog?” Dataversity, 28 Dec. 2017. Web.
Lim, Jason. “Alation 2020.3: Getting Business Users in the Game.” Alation, 2020. Accessed 25 June 2021.
McDonagh, Mariann. “Automating Data Governance.” Erwin, 29 Oct. 2020. Accessed 25 June 2021.
NewVantage Partners. Data-Driven Business Transformation: Connecting Data/AI Investment to Business Outcomes. NewVantage Partners, 2020. Accessed 25 June 2021.
Olavsrud, Thor. “What is data governance? A best practices framework for managing data assets.” CIO.com, 18 March 2021. Accessed 25 June 2021.
Open Data Institute. “Introduction to data ethics and the data ethics canvas.” Open Data Institute, 2020. Accessed 25 June 2021.
Open Data Institute. “The UK National Data Strategy 2020: doing data ethically.” Open Data Institute, 17 Nov. 2020. Accessed 25 June 2021.
Open Data Institute. “What is the Data Ethics Canvas?” Open Data Institute, 3 July 2019. Accessed 25 June 2021.
Pathak, Rahul. “Becoming a Data-Driven Enterprise: Meeting the Challenges, Changing the Culture.” MIT Sloan Management Review, 28 Sept. 2020. Accessed 25 June 2021.
Redman, Thomas, et al. “Only 3% of Companies’ Data Meets Basic Quality Standards.” Harvard Business Review. 11 Sept 2017.
Petzold, Bryan, et al. “Designing data governance that delivers value.” McKinsey & Company, 26 June 2020. Accessed 25 June 2021.
Smaje, Kate. “How six companies are using technology and data to transform themselves.” McKinsey & Company, 12 Aug. 2020. Accessed 25 June 2021.
Talend. “The Definitive Guide to Data Governance.” Talend. Accessed 25 June 2021.
“The Powerfully Simple Modern Data Catalog.” Atlan, 2021. Web.
U.S. Geological Survey. “Data Management: Data Standards.” U.S. Geological Survey. Accessed 25 June 2021.
Waller, David. “10 Steps to Creating a Data-Driven Culture.” Harvard Business Review, 6 Feb. 2020. Accessed 25 June 2021.
“What is the Difference Between A Business Glossary, A Data Dictionary, and A Data Catalog, and How Do They Play A Role In Modern Data Management?” Analytics8, 23 June 2021. Web.
Wikipedia. “RFM (market research).” Wikipedia. Accessed 25 June 2021.
Windheuser, Christoph, and Nina Wainwright. “Data in a Modern Digital Business.” Thoughtworks, 12 May 2020. Accessed 25 June 2021.
Wright, Tom. “Digital Marketing KPIs - The 12 Key Metrics You Should Be Tracking.” Cascade, 3 March 2021. Accessed 25 June 2021.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand what AI really is in the modern world and how AI technologies impact the business functions.
Develop a good understanding of where AI is delivering value in your industry and other verticals. Determine the top three business goals to get value from your AI and give your AI a purpose.
Brainstorm your AI PoC projects, prioritize and sequence your AI ideas, select your first AI PoC, and create a minimum viable business case for this use case.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Assess current maturity, establish a team, and choose a pilot business unit. Identify business processes, dependencies, and alternatives.
Define an objective impact scoring scale, estimate the impact of downtime, and set recovery targets.
Build a workflow of the current steps for business recovery. Identify gaps and risks to recovery. Brainstorm and prioritize solutions to address gaps and mitigate risks.
Present pilot project results and next steps. Create BCMS teams. Update and maintain BCMS documentation.
Use these tools and templates to assist in the creation of your BCP.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Define BCP scope, objectives, and stakeholders.
Prioritize BCP efforts and level-set scope with key stakeholders.
1.1 Assess current BCP maturity.
1.2 Identify key business processes to include in scope.
1.3 Flowchart key business processes to identify business processes, dependencies, and alternatives.
BCP Maturity Scorecard: measure progress and identify gaps.
Business process flowcharts: review, optimize, and allow for knowledge transfer of processes.
Identify workarounds for common disruptions to day-to-day continuity.
Define RTOs and RPOs based on your BIA.
Set recovery targets based business impact, and illustrate the importance of BCP efforts via the impact of downtime.
2.1 Define an objective scoring scale to indicate different levels of impact.
2.2 Estimate the impact of downtime.
2.3 Determine acceptable RTO/RPO targets for business processes based on business impact.
BCP Business Impact Analysis: objective scoring scale to assess cost, goodwill, compliance, and safety impacts.
Apply the scoring scale to estimate the impact of downtime on business processes.
Acceptable RTOs/RPOs to dictate recovery strategy.
Create a recovery workflow.
Build an actionable, high-level, recovery workflow that can be adapted to a variety of different scenarios.
3.1 Conduct a tabletop exercise to determine current recovery procedures.
3.2 Identify and prioritize projects to close gaps and mitigate recovery risks.
3.3 Evaluate options for command centers and alternate business locations (i.e. BC site).
Recovery flow diagram – current and future state
Identify gaps and recovery risks.
Create a project roadmap to close gaps.
Evaluate requirements for alternate business sites.
Extend the results of the pilot BCP and implement governance.
Outline the actions required for the rest of your BCMS, and the required effort to complete those actions, based on the results of the pilot.
4.1 Summarize the accomplishments and required next steps to create an overall BCP.
4.2 Identify required BCM roles.
4.3 Create a plan to update and maintain your overall BCP.
Pilot BCP Executive Presentation
Business Continuity Team Roles & Responsibilities
3. Maintenance plan and BCP templates to complete the relevant documentation (BC Policy, BCP Action Items, Recovery Workflow, etc.)
None of us needs to look very far to find a reason to have an effective business continuity plan.
From pandemics to natural disasters to supply chain disruptions to IT outages, there’s no shortage of events that can disrupt your complex and interconnected business processes. How in the world can anyone build a plan to address all these threats?
Don’t try to boil the ocean. Use these tactics to streamline your BCP project and stay on track:
No one can predict every possible disruption, but by following the guidance in this blueprint, you can build a flexible continuity plan that allows you to withstand the threats your organization may face.
Research Director,
IT Infrastructure & Operations Practice
Info-Tech Research Group
Senior Research Analyst,
IT Infrastructure & Operations Practice
Info-Tech Research Group
IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.
As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but you must enable business leaders to own their department’s BCP practices and outputs. They know their processes and, therefore, their requirements to resume business operations better than anyone else.
A business continuity plan (BCP) consists of separate but related sub-plans, as illustrated below. This blueprint enables you to:
A plan to restore IT application and infrastructure services following a disruption.
Info-Tech’s disaster recovery planning blueprint provides a methodology for creating the IT DRP. Leverage this blueprint to validate and provide inputs for your IT DRP.
A set of plans to resume business processes for each business unit. This includes:
A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage.
Info-Tech’s Implement Crisis Management Best Practices blueprint provides a framework for planning a response to any crisis, from health and safety incidents to reputational damage.
Back when transactions were recorded on paper and then keyed into the mainframe system later, it was easier to revert to deskside processes. There is very little in the way of paper-based processes anymore, and as a result, it is increasingly difficult to resume business processes without IT.
Think about your own organization. What IT system(s) are absolutely critical to business operations? While you might be able to continue doing business without IT, this requires regular preparation and training. It’s likely a completely offline process and won’t be a viable workaround for long even if staff know how to do the work. If your data center and core systems are down, technology-enabled workarounds (such as collaboration via mobile technologies or cloud-based solutions) could help you weather the outage, and may be more flexible and adaptable for day-to-day work.
The bottom line:
Technology is a critical dependency for business processes. Consider the role IT systems play as process dependencies and as workarounds as part of continuity planning.
BCP for Business Unit A:
Scope → Pilot BIA → Response Plan → Gap Analysis
→ Lessons Learned:
= Ongoing governance, testing, maintenance, improvement, awareness, and training.
By comparison, a traditional BCP approach takes much longer to mitigate risk:
Organizational Risk Assessment and Business Impact Analysis → Solution Design to Achieve Recovery Objectives → Create and Validate Response Plans
A charitable foundation for a major state university engaged Info-Tech to support the creation of their business continuity plan.
With support from Info-Tech analysts and the tools in this blueprint, they worked with their business unit stakeholders to identify recovery objectives, confirm recovery capabilities and business process workarounds, and address gaps in their continuity plans.
The outcome wasn’t a pandemic plan – it was a continuity plan that was applicable to pandemics. And it worked. Business processes were prioritized, gaps in work-from-home and business process workarounds had been identified and addressed, business leaders owned their plan and understood their role in it, and IT had clear requirements that they were able and ready to support.
“The work you did here with us was beyond valuable! I wish I could actually explain how ready we really were for this…while not necessarily for a pandemic, we were ready to spring into action, set things up, the priorities were established, and most importantly some of the changes we’ve made over the past few years helped beyond words! The fact that the groups had talked about this previously almost made what we had to do easy.“ -- VP IT Infrastructure
| Phases | Phase 1: Identify BCP Maturity and Document Process Dependencies | Phase 2: Conduct a BIA to Determine Acceptable RTOs and RPOs | Phase 3: Document the Recovery Workflow and Projects to Close Gaps | Phase 4: Extend the Results of the Pilot BCP and Implement Governance |
|---|---|---|---|---|
| Steps | 1.1 Assess current BCP maturity | 2.1 Define an objective impact scoring scale | 3.1 Determine current recovery procedures | 4.1 Consolidate BCP pilot insights to support an overall BCP project plan |
| 1.2 Establish the pilot BCP team | 2.2 Estimate the impact of downtime | 3.2 Identify and prioritize projects to close gaps | 4.2 Outline a business continuity management (BCM) program | |
| 1.3 Identify business processes, dependencies, and alternatives | 2.3 Determine acceptable RTO/RPO targets | 3.3 Evaluate BC site and command center options | 4.3 Test and maintain your BCP | |
| Tools and Templates | ||||
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
BCP Business Impact Analysis Tool: Conduct and document a business impact analysis using this document.
BCP Recovery Workflows Example: Model your own recovery workflows on this example.
BCP Project Roadmap: Use this tool to prioritize projects that can improve BCP capabilities and mitigate gaps and risks.
BCP Relocation Checklists: Plan for and manage a site relocation – whether to an alternate site or work from home.
Summarize your organization's continuity capabilities and objectives in a 15-page, easy-to-consume template.
This document consolidates data from the supporting documentation and tools to the right.
Download Info-Tech’s BCP Summary Document
Focus less on risk, and more on recovery
Avoid focusing on risk and probability analysis to drive your continuity strategy. You never know what might disrupt your business, so develop a flexible plan to enable business resumption regardless of the event.
Small teams = good pilots
Choose a small team for your BCP pilot. Small teams are better at trialing new techniques and finding new ways to think about problems.
Calculate downtime impact
Develop and apply a scoring scale to develop a more-objective assessment of downtime impact for the organization. This will help you prioritize recovery.
It’s not no, but rather not now…
You can’t address all the organization’s continuity challenges at once. Prioritize high value, low effort initiatives and create a long-term roadmap for the rest.
Show Value Now
Get to value quickly. Start with one business unit with continuity challenges, and a small, focused project team who can rapidly learn the methodology, identify continuity gaps, and define solutions that can also be leveraged by other departments right away.
Lightweight Testing Exercises
Outline recovery capabilities using lightweight, low risk tabletop planning exercises. Our research shows tabletop exercises increase confidence in recovery capabilities almost as much as live exercises, which carry much higher costs and risks.
Info-Tech members told us they save an average of $44,522 and 23 days by working with an Info-Tech analyst on BCP (source: client response data from Info-Tech's Measured Value Survey).
Why do members report value from analyst engagement?
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Diagnostic and consistent frameworks are used throughout all four options.
A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is between eight to twelve calls over the course of four to six months.
Call 1: Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.
Calls 2 - 4: Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds.
Calls 5 – 7: Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.
Calls 8 – 9: Create a recovery workflow based on tabletop planning.
Call 10: Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.
Contact your account representative for more information.
workshops@infotech.com | 1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
| Identify BCP Maturity, Key Processes, and Dependencies | Conduct a BIA to Determine Acceptable RTOs and RPOs | Document the Current Recovery Workflow and Projects to Close Gaps | Identify Remaining BCP Documentation and Next Steps | Next Steps and Wrap-Up (offsite) | |
| Activities |
1.1 Assess current BCP maturity. 1.2 Identify key business processes to include in scope. 1.3 Create a flowchart for key business processes to identify business processes, dependencies, and alternatives. |
2.1 Define an objective scoring scale to indicate different levels of impact. 2.2 Estimate the impact of a business disruption on cost, goodwill, compliance, and health & safety. 2.3 Determine acceptable RTOs/RPOs for selected business processes based on business impact. |
3.1 Review tabletop planning – what is it, how is it done? 3.2 Walk through a business disruption scenario to determine your current recovery timeline, RTO/RPO gaps, and risks to your ability to resume business operations. 3.3 Identify and prioritize projects to close RTO/RPO gaps and mitigate recovery risks. |
4.1 Assign business continuity management (BCM) roles to govern BCP development and maintenance, as well as roles required to execute recovery. 4.2 Identify remaining documentation required for the pilot business unit and how to leverage the results to repeat the methodology for remaining business units. 4.3 Workshop review and wrap-up. |
5.1 Finalize deliverables for the workshop. 5.2 Set up review time for workshop outputs and to discuss next steps. |
| Deliverables |
|
|
|
|
|
1.1 Assess Current BCP Maturity
1.2 Establish the pilot BCP team
1.3 Identify business processes, dependencies, and alternatives
Define the scope for the BCP project: assess the current state of the plan, create a pilot project team and pilot project charter, and map the business processes that will be the focus of the pilot.
This step will walk you through the following activities:
This step involves the following participants:
You'll use the following tools & templates:
Establish current BCP maturity using Info-Tech’s ISO 22301-aligned BCP Maturity Scorecard.
This blueprint primarily addresses the first four sections in the scorecard, which align with the creation of the core components of your business continuity plan.
Info-Tech’s maturity scorecard is aligned with ISO 22301, the international standard that describes the key elements of a functioning business continuity management system or program – the overarching set of documents, practices, and controls that support the ongoing creation and maintenance of your BCP. A fully functional BCMS goes beyond business continuity planning to include crisis management, BCP testing, and documentation management.
Audit tools tend to treat every bullet point in ISO 22301 as a separate requirement – which means there’s almost 400 lines to assess. Info-Tech’s BCP Maturity Scorecard has synthesized key requirements, minimizing repetition to create a high-level self-assessment aligned with the standard.
A high score is a good indicator of likely success with an audit.
Download Info-Tech's BCP Maturity Scorecard
"The fact that this aligns with ISO is huge." - Dr. Bernard Jones MBCI, CBCP
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Assign roles and responsibilities for the BCP pilot project. Set milestones and timelines for the pilot.
Though IT is a critical dependency for most processes, IT shouldn’t own the business continuity plan. IT should be an internal BCP process consultant, and each business unit must own their plan.
IT should be an internal BCP consultant.
Why shouldn’t IT own the plan?
Info-Tech Insight
A goal of the pilot is to seed success for further planning exercises. This is as much about demonstrating the value of continuity planning to the business unit, and enabling them to own it, as it is about implementing the methodology successfully.
Outline roles and responsibilities on the pilot team using a “RACI” exercise. Remember, only one party can be ultimately accountable for the work being completed.
| Board | Executive Team | BCP Executive Sponsor | BCP Team Leader | BCP Coordinator | Pilot Bus. Unit Manager | Expert Bus. Unit Staff | IT Manager | |
|---|---|---|---|---|---|---|---|---|
| Communicate BCP project status | I | I | I | A | R | C | C | I |
| Assign resources to pilot BCP project | A | R | C | R | C | R | ||
| Conduct continuity planning activities | I | A/R | R | R | R | R | ||
| Create pilot BCP deliverables | I | A | R | R | C | C | C | |
| Manage BCP documentation | I | A | C | R | I | C | C | |
| Integrate results into BCMS | I | I | A | R | R | I | C | C |
| Create overall BCP project plan | I | I | A | R | C | C |
R: Responsible for doing the work.
A: Accountable to ensure the activity/work happens.
C: Consulted prior to decision or action.
I: Informed of the decision/action once it’s made.
"Large teams excel at solving problems, but it is small teams that are more likely to come up with new problems for their more sizable counterparts to solve." – Wang & Evans, 2019
Small teams tend to be better at trialing new techniques and finding new ways to think about problems, both of which are needed for a BCP pilot project.
Many organizations begin their BCP project with a target business unit in mind. It’s still worth establishing whether this business unit meets the criteria below.
Good candidates for a pilot project:
These short descriptions establish the functions, expectations, and responsibilities of each role at a more granular level.
The Board and executives have an outsized influence on the speed at which the project can be completed. Ensure that communication with these stakeholders is clear and concise. Avoid involving them directly in activities and deliverable creation, unless it’s required by their role (e.g. as a business unit manager).
| Project Role | Description |
|---|---|
| Board & Executive Team |
|
| Executive Sponsor |
|
| Pilot Business Unit Manager |
|
| BCP Coordinator |
|
| Expert Business Unit Staff |
|
| IT Manager |
|
| Other Business Unit Managers |
|
A skilled and committed coordinator is critical to building an effective and durable BCP.
Structure the role of the BCP Coordinator
The BCP Coordinator works with the pilot business unit as well as remaining business units to provide continuity and resolve discrepancies as they come up between business units.
Specifically, this role includes:
"We found it necessary to have the same person work with each business unit to pass along lessons learned and resolve contingency planning conflicts for common dependencies." – Michelle Swessel, PM and IT Bus. Analyst, Wisconsin Compensation Rating Bureau (WCRB)
This step will walk you through the following activities:
This step involves the following participants:
You'll use the following tools & templates:
Documented workflows, process dependencies, and workarounds when dependencies are unavailable.
Process review often results in discovering informal processes, previously unknown workarounds or breakdowns, shadow IT, or process improvement opportunities.
Note: A more in-depth analysis will be conducted later to refine priorities. The goal here is a high-level order of priority for the next steps in the planning methodology (identify business processes and dependencies).
Download Info-Tech’s Business Process Workflows Example
Policies and procedures manuals, if they exist, are often out of date or incomplete. Use these as a starting point, but don’t stop there. Identify the go-to staff members who are well versed in how a process works.
2.1 Define an objective impact scoring scale
2.2 Estimate the impact of downtime
2.3 Determine acceptable RTO/RPO targets
Assess the impact of business process downtime using objective, customized impact scoring scales. Sort business processes by criticality and by assigning criticality tiers, recovery time, and recovery point objectives.
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Define an impact scoring scale relevant to your business, which allows you to more-objectively assess the impact of business process downtime.
The activities in Phase 2 will help you set appropriate, acceptable recovery objectives based on the business impact of process downtime.
For example:
Create Impact Scoring Scales→Assess the impact of process downtime→Review overall impact of process downtime→Set Criticality Tiers→Set Recovery Time and Recovery Point Objectives
Work with the Business Unit Manager and Executive Sponsor to identify the maximum impact in each category to the entire business. Use a worst-case scenario to estimate the maximum for each scale. In the future, you can use this scoring scale to estimate the impact of downtime for other business units.
Cost estimates are like hand grenades and horseshoes: you don’t need to be exact. It’s much easier to get input and validation from other stakeholders when you have estimates. Even weak estimates are far better than a blank sheet.
Use just the impact scales that are relevant to your organization.
This step involves the following participants:
In this step, you’ll use these tools and templates:
Develop an objective view of the impact of downtime for key business processes.
Example: Highest total Goodwill, Compliance, and Safety impact score is 18.
| Tier | Score Range | % of high score |
|---|---|---|
| Tier 1 - Gold | 9-18 | 50-100% |
| Tier 2 - Silver | 5 to 9 | 25-50% |
| Tier 3 - Bronze | 0 to 5 | 0-25% |
This step involves the following participants:
In this step, you’ll use these tools and templates:
Right-size recovery objectives based on business impact.
The impact of downtime for most business processes tends to look something like the increasing impact curve in the image to the right.
In the moments after a disruption, impact tends to be minimal. Imagine, for example, that your organization was suddenly unable to pay its suppliers (don’t worry about the reason for the disruption, for the moment). Chances are, this disruption wouldn’t affect many payees if it lasted just a few minutes, or even a few hours. But if the disruption were to continue for days, or weeks, the impact of downtime would start to spiral out of control.
In general, we want to target recovery somewhere between the point where impact begins, and the point where impact is intolerable. We want to balance the impact of downtime with the investment required to make processes more resilient.
Account for hard copy files as well as electronic data. If that information is lost, is there a backup? BCP can be the driver to remove the last resistance to paperless processes, allowing IT to apply appropriate data protection.
Set recovery time objectives and recovery point objectives in the “Debate Space”
RTOs and RPOs are business-defined, impact-aligned objectives that you may not be able to achieve today. It may require significant investments of time and capital to enable the organization to meet RTO and RPO.
Set a range for RTO for each Tier.
| Tier | RTO |
|---|---|
| Tier 1 | 4 hrs- 24 hrs |
| Tier 2 | 24 hrs - 72 hrs |
| Tier 3 | 72 hrs - 120 hrs |
3.1 Determine current recovery procedures
3.2 Identify and prioritize projects to close gaps
3.3 Evaluate business continuity site and command center options
Outline business recovery processes. Highlight gaps and risks that could hinder business recovery. Brainstorm ideas to address gaps and risks. Review alternate site and business relocation options.
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Establish steps required for business recovery and current recovery timelines.
Identify risks & gaps that could delay or obstruct an effective recovery.
Step 2 - 2 hours
Establish command center.
Step 2: Risks
Step 2: Gaps
A good scenario is one that helps the group focus on the goal of tabletop planning – to discuss and document the steps required to recover business processes. We suggest choosing a scenario for your first exercise that:
An example: a gas leak at company HQ that requires the area to be cordoned off and power to be shut down. The business must resume processes from another location without access to materials, equipment, or IT services at the primary location.
A plan that satisfies the gas leak scenario should meet the needs of other scenarios that affect your normal workspace. Then use BCP testing to validate that the plan meets a wider range of incidents.
Notification
How will you be notified of a disaster event? How will this be escalated to leadership? How will the team responsible for making decisions coordinate (if they can’t meet on-site)? What emergency response plans are in place to protect health and safety? What additional steps are involved if there’s a risk to health and safety?
Assessment
Who’s in charge of the initial assessment? Who may need to be involved in the assessment? Who will coordinate if multiple teams are required to investigate and assess the situation? Who needs to review the results of the assessment, and how will the results of the assessment be communicated (e.g. phone bridge, written memo)? What happens if your primary mode of communication is unavailable (e.g. phone service is down)?
Declaration
Who is responsible today for declaring a disaster and activating business continuity plans? What are the organization’s criteria for activating continuity plans, and how will BCP activation be communicated? Establish a crisis management team to guide the organization through a wide range of crises by Implementing Crisis Management Best Practices.
Do the following:
Tabletop planning is most effective when you keep it simple.
Create one recovery workflow for all scenarios.
Traditional planning calls for separate plans for different “what-if” scenarios. This is challenging not just because it’s a lot more documentation – and maintenance – but because it’s impossible to predict every possible incident. Use the template, aligned to recovery of process dependencies, to create one recovery workflow for each business unit that can be used in and tested against different scenarios.
Download Info-Tech’s BCP Recovery Workflow Example
"We use flowcharts for our declaration procedures. Flowcharts are more effective when you have to explain status and next steps to upper management." – Assistant Director-IT Operations, Healthcare Industry
"Very few business interruptions are actually major disasters. It’s usually a power outage or hardware failure, so I ensure my plans address ‘minor’ incidents as well as major disasters."- BCP Consultant
Add the following data to your copy of the BCP Business Impact Analysis Tool.
Operating at a minimum acceptable functional level may not be feasible for more than a few days or weeks. Develop plans for immediate continuity first, then develop further plans for long-term continuity processes as required. Recognize that for longer term outages, you will evolve your plans in the crisis to meet the needs of the situation.
Work from and update the soft copy of your recovery workflow.
Info-Tech Insight
Remember that health and safety risks must be dealt with first in a crisis. The business unit recovery workflow will focus on restoring business operations after employees are no longer at risk (e.g. the risk has been resolved or employees have been safely relocated). See Implement Crisis Management Best Practices for ideas on how to respond to and assess a wide range of crises.
For some organizations, it’s not practical or possible to invest in the redundancy that would be necessary to recover in a timely manner from certain major events.
Leverage existing risk management practices to identify key high impact events that could present major business continuity challenges that could cause catastrophic disruptions to facility, IT, staffing, suppliers, or equipment. If you don’t have a risk register, review the scenarios on the next slide and brainstorm risks with the working group.
Work through tabletop planning to identify how you might work through an event like this, at a high level. In step 3.2, you can estimate the effort, cost, and benefit for different ideas that can help mitigate the damage to the business to help decision makers choose between investment in mitigation or accepting the risk.
Document any scenarios that you identify as outside the scope of your continuity plans in the “Scope” section of your BCP Summary document.
For example:
A single location manufacturing company is creating a BCP.
The factory is large and contains expensive equipment; it’s not possible to build a second factory for redundancy. If the factory is destroyed, operations can’t be resumed until the factory is rebuilt. In this case, the BCP outlines how to conduct an orderly business shutdown while the factory is rebuilt.
Contingency planning to resume factory operations after less destructive events, as well as a BCP for corporate services, is still practical and necessary.
| Scenario Type | Considerations |
|---|---|
| Local hazard (gas leak, chemical leak, criminal incident, etc.) |
|
| Equipment/building damage (fire, roof collapse, etc.) |
|
| Regional natural disasters |
|
| Supplier failure (IT provider outage, disaster at supplier, etc.) |
|
| Staff (lottery win, work stoppage, pandemic/quarantine) |
|
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Identify and prioritize projects and action items that can improve business continuity capabilities.
Try to avoid debates about feasibility at this point. The goal is to get ideas on the board.
When you’re brainstorming solutions to problems, don’t stop with the first idea, even if the solution seems obvious. The first idea isn’t always the best or only solution – other ideas can expand on it and improve it.
Step 4: No formal process to declare a disaster and invoke business continuity.
Step 7: Alternate site could be affected by the same regional event as the main office.
Step 12: Need to confirm supplier service-level agreements (SLAs).
With COVID-19, most organizations have experience with mass work-from-home.
Review the following case studies. Do they reflect your experience during the COVID-19 pandemic?
Consider where your own work-from-home plans fell short.
People
→
Site & Facilities
→
External Services & Suppliers
→
Technology & Physical Assets
→
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Identify requirements for an alternate business site.
"There are horror stories about organizations that assumed things about their alternate site that they later found out they weren’t true in practice." – Dr. Bernard Jones, MBCI CBCP
If you choose a shared location as a BCP site, a regional disaster may put you in competition with other tenants for space.
For many organizations, a dedicated command center (TVs on the wall, maps and charts in filing cabinets) isn’t necessary. A conference bridge and collaboration tools allowing everyone to work remotely can be an acceptable offsite command center as long as digital options can meet your command center requirements.
Leverage the methodology and tools in this blueprint to define your return to normal (repatriation) procedures:
For more on supporting a business move back to the office from the IT perspective, see Responsibly Resume IT Operations in the Office
4.1 Consolidate BCP pilot insights to support an overall BCP project plan
4.2 Outline a business continuity management (BCM) program
4.3 Test and maintain your BCP
Summarize and consolidate your initial insights and documentation. Create a project plan for overall BCP. Identify teams, responsibilities, and accountabilities, and assign documentation ownership. Integrate BCP findings in DR and crisis management practices. Set guidelines for testing, plan maintenance, training, and awareness.
Participants
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Present results from the pilot BCP, and outline how you’ll use the pilot process with other business units to create an overall continuity program.
Structure the overall BCP program.
The BCP Summary document is the capstone to business unit continuity planning exercises. It consolidates your findings in a short overview of your business continuity requirements, capabilities, and maintenance procedures.
Info-Tech recommends embedding hyperlinks within the Summary to the rest of your BCP documentation to allow the reader to drill down further as needed. Leverage the following documents:
The same methodology described in this blueprint can be repeated for each business unit. Also, many of the artifacts from the BCP pilot can be reused or built upon to give the remaining business units a head start. For example:
You may need to create some artifacts that are site specific. For example, relocation plans or emergency plans may not be reusable from one site to another. Use your judgement to reuse as much of the templates as you can – similar templates simplify audit, oversight, and plan management.
Adjust the pilot charter to answer the following questions:
As with the pilot, choose a business unit, or business units, where BCP will have the greatest impact and where further BCP activities will have the greatest likelihood of success. Prioritize business units that are critical to many areas of the business to get key results sooner.
Work with one business unit at a time if:
Work with several business units at the same time if:
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Document BCP teams, roles, and responsibilities.
Document contact information, alternates, and succession rules.
A BCM program should:
Develop a Business Continuity Management Program
Phase 4 of this blueprint will focus on the following elements of a business continuity management program:
Schedule a call with an Info-Tech Analyst for help building out these core elements, and for advice on developing the rest of your BCM program.
BC management teams (including the secondary teams such as the emergency response team) have two primary roles:
Crisis leaders require strong crisis management skills:
Collectively, the team must include a broad range of expertise as well as strong planning skills:
Note: For specific BC team roles and responsibilities, including key resources such as Legal, HR, and IT SMEs required to prepare for and execute crisis management plans, see Implement Crisis Management Best Practices.
BCM Team: Govern business continuity, DR, and crisis management planning. Support the organization’s response to a crisis, including the decision to declare a disaster or emergency.
Emergency Response Teams: Assist staff and BC teams during a crisis, with a focus first on health and safety. There’s usually one team per location. Develop and maintain emergency response plans.
Emergency Response Teams: Assist staff and BC teams during a crisis, with a focus first on health and safety. There’s usually one team per location. Develop and maintain emergency response plans.
IT Disaster Recovery Team: Manage the recovery of IT services and data following an incident. Develop and maintain the IT DRP.
Business Unit BCP Teams: Coordinate business process recovery at the business unit level. Develop and maintain business unit BCPs.
“Planning Mode”
Executive Team → BC Management Team ↓
“Crisis Mode”
Executive Team ↔Crisis Management Team↓ ↔ Emergency Response Teams (ERT)
For more details on specific roles to include on these teams, as well as more information on crisis management, review Info-Tech’s blueprint, Implement Crisis Management Best Practices.
Track teams, roles, and contacts in this template. It is pre-populated with roles and responsibilities for business continuity, crisis management, IT disaster recovery, emergency response, and vendors and suppliers critical to business operations.
Track contact information in this template only if you don’t have a more streamlined way of tracking it elsewhere.
Download Info-Tech’s Business Continuity Teams and Roles Tool
Suppliers and vendors might include:
Supplier RTOs and RPOs should align with the acceptable RTOs and RPOs defined in the BIA. Where they do not, explore options for improvement.
Confirm the following:
Your BCP isn’t any one document. It’s multiple documents that work together.
Continue to work through any additional required documentation. Build a repository where master copies of each document will reside and can be updated as required. Assign ownership of document management to someone with an understanding of the process (e.g. the BCP Coordinator).
| Governance | Recovery | ||
|---|---|---|---|
| BCMS Policy | BCP Summary | Core BCP Recovery Workflows | |
| Business Process Workflows | Action Items & Project Roadmap | BCP Recovery Checklists | |
| BIA | Teams, Roles, Contact Information | BCP Business Process Workarounds and Recovery Checklists | |
| BCP Maturity Scorecard | BCP Project Charter | Additional Recovery Workflows | |
| Business Unit Prioritization Tool | BCP Presentation | ||
Recovery documentation has a different audience, purpose, and lifecycle than governance documentation, and keeping the documents separate can help with content management. Disciplined document management keeps the plan current and accessible.
Use the following BCP outputs to inform your DRP:
| PCP Outputs | DRP Activities | |
|---|---|---|
| Business processes defined | Identify critical applications | |
|
Dependencies identified:
|
↗ → |
Identify IT dependencies:
|
|
Recovery objectives defined:
|
→ |
Identify recovery objectives:
|
|
Projects identified to close gaps:
|
→ |
Identify projects to close gaps:
|
Info-Tech Insight
Don’t think of inconsistencies between your DRP and BCP as a problem. Discrepancies between the plans are part of the discovery process, and they’re an opportunity to have a conversation that can improve alignment between IT service capabilities and business needs. You should expect that there will be discrepancies – managing discrepancies is part of the ongoing process to refine and improve both plans.
BC/DR Planning Workflow
1. Collect BCP outputs that impact IT DRP (e.g. technology RTOs/RPOs).
2. As BCPs are done, BCP Coordinator reviews outputs with IT DRP Management Team.
3. Use the RTOs/RPOs from the BCPs as a starting point to determine IT recovery plans.
4. Identify investments required to meet business-defined RTOs/RPOs, and validate with the business.
5. Create a DR technology roadmap to meet validated RTOs/RPOs.
6. Review and update business unit BCPs to reflect updated RTOs/RPOs.
Shadow IT can be a symptom of larger service support issues. There should be a process for requesting and tracking non-standard services from IT with appropriate technical, security, and management oversight.
Assign the BCP Coordinator the task of creating a master list of BC projects, and then work with the BC management team to review and reprioritize this list, as described below:
Improving business continuity capabilities is a marathon, not a sprint. Change for the better is still change and introduces risk – massive changes introduce massive risk. Incremental changes help minimize disruption. Use Info-Tech research to deliver organizational change.
"Developing a BCP can be like solving a Rubik’s Cube. It’s a complex, interdepartmental concern with multiple and sometimes conflicting objectives. When you have one side in place, another gets pushed out of alignment." – Ray Mach, BCP Expert
This step will walk you through the following activities:
This step involves the following participants:
In this step, you’ll use these tools and templates:
Create a plan to maintain the BCP.
Mastery comes through practice and iteration. Iterating on and testing your plan will help you keep up to date with business changes, identify plan improvements, and help your organization’s employees develop a mindset of continuity readiness. Maintenance drives continued success; don’t let your plan become stagnant, messy, and unusable.
Your BCM program should structure BCP reviews and updates by answering the following:
At a minimum, review goals should include:
Who leads reviews and updates documents?
The BCP Coordinator is likely heavily involved in facilitating reviews and updating documentation, at least at first. Look for opportunities to hand off document ownership to the business units over time.
How do we track reviews, tests, and updates?
Keep track of your good work by keeping a log of document changes. If you don’t have one, you can use the last tab on the BCP-DRP Maintenance Checklist.
When do we review the plan?
This tool helps you set a schedule for plan update activities, identify document and exercise owners, and log updates for audit and governance purposes.
Info-Tech Insight
Everyone gets busy. If there’s a meeting you can schedule months in advance, schedule it months in advance! Then send reminders closer to the date. As soon as you’re done the pilot BCP, set aside time in everyone’s calendar for your first review session, whether that’s three months, six months, or a year from now.
Use this template to:
If you require more detail to support your recovery procedures, you can use this template to:
Download Info-Tech’s BCP Process Workarounds & Recovery Checklists Template
Use this template to:
Download Info-Tech’s BCP Notification, Assessment, and Disaster Declaration Plan template
Use this template to:
These HR research resources live on the website of Info-Tech’s sister company, McLean & Company. Contact your Account Manager to gain access to these resources.
This blueprint outlined:
If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.
Contact your account representative for more information.
workshops@infotech.com
1-888-670-8889
Dr. Bernard A. Jones, MBCI, CBCP
Professor and Continuity Consultant Berkeley College
Dr. Jones is a professor at Berkeley College within the School of Professional Studies teaching courses in Homeland Security and Emergency Management. He is a member of the National Board of Directors for the Association of Continuity Professionals (ACP) as well as the Information & Publications Committee Chair for the Garden State Chapter of the ACP. Dr. Jones earned a doctorate degree in Civil Security Leadership, Management & Policy from New Jersey City University where his research focus was on organizational resilience.
Kris L. Roberson
Disaster Recovery Analyst Veterans United Home Loans
Kris Roberson is the Disaster Recovery Analyst for Veterans United Home Loans, the #1 VA mortgage lender in the US. Kris oversees the development and maintenance of the Veterans United Home Loans DR program and leads the business continuity program. She is responsible for determining the broader strategies for DR testing and continuity planning, as well as the implementation of disaster recovery and business continuity technologies, vendors, and services. Kris holds a Masters of Strategic Leadership with a focus on organizational change management and a Bachelors in Music. She is a member of Infragard, the National Association of Professional Women, and Sigma Alpha Iota, and holds a Project+ certification.
Trevor Butler
General Manager of Information Technology City of Lethbridge
As the General Manager of Information Technology with the City of Lethbridge, Trevor is accountable for providing strategic management and advancement of the city’s information technology and communications systems consistent with the goals and priorities of the corporation while ensuring that corporate risks are appropriately managed. He has 15+ years of progressive IT leadership experience, including 10+ years with public sector organizations. He holds a B.Mgt. and PMP certification along with masters certificates in both Project Management and Business Analysis.
Robert Miller
Information Services Director Witt/Kieffer
Bob Miller is the Information Services Director at Witt/Kieffer. His department provides end-user support for all company-owned devices and software for Oak Brook, the regional offices, home offices, and traveling employees. The department purchases, implements, manages, and monitors the infrastructure, which includes web hosting, networks, wireless solutions, cell phones, servers, and file storage. Bob is also responsible for the firm’s security planning, capacity planning, and business continuity and disaster preparedness planning to ensure that the firm has functional technology to conduct business and continue business growth.
Create a Right-Sized Disaster Recovery Plan
Close the gap between your DR capabilities and service continuity requirements.
Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind
Go beyond satisfying auditors to drive process improvement, consistent IT operations, and effective knowledge transfer.
Select the Optimal Disaster Recovery Deployment Model
Determine which deployment models, including hybrid solutions, best meet your DR requirements.
“Business Continuity Planning.” IT Examination HandBook. The Federal Financial Institution Examination Council (FFIEC), February 2015. Web.
“Business Continuity Plans and Emergency Contact Information.” FINRA, 12 February 2015. Web.
“COBIT 5: A Business Framework for the Governance and Management of Enterprise IT.” ISACA, n.d. Web.
Disaster Resource GUIDE. Emergency Lifeline Corporation, n.d. Web.
“DR Rules & Regulations.” Disaster Recovery Journal, March 2017. Web.
“Federal Information Security Management Act (FISMA).” Homeland Security, 2014. Web.
FEMA. “Planning & Templates.” FEMA, n.d. Web.
“FINRA-SEC-CFTC Joint Advisory (Regulatory Notice 13-25).” FINRA, August 2013. Web.
Gosling, Mel and Andrew Hiles. “Business Continuity Statistics: Where Myth Meets Fact.” Continuity Central, 24 April 2009. Web.
Hanwacker, Linda. “COOP Templates for Success Workbook.” The LSH Group, 2016. Web.
Potter, Patrick. “BCM Regulatory Alphabet Soup – Part Two.” RSA Link, 28 August 2012. Web.
The Good Practice Guidelines. Business Continuity Institute, 2013. Web.
Wang, Dashun and James A. Evans. “When Small Teams are Better than Big Ones.” Harvard Business Review, 21 February 2019. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Map the current onboarding process and identify the challenges to a virtual approach.
Determine how existing onboarding activities can be modified for a virtual environment.
Finalize the virtual onboarding process and create an action plan. Continue to re-assess and iterate over time.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Establish your project vision and metrics of success before shortlisting potential contact center architectures and deciding which is right-sized for the organization.
Build business requirements to achieve stakeholder buy-in, define key deliverables, and issue an RFP/RFQ to shortlisted vendors.
Score RFP/RFQ responses and decide upon a vendor before constructing a SOW.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Shortlist and decide upon a right-sized contact center architecture.
A high-level decision for a right-sized architecture
1.1 Define vision and mission statements.
1.2 Identify infrastructure metrics of success.
1.3 Confirm key performance indicators for contact center operations.
1.4 Complete architecture assessment.
1.5 Confirm right-sized architecture.
Project outline
Metrics of success
KPIs confirmed
Quickly narrow down right-sized architecture
Decision on right-sized contact center architecture
Build business requirements and define key deliverables to achieve stakeholder buy-in and shortlist potential vendors.
Key deliverables defined and a shortlist of no more than five vendors
Sections 7-8 of the Contact Center Playbook completed
2.1 Hold focus groups with key stakeholders.
2.2 Gather business, nonfunctional, and functional requirements.
2.3 Define key deliverables.
2.4 Shortlist five vendors that appear meet those requirements.
User requirements identified
Business Requirements Document completed
Key deliverables defined
Shortlist of five vendors
Compare and evaluate shortlisted vendors against gathered requirements.
Have a strong overview of which vendors are preferred for issuing RFP/RFQ
Section 9 of the Contact Center Playbook
3.1 Input requirements to the Contact Center RFP Scoring Tool. Define which are mandatory and which are desirable.
3.2 Determine which vendors best meet requirements.
3.3 Compare requirements met with anticipated TCO.
3.4 Compare and rank vendors.
An assessment of requirements
Vendor scoring
A holistic overview of requirements scoring and vendor TCO
An initial ranking of vendors to shape RFP process after workshop end
Walk through the Contact Center SOW Template and Guide to identify how much time to allocate per section and who will be responsible for completing it.
An understanding of a SOW that is designed to avoid major pitfalls with vendor management
Section 10 of the Contact Center Playbook
4.1 Get familiar with the SOW structure.
4.2 Identify which sections will demand greater time allocation.
4.3 Strategize how to avoid potential pitfalls.
4.4 Confirm reviewer responsibilities.
A broad understanding of a SOW’s key sections
A determination of how much time should be allocated for reviewing major sections
A list of ways to avoid major pitfalls with vendor management
A list of reviewers, the sections they are responsible for reviewing, and their time allocation for their review
Finalize deliverables and plan post-workshop communications.
A completed Contact Center Playbook that justifies each decision of this workshop
5.1 Finalize deliverables.
5.2 Support communication efforts.
5.3 Identify resources in support of priority initiatives.
Contact Center Playbook delivered
Post-workshop engagement to confirm satisfaction
Follow-up research that complements the workshop or leads workshop group in relevant new directions
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
IT leaders often realize that there are barriers impacting their employees but don’t know how to address them. This report provides insights on the barriers and actions that can help improve the lives of Black professionals in technology.
Diversity in tech is not a new topic, and it's not a secret that technology organizations struggle to attract and retain Black employees. Ever since the early '90s, large tech organizations have been dealing with public critique of their lack of diversity. This topic is close to our hearts, but unfortunately while improvements have been made, progress is quite slow.
In recent years, current events have once again brought diversity to the forefront for many organizations. In addition, the pandemic along with talent trends such as "the great resignation" and "quiet quitting" and preparations for a recession have not only impacted diversity at large but also Black professionals in technology. Our previous research has focused on the wider topic of Recruiting and Retaining People of Color in Tech, but we've found that the experiences of persons of color are not all the same.
This study focuses on the unique experience of Black professionals in technology. Over 600 people were surveyed using an online tool; interviews provided additional insights. We're excited to share our findings with you.
|
|
|
Allison Straker |
Ugbad Farah |
In October 2021, we launched a survey to understand what the Black experience is like for people in technology. We wanted and received a variety of responses which would help us to understand how Black technology professionals experienced their working world. We received responses from 633 professionals, providing us with the data for this report.
For more information on our survey demographics please see the appendix at this end of this report.
26% of our respondents either identified as Black or felt the world sees them as Black.
Professionals from various countries responded to the survey:
Organizations do better and are more innovative when they have more diversity, a key ingredient in an organization's secret sauce.
Organizations also benefit from engaged employees, yet we've seen that organizations struggle with both. Just having a certain number of diverse individuals is not enough. When it comes to reaping the benefits of diversity, organizations can flourish when employees feel safe bringing their whole selves to work.
| 45% | Innovation Revenue by Companies With Above-Average Diversity Scores |
| 26% |
Innovation Revenue by Companies With Below-Average Diversity Scores |
Companies with higher employee engagement experience 19.2% higher earnings.
However, those with lower employee engagement experience 32.7% lower earnings.
(DecisionWise, 2020)
If your workforce doesn't reflect the community it serves, your business may be missing out on the chance to find great employees and break into new and growing markets, both locally and globally.
Diversity makes good business sense.
(Business Development Canada, 2023)
Why is this about Black professionals and not other diverse groups?
While there are a variety of diversity dimensions, it's important to understand what makes up a "multicultural workforce." There is more to diversity than gender, race, and ethnicity. Organizations need to understand that there is diversity within these groups and Black professionals have their own unique experience when it comes to entering and navigating tech that needs to be addressed.
(Brookfield Institute for Innovation and Entrepreneurship, 2019)
The solutions that apply to Black professionals are not only beneficial for Black employees but for all. While all demographics are unique, the solutions in this report can support many.
Less Black professionals responded as "satisfied" in their IT careers. The question is: How do we mend the Gap?
Percentage of IT Professionals Who Reported Being Very Satisfied in Their Current Role
Our research suggests that the differences in satisfaction among ethnic groups are related to differences in value systems. We asked respondents to rank what's important, and we explored why.
Non-Black professionals rated autonomy and their manager working relationships as most important.
For Black professionals, while those were important, #1 was promotion and growth opportunities, ranked #7 by all other professionals. This is a significant discrepancy.
Recognition of my work/accomplishments also was viewed significantly differently, with Black professionals ranking it low on the list at #7 and all other professionals considering it very important at #3.
|
All Other Professionals |
Black Professionals |
|
|---|---|---|
|
||
In Maslow's hierarchy, it is necessary for people to achieve items lower on the hierarchy before they can successfully pursue the higher tiers.
Too many Black professionals in tech are busy trying to achieve some of the lower parts of the hierarchy; it is stopping them from achieving elements higher up that can lead to job satisfaction.
This can stop them from gaining esteem, importance, and ultimately, self-actualization. The barriers that impact safety and social belonging happen on a day-to-day basis, and so the day-to-day lives of Black professionals in tech can look very different from their counterparts.
|
|
| There are various barriers that increase the likelihood for Black professionals to focus on the lower end of the needs hierarchy: |
These are among some of the solutions that, when layered, can support Black professionals in tech in moving up the needs hierarchy. Focusing on these actions can support Black professionals in achieving much needed job satisfaction. |
The barriers that Black professionals encounter aren't limited to the same barriers as their colleagues, and too often this means that they aren't in a position to grow their careers in a way that leads to job satisfaction.
There is a 11% gap between the satisfaction of Black professionals and their peers.
Early Steps:
Take time to understand the Black experience.
As leaders, it's important to be aware that employee goals vary depending on the barriers they're battling with.
Intermediate:
If Black employees don't have strong relationships, networks, and mentorships it becomes increasingly difficult to navigate the path to upward mobility.
As a leader, you can look for opportunities to bridge the gap on these types of conversations.
Advanced:
Black professionals in tech are not advancing like their counterparts.
Creating clear career paths will not only benefit Black employees but also support your entire organization.
Key metrics:
Common barriers
Black professionals, like their colleagues, encounter barriers as they try to advance their careers. The barriers both groups encounter include microaggressions, racism, ageism, accessibility issues, sexual orientation, bias due to religion, lack of a career-supported network, gender bias, family status bias, and discrimination due to language/accents.
Microaggressions and racism are at the top of these barriers, but Black professionals also deal with other barriers that their colleagues may experience, such as gender-based bias, accessibility issues, religion, and more.
One of these barriers alone can be difficult to deal with but when they are compounded it can be very difficult to navigate through the working environment in tech.
A statement, action, or incident regarded as an instance of indirect, subtle, or unintentional discrimination against members of a marginalized group such as a racial or ethnic minority.
(Oxford Languages, 2023)
These things may seem innocent enough but the messaging that is received and the lasting impression is often far from it.
Our research shows that racism and discrimination contribute to poor mental health among Black professionals.
"The experience of having to question whether something happened to you because of your race or constantly being on edge because your environment is hostile can often leave people feeling invisible, silenced, angry, and resentful."
Dr. Joy Bradford,
clinical Psychologist, qtd. In Pfizer
Both groups had some success finding jobs in "no time" – however, there was a difference. Thirty-four percent of "all others" found their jobs quickly, while the numbers were less for Black professionals, at 26%. There was also a difference at the opposite end of the spectrum. For 29% of Black professionals, it took seven months or longer to find their IT job, while that number is only 19% for their peers.
.
This points to the need for improvements in recruitment and career advancement.
29% of Black respondents said that it took them 7 months or longer to find their technology job.
Compared to 19% of all other professionals that selected the same response.
Our research shows that compared to all other ethnicities; Black participants were 55% more likely to report that they had no career advancement/promotion in their career. There is a bigger percentage of Black professionals who have never received a promotion; there's also a large number of Black professionals who have been working a significant amount time in the same role without a promotion.
Black participants were 55% more likely to report that they had had no career advancement/promotion in their career.
When employees feel disillusioned with things like career advancement and microaggressions, they often become disengaged. When you continuously have to steel yourself against microaggressions, racism, and other barriers, it prevents you from bringing your whole self to the office. The barriers can lead to what's been coined as "emotional tax." An emotional tax is the experience of feeling different from colleagues because of your inherent diversity and the associated negative effects on health, wellbeing, and the ability to thrive at work.
|
Earnings of companies with higher employee engagement |
19.2% |
|
Earnings of companies with lower employee engagement |
-32.7% |
(DecisionWise, 2020)
"I've conditioned myself for the corporate world, I don't bring my authentic self to work."
Anonymous Interview Subject
Lack of engagement also costs the organization in terms of turnover, something many organizations today are struggling with how to address. Organizations want to increase the ability of the workforce to remain in the organization. For Black employees, this gets harder when they're not engaged and they're the only one. When the emotional tax gets to be too much, this can lead to turnover. Turnover not only costs companies billions in profits, it also negatively impacts leadership diversity. It's difficult to imagine career growth when you don't see anyone that looks like you at the top. It is a challenge to see your future when there aren't others that you can relate to at top levels in the organization, leading to one of our interview subjects to muse, "How long can I last?"
"Being Black in tech can be hard on your mental health. Your mind is constantly wondering, 'how long can I last?' "
Anonymous Interview Subject
For many Black professionals, "code-switching," or altering the way one speaks and acts depending on context, becomes the norm to make others more comfortable. Many feel that being authentic and succeeding in the workplace are mutually exclusive.
We asked respondents "What's in place to build an inclusive culture at your company?" Most respondents (51% and 45%) reported that there were employee resource groups at their organizations.
There are various actions that organizations can take to help address barriers.
It's important to ensure these are not put in as band-aid solutions but that they are carefully thought out and layered.
Our findings demonstrate that remote work, career development, and DEI programs along with mentorship and diverse leadership are strong enablers of professional satisfaction. An unfortunate consequence, if professionals are not nurtured, is that we risk losing much needed talent to self-employment or to other organizations.
Respondents were asked to distribute points across potential solutions that could lead to job satisfaction. The ratings showed that there were common solutions that could be leveraged across all groups.
Respondents were asked what solutions were valuable for their career development.
All groups were mostly aligned on the order of the solutions that would lead to career satisfaction; however, Black professionals rated the importance of employee resource groups as higher than their colleagues did.
Mentorship and sponsorship are seen as key for all employees, as is of course training.
However, employee resource groups (ERGs) were rated significantly higher for Black professionals and discussions around diversity were higher for their colleagues. This may be because other groups feel a need to learn more about diversity, whereas Black professionals live this experience on a day-to day basis, so it's not as critical for them.
Mentorship and sponsorship help to close the job satisfaction gap for Black IT professionals. The percentage of satisfied Black employees almost doubles when they have a mentor or sponsorship, moving the satisfaction rate to closer to all other colleagues.
As leaders, you likely benefit from a few different advisors, and your staff should be able to benefit in the same way.
They can have their own personal board of advisors, both inside and outside of your organization, helping them to navigate the working world in IT.
To support your staff, provide guidance and coaching to internal mentors so that they can best support employees, and ensure that your organizational culture supports relationship building and trust.
Performance-driven guidance geared to support the employee with on-the-job performance. This could be a short-term relationship.
A relationship where the mentor provides guidance, information, and expertise to support the long-term career development of the mentee.
The act of advocating on the behalf of another for a position, promotion, development opportunity, etc. over a longer period.
For more information on setting up a mentorship program, see Optimize the Mentoring Program to Build a High Performing Learning Organization.
|
"With some degree of mentorship or sponsorship, it means that your ability to thrive or to have a positive experience in organizations increases substantially. Mentorship and sponsorship are very often the lynchpin of someone being successful and sticking with an organization. Sponsorship is an endorsement to other high-level stakeholders who very often are the gatekeepers of opportunity. Sponsors help to shepherd you through the gate." |
|
|
Carlos Thomas |
Employee resource groups enable employees to connect in their workplace based on shared characteristics or life experiences.
ERGs generally focus on providing support, enhancing career development, and contributing to personal development in the work environment. Some ERGs provide advice to the organization on how they can support their diverse employees.
As leaders, you should support and encourage the formation of ERGs in your organization.
What each ERG does will vary according to the needs of employees in your organization. Your role is to enable the ERGs as they are created and maintained.
|
"Employee resource groups, when leveraged in an authentically intentional way, can be the some of the most impactful stakeholders in the development and implementation of the organizational diversity, equity, and inclusion strategy. ERGs are essential to the development of policies, programs, and initiatives that address the needs of equity-seeking groups and are key to driving organizational culture and employee wellbeing, in addition to hiring and recruitment. ERGs must be set up for success by having adequate resources to do the work, which includes adequate budgets, executive sponsorship, training, support, and capacity to do the work. According to a Great Place To Work survey (2021), 50% of ERGs identified the need for adequate resources as a challenge for carrying out the work.:" |
|
|
CINNAMON CLARK |
Representation at leadership levels is especially stagnant.
Black Americans comprise 13.6% of the US population
(2022 data from the US Census Bureau)
And yet only 5.9% of the country's CEOs are Black, with only 6 (1%) at the top of Fortune 500 companies.
(2021 data from the Bureau of Labor Statistics and Fortune.com)
I've never worked for a company that has Black executives. It's difficult to envision long-term growth with an organization when you don't see yourself represented in leadership.
– Anonymous Interview Subject
Our research shows that Black professionals are more satisfied in their role when they see leaders that look like them.
Satisfaction of other professionals is not as impacted by diversity in leadership as for Black professionals. Satisfaction doubles in organizations that have a diverse leadership team.
To reap the benefits from diversity, we need to ensure diversity is not just in entry or mid-level positions and provide employees an opportunity to see diversity in their company's leadership.
|
"As a Black professional leader, it's not lost on me that I have a responsibility. I have to demonstrate authenticity, professionalism, and exemplary behavior that others can mimic. And I must also showcase that there are possibilities for those coming up in their career. I feel very grateful that I can bestow onto others my knowledge, my experience, my journey, and the tips that I've used to help bring me to be where I am. |
|
|
C. Fara Francis |
While all groups have embraced the work-from-home movement, many Black professionals find it reduces the impact of racial incidents in the workplace.
I have to guard and protect myself from experiencing and witnessing racism every day. I am currently working remotely, and I can say for certain my mood and demeanor have improved. Not having to decide if I should address a racist comment or action has made my day easier.
Source: Slate, 2022
Survey respondents were asked about the positive and negative changes they saw in their interactions and experiences with remote work. Black employees and their colleagues replied similarly, with mostly positive experiences.
While both groups enjoyed better chances for career advancement, the difference was significantly higher for Black professionals.
The biggest reasons for both groups in choosing self-employment were for better pay, career growth, and work/life balance.
While the desire for better pay was the highest reason for both groups, for engaged employees salary is a lower priority than other concerns (Adecco Group's Global Workforce of the Future report). Consider salary in conjunction with career growth, work/life balance, and the variety in the work that your employees have.
If we don't consider our Black employees, not only do we risk them leaving the organization, but they may decide to just work for themselves.
38% of all respondents believe their organizations are very committed to DEI
49% believe they are somewhat committed
9% feel they are not committed
4% are unsure
Make sure supports are in place to help your employees grow in their careers:
Leadership
IT Leadership Career Planning Research Center
Diversity and Inclusion Tactics
IT Diversity & Inclusion Tactics
Employee Development Planning
Implement an IT Employee Development Plan
While organization's efforts are acknowledged, Black professionals aren't as optimistic about the commitment as their peers. Make sure that your programs are reaching the various groups you want to impact, to increase the likelihood of satisfaction in their roles.
SATISFACTION INCREASES IN BOTH BLACK AND NON-BLACK PROFESSIONALS
When they believe in their company's commitment to diversity, equity. and inclusion.
Of those who believe in their organization's commitment, 61% of Black professionals and 67% of non-Black professionals are very satisfied in their roles.
|
BELIEVE THEIR ORGANIZATION IS NOT COMMITTED TO DEI |
BELIEVE THEIR ORGANIZATION IS VERY COMMITTED TO DEI |
|
|---|---|---|
|
NON-BLACK PROFESSIONALS |
8% |
41% |
|
BLACK PROFESSIONALS |
13% |
30% |
It's important to understand the current landscape:
We recognize that resolving this is not easy. Although senior executives are recognizing that a diverse set of experiences, perspectives, and backgrounds is crucial to fostering innovation and competing on the global stage, organizations often don't take the extra step to actively look for racialized talent, and many people still believe that race doesn't play an important part in an individual's ability to access opportunities.
Look at a variety of solutions that you can implement within your organization; layering solutions is the key to driving business diversity. Always keep in mind that diversity is not a monolith, that the experiences of each demographic varies.
Diversity in tech survey
As part of the research process for the State of Black Tech Report, Info-Tech Research Group conducted an open online survey among its membership and wider community of professionals. The survey was fielded from October 2021 to April 2022, collecting 633 responses.
Education was fairly consistent across both groups, with a few exceptions: more Black professionals had secondary school (9% vs. 4%) and more Black professionals had Doctorate degrees (4% vs. 2%).
We had more non-Black respondents with 20+ years of experience (31% vs. 19%) and more Black respondents with less than 1 year of experience (8% vs. 5%) – the rest of the years of experience were consistent across the two groups.
It is important to recognize that people are often seen by "the world" as belonging to a different race or set of races than what they personally identify as. Both aspects impact a professional's experience in the workplace.
Barton, LeRon. “I’m Black. Remote Work Has Been Great for My Mental Health.” Slate, 15 July 2022.
“Black or African American alone, percent.” U.S. Census Bureau QuickFacts: United States. Accessed 14 February 2023.
Boyle, Matthew. “More Workers Ready to Quit Over ‘Window Dressing’ Racism Efforts.” Bloomberg.com, 9 June 2022.
Boyle, Matthew. “Remote Work Has Vastly Improved the Black Worker Experience.” Bloomberg.com, 5 October 2021.
Cooper, Frank, and Ranjay Gulati. “What Do Black Executives Really Want?” Harvard Business Review, 18 November 2021.
“Emotional Tax.” Catalyst. Accessed 1 April 2022.
“Employed Persons by Detailed Occupation, Sex, Race, and Hispanic or Latino Ethnicity” U.S. Bureau of Labor Statistics. Accessed February 14, 2023.
“Equality in Tech Report - Welcome.” Dice, 9 March 2022. Accessed 23 March 2022.
Erb, Marcus. "Leaders Are Missing the Promise and Problems of Employee Resource Groups." Great Place To Work, 30 June 2021.
Gawlak, Emily, et al. “Key Findings - Being Black In Corporate America.” Coqual, Center for Talent Innovation (CTI), 2019.
“Global Workforce of the Future Research.” Adecco, 2022. Accessed 4 February 2023.
Gruman, Galen. “The State of Ethnic Minorities in U.S. Tech: 2020.” Computerworld, 21 September 2020. Accessed 31 May 2022.
Hancock, Bryan, et al. “Black Workers in the US Private Sector.” McKinsey, 21 February 2021. Accessed 1 April 2022.
“Hierarchy Of Needs Applied To Employee Engagement.” Proactive Insights, 12 February 2020.
Hobbs, Cecyl. “Shaping the Future of Leadership for Black Tech Talent.” Russell Reynolds Associates, 27 January 2022. Accessed 3 August 2022.
Hubbard, Lucas. “Race, Not Job, Predicts Economic Outcomes for Black Households.” Duke Today, 16 September 2021. Accessed 30 May 2022.
Knight, Marcus. “How the Tech Industry Can Be More Inclusive to the Black Community.” Crunchbase, 23 February 2022.
“Maslow’s Hierarchy of Needs in Employee Engagement (Pre and Post Covid 19).” Vantage Circle HR Blog, 30 May 2022.
McDonald, Autumn. “The Racism of the ‘Hard-to-Find’ Qualified Black Candidate Trope (SSIR).” Stanford Social Innovation Review, 1 June 2021. Accessed 13 December 2021.
McGlauflin, Paige. “The Fortune 500 Features 6 Black CEOs—and the First Black Founder Ever.” Fortune, 23 May 2022. Accessed 14 February 2023.
“Microaggression." Oxford English Dictionary, Oxford Languages, 2023.
Reed, Jordan. "Understanding Racial Microaggression and Its Effect on Mental Health." Pfizer, 26 August 2020.
Shemla, Meir “Why Workplace Diversity Is So Important, And Why It’s So Hard To Achieve.” Forbes, 22 August 2018. Accessed 4 February 2023.
“The State of Black Women in Corporate America.” Lean In and McKinsey & Company, 2020. Accessed 14 January 2022.
Van Bommel, Tara. “The Power of Empathy in Times of Crisis and Beyond (Report).” Catalyst, 2021. Accessed 1 April 2022.
Vu, Viet, Creig Lamb, and Asher Zafar. “Who Are Canada’s Tech Workers?” Brookfield Institute for Innovation and Entrepreneurship, January 2019. Accessed on Canadian Electronic Library, 2021. Web.
Warner, Justin. “The ROI of Employee Engagement: Show Me the Money!” DecisionWise, 1 January 2020. Web.
White, Sarah K. “5 Revealing Statistics about Career Challenges Black IT Pros Face.” CIO (blog), 9 February 2023. Accessed 5 July 2022.
Williams, Joan C. “Stop Asking Women of Color to Do Unpaid Diversity Work.” Bloomberg.com, 14 April 2022.
Williams, Joan C., Rachel Korn, and Asma Ghani. “A New Report Outlines Some of the Barriers Facing Asian Women in Tech.” Fast Company, 13 April 2022.
Wilson, Valerie, Ethan Miller, and Melat Kassa. “Racial representation in professional occupations.” Economic Policy Institute, 8 June 2021.
“Workplace Diversity: Why It’s Good for Business.” Business Development Canada (BDC.ca), 6 Feb. 2023. Accessed 4 February 2023.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Whether you have no Service Desk customer feedback program in place or you need to improve your existing process for gathering and responding to feedback, this deck will help you design your surveys and act on their results to improve CSAT scores.
This template provides a sample transactional (ticket) satisfaction survey. If your ITSM tool or other survey mechanism allows you to design or write your own survey, use this template as a starting point.
Use the Sample Size Calculator to calculate your ideal sample size for your relationship surveys.
This template will help you map out the step-by-step process to review collected feedback from your end-user satisfaction surveys, analyze the data, and act on it.
EXECUTIVE BRIEF
Natalie Sansone, PhD
Info-Tech Research Group |
Often when we ask service desk leaders where they need to improve and if they’re measuring customer satisfaction, they either aren’t measuring it at all, or their ticket surveys are turned on but they get very few responses (or only positive responses). They fail to see the value of collecting feedback when this is their experience with it. Feedback is important because traditional service desk metrics can only tell us so much. We often see what’s called the “watermelon effect”: metrics appear “green”, but under the surface they’re “red” because customers are in fact dissatisfied for reasons unmeasured by standard internal IT metrics. Customer satisfaction should always be the goal of service delivery, and directly measuring satisfaction in addition to traditional metrics will help you get a clearer picture of your strengths and weaknesses, and where to prioritize improvements. It’s not as simple as asking customers if they were satisfied with their ticket, however. There are two steps necessary for success. The first is collecting feedback, which should be done purposefully, with clear goals in mind in order to maximize the response rate and value of responses received. The second – and most critical – is acting on that feedback. Use it to inform improvements and communicate those improvements. Doing so will not only make your service desk better, increasing satisfaction through better service delivery, but also will make your customers feel heard and valued, which alone increases satisfaction. |
Emily Sugerman, PhD
Info-Tech Research Group |
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
|
|
Asking your customers for feedback then doing nothing with it is worse than not asking for feedback at all. Your customers may end up more dissatisfied than they were before, if their opinion is sought out and then ignored. It’s valuable to collect feedback, but the true value for both IT and its customers comes from acting on that feedback and communicating those actions back to your users.
The watermelon effect
When a service desk appears to hit all its targets according to the metrics it tracks, but service delivery is poor and customer satisfaction is low, this is known as the “watermelon effect”. Service metrics appear green on the outside, but under the surface (unmeasured), they’re red because customers are dissatisfied.
Traditional SLAs and service desk metrics (such as time to respond, average resolution time, percentage of SLAs met) can help you understand service desk performance internally to prioritize your work and identify process improvements. However, they don’t tell you how customers perceive the service or how satisfied they are.
Providing good service to your customers should be your end goal. Failing to measure, monitor, and act on customer feedback means you don’t have the whole picture of how your service desk is performing and whether or where improvements are needed to maximize satisfaction.
The Service Desk Institute (SDI) suggests that customer satisfaction is the most important indicator of service desk success, and that traditional metrics around SLA targets – currently the most common way to measure service desk performance – may become less valuable or even obsolete in the future as customer experience-focused targets become more popular. (Service Desk Institute, 2021)
SDI conducted a Customer Experience survey of service desk professionals from a range of organizations, both public and private, from January to March 2018. The majority of respondents said that customer experience is more important than other metrics such as speed of service or adherence to SLAs, and that customer satisfaction is more valuable than traditional metrics. (SDI, 2018).

Obstacles to collecting feedback |
Obstacles to acting on collected feedback |
|---|---|
|
|
Insight into customer experience |
Gather insight into both the overall customer relationship with the service desk and individual transactions to get a holistic picture of the customer experience. |
|---|---|
Data to inform decisions |
Collect data to inform decisions about where to spend limited resources or time on improvement, rather than guessing or wasting effort on the wrong thing. |
Identification of areas for improvement |
Better understand your strengths and weaknesses from the customer’s point of view to help you identify gaps and priorities for improvement. |
Customers feel valued |
Make customers feel heard and valued; this will improve your relationship and their satisfaction. |
Ability to monitor trends over time |
Use the same annual relationship survey to be able to monitor trends and progress in making improvements by comparing data year over year. |
Foresight to prevent problems from occurring |
Understand where potential problems may occur so you can address and prevent them, or who is at risk of becoming a detractor so you can repair the relationship. |
IT staff coaching and engagement opportunities |
Turn negative survey feedback into coaching and improvement opportunities and use positive feedback to boost morale and engagement. |

Phase |
1. Understand how to measure customer satisfaction |
2. Design and implement transactional surveys |
3. Design and implement relationship surveys |
4. Analyze and act on feedback |
|---|---|---|---|---|
Phase outcomes |
Understand the main types of customer satisfaction surveys, principles for survey design, and best practices for surveying your users. |
Learn why and how to design a simple survey to assess satisfaction with individual service desk transactions (tickets) and a methodology for survey delivery that will improve response rates. |
Understand why and how to design a survey to assess overall satisfaction with the service desk across your organization, or use Info-Tech’s diagnostic. |
Measure and analyze the results of both surveys and build a plan to act on both positive and negative feedback and communicate the results with the organization. |
Key Insight:
Asking your customers for feedback then doing nothing with it is worse than not asking for feedback at all. Your customers may end up more dissatisfied than they were before if they’re asked for their opinion then see nothing done with it. It’s valuable to collect feedback, but the true value for both IT and its customers comes from acting on that feedback and communicating those actions back to your users.
Additional insights:
Insight 1 |
Take the time to define the goals of your transactional survey program before launching it – it’s not as simple as just deploying the default survey of your ITSM tool out of the box. The objectives of the survey – including whether you want to keep a pulse on average satisfaction or immediately act on any negative experiences – will influence a range of key decisions about the survey configuration. |
|---|---|
Insight 2 |
While transactional surveys provide useful indicators of customer satisfaction with specific tickets and interactions, they tend to have low response rates and can leave out many users who may rarely or never contact the service desk, but still have helpful feedback. Include a relationship survey in your customer feedback program to capture a more holistic picture of what your overall user base thinks about the service desk and where you most need to improve. |
Insight 3 |
Satisfaction scores provide valuable data about how your customers feel, but don’t tell you why they feel that way. Don’t neglect the qualitative data you can gather from open-ended comments and questions in both types of satisfaction surveys. Take the time to read through these responses and categorize them in at least a basic way to gain deeper insight and determine where to prioritize your efforts. |
Understand the main types of customer satisfaction surveys, principles for survey design, and best practices for surveying your users.
Phase 1: |
Phase 2: |
Phase 3: |
Phase 4: |
|---|---|---|---|
Understand how to measure customer satisfaction |
Design and implement transactional surveys |
Design and implement relationship surveys |
Analyze and act on feedback |
Transactional |
Relationship |
One-off |
|
|---|---|---|---|
Also known as |
Ticket surveys, incident follow-up surveys, on-going surveys |
Annual, semi-annual, periodic, comprehensive, relational |
One-time, single, targeted |
Definition |
|
|
|
Transactional | Relationship | One-off | |
|---|---|---|---|
Pros |
|
|
|
Cons |
|
|
|
Only relying on one type of survey will leave gaps in your understanding of customer satisfaction. Include both transactional and relationship surveys to provide a holistic picture of customer satisfaction with the service desk.
If you can only start with one type, choose the type that best aligns with your goals and priorities:
If your priority is to identify larger improvement initiatives the service desk can take to improve overall customer satisfaction and trust in the service desk: |
If your priority is to provide customers with the opportunity to let you know when transactions do not go well so you can take immediate action to make improvements: |
| ↓ | ↓ |
Start with a relationship survey |
Start with a transactional survey |

Info-Tech Insight
One-off surveys can be useful to assess whether a specific change has impacted satisfaction, or to inform a planned change/initiative. However, as they aren’t typically part of an on-going customer feedback program, the focus of this research will be on transactional and relationship surveys.
| CSAT | CES | NPS | |
|---|---|---|---|
| Name | Customer Satisfaction | Customer Effort Score | Net Promoter score |
| What it measures | Customer happiness | Customer effort | Customer loyalty |
| Description | Measures satisfaction with a company overall, or a specific offering or interaction | Measures how much effort a customer feels they need to put forth in order to accomplish what they wanted | Single question that asks consumers how likely they are to recommend your product, service, or company to other people |
| Survey question | How satisfied are/were you with [company/service/interaction/product]? | How easy was it to [solve your problem/interact with company/handle my issue]? Or: The [company] made it easy for me to handle my issue | How likely are you to recommend [company/service/product] to a friend? |
| Scale | 5, 7, or 10 pt scale, or using images/emojis | 5, 7, or 10 pt scale | 10-pt scale from highly unlikely to highly likely |
| Scoring | Result is usually expressed as a percentage of satisfaction | Result usually expressed as an average | Responses are divided into 3 groups where 0-6 are detractors, 7-8 are passives, 9-10 are promoters |
| Pros |
|
|
|
| Cons |
|
|
|

While we focus mainly on traditional survey-based approaches to measuring customer satisfaction in this blueprint, there’s no need to limit yourselves to surveys as your only method. Consider multiple techniques to capture a wider audience, including:
Don’t include unnecessary questions that won’t give you actionable information; it will only waste respondents’ time.
Keep each question as short as possible and limit the total number of survey questions to avoid survey fatigue.
Most of your measures will be close-ended, but include at least one comment box to allow for qualitative feedback.
Ensure that question wording is clear and specific so that all respondents interpret it the same way.
You won’t get accurate results if your question leads respondents into thinking or answering a certain way.
Don’t ask about two different things in the same question – it will confuse respondents and make your data hard to interpret.
Response options should include all possible opinions (including “don’t know”) to avoid frustrating respondents.
Pre-populate information where possible (e.g. name, department) and ensure the survey is responsive on mobile devices.
If every question is mandatory, respondents may leave the survey altogether if they can’t or don’t want to answer one question.
Test your survey with your target audience before launching, and incorporate feedback - they may catch issues you didn’t notice.
There are two types of survey fatigue:
Occurs when users are overwhelmed by too many requests for feedback and stop responding.
Occurs when the survey is too long or irrelevant to users, so they grow tired and abandon the survey.
Fight survey fatigue:
Learn why and how to design a simple survey to assess satisfaction with individual service desk transactions (tickets) and a methodology for survey delivery that will improve response rates.
Phase 1: | Phase 2: | Phase 3: | Phase 4: |
|---|---|---|---|
Understand how to measure customer satisfaction | Design and implement transactional surveys | Design and implement relationship surveys | Analyze and act on feedback |
While feedback on transactional surveys is specific to a single transaction, even one negative experience can impact the overall perception of the service desk. Pair your transactional surveys with an annual relationship survey to capture broader sentiment toward the service desk.
Transactional surveys serve several purposes:
| Decision | Considerations | For more guidance, see |
| What are the goals of your survey? | Are you hoping to get an accurate pulse of customer sentiment (if so, you may want to randomly send surveys) or give customers the ability to provide feedback any time they have some (if so, send a survey after every ticket)? | Slide 25 |
| How many questions will you ask? | Keep the survey as short as possible – ideally only one mandatory question. | Slide 26 |
| What questions will you ask? | Do you want a measure of NPS, CES, or CSAT? Do you want to measure overall satisfaction with the interaction or something more specific about the interaction? | Slide 27 |
| What will be the response options/scale? | Keep it simple and think about how you will use the data after. | Slide 28 |
| How often will you send the survey? | Will it be sent after every ticket, every third ticket, or randomly to a select percentage of tickets, etc.? | Slide 29 |
| What conditions would apply? | For example, is there a subset of users who you never want to receive a survey or who you always want to receive a survey? | Slide 30 |
| What mechanism/tool will you use to send the survey? | Will your ITSM tool allow you to make all the configurations you need, or will you need to use a separate survey tool? If so, can it integrate to your ITSM solution? | Slide 30 |
| Decision | Considerations | For more guidance, see |
| What will trigger the survey? | Typically, marking the ticket as either ‘resolved’ or ‘closed’ will trigger the survey. | Slide 31 |
| How long after the ticket is closed will you send the survey? | You’ll want to leave enough time for the user to respond if the ticket wasn’t resolved properly before completing a survey, but not so much time that they don’t remember the ticket. | Slide 31 |
| Will the survey be sent in a separate email or as part of the ticket resolution email? | A separate email might feel like too many emails for the user, but a link within the ticket closure email may be less noticeable. | Slide 32 |
| Will the survey be embedded in email or accessed through a link? | If the survey can be embedded into the email, users will be more likely to respond. | Slide 32 |
| How long will the survey link remain active, and will you send any reminders? | Leave enough time for the user to respond if they are busy or away, but not so much time that the data would be irrelevant. Balance the need to remind busy end users with the possibility of overwhelming them with survey fatigue. | Slide 32 |
| What other text will be in the main body of the survey email and/or thank you page? | Keep messaging short and straightforward and remind users of the benefit to them. | Slide 33 |
| Where will completed surveys be sent/who will have access? | Will the technician assigned to the ticket have access or only the manager? What email address/DL will surveys be sent to? | Slide 33 |
If your objective is: |
|
Keep a continual pulse on average customer satisfaction |
Gain the opportunity to act on negative feedback for any poor experience |
Then: |
|
Send survey randomly |
Send survey after every ticket |
Rationale: |
|
Sending a survey less often will help avoid survey fatigue and increase the chances of users responding whether they have good, bad, or neutral feedback |
Always having a survey available means users can provide feedback every time they want to, including for any poor experience – giving you the chance to act on it. |
Service Managers often get caught up in running a transactional survey program because they think it’s standard practice, or they need to report a satisfaction metric. If that’s your only objective, you will fail to derive value from the data and will only turn customers away from responding.
As you design your survey, keep in mind the following principles:
Q: How many questions should the survey contain?
A: Ideally, your survey will have only one mandatory question that captures overall satisfaction with the interaction.
This question can be followed up with an optional open-ended question prompting the respondent for more details. This will provide a lot more context to the overall rating.
If there are additional questions you need to ask based on your goals, clearly make these questions optional so they don’t deter respondents from completing the survey. For example, they can appear only after the respondent has submitted their overall satisfaction response (i.e. on a separate, thank you page).
Additional (optional) measures may include:
Tips for writing survey questions:
Sample question wording:
How satisfied are you with this support experience?
How would you rate your support experience?
Please rate your overall satisfaction with the way your issue was handled.
Instead of this…. |
Ask this…. |
|---|---|
“We strive to provide excellent service with every interaction. Please rate how satisfied you are with this interaction.” |
“How satisfied were you with this interaction?” |
“How satisfied were you with the customer service skills, knowledge, and responsiveness of the technicians?” |
Choose only one to ask about. |
“How much do you agree that the service you received was excellent?” |
“Please rate the service you received.” |
“On a scale of 1-10, thinking about your most recent experience, how satisfied would you say that you were overall with the way that your ticket was resolved?” |
“How satisfied were you with your ticket resolution?” |
When planning your response options, remember to keep the survey as easy to respond to as possible – this means allowing a one-click response and a scale that’s intuitive and simple to interpret. |
Think about how you will use the responses and interpret the data. If you choose a 10-point scale, for example, what would you classify as a negative vs positive response? Would a 5-point scale suffice to get the same data? |
Again, use your goals to inform your response options. If you need a satisfaction metric, you may need a numerical scale. If your goal is just to capture negative responses, you may only need two response options: good vs bad. |
Common response options:
|
Investigate the capabilities of your ITSM tool. It may only allow one built-in response option style. But if you have the choice, choose the simplest option that aligns with your goals. |
There are two common choices for when to send ticket satisfaction surveys:
After random tickets |
After every ticket |
|
Pros |
|
|
Cons |
|
|
SDI’s 2018 Customer Experience in ITSM survey of service desk professionals found:
Almost two-thirds (65%) send surveys after every ticket.
One-third (33%) send surveys after randomly selected tickets are closed.
Send a survey after every ticket so that anyone who has feedback gets the opportunity to provide it – and you always get the chance to act on negative feedback. But, limit how often any one customer receives a ticket to avoid over-surveying them – restrict to anywhere between one survey a week to one per month per customer.
Decision #1 |
Decision #2 |
|---|---|
What tool will you use to deliver the survey? |
What (if any) conditions apply to your survey? |
Considerations
|
Considerations Is there a subset of users who you never want to receive a survey (e.g. a specific department, location, role, or title)? Is there a subset of users who you always want to receive a survey, no matter how often they contact the service desk (e.g. VIP users, a department that scored low on the annual satisfaction survey, etc.)? Are there certain times of the year that you don’t want surveys to go out (e.g. fiscal year end, holidays)? Are there times of the day that you don’t want surveys to be sent (e.g. only during business hours; not at the end of the day)? |
Recommendations The built-in functionality of your ITSM tool’s surveys will be easiest to send and track; use it if possible. However, if your tool’s survey module is limited and won’t give you the value you need, consider a third-party solution or survey tool that integrates with your ITSM solution and won’t require significant manual effort to send or review the surveys. |
Recommendations If your survey module allows you to apply conditions, think about whether any are necessary to apply to either maximize your response rate (e.g. don’t send a survey on a holiday), avoid annoying certain users, or seek extra feedback from dissatisfied users. |
Decision #2 | Decision #1 |
|---|---|
What will trigger the survey? | When will the survey be sent? |
Considerations
| Considerations
|
Recommendations Only send the survey once you’re sure the issue has actually been resolved; you could further upset the customer if you ask them how happy they are with the resolution if resolution wasn’t achieved. This means sending the survey once the user confirms resolution (which closes ticket) or the agent closes the ticket. | Recommendations If you are sending the survey upon ticket status moving to ‘resolved’, wait at least 24 hours before sending the survey in case the user responds that their issue wasn’t actually resolved. However, if you are sending the survey after the ticket has been verified resolved and closed, you can send the survey immediately while the experience is still fresh in their memory. |
Decision #1 | Decision #2 |
|---|---|
How will the survey appear in email? | How long will the survey remain active? |
Considerations
| Considerations
|
Recommendations Send the survey separately from the ticket resolution email or users will never notice it. However, if possible, have the entire survey embedded within the email so users can click to respond directly from their email without having to open a separate link. Reduce effort, to make users more likely to respond. | Recommendations Leave enough time for the user to respond if they are busy or away, but not so much time that the data will be irrelevant. Balance the need to remind busy end users, with the possibility of overwhelming them with survey fatigue. About a week is typical. |
Decision #1 | Decision #2 |
|---|---|
What will the body of the email/messaging say? | Where will completed surveys be sent? |
Considerations
| Considerations
|
Recommendations Most users won’t read a long message, especially if they see it multiple times, so keep the email short and simple. Tell users you value their feedback, indicate which interaction you’re asking about, and say how long the survey should take. Thank them after they submit and tell them you will act on their feedback. | Recommendations Survey results should be sent to the Service Manager, Customer Experience Lead, or whoever is the person responsible for managing the survey feedback. They can choose how to share feedback with specific agents and the service desk team. |
Most IT organizations see transactional survey response rates of less than 20%.
Source: SDI, 2018SDI’s 2018 Customer Experience in ITSM survey of service desk professionals found that 69% of respondents had survey response rates of 20% or less. However, they did not distinguish between transactional and relationship surveys. |
Reasons for low response rates:
|
“In my experience, single digits are a sign of a problem. And a downward trend in response rate is also a sign of a problem. World-class survey response rates for brands with highly engaged customers can be as high as 60%. But I’ve never seen it that high for internal support teams. In my experience, if you get a response rate of 15-20% from your internal customers then you’re doing okay. That’s not to say you should be content with the status quo, you should always be looking for ways to increase it.” – David O’Reardon, Founder & CEO of Silversix |
Don’t over-survey any one user or they will start to ignore the surveys.
Ask for feedback soon after the ticket was resolved so it’s fresh in the user’s memory.
Keep the survey short, concise, and simple to respond to.
Minimize effort involved as much as possible. Allow users to respond directly from email and from any device.
Experiment with your subject line or email messaging to draw more attention.
Respond to customers who provide feedback – especially negative – so they know you’re listening.
Demonstrate that you are acting on feedback so users see the value in responding.
Once you’ve worked through all the decisions in this step, you’re ready to configure your transactional survey in your ITSM solution or survey tool.
As a starting point, you can leverage Info-Tech’s Transactional Service Desk Survey Templatee to design your templates and wording.
Make adjustments to match your decisions or your configuration limitations as needed.
Refer to the key decisions tables on slides 24 and 25 to ensure you’ve made all the configurations necessary as you set up your survey.

Understand why and how to design a survey to assess overall satisfaction with the service desk across your organization, or use Info-Tech’s diagnostic.
Phase 1: | Phase 2: | Phase 3: | Phase 4: |
|---|---|---|---|
Understand how to measure customer satisfaction | Design and implement transactional surveys | Design and implement relationship surveys | Analyze and act on feedback |
Evaluating service quality in any industry is challenging for both those seeking feedback and those consuming the service: “service quality is more difficult for the consumer to evaluate than goods quality.”
You are in the position of trying to measure something intangible: customer perception, which “result[s] from a comparison of consumer expectations with actual service performance,” which includes both the service outcome and also “the process of service delivery”
(Source: Parasuraman et al, 1985, 42).
Your mission is to design a relationship survey that is:
Annual relationship surveys provide great value in the form of year-over-year internal benchmarking data, which you can use to track improvements and validate the impact of your service improvement efforts.
The Service Quality Model (Parasuraman, Zeithaml and Berry, 1985) shows how perceived service quality is negatively impacted by the gap between expectations for quality service and the perceptions of actual service delivery: Gap 1: Consumer expectation – Management perception gap: Are there differences between your assumptions about what users want from a service and what those users expect? Gap 2: Management perception – Service quality specification gap: Do you have challenges translating user expectations for service into standardized processes and guidelines that can meet those expectations? Gap 3: Service quality specifications – Service delivery gap: Do staff members struggle to carry out the service quality processes when delivering service? Gap 4: Service delivery – External communications gap: Have users been led to expect more than you can deliver? Alternatively, are users unaware of how the organization ensures quality service, and therefore unable to appreciate the quality of service they receive? Gap 5: Expected service – Perceived service gap: Is there a discrepancy between users’ expectations and their perception of the service they received (regardless of any user misunderstanding)? |
![]() |
|---|
Your survey questions about service and support should provide insight into where these gaps exist in your organization
| Decision/step | Considerations |
| Align the relationship survey with your goals | Align what is motivating you to launch the survey at this time and the outcomes it is intended to feed into. |
| Identify what you’re measuring | Clarify the purpose of the questions. Are you measuring feedback on your service desk, specifically? On all of IT? Are you trying to capture user effort? User satisfaction? These decisions will affect how you word your questions. |
| Determine a framework for your survey | Reporting on results and tracking year-over-year changes will be easier if you design a basic framework that your survey questions fall into. Consider drawing on an existing service quality framework to match best practices in other industries. |
| Cover logistical details | Designing a relationship survey requires attention to many details that may initially be overlooked: the survey’s length and timing, who it should be sent to and how, what demographic info you need to collect to slice and dice the results, and if it will be possible to conduct the survey anonymously. |
| Design question wording | It is important to keep questions clear and concise and to avoid overly lengthy surveys. |
| Select answer scales | The answer scales you select will depend on how you have worded the questions. There is a wide range of answer scales available to you; decide which ones will produce the most meaningful data. |
| Test the survey | Testing the survey before widely distributing it is key. When collecting feedback, conduct at least a few in person observations of someone taking the survey to get their unvarnished first impressions. |
| Monitor and maximize your response rate | Ensure success by staying on top of the survey during the period it is open. |
What is motivating you to launch the survey at this time?
Is there a renewed focus on customer service satisfaction? If so, this survey will track the initiative’s success, so its questions must align with the sponsors’ expectations.
Are you surveying customer satisfaction in order to comply with legislation, or directives to measure customer service quality?
What objectives/outcomes will this survey feed into?
What do you need to report on to your stakeholders? Have they communicated any expectations regarding the data they expect to see?
Does the CIO want the annual survey to measure end-user satisfaction with all of IT?
In 1993 the U.S. president issued an Executive Order requiring executive agencies to “survey customers to determine the kind and quality of services they want and their level of satisfaction with existing services” and “post service standards and measure results against them.” (Clinton, 1993)
Examples of Measures |
||
Clarify the purpose of the questions Each question should measure something specific you want to track and be phrased accordingly. |
Are you measuring feedback on the service desk? | Service desk professionalism |
Are you measuring user satisfaction? |
Service desk timeliness |
|
Your customers’ happiness with aspects of IT’s service offerings and customer service |
Trust in agents’ knowledge |
|
Users’ preferred ticket intake channel (e.g. portal vs phone) |
||
Satisfaction with self-serve features |
||
Are you measuring user effort? |
Are you measuring feedback on IT overall? |
Satisfaction with IT’s ability to enable the business |
How much effort your customer needs to put forth to accomplish what they wanted/how much friction your service causes or alleviates |
Satisfaction with company-issued devices |
|
| Satisfaction with network/Wi-Fi | ||
Satisfaction with applications |
As you compose survey questions, decide whether they are intended to capture user satisfaction or effort: this will influence how the question is worded. Include a mix of both.
If your relationship survey covers satisfaction with service support, ensure the questions cover the major aspects of service quality. You may wish to align your questions on support with existing frameworks: for example, the SERVQUAL service quality measurement instrument identifies 5 dimensions of service quality: Reliability, Assurance, Tangibles, Empathy, and Responsiveness (see below). As you design the survey, consider if the questions relate to these five dimensions. If you have overlooked any of the dimensions, consider if you need to revise or add questions.
Service dimension |
Definition |
Sample questions |
|---|---|---|
Reliability |
“Ability to perform the promised service dependably and accurately”1 |
|
Assurance |
“Knowledge and courtesy of employees and their ability to convey trust and confidence”2 |
|
Tangibles |
“Appearance of physical facilities, equipment, personnel, and communication materials”3 |
|
Empathy |
“Caring, individualized attention the firm provides its customers”4 |
|
Responsiveness |
“Willingness to help customers and provide prompt service”5 |
|
Identify who you will send it to Will you survey your entire user base or a specific subsection? For example, a higher education institution may choose to survey students separately from staff and faculty. If you are gathering data on customer satisfaction with a specific implementation, only survey the affected stakeholders. Determine timing Avoid sending out the survey during known periods of time pressure or absence (e.g. financial year-end, summer vacation). Decide upon its length Consider what survey length your users can tolerate. Configure the survey to show the respondents’ progression or their percentage complete. Clearly introduce the survey The survey should begin with an introduction that thanks users for completing the survey, indicates its length and anonymity status, and conveys how the data will be used, along with who the participants should contact with any questions about the survey. Decide upon incentives Will you incentivize participation (e.g. by entering the participants in a draw or rewarding highest-participating department)? |
Collect demographic information Ensure your data can be “sliced and diced” to give you more granular insights into the results. Ask respondents for information such as department, location, seniority, and tenure to help with your trend analysis later. Clarify if anonymous Users may be more comfortable participating if they can do so anonymously (Quantisoft, n.d.). If you promise anonymity, ensure your survey software/ partner can support this claim. Note the difference between anonymity (identity of participant is not collected) and confidentiality (identifying data is collected but removed from the reported results). Decide how to deliver the survey Will you be distributing the survey yourself through your own licensed software (e.g. through Microsoft Forms if you are an MS shop)? Or, will you be partnering with a third-party provider? Is the survey optimized for mobile? Some find up to 1/3 of participants use mobile devices for their surveys (O’Reardon, 2018). |
Use Info-Tech’s Sample Size Calculator to calculate the number of people you need to complete your survey to have statistically representative results.
In the example above, the service desk supports 1000 total users (and sent the survey to each one). To be 95% confident that the survey results fall within 5% of the true value (if every user responded), they would need 278 respondents to complete their survey. In other words, to have a sample that is representative of the whole population, they would need 278 completed surveys. |
Explanation of terms: Confidence Level: A measure of how reliable your survey is. It represents the probability that your sample accurately reflects the true population (e.g. your entire user base). The industry standard is typically 95%. This means that 95 times out of 100, the true data value that you would get if you surveyed the entire population would fall within the margin of error. Margin of Error: A measure of how accurate the data is, also known as the confidence interval. It represents the degree of error around the data point, or the range of values above and below the actual results from a survey. A typical margin of error is 5%. This means that if your survey sample had a score of 70%, the true value if you sampled the entire population would be between 65% and 75%. To narrow the margin of error, you would need a bigger sample size. Population Size: The total set of people you want to study with your survey. For example, the total number of users you support. Sample Size: The number of people who participate in your survey (i.e. complete the survey) out of the total population. |
I need to measure and report customer satisfaction with all of IT:
|
Both products measure end-user satisfaction One is more general to IT One is more specific to service desk |
I need to measure and report more granularly on Service Desk customer satisfaction:
|
Choose Info-Tech's End User Satisfaction Survey |
Choose Info-Tech’s Service Desk Satisfaction Survey |
Write accessible questions: | Instead of this…. | Ask this…. |
48% of US adults meet or exceed PIACC literacy level 3 and thus able to deal with texts that are “often dense or lengthy.” 52% of US adults meet level 2 or lower. Keep questions clear and concise. Avoid overly lengthy surveys. Source: Highlights of the 2017 U.S. PIAAC Results Web Report |
Users will have difficulty perceiving the difference between these two questions. |
|
Tips for writing survey questions: | “How satisfied are you with the customer service skills, knowledge, and responsiveness of the technicians?” This question measures too many things and the data will not be useful. | Choose only one to ask about. |
| “On a scale of 1-10, thinking about the past year, how satisfied would you say that you were overall with the way that your tickets were resolved?” This question is too wordy. | “How satisfied were you with your ticket resolution?” |
Likert scale
Respondents select from a range of statements the position with which they most agree:
E.g. How satisfied are you with how long it generally takes to resolve your issue completely?
Frequency scale
How often does the respondent have to do something, or how often do they encounter something?
E.g. How frequently do you need to re-open tickets that have been closed without being satisfactorily resolved?
Numeric scale
By asking users to rate their satisfaction on a numeric scale (e.g., 1-5, 1-10), you can facilitate reporting on averages:
E.g. How satisfied are you with IS’s ability to provide services to allow the organization to meet its goals?
Forced ranking
Learn more about your users’ priorities by asking them to rank answers from most to least important, or selecting their top choices (Sauro, 2018):
E.g. From the following list, drag and drop the 3 aspects of our service that are most important to you into the box on the right.
Always include an optional open-ended question, which allows customers to provide more feedback or suggestions.
Test the survey with different stakeholder groups:
Testing methodology:
In the survey testing phase, try to capture at least a few real-time responses to the survey. If you collect survey feedback only once the test is over, you may miss some key insights into the user experience of navigating the survey.
“Follow the golden rule: think of your audience and what they may or may not know. Think about what kinds of outside pressures they may bring to the work you’re giving them. What time constraints do they have?”
– Sally Colwell, Project Officer, Government of Canada Pension Centre
“[Send] one reminder to those who haven’t completed the survey after a few days. Don’t use the word ‘reminder’ because that’ll go straight in the bin, better to say something like, ‘Another chance to provide your feedback’”
– David O’Reardon, Founder & CEO of Silversix
Measure and analyze the results of both surveys and build a plan to act on both positive and negative feedback and communicate the results with the organization.
Phase 1: | Phase 2: | Phase 3: | Phase 4: |
|---|---|---|---|
Understand how to measure customer satisfaction | Design and implement transactional surveys | Design and implement relationship surveys | Analyze and act on feedback |

A service failure or a poor experience isn’t what determines customer satisfaction – it’s how you respond to the issue and take steps to fix it that really matters.
This means one poor experience with the service desk doesn’t necessarily lead to an unhappy user; if you quickly and effectively respond to negative feedback to repair the relationship, the customer may be even happier afterwards because you demonstrated that you value them.
“Every complaint becomes an opportunity to turn a bad IT customer experience into a great one.”
– David O’Reardon, Founder & CEO of Silversix
|
![]() |
“Your IT service desk’s CSAT survey should be the means of improving your service (and the employee experience), and something that encourages people to provide even more feedback, not just the means for understanding how well it’s doing” – Joe the IT Guy, SysAid |
If collecting and analyzing customer feedback is something that happens off the side of your desk, it either won’t get done or won’t get done well.
Assign accountability for the customer feedback program to one person (i.e. Service Desk Manager, Service Manager, Infrastructure & Operations Lead, IT Director), who may take on or assign responsibilities such as:
Info-Tech Insight
While feedback can feed into internal coaching and training, the goal should never be to place blame or use metrics to punish agents with poor results. The focus should always be on improving the experience for end users.
Calculating NPS Scores
Categorize respondents into 3 groups:
Calculate overall NPS score:
Calculating CSAT Scores
Why analyze qualitative data |
How to analyze qualitative data |
||||||
|---|---|---|---|---|---|---|---|
|
Methods range in sophistication; choose a technique depending on your tools available and goals of your program.
|
Successful customer satisfaction programs respond effectively to both positive and negative outcomes. Late or lack of responses to negative comments may increase customer frustration, while not responding at all to the positive comments may give the perception of indifference.
E.g. Scores of 1 to 2 out of 5 are negative, scores of 4 to 5 out of 5 are positive.
1. Who should receive communication? |
Each audience will require different messaging, so start by identifying who those audiences are. At a minimum, you should communicate to your end users who provided feedback, your service desk/IT team, and business leaders or stakeholders. |
|---|---|
2. What information do they need? |
End users: Thank them for providing feedback. Demonstrate what you will do with that feedback. IT team: Share results and what you need them to do differently as a result. Business leaders: Share results, highlight successes, share action plan for improvement. |
3. Who is responsible for communication? |
Typically, this will be the person who is accountable for the customer feedback program, but you may have different people responsible for communicating to different audiences. |
4. When will you communicate? |
Frequency of communication will depend on the survey type – relationship or transactional – as well as the audience, with internal communication being much more frequent than end-user communication. |
5. How will you communicate? |
Again, cater your approach to the audience and choose a method that will resonate with them. End users may view an email, an update on the portal, a video, or update in a company meeting; your internal IT team can view results on a dashboard and have regular meetings. |
Based on the Customer Communication Cycle by David O’Reardon, 2018 |
|
|---|
Focus your communications to users around them, not you. Demonstrate that you need feedback to improve their experience, not just for you to collect data.
Prioritize improvements |
Prioritize improvements based on low scores and most commonly received feedback, then build into an action plan. |
|---|---|
Take immediate action on negative feedback |
Investigate the issue, diagnose the root cause, and repair both the relationship and issue – just like you would an incident. |
Apply lessons learned from positive feedback |
Don’t neglect actions you can take from positive feedback – identify how you can expand upon or leverage the things you’re doing well. |
Use feedback in coaching and training |
Share positive experiences with the team as lessons learned, and use negative feedback as an input to coaching and training. |
Make the change stick |
After making a change, train and communicate it to your team to ensure the change sticks and any negative experiences don’t happen again. |
“Without converting feedback into actions, surveys can become just a pointless exercise in number watching.”
Outline exactly what you plan to do to address customer feedback in an action plan, and regularly review that action plan to select and prioritize initiatives and monitor progress.
For more guidance on tracking and prioritizing ongoing improvement initiatives, see the blueprints Optimize the Service Desk with a Shift Left Strategy and Build a Continual Improvement Plan for the Service Desk.
Improve service desk processes: |
Improve end-user self-service options: |
Assess and optimize service desk staffing: |
Improve ease of contacting the service desk: |
|---|---|---|---|
| Standardize the Service Desk | Optimize the Service Desk With a Shift-Left Strategy | Staff the Service Desk to Meet Demand | Improve Service Desk Ticket Intake |
Improve service desk processes: |
Improve end-user self-service options: |
Assess and optimize service desk staffing: |
Improve ease of contacting the service desk:: |
| Improve Incident and Problem Management | Improve Incident and Problem Management | Deliver a Customer Service Training Program to Your IT Department | Modernize and Transform Your End-User Computing Strategy |


This project will help you build and improve essential service desk processes, including incident management, request fulfillment, and knowledge management to create a sustainable service desk.
Optimize the Service Desk With a Shift-Left Strategy
This project will help you build a strategy to shift service support left to optimize your service desk operations and increase end-user satisfaction.
Build a Continual Improvement Plan
This project will help you build a continual improvement plan for the service desk to review key processes and services and manage the progress of improvement initiatives.
Deliver a Customer Service Training Program to Your IT Department
This project will help you deliver a targeted customer service training program to your IT team to enhance their customer service skills when dealing with end users, improve overall service delivery and increase customer satisfaction.
Amaresan, Swetha. “The best time to send a survey, according to 5 studies.” Hubspot. 15 Jun 2021. Accessed October 2022.
Arlen, Chris. “The 5 Service Dimensions All Customers Care About.” Service Performance Inc. n.d. Accessed October 2022.
Clinton, William Jefferson. “Setting Customer Service Standards.” (1993). Federal Register, 58(176).
“Understanding Confidentiality and Anonymity.” The Evergreen State College. 2022. Accessed October 2022.
"Highlights of the 2017 U.S. PIAAC Results Web Report" (NCES 2020-777). U.S. Department of Education. Institute of Education Sciences, National Center for Education Statistics.
Joe the IT Guy. “Are IT Support’s Customer Satisfaction Surveys Their Own Worst Enemy?” Joe the IT Guy. 29 August 2018. Accessed October 2022.
O’Reardon, David. “10 Ways to Get the Most out of your ITSM Ticket Surveys.” LinkedIn. 2 July 2019. Accessed October 2022.
O'Reardon, David. "13 Ways to increase the response rate of your Service Desk surveys".LinkedIn. 8 June 2016. Accessed October 2022.
O’Reardon, David. “IT Customer Feedback Management – A Why & How Q&A with an Expert.” LinkedIn. 13 March 2018. Accessed October 2022.
Parasuraman, A., Zeithaml, V. A., & Berry, L. L. (1985). "A Conceptual Model of Service Quality and Its Implications for Future Research." Journal of Marketing, 49(4), 41–50.
Quantisoft. "How to Increase IT Help Desk Customer Satisfaction and IT Help Desk Performance.“ Quantisoft. n.d. Accessed November 2022.
Rumberg, Jeff. “Metric of the Month: Customer Effort.” HDI. 26 Mar 2020. Accessed September 2022.
Sauro, Jeff. “15 Common Rating Scales Explained.” MeasuringU. 15 August 2018. Accessed October 2022.
SDI. “Customer Experience in ITSM.” SDI. 2018. Accessed October 2022.
SDI. “CX: Delivering Happiness – The Series, Part 1.” SDI. 12 January 2021. Accessed October 2022.
Wronski, Laura. “Who responds to online surveys at each hour of the day?” SurveyMonkey. n.d. Accessed October 2022.
Sally Colwell
Project Officer
Government of Canada Pension Centre
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Review and assess your IT contracts for vendor-biased terms and conditions, and gain tips for getting vendors to take on their fair share of risk and become more accountable.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand IT contract clauses, improve risk identification, and be more effective at negotiating contract terms.
Increased awareness of how contract provisions relate to each other.
Demystification of legalese and legal concepts.
Increased ability to seek assistance from internal parties (e.g. Legal, Risk, and Procurement).
1.1 Review the Contract Review Tool.
1.2 Review the Contract Playbook template.
1.3 Review 35 contract provisions and reinforce key learnings with exercises (spread across three days)
Partial completion of the template
Exercise results and debrief
Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Integrating physical and information security introduces challenges in:
Info-Tech's approach is a modular, incremental, and repeatable process to integrate physical and information security to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Info-Tech provides a three-phased framework for integrating physical security and information security: Plan, Enhance, and Monitor & Optimize.
This tool serves as a repository for information about security integration elements, compliance, and other factors that will influence your integration of physical security and information security.
Populating a RACI chart (Responsible, Accountable, Consulted, and Informed) is a critical step that will assist you in organizing roles for carrying out integration steps. Complete this tool to assign tasks to suitable roles.
Complete this template to effectively communicate your integrated security plan to stakeholders.
From physical access control systems (PACS) such as electronic locks and fingerprint biometrics to video surveillance systems (VSS) such as IP cameras to perimeter intrusion detection and prevention to fire and life safety and beyond: physical security systems pose unique challenges to overall security. Additionally, digital transformation of physical security to the cloud and the convergence of operational technology (OT), internet of things (IoT), and industrial IoT (IIoT) increase both the volume and frequency of security threats.
These threats can be safety, such as the health impact when a gunfire attack downed wastewater pumps at Duke Energy Substation, North Carolina, US, in 2022. The threats can also be economic, such as theft of copper wire, or they can be reliability, such as when a sniper attack on Pacific Gas & Electric’s Metcalf Substation in California, US, damaged 17 out of 21 power transformers in 2013.
Considering the security risks organizations face, many are unifying physical, cyber, and information security systems to gain the long-term overall benefits a consolidated security strategy provides.

Research Director, Security and Privacy Practice
Info-Tech Research Group
Your ChallengePhysical security is often managed by facilities, not by IT security, resulting in segmented security systems. Meanwhile, integrating physical and information security introduces challenges in:
|
Common ObstaclesPhysical security systems integration is complex due to various components such as proprietary devices and protocols and hybrid systems of analog and digital technology. Thus, open architecture with comprehensive planning and design is important. However, territorial protection by existing IT and physical security managers may limit security visibility and hinder security integration. Additionally, integration poses challenges in staffing, training and awareness programs, and dependency on third-party technologies and their migration plans. |
Info-Tech's ApproachInfo-Tech’s approach is a modular, incremental, and repeatable process to integrate physical and information security that enables organizations to:
|
An integrated security architecture, including people, process, and technology, will improve your overall security posture. These benefits are leading many organizations to consolidate their siloed systems into a single platform across physical security, cybersecurity, HR, legal, and compliance.
Current security models do not cover all areas of security, especially if physical systems and personnel are involved and safety is also an important property required.
Sources: Parker, 1998; Pender-Bey, 2012; Cherdantseva and Hilton, 2015
Sources: Cisco, n.d.; Preparing for Technology Convergence in Manufacturing, Info-Tech Research Group, 2018
Physical security includes:
Why is integrating physical and information security gaining more and more traction? Because the supporting technologies are becoming more matured. This includes, for example, migration of physical security devices to IP-based network and open architecture.
Target: Alfred P. Murrah Federal Building, Oklahoma, US. Method: Bombing. Impact: Destroyed structure of 17 federal agencies, 168 casualties, over 800 injuries. Result: Creation of Interagency Security Committee (ISC) in Executive Order 12977 and “Vulnerability Assessment of Federal Facilities” standard.
(Source: Office of Research Services, 2017)
Target: Pacific Gas & Electric’s Metcalf Substation, California, US. Method: Sniper attack. Impact: Out of 21 power transformers, 17 were damaged. Result: Creation of Senate Bill No. 699 and NERC- CIP-014 standard.
(Source: T&D World, 2023)
Target: Nord Stream gas pipelines connecting Russia to Germany, Baltic sea. Method: Detonations. Impact: Methane leaks (~300,000 tons) at four exclusive economic zones (two in Denmark and two in Sweden). Result: Sweden’s Security Service investigation.
(Source: CNBC News, 2022)
Target: Duke Energy Substation, North Carolina, US. Method: Gunfire. Impact: Power outages of ~40,000 customers and wastewater pumps in sewer lift stations down. Result: State of emergency was declared.
(Source: CBS News, 2022)
When it comes to physical security, we have been mostly reactive. Typically the pattern starts with physical attacks. Next, the impacted organization mitigates the incidents. Finally, new government regulatory measures or private sector or professional association standards are put in place. We must strive to change our pattern to become more proactive.
A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.
Source: MarketsandMarkets, 2022
An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.
Source: Ontic Center for Protective Intelligence, 2022
The physical security market is growing in systems and services, especially the integration of threat data management with cybersecurity.
We know the physical security challenges and how the physical security market is growing, but what initiatives are driving this growth? These are the top physical security initiatives and top investments for physical security operations integration:
A survey by Brivo asked 700 security professionals about their top physical security initiatives. The number one initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration.
Source: Brivo, 2022
An Ontic survey (N=359) on areas of investment for physical security operations integration shows the number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.
Source: Ontic Center for Protective Intelligence, 2022
When looking for a quick win, consider learning the best internal or external practice. For example, in 1994 IBM reorganized its security operation by bringing security professionals and non-security professionals in one single structure, which reduced costs by approximately 30% in two years.
Sources: Create and Implement an IoT Strategy, Info-Tech Research Group, 2022; Baker and Benny, 2013; Erich Krueger, Omaha Public Power District (contributor); Doery Abdou, March Networks Corporate (contributor)
4Wall Entertainment is a provider of entertainment lighting and equipment to event venues, production companies, lighting designers, and others, with a presence in 18 US and UK locations.
After many acquisitions, 4Wall Entertainment needed to standardize its various acquired systems, including physical security systems such as access control. In its integrated security approach, IT owns the integrated security, but they interface with related entities such as HR, finance, and facilities management in every location. This allows them to obtain information such as holidays, office hours, and what doors need to be accessed as inputs to the security system and to get sponsorship in budgeting.
In the past, 4Wall Entertainment tried delegating specific physical security to other divisions, such as facilities management and HR. This approach was unsuccessful, so IT took back the responsibility and accountability.
Currently, 4Wall Entertainment works with local vendors, and its biggest challenge is finding third-party vendors that can provide nationwide support.
In the future, 4Wall Entertainment envisions physical security modernization such as camera systems that allow more network accessibility, with one central system to manage and IoT device integration with SIEM and MDR.
Physical security is often part of facilities management. As a result, there are interdependencies with both internal departments (such as IT, information security, and facilities) and external parties (such as third-party vendors). IT leaders, security leaders, and operational leaders should keep the big picture in mind when designing and implementing integration of physical and information security. Use this checklist as a tool to track your security integration journey.
Today’s matured technology makes security integration possible. However, the governance and management of single integrated security presents challenges. These can be overcome using a multi-phased framework that enables a modular, incremental, and repeatable integration process, starting with planning to justify the value of investment, then enhancing the integrated security based on risks and open architecture. This is followed by using metrics for monitoring and optimization.
Just as medicine often comes with side effects, our Integration of Physical and Information Security Framework may introduce risks too. However, as John F. Kennedy, thirty-fifth president of the United States, once said, "There are risks and costs to a program of action — but they are far less than the long-range cost of comfortable inaction."
Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.
Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.
Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.
Find the most optimized architecture that is strategic, realistic, and based on risk. Next, perform an evaluation of the security systems and program by understanding what, where, when, and how to measure and to report the relevant metrics.
Identify the security integration problems to solve with visible improvement possibilities, and don’t choose technology for technology’s sake. Design first, then conduct market research by comparing products or services from vendors or manufacturers.
Avoid a big bang approach and test technologies in multiple conditions. Run inexpensive pilots and increase flexibility to build a technology ecosystem.
Each step of this framework is accompanied by supporting deliverables to help you accomplish your goals:
Map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals. Identify your security integration elements and compliance.
Identify various security integration stakeholders across the organization and assign tasks to suitable roles.
Present your findings in a prepopulated document that summarizes the work you have completed.
Planning is foundational to engage stakeholders. Start with justifying the value of investment, then define roles and responsibilities, update governance, and finally identify integrated elements and compliance obligations.
It is important to speak the same language. Physical security concerns safety and availability, while information security concerns confidentiality and integrity. Thus, the two systems have different goals and require alignment.
Similarly, taxonomy of terminologies needs to be managed,1 e.g. facility management with an emergency management background may have a different understanding from a CISO with an information security background when discussing the same term. For example:
In emergency management prevention means “actions taken to eliminate the impact of disasters in order to protect lives, property and the environment, and to avoid economic disruption.”2
In information security prevention is “preventing the threats by understanding the threat environment and the attack surfaces, the risks, the assets, and by maintaining a secure system.”3
Sources: 1 Owen Yardley, Omaha Public Power District (contributor); 2 Translation Bureau, Government of Canada, n.d.; 3 Security Intelligence, 2020
Input
|
Output
|
Materials
|
Participants
|
Download the Integrate Physical Security and Information Security Requirements Gathering Tool.
Refer to the Integration of Physical and Information Security Framework when filling in the table.
Facilities in most cases have a team that is responsible for physical security installations such as access key controllers. Whenever there is an issue, they contact the provider to fix the error. However, with smart buildings and smart devices, the threat surface grows to include information security threats, and Facilities may not possess the knowledge and skills required to deal with them. At the same time, delegating physical security to IT may add more tasks to their already-too-long list of responsibilities. Consolidating security to a focused security team that covers both physical and information security can help.1 We need to develop the security integration business case beyond physical security "gates, guns, and guards" mentality.2
Benefits |
Metrics |
Operational Efficiency and Cost Savings |
|
Reliability Improvements |
|
Customers & Users Benefits |
|
Cost |
Metrics |
Equipment and Infrastructure |
|
Software and Commission |
|
Support and Resources |
|
Sources: 1 Andrew Amaro, KLAVAN Security Services (contributor); 2 Baker and Benny, 2013;
Industrial Control System Modernization, Info-Tech Research Group, 2023; Lawrence Berkeley National Laboratory, 2021
Input
| Output
|
Materials
| Participants
|
Many factors impact an organization’s level of effectiveness as it relates to integration of physical and information security. How the team interacts, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, we need to identify stakeholders that are:
Download the Integrate Physical Security and Information Security RACI Chart Tool
Define Responsible, Accountable, Consulted, Informed (RACI) stakeholders.
Sources: ISC, 2015; ISC, 2021
The roles and responsibilities should be clearly defined. For example, IT Security should be responsible for the installation and configuration of all physical access controllers and devices, and facility managers should be responsible for the physical maintenance including malfunctioning such as access device jammed or physically broken.
HR provides information such as new hires and office hours as input to the security system. Finance assists in budgeting.
The security and privacy team will need to evaluate solutions and enforce standards on various physical and information security systems and to protect data privacy.
Business stakeholders will provide clarity for their strategy and provide input into how they envision security furthering those goals.
IT stakeholders will be a driving force, ensuring all necessary resources are available and funded.
Operational plans will include asset management, monitoring, and support to meet functional goals and manage throughout the asset lifecycle.
Each solution added to the environment will need to be chosen and architected to meet business goals and security functions.
Assemble the right team to ensure the success of your integrated security ecosystem and decide the governance model, e.g. security steering committee (SSC) or a centralized single structure.
Adapted from Create and Implement an IoT Strategy, Info-Tech Research Group, 2022
Ensuring proper governance over your security program is a complex task that requires ongoing care and feeding from executive management to succeed.
Your SSC should aim to provide the following core governance functions for your security program:
Adapted from Improve Security Governance With a Security Steering Committee , Info-Tech Research Group, 2018
To determine what elements need to be integrated, it’s important to scope the security integration program and to identify the consequences of integration for compliance obligations.
What are my concerns?
How can I address my concerns?
Refer to the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool when filling in the following elements.
Refer to the “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
View a sample contract provided by the US Department of Health and Human Services.
Source: Take Control of Compliance Improvement to Conquer Every Audit, Info-Tech Research Group, 2015
Sources: Real Time Networks, 2022; Andrew Amaro, KLAVAN Security Services (contributor)
Enhancing is the development of an integrated security strategy, policies, procedures, BCP, DR, and IR based on the organization’s risks.
Sources: Amy L. Meger, Platte River Power Authority (contributor); Baker and Benny, 2013; IFSEC Global, 2023; Security Priorities 2023, Info-Tech Research Group, 2023; Build an Information Security Strategy, Info-Tech Research Group, 2020; ISC, n.d.
Maturity models are very effective for determining security states. This table provides examples of general descriptions for physical and information security maturity levels.
Determine which framework is suitable and select the description that most accurately reflects the ideal state for security in your organization.
Level 1 |
Level 2 |
Level 3 |
Level 4 |
Level 5 |
|
| Minimum security with simple physical barriers. | Low-level security to prevent and detect some unauthorized external activity. | Medium security to prevent, detect, and assess most unauthorized external activity and some unauthorized internal activity. | High-level security to prevent, detect, and assess most unauthorized external and internal activity. | Maximum security to prevent, detect, assess, and neutralize all unauthorized external and internal activity. |
Physical security maturity level1 |
| Initial/Ad hoc security programs are reactive. | Developing security programs can be effective at what they do but are not holistic. | A defined security program is holistic, documented, and proactive. | Managed security programs have robust governance and metrics processes. | An optimized security program is based on strong risk management practices, including the production of key risk indicators (KRIs). |
Information security maturity level2 |
Sources: 1 Fennelly, 2013; 2 Build an Information Security Strategy, Info-Tech Research Group, 2020
The risk assessment conducted consists of analyzing existing inherent risks, existing pressure to the risks such as health and safety laws and codes of practice, new risks from the integration process, risk tolerance, and countermeasures.
Sources: EPA, n.d.; America's Water Infrastructure Act (AWIA), 2018; ISC, 2021
Source: Ontic Center for Protective Intelligence, 2022; N=359
The risk assessment conducted is based on a combination of physical and information security factors such as certain facilities factors. The risk level can be used to determine the baseline level of protection (LOP). Next, the baseline LOP is customized to the achievable LOP. The following is an example for federal facilities determined by Interagency Security Committee (ISC).
Source: ISC, 2021
It is important to identify the organization’s requirements, including its environments (IT, IoT, OT, facilities, etc.), and to measure and evaluate its risks and threats using an appropriate risk framework and tools with the critical step of identifying assets prior to acquiring solutions.
Certain exceptions must be identified in risk assessment. Usually physical barriers such as gates and intrusion detection sensors are considered as countermeasures,1 however, under certain assessment, e.g. America's Water Infrastructure Act (AWIA),2 physical barriers are also considered assets and as such must also be assessed.
An anecdotal example of why physical security alone is not sufficient.
Image by Rawpixel.com on Freepik
Lessons learned from using fingerprints for authentication:
In an ideal world, we want a physical security system that is interoperable with all technologies, flexible with minimal customization, functional, and integrated. In the real world, we may have physical systems with proprietary configurations that are not easily customized and siloed.
Source: Robert Dang, Info-Tech Research Group
Microchip implants can be used instead of physical devices such as key cards for digital identity and access management. Risks can be assessed using quantitative or qualitative approaches. In this use case a qualitative approach is applied to impact and likelihood, and a quantitative approach is applied to revenue and cost.
Impact |
|
Likelihood |
|
Revenue |
|
Impact |
|
Likelihood |
|
Cost |
|
Sources: Business Insider, 2018; BBC News, 2022; ISC, 2015
This model works for corporate groups with a parent company. In this model, global security policies are developed by a parent company and local policies are applied to the unique business that is not supported by the parent company.
This model works for organizations with sufficient resources. In this model, integrated security policies are derived from various policies. For example, physical security in smart buildings/devices (sensors, automated meters, HVAC, etc.) and OT systems (SCADA, PLCs, RTUs, etc.) introduce unique risk exposures, necessitating updates to security policies.
This model works for smaller organizations with limited resources. In this model, integrated security policies are derived from information security policies. The issue is when these policies are not applicable to physical security systems or other environments, e.g. OT systems.
Sources: Kris Krishan, Waymo (contributor); Isabelle Hertanto, Info-Tech Research Group (contributor); Physical and Environmental Security Policy Template, Info-Tech Research Group, 2022.
Sources: IEEE, 2021; ISC, 2021
Source: Dan Erwin, Security Officer, Dow Chemical Co., in Computerworld, 2022
Optimizing means working to make the most effective and efficient use of resources, starting with identifying skill requirements and closing skill gaps, followed by designing and deploying integrated security architecture and controls, and finally monitoring and reporting integrated security metrics.
| Identify skill gaps that hinder the successful execution of the hybrid work security strategy. | Use the identified skill gaps to define the technical skill requirements for current and future work roles. | Conduct a skills assessment on your current workforce to identify employee skill gaps. | Decide whether to train (including certification), hire, contract, or outsource to close each skill gap. |
Internal security governance and management using in-house developed tools or off-the-shelf solutions, e.g. security information and event management (SIEM).
Internal security management using third-party security services, e.g. managed security service providers (MSSPs).
Outsourcing the entire security functions, e.g. using managed detection and response (MDR).
Sources: Info-Tech Research Group’s Security Priorities 2023, Close the InfoSec Skills Gap, Build an IT Employee Engagement Program, and Grid Modernization
Sources: ISA and Honeywell Integrated Security Technology Lab, n.d.; IEEE, 2021
Source: FedTech magazine, 2009
Cloud, on-premises, or hybrid? During the pandemic, many enterprises were under tight deadlines to migrate to the cloud. Many did not refactor data and applications correctly for cloud platforms during migration, with the consequence of high cloud bills. This happened because the migrated applications cannot take advantage of on-premises capabilities such as autoscaling. Thus, in 2023, it is plausible that enterprises will bring applications and data back on-premises.
Below is an example of a security design analysis of platform architecture. Design can be assessed using quantitative or qualitative approaches. In this example, a qualitative approach is applied using high-level advantages and disadvantages.
Design criteria | Cloud | Hybrid | On-premises |
Effort | Consumer effort is within a range, e.g. < 60% | Consumer effort is within a range e.g. < 80% | 100% organization |
Reliability | High reliability | High reliability | Medium reliability that depends on data centers |
Cost | High cost when data and applications are not correctly designed for cloud | Optimized cost when data and applications are correctly designed either for cloud or native | Medium cost when data and applications take advantage of on-prem capabilities |
It is important for organizations to find the most optimized architecture to support them, for example, a hybrid architecture of cloud and on-premises based on operations and cost-effectiveness. To help design a security architecture that is strategic, realistic, and based on risk, see Info-Tech’s Identify the Components of Your Cloud Security Architecture research.
Sources: InfoWorld, 2023; Identify the Components of Your Cloud Security Architecture , Info-Tech Research Group, 2021
Below is an example case of a security design analysis of electronic security systems. Design can be assessed using quantitative or qualitative approaches. In this example a qualitative approach is applied using advantages and disadvantages.
Surveillance design criteria |
Video camera |
Motion detector |
Theft of security system equipment |
Higher economic loss | Lower economic loss |
Reliability |
Positive detection of intrusion | Spurious indication and lower reliability |
Energy savings and bandwidth |
Only record when motion is detected | Detect and process all movement |
Once the design has been analyzed, the next step is to conduct market research to analyze the solutions landscape, e.g. to compare products or services from vendors or manufacturers.
Sources: IEEE, 202; IEC, n.d.; IEC, 2013
Passively monitoring data using various protocol layers, actively sending queries to devices, or parsing configuration files of physical security devices, OT, IoT, and IT environments on assets, processes, and connectivity paths.
Automation of threat analysis (signature-based, specification-based, anomaly-based, flow-based, content-based, sandboxing) not only in IT but also in relevant environments, e.g. physical, IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.
Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.
The user and administrative experience, multiple deployment options, extensive integration capabilities, and affordability.
Source: Secure IT/OT Convergence, Info-Tech Research Group, 2022
Security metrics serve various functions in a security program.1 For example:
Physical security interfaces with the physical world. Thus, metrics based on risks related to safety are crucial. These metrics motivate personnel by making clear why they should care about security.
Source: EPRI, 2017
The impact of security on the business can be measured with various metrics such as operational metrics, service level agreements (SLAs), and financial metrics.
Source: BMC, 2022
Early detection leads to faster remediation and less damage. Metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability.
Source: Dark Reading, 2022
Measure the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.
Security failure can be avoided by evaluating the security systems and program. Security evaluation requires understanding what, where, when, and how to measure and to report the relevant metrics.
The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.
Hence, IT and OT need to collaborate, starting with communication to build trust and to overcome their differences and followed by negotiation on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.
Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.
Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.
Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.
This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.
"1402-2021 - IEEE Guide for Physical Security of Electric Power Substations." IEEE, 2021. Accessed 25 Jan. 2023.
"2022 State of Protective Intelligence Report." Ontic Center for Protective Intelligence, 2022. Accessed 16 Jan. 2023.
"8 Staggering Statistics: Physical Security Technology Adoption." Brivo, 2022. Accessed 5 Jan. 2023.
"America's Water Infrastructure Act of 2018." The United States' Congress, 2018. Accessed 19 Jan. 2023.
Baker, Paul and Daniel Benny. The Complete Guide to Physical Security. Auerbach Publications. 2013
Bennett, Steve. "Physical Security Statistics 2022 - Everything You Need to Know." WebinarCare, 4 Dec. 2022. Accessed 30 Dec. 2022.
"Best Practices for Planning and Managing Physical Security Resources: An Interagency Security Committee Guide." Interagency Security Committee (ISC), Dec. 2015. Accessed 23 Jan. 2023.
Black, Daniel. "Improve Security Governance With a Security Steering Committee." Info-Tech Research Group, 23 Nov. 2018. Accessed 30 Jan. 2023.
Borg, Scott. "Don't Put Up Walls Between Your Security People." FedTech Magazine, 17 Feb. 2009. Accessed 15 Dec. 2022.
Burwash, John. “Preparing for Technology Convergence in Manufacturing.” Info-Tech Research Group, 12 Dec. 2018. Accessed 7 Dec. 2022.
Carney, John. "Why Integrate Physical and Logical Security?" Cisco. Accessed 19 Jan. 2023.
"Certification of Cyber Security Skills of ICS/SCADA Professionals." European Union Agency for Cybersecurity (ENISA), 2015. Accessed 27 Sep. 2022.
Cherdantseva, Yulia and Jeremy Hilton. "Information Security and Information Assurance. The Discussion about the Meaning, Scope and Goals." Organizational, Legal, and Technological Dimensions of IS Administrator, Almeida F., Portela, I. (eds.), pp. 1204-1235. IGI Global Publishing, 2013.
Cobb, Michael. "Physical security." TechTarget. Accessed 8 Dec. 2022.
“Conduct a Drinking Water or Wastewater Utility Risk Assessment.” United States Environmental Protection Agency (EPA), n.d. Web.
Conrad, Sandi. "Create and Implement an IoT Strategy." Info-Tech Research Group, 28 July 2022. Accessed 7 Dec. 2022.
Cooksley, Mark. "The IEC 62443 Series of Standards: A Product Manufacturer's Perspective." YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.
"Cyber and physical security must validate their value in 2023." IFSEC Global, 12 Jan. 2023. Accessed 20 Jan. 2023.
"Cybersecurity Evaluation Tool (CSET®)." Cybersecurity and Infrastructure Security Agency (CISA). Accessed 23 Jan. 2023.
"Cybersecurity Maturity Model Certification (CMMC) 2.0." The United States' Department of Defense (DOD), 2021. Accessed 29 Dec. 2022.
“Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.
Czachor, Emily. "Mass power outage in North Carolina caused by gunfire, repairs could take days." CBS News, 5 Dec. 2022. Accessed 20 Jan. 2023.
Dang, Robert, et al. “Secure IT/OT Convergence.” Info-Tech Research Group, 9 Dec. 2022. Web.
"Emergency Management Act (S.C. 2007, c. 15)." The Government of Canada, 2007. Accessed 19 Jan. 2023.
"Emergency management vocabulary." Translation Bureau, Government of Canada. Accessed 19 Jan. 2023.
Fennelly, Lawrence. Effective physical security. Butterworth-Heinemann, 2013.
Ghaznavi-Zadeh, Rassoul. "Enterprise Security Architecture - A Top-down Approach." The Information Systems Audit and Control Association (ISACA). Accessed 25 Jan. 2023.
"Good Practices for Security of Internet of Things." European Union Agency for Cybersecurity (ENISA), 2018. Accessed 27 Sep. 2022.
"Health and Safety at Work etc Act 1974." The United Kingdom Parliament. Accessed 23 Jan. 2023.
Hébert, Michel, et al. “Security Priorities 2023.” Info-Tech Research Group, 1 Feb. 2023. Web.
"History and Initial Formation of Physical Security and the Origin of Authority." Office of Research Services (ORS), National Institutes of Health (NIH). March 3, 2017. Accessed 19 Jan. 2023.
"IEC 62676-1-1:2013 Video surveillance systems for use in security applications - Part 1-1: System requirements - General." International Electrotechnical Commission (IEC), 2013. Accessed 9 Dec. 2022.
"Incident Command System (ICS)." ICS Canada. Accessed 17 Jan. 2023.
"Information Security Manual - Guidelines for Physical Security." The Australian Cyber Security Centre (ACSC), Dec. 2022. Accessed 13 Jan. 2023.
"Integrated Physical Security Framework." Anixter. Accessed 8 Dec. 2022.
"Integrating Risk and Security within a TOGAF® Enterprise Architecture." TOGAF 10, The Open Group. Accessed 11 Jan. 2023.
Latham, Katherine. "The microchip implants that let you pay with your hand." BBC News, 11 Apr. 2022. Accessed 12 Jan. 2023.
Linthicum, David. "2023 could be the year of public cloud repatriation." InfoWorld, 3 Jan. 2023. Accessed 10 Jan. 2023.
Ma, Alexandra. "Thousands of people in Sweden are embedding microchips under their skin to replace ID cards." Business Insider, 14 May 2018. Accessed 12 Jan. 2023.
Mendelssohn, Josh and Dana Tessler. "Take Control of Compliance Improvement to Conquer Every Audit." Info-Tech Research Group, 25 March 2015. Accessed 27 Jan. 2023.
Meredith, Sam. "All you need to know about the Nord Stream gas leaks - and why Europe suspects 'gross sabotage'." CNBC, 11 Oct. 2022. Accessed 20 Jan. 2023.
Nicaise, Vincent. "EU NIS2 Directive: what’s changing?" Stormshield, 20 Oct. 2022. Accessed 17 Nov. 2022.
"NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations." The National Institute of Standards and Technology (NIST), 13 Jul. 2022. Accessed 27 Jan. 2023.
"North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) Series." NERC. Accessed 23 Jan. 2023.
"North America Physical Security Market - Global Forecast to 2026." MarketsandMarkets, June 2021. Accessed 30 Dec. 2022.
"NSTISSI No. 4011 National Training Standard For Information Systems Security (InfoSec) Professionals." The United States Committee on National Security Systems (CNSS), 20 Jun. 1994. Accessed 23 Jan. 2023.
"Occupational Safety and Health Administration (OSH) Act of 1970." The United States Department of Labor. Accessed 23 Jan. 2023.
Palter, Jay. "10 Mistakes Made in Designing a Physical Security Program." Real Time Networks, 7 Sep. 2022. Accessed 6 Jan. 2023.
Parker, Donn. Fighting Computer Crime. John Wiley & Sons, 1998.
Pathak, Parag. "What Is Threat Management? Common Challenges and Best Practices." Security Intelligence, 2020. Accessed 5 Jan. 2023.
Pender-Bey, Georgie. "The Parkerian Hexad." Lewis University, 2012. Accessed 24 Jan. 2023.
Philippou, Oliver. "2023 Trends to Watch: Physical Security Technologies." Omdia. Accessed 20 Jan. 2023.
Phinney, Tom. "IEC 62443: Industrial Network and System Security." ISA and Honeywell Integrated Security Technology Lab. Accessed 30 Jan. 2023.
"Physical Security Market, with COVID-19 Impact Analysis - Global Forecast to 2026." MarketsandMarkets, Jan. 2022. Accessed 30 Dec. 2022.
"Physical Security Professional (PSP)" ASIS International. Accessed 17 Jan. 2023.
"Physical Security Systems (PSS) Assessment Guide" The United States' Department of Energy (DOE), Dec. 2016. Accessed 23 Jan. 2023.
"Policies, Standards, Best Practices, Guidance, and White Papers." Interagency Security Committee (ISC). Accessed 23 Jan. 2023.
"Profiles, Add-ons and Specifications." ONVIF. Accessed 9 Dec. 2022.
"Protective Security Policy Framework (PSPF)." The Australian Attorney-General's Department (AGD). Accessed 13 Jan. 2023.
"Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.
""Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.
Satgunananthan, Niru. "Challenges in Security Convergence?" LinkedIn, 8 Jan. 2022. Accessed 20 Dec. 2022.
Sooknanan, Shastri and Isaac Kinsella. "Identify the Components of Your Cloud Security Architecture." Info-Tech Research Group, 12 March 2021. Accessed 26 Jan. 2023.
"TC 79 Alarm and electronic security systems." International Electrotechnical Commission (IEC), n.d. Accessed 9 Dec. 2022.
"The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard." Interagency Security Committee (ISC), 2021. Accessed 26 Jan. 2023.
"The Short Guide to Why Security Programs Can Fail." CyberTalk, 23 Sep. 2021. Accessed 30 Dec. 2022.
Verton, Dan. "Companies Aim to Build Security Awareness." Computerworld, 27 Nov. 2022. Accessed 26 Jan. 2023.
"Vulnerability Assessment of Federal Facilities." The United States' Department of Justice, 28 Jun. 1995. Accessed 19 Jan. 2023.
"What is IEC 61508?" 61508 Association. Accessed 23 Jan. 2023.
Wolf, Gene. "Better Include Physical Security With Cybersecurity." T&D World 5 Jan. 2023. Accessed 19 Jan. 2023.
Wood, Kate, and Isaac Kinsella. “Build an Information Security Strategy.” Info-Tech Research Group, 9 Sept. 2020. Web.
Woolf, Tim, et al. "Benefit-Cost Analysis for Utility-Facing Grid Modernization Investments: Trends, Challenges, and Considerations." Lawrence Berkeley National Laboratory, Feb. 2021. Accessed 15 Nov. 2022.
"Work Health and Safety Act 2011." The Australian Government. Accessed 13 Jan. 2023.
Wu, Jing. “Industrial Control System Modernization: Unlock the Value of Automation in Utilities.” Info-Tech Research Group, 6 April 2023. Web.
Information and Cyber Governance Manager
Platte River Power Authority
Chief Security Officer (CSO) & Founder
KLAVAN Security
IT Security Manager
4Wall Entertainment
VP of Information Technology
4Wall Entertainment
Senior Manager
March Networks Corporate
Manager of Security Engineering
Omaha Public Power District
Head of IT
Waymo
Director, Facilities Security Preparedness
Omaha Public Power District
Don’t architect for normal situations. That is a shallow approach and leads to decisions that may seem “right” but will not be able to stand up to system elasticity needs.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Translate stakeholder objectives into architecture requirements, solutions, and changes. Incorporate architecture quality attributes in decisions to increase your architecture’s life. Evaluate your solution architecture from multiple views to obtain a holistic perspective of the range of issues, risks, and opportunities.
Identify and detail the value maps that support the business, and discover the architectural quality attribute that is most important for the value maps. Brainstorm solutions for design decisions for data, security, scalability, and performance.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Document a vision statement for the solution architecture practice (in general) and/or a specific vision statement, if using a single project as an example.
Document business architecture and capabilities.
Decompose capabilities into use cases.
Provide a great foundation for an actionable vision and goals that people can align to.
Develop a collaborative understanding of business capabilities.
Develop a collaborative understanding of use cases and personas that are relevant for the business.
1.1 Develop vision statement.
1.2 Document list of value stream maps and their associated use cases.
1.3 Document architectural quality attributes needed for use cases using SRME.
Solution Architecture Template with sections filled out for vision statement canvas and value maps
Map value stream to required architectural attributes.
Prioritize architecture decisions.
Discuss and document data architecture.
An understanding of architectural attributes needed for value streams.
Conceptual understanding of data architecture.
2.1 Map value stream to required architectural attributes.
2.2 Prioritize architecture decisions.
2.3 Discuss and document data architecture.
Solution Architecture Template with sections filled out for value stream and architecture attribute mapping; a prioritized list of architecture design decisions; and data architecture
Discuss security and threat assessment.
Discuss resolutions to threats via security architecture decisions.
Discuss system’s scalability needs.
Decisions for security architecture.
Decisions for scalability architecture.
3.1 Discuss security and threat assessment.
3.2 Discuss resolutions to threats via security architecture decisions.
3.3 Discuss system’s scalability needs.
Solution Architecture Template with sections filled out for security architecture and scalability design
Discuss performance architecture.
Compile all the architectural decisions into a solutions architecture list.
A complete solution architecture.
A set of principles that will form the foundation of solution architecture practices.
4.1 Discuss performance architecture.
4.2 Compile all the architectural decisions into a solutions architecture list.
Solution Architecture Template with sections filled out for performance and a complete solution architecture
Application architecture is a critical foundation for supporting the growth and evolution of application systems. However, the business is willing to exchange the extension of the architecture’s life with quality best practices for the quick delivery of new or enhanced application functionalities. This trade-off may generate immediate benefits to stakeholders, but it will come with high maintenance and upgrade costs in the future, rendering your system legacy early.
Technical teams know the importance of implementing quality attributes into architecture but are unable to gain approval for the investments. Overcoming this challenge requires a focus of architectural enhancements on specific problem areas with significant business visibility. Then, demonstrate how quality solutions are vital enablers for supporting valuable application functionalities by tracing these solutions to stakeholder objectives and conducting business and technical risk and impact assessments through multiple business and technical perspectives.
Andrew Kum-Seun
Research Manager, Applications
Info-Tech Research Group
EXECUTIVE BRIEF
Well-received applications can have poor architectural qualities. Functional needs often take precedence over quality architecture. Quality must be baked into design, execution, and decision-making practices to ensure the right tradeoffs are made.
A well-thought-through and strategically designed solution architecture is essential for the long-term success of any software system, and by extension, the organization because:
In its need for speed, a business often doesn’t see the value in making sure architecture is maintainable, reusable, and scalable. This demand leads to an organizational desire for development practices and the procurement of vendors that favor time-to-market over long-term maintainability. Unfortunately, technical teams are pushed to omit design quality and validation best practices.
Poor quality application architecture impedes business growth opportunities, exposes enterprise systems to risks, and consumes precious IT budgets in maintenance that could otherwise be used for innovation and new projects.
Previous estimations indicate that roughly 50% of security problems are the result of software design. […] Flaws in the architecture of a software system can have a greater impact on various security concerns in the system, and as a result, give more space and flexibility for malicious users.(Source: IEEE Software)
Errors in software requirements and software design documents are more frequent than errors in the source code itself according to Computer Finance Magazine. Defects introduced during the requirements and design phase are not only more probable but also more severe and more difficult to remove. (Source: iSixSigma)
… describes the dependencies, structures, constraints, standards, and development guidelines to successfully deliver functional and long-living applications. This artifact lays the foundation to discuss the enhancement of the use and operations of your systems considering existing complexities.
Lowers maintenance costs by revealing key issues and risks early. The Systems Sciences Institute at IBM has reported that the cost to fix an error found after product release was 4 to 5 times as much as one uncovered during design.
(iSixSigma)
Supports the design and implementation activities by providing key insights for project scheduling, work allocation, cost analysis, risk management, and skills development.(IBM: developerWorks)
Eliminates unnecessary creativity and activities on the part of designers and implementers, which is achieved by imposing the necessary constraints on what they can do and making it clear that deviation from constraints can break the architecture.(IBM: developerWorks)
Solution architecture is not a one-size-fits-all conversation. There are many design considerations and trade-offs to keep in mind as a product or services solution is conceptualized, evaluated, tested, and confirmed. The following is a list of good practices that should inform most architecture design decisions.
Principle 1: Design your solution to have at least two of everything.
Principle 2: Include a “kill switch” in your fault-isolation design. You should be able to turn off everything you release.
Principle 3: If it can be monitored, it should be. Use server and audit logs where possible.
Principle 4: Asynchronous is better than synchronous. Asynchronous design is more complex but worth the processing efficiency it introduces.
Principle 5: Stateless over stateful: State data should only be used if necessary.
Principle 6: Go horizonal (scale out) over vertical (scale up).
Principle 7: Good architecture comes in small packages.
Principle 8: Practice just-in-time architecture. Delay finalizing an approach for as long as you can.
Principle 9: X-ilities over features. Quality of an architecture is the foundation over which features exist. A weak foundation can never be obfuscated through shiny features.
Principle 10: Architect for products not projects. A product is an ongoing concern, while a project is short lived and therefore only focused on what is. A product mindset forces architects to think about what can or should be.
Principle 11: Design for rollback: When all else fails, you should be able to stand up the previous best state of the system.
Principle 12: Test the solution architecture like you test your solution’s features.
Solution architecture is a technical response to a business need, and like all complex evolutionary systems, must adapt its design for changing circumstances.
The triggers for changes to existing solution architectures can come from, at least, three sources:
A solution’s architecture is cross-cutting and multi-dimensional and at the minimum includes:
along with several qualitative attributes (also called non-functional requirements).
Integrate Portfolios to Create Exceptional Customer Value
Deliver on Your Digital Portfolio Vision
Build a Data Architecture Roadmap
Build a Data Pipeline for Reporting and Analytics
Optimize Application Release Management
Build Your Infrastructure Roadmap
Identify Opportunities to Mature the Security Architecture
Solution Architecture Template
Record the results from the exercises to help you define, detail, and make real your digital product vision.
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.
Our team knows that we need to fix a process, but we need assistance to determine where to focus. some check-ins along the way would help keep us on track
We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place
Our team does not have the time or the knowledge to take this project on. we need assistance through the entirety of this project.
Diagnostics and consistent frameworks are used throughout all four options
Contact your account representative for more information. workshops@infotech.com 1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | |
|---|---|---|---|---|
| Exercises |
|
|
|
|
| Outcomes |
|
|
|
|
What does a typical GI on this topic look like?
A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.
This GI is between 8 to 10 calls over the course of approximately four to six months.
| Phase 1 | Phase 2 | Phase 2 |
|---|---|---|
| Call #1: Articulate an architectural vision. |
Call #4: Continue discussion on value stream mapping and related use cases. |
Call #6: Document security design decisions. |
| Call #2: Discuss value stream mapping and related use cases. |
Call #5:
|
Call #7:
|
| Call #3: Continue discussion on value stream mapping and related use cases. |
Call #8: Bring it all together. |
1.1 Articulate an Architectural Vision
1.2 Develop Dynamic Value Stream Maps
1.3 Map Value Streams, Use Cases, and Required Architectural Attributes
1.4 Create a Prioritized List of Architectural Attributes
2.1 Develop a Data Architecture That Supports Transactional and Analytical Needs
2.2 Document Security Architecture Risks and Mitigations
3.1 Document Scalability Architecture
3.2 Document Performance Enhancing Architecture
3.3 Combine the Different Architecture Design Decisions Into a Unified Solution Architecture
Enhance Your Solution Architecture Practice
If you start off by saying I want to architect a system,
you’ve already lost.
Remember what a vision is for!
Your product vision serves as the single fixed point for product development and delivery.
It gets everyone on the same page.
There is no pride in being a rudderless ship. It can also be very expensive.
We know where to go, we know who to bring along, and we know the steps to get there. Let’s plan this out.
Who is the target customer (or customers)?
What is the key benefit a customer can get from using our service or product?
Why should they be engaged with you?
What makes our service or product better than our competitors?
(Adapted from Crossing the Chasm)
It doesn’t matter if you are delivering value to internal or external stakeholders, you need a product vision to ensure everyone understands the “why.”
The solution architecture canvas provides a single dashboard to quickly define and communicate the most important information about the vision. A canvas is an effective tool for aligning teams and providing an executive summary view.
There are different statement templates available to help form your product vision statements. Some include:
We believe (in) a [noun: world, time, state, etc.] where [persona] can [verb: do, make, offer, etc.], for/by/with [benefit/goal].
Our vision is to [verb: build, design, provide] the [goal, future state] to [verb: help, enable, make it easier to...] [persona].
(Adapted from Crossing the Chasm)
Download the Solution Architecture Template and document your vision statement.
Sets and communicates the direction of the entire organization.
Segments, groups, and creates a coherent narrative as to how an organization creates value.
Decomposes an organization into its component parts to establish a common language across the organization.
Implements the business strategy through capability building or improvement projects.
Revenue Growth
Stream 1- Product Purchase
Stream 2- Customer Acquisition
stream 3- Product Financing
There are many techniques that help with constructing value streams and their capabilities.
Domain-driven design is a technique that can be used for hypothesizing the value maps, their capabilities, and associated solution architecture.
Read more about domain-driven design here.
Value chains set a high-level context, but architectural decisions still need to be made to deal with the dynamism of user interaction and their subsequent expectations. User stories (and/or use cases) and themes are great tools for developing such decisions.

The use case Confirming Customer’s Online Order has four actors:
Each use case theme links back to a feature(s) in the product backlog.
Deliver on Your Digital Portfolio Vision
Document Your Business Architecture
*Refer to the next slide for an example of a dynamic value stream map.
Download the Solution Architecture Template for documentation of dynamic value stream map
*Value Stream Name: Usually has the same name as the capability it illustrates.
**Value Stream Components: Specific functions that support the successful delivery of a value stream.
The use case Disbursement of Funds has three actors:
| Loan Provision: Disbursement of Funds | ||
|---|---|---|
| Use Case | Actors | Expectation |
| Deposit Loan Into Applicant’s Bank Account |
|
|
Quality attributes can be viewed as the -ilities (e.g. scalability, usability, reliability) that a software system needs to provide. A system not meeting any of its quality attribute requirements will likely not function as required. Examples of quality attributes are:
| Examples of Qualitative Attributes | |||||
|---|---|---|---|---|---|
| Performance | Compatibility | Usability | Reliability | Security | Maintainability |
|
|
|
|
|
|
Focus on quality attributes that are architecturally significant.
*Abstract since attributes like performance and reliability are not directly measurable by a user.
For applicable use cases: (*Adapted from S Carnegie Mellon University, 2000)
Three out of four is bad. Don’t architect for normal situations because the solution will be fragile and prone to catastrophic failure under unexpected events.
Read article: Retail sites crash under weight of online Black Friday shoppers.
Assume analysis is being done for a to-be developed system.
| User | Loan Applicant | |
|---|---|---|
| Expectations | On login to the web system, should be able to see accurate bank balance after loan funds are deposited. | |
| User signs into the online portal and opens their account balance page. | ||
| Expected Response From System | System creates a connection to the data source and renders it on the screen in under 10ms. | |
| Measurement | Under Normal Loads:
|
Under Peak Loads:
|
| Quality Attribute Required | Required Attribute # 1: Performance
|
|
Use cases developed in Phase 1.2 should be used here. (Adapted from the ATAM Utility Tree Method for Quality Attribute Engineering)
Assume analysis is being done for a to-be developed system.
| User | Loan Applicant | |
|---|---|---|
| Expectations | On login to the web system, should be able to see accurate bank balance after loan funds are deposited. | |
| User signs into the online portal and opens their account balance page. | ||
| Expected Response From System | System creates a connection to the data source and renders it on the screen in under 10ms. | |
| Measurement | Under Normal Loads:
| Under Peak Loads:
|
| Quality Attribute Required | Required Attribute # 1: Performance
Required Attribute # 2: Data Reliability
Required Attribute # 3: Scalability
| |
Loan Application → Disbursement of Funds → Risk Management → Service Accounts
| Value Stream Component | Use Case | Required Architectural Attribute |
|---|---|---|
| Loan Application | UC1: Submit Loan Application UC2: Review Loan Application UC3: Approve Loan Application UCn: …….. |
UC1: Resilience, Data Reliability UC2: Data Reliability UC3: Scalability, Security, Performance UCn: ….. |
| Disbursement of Funds | UC1: Deposit Funds Into Applicant’s Bank Account UCn: …….. |
UC1: Performance, Scalability, Data Reliability |
| Risk Management | ….. | ….. |
| Service Accounts | ….. | ….. |
*Refer to the next slide for an example of a dynamic value stream map.
Download the Solution Architecture Template for documentation of dynamic value stream map
*Value Stream Name: Usually has the same name as the capability it illustrates.
**Value Stream Components: Specific functions that support the successful delivery of a value stream.
The use case Disbursement of Funds has three actors:
| Loan Provision: Disbursement of Funds | ||
|---|---|---|
| Use Case | Actors | Expectation |
| Deposit Loan Into Applicant’s Bank Account |
|
|
Quality attributes can be viewed as the -ilities (e.g. scalability, usability, reliability) that a software system needs to provide. A system not meeting any of its quality attribute requirements will likely not function as required. Examples of quality attributes are:
| Examples of Qualitative Attributes | |||||
|---|---|---|---|---|---|
| Performance | Compatibility | Usability | Reliability | Security | Maintainability |
|
|
|
|
|
|
Focus on quality attributes that are architecturally significant.
*Abstract since attributes like performance and reliability are not directly measurable by a user.
For applicable use cases: (*Adapted from S Carnegie Mellon University, 2000)
Three out of four is bad. Don’t architect for normal situations because the solution will be fragile and prone to catastrophic failure under unexpected events.
Read article: Retail sites crash under weight of online Black Friday shoppers.
Assume analysis is being done for a to-be developed system.
| User | Loan Applicant | |
|---|---|---|
| Expectations | On login to the web system, should be able to see accurate bank balance after loan funds are deposited. | |
| User signs into the online portal and opens their account balance page. | ||
| Expected Response From System | System creates a connection to the data source and renders it on the screen in under 10ms. | |
| Measurement | Under Normal Loads:
|
Under Peak Loads:
|
| Quality Attribute Required | Required Attribute # 1: Performance
|
|
Use cases developed in Phase 1.2 should be used here. (Adapted from the ATAM Utility Tree Method for Quality Attribute Engineering)
Assume analysis is being done for a to-be developed system.
| User | Loan Applicant | |
|---|---|---|
| Expectations | On login to the web system, should be able to see accurate bank balance after loan funds are deposited. | |
| User signs into the online portal and opens their account balance page. | ||
| Expected Response From System | System creates a connection to the data source and renders it on the screen in under 10ms. | |
| Measurement | Under Normal Loads:
| Under Peak Loads:
|
| Quality Attribute Required | Required Attribute # 1: Performance
Required Attribute # 2: Data Reliability
Required Attribute # 3: Scalability
| |
Trade-offs are inherent in solution architecture. Scaling systems may impact performance and weaken security, while fault-tolerance and redundancy may improve availability but at higher than desired costs. In the end, the best solution is not always perfect, but balanced and right-engineered (versus over- or under-engineered).
Loan Application → Disbursement of Funds → Risk Management → Service Accounts
In our example, the prioritized list of architectural attributes are:
Download the Solution Architecture Template and document the list of architectural attributes by priority.
1.1 Articulate an Architectural Vision
1.2 Develop Dynamic Value Stream Maps
1.3 Map Value Streams, Use Cases, and Required Architectural Attributes
1.4 Create a Prioritized List of Architectural Attributes
2.1 Develop a Data Architecture That Supports Transactional and Analytical Needs
2.2 Document Security Architecture Risks and Mitigations
3.1 Document Scalability Architecture
3.2 Document Performance Enhancing Architecture
3.3 Combine the Different Architecture Design Decisions Into a Unified Solution Architecture
Enhance Your Solution Architecture Practice
Source: Flexera
In addition, companies are faced with:
A robust and reliable integrated data architecture is essential for any organization that aspires to be relevant and impactful in its industry.
Data used to be the new oil. Now it’s the life force of any organization that has serious aspirations of providing profit-generating products and services to customers. Architectural decisions about managing data have a significant impact on the sustainability of a software system as well as on quality attributes such as security, scalability, performance, and availability.
Storage and Processing go hand in hand and are the mainstay of any data architecture. Due to their central position of importance, an architecture decision for storage and processing must be well thought through or they become the bottleneck in an otherwise sound system.
Ingestion refers to a system’s ability to accept data as an input from heterogenous sources, in different formats, and at different intervals.
Dissemination is the set of architectural design decisions that make a system’s data accessible to external consumers. Major concerns involve security for the data in motion, authorization, data format, concurrent requests for data, etc.
Orchestration takes care of ensuring data is current and reliable, especially for systems that are decentralized and distributed.
Most companies have a combination of data. They have data they own using on-premises data sources and on the cloud. Hybrid data management also includes external data, such as social network feeds, financial data, and legal information amongst many others.
| Application to Application Integration (or “speed matters”) | Analytical Data Integrations (or “send it to me when its all done”) |
|---|---|
|
|
Data ingestion/dissemination frameworks capture/share data from/to multiple data sources.
What is the mode for data movement?
What is the ingestion/dissemination architecture deployment strategy?
How many different and disparate data sources are sending/receiving data?
What are the different formats flowing through?
What are expected performance SLAs as data flow rate changes?
What are the security requirements for the data being stored?
… but that’s a good thing because the range of data formats that organizations must deal with is also richer than in the past.
The data processing tool to use may depend upon the workloads the system has to manage.
Expanding upon the Risk Management use case (as part of the Loan Provision Capability), one of the outputs for risk assessment is a report that conducts a statistical analysis of customer profiles and separates those that are possibly risky. The data for this report is spread out across different data systems and will need to be collected in a master data management storage location. The business and data architecture team have discussed three critical system needs, noted below:
| Data Management Requirements for Risk Management Reporting | Data Design Decision |
|---|---|
| Needs to query millions of relational records quickly |
|
| Needs a storage space for later retrieval of relational data |
|
| Needs turnkey geo-replication mechanism with document retrieval in milliseconds |
|
A task or application may periodically fail, and therefore, as a part of our data architecture strategy, there must be provisions for scheduling, rescheduling, replaying, monitoring, retrying, and debugging the entire data pipeline in a holistic way.
Some of the functionality provided by orchestration frameworks are:
| Data Orchestration Has Three Stages | ||
|---|---|---|
| Organize | Transform | Publicize |
| Organizations may have legacy data that needs to be combined with new data. It’s important for the orchestration tool to understand the data it deals with. | Transform the data from different sources into one standard type. | Make transformed data easily accessible to stakeholders. |
Download the Solution Architecture Template for documenting data architecture decisions.
| Data Management Requirements for Risk Management Reporting | Data Design Decision |
|---|---|
| Needs to query millions of relational records quickly |
|
| Needs a storage space for later retrieval of relational data |
|
| Needs turnkey geo-replication mechanism with document retrieval in milliseconds |
|
Ensuring that any real system is secure is a complex process involving tradeoffs against other important quality attributes (such as performance and usability). When architecting a system, we must understand:
Authentication mechanisms help systems verify that a user is who they claim to be.
Examples of authentication mechanisms are:
Authorization helps systems limit access to allowed features, once a user has been authenticated.
Examples of authentication mechanisms are:
Securely recording security events through auditing proves that our security mechanisms are working as intended.
Auditing is a function where security teams must collaborate with software engineers early and often to ensure the right kind of audit logs are being captured and recorded.
Defects in your application software can compromise privacy and integrity even if cryptographic controls are in place. A security architecture made after thorough TRA does not override security risk introduced due to irresponsible software design.
STRIDE is a threat modeling framework and is composed of:
| Example of using STRIDE for a TRA on a solution using a payment system |
|
||
|---|---|---|---|
| Spoofing | PayPal | Bad actor can send fraudulent payment request for obtaining funds. | |
| Tampering | PayPal | Bad actor accesses data base and can resend fraudulent payment request for obtaining funds. | |
| Repudiation | PayPal | Customer claims, incorrectly, their account made a payment they did not authorize. | |
| Disclosure | PayPal | Private service database has details leaked and made public. | |
| Denial of Service | PayPal | Service is made to slow down through creating a load on the network, causing massive build up of requests | |
| Elevation of Privilege | PayPal | Bad actor attempts to enter someone else’s account by entering incorrect password a number of times. | |
Download the Solution Architecture Template for documenting data architecture decisions.
| Example of using STRIDE for a TRA on a solution using a payment system | ||||
|---|---|---|---|---|
| Threat | System Component | Description | Quality Attribute Impacted | Resolution |
| Spoofing | PayPal | Bad actor can send fraudulent payment request for obtaining funds. | Confidentiality | Authorization |
| Tampering | PayPal | Bad actor accesses data base and can resend fraudulent payment request for obtaining funds. | Integrity | Authorization |
| Repudiation | PayPal | Customer claims, incorrectly, their account made a payment they did not authorize. | Integrity | Authentication and Logging |
| Disclosure | PayPal | Private service database has details leaked and made public. | Confidentiality | Authorization |
| Denial of Service | PayPal | Service is made to slow down through creating a load on the network, causing massive build up of requests | Availability | N/A |
| Elevation of Privilege | PayPal | Bad actor attempts to enter someone else’s account by entering incorrect password a number of times. | Confidentiality, Integrity, and Availability | Authorization |
1.1 Articulate an Architectural Vision
1.2 Develop Dynamic Value Stream Maps
1.3 Map Value Streams, Use Cases, and Required Architectural Attributes
1.4 Create a Prioritized List of Architectural Attributes
2.1 Develop a Data Architecture That Supports Transactional and Analytical Needs
2.2 Document Security Architecture Risks and Mitigations
3.1 Document Scalability Architecture
3.2 Document Performance Enhancing Architecture
3.3 Combine the Different Architecture Design Decisions Into a Unified Solution Architecture
Enhance Your Solution Architecture Practice
Scale and scope of workloads are more important now than they were, perhaps, a decade and half back. Architects realize that scalability is not an afterthought. Not dealing with it at the outset can have serious consequences should an application workload suddenly exceed expectations.
… the ability of a system to handle varying workloads by either increasing or decreasing the computing resources of the system.
An increased workload could include:
… not easy since organizations may not be able to accurately judge, outside of known circumstances, when and why workloads may unexpectedly increase.
A scalable architecture should be planned at the:
… balancing the demands of the system with the supply of attributes.
If demand from system > supply from system:
If supply from system > demand from system:
The best input for an effective scaling strategy is previously gathered traffic data mapped to specific circumstances.
In some cases, either due to lack of monitoring or the business not being sure of its needs, scalability requirements are hard to determine. In such cases, use stated tactical business objectives to design for scalability. For example, the business might state its desire to achieve a target revenue goal. To accommodate this, a certain number of transactions would need to be conducted, assuming a particular conversion rate.
| Scaling strategies can be based on Vertical or Horizontal expansion of resources. | ||
|---|---|---|
| Pros | Cons | |
| Vertical Scale up through use of more powerful but limited number of resources |
|
|
| Horizontal Scale out through use of similarly powered but larger quantity of resources |
|
|
Through this mechanism, incoming traffic is partitioned around a characteristic of the workload flowing in. Examples of partitioning characteristics are user groups, geo-location, and transaction type.
Beware of:
As the name suggests, clone the compute resources along with the underlying databases. The systems will use a load balancer as the first point of contact between itself and the workload flowing in.
This involves breaking up the system into specific functions and services and bundling their business rules/databases into deployable containers.
To know where to go, you must know where you are. Before introducing architectural changes to database designs, use the right metrics to get an insight into the root cause of the problem(s).
In a nutshell, the purpose of scaling solutions is to have the technology stack do less work for the most requested services/features or be able to effectively distribute the additional workload across multiple resources.
For databases, to ensure this happens, consider these techniques:
A non-scalable architecture has more than just technology-related ramifications. Hoping that load balancers or cloud services will manage scalability-related issues is bound to have economic impacts as well.
Database Caching
Fetches and stores result of database queries in memory. Subsequent requests to the database for the same queries will investigate the cache before making a connection with the database.
Tools like Memcached or Redis are used for database caching.
Precompute Database Caching
Unlike database caching, this style of caching precomputes results of queries that are popular and frequently used. For example, a database trigger could execute several predetermined queries and have them ready for consumption. The precomputed results may be stored in a database cache.
Application Object Caching
Stores computed results in a cache for later retrieval. For data sources, which are not changing frequently and are part of a computation output, application caching will remove the need to connect with a database.
Proxy Caching
Caches retrieved web pages on a proxy server and makes them available for the next time the page is requested.
A synchronous request (doing one thing at a time) means that code execution will wait for the request to be responded to before continuing.
Asynchronous requests (doing many things at the same time) do not block the system they are targeting.
| STATELESS SERVICES | VERSUS | STATEFUL SERVICES |
|---|---|---|
|
|
|
| It is generally accepted that stateless services are better for system scalability, especially if vertical scaling is costly and there is expectation that workloads will increase. | ||
| MICROSERVICES | VERSUS | SERVERLESS FUNCTIONS |
|
|
|
| Serverless function is an evolving technology and tightly controlled by the vendor. As and when vendors make changes to their serverless products, your own systems may need to be modified to make the best use of these upgrades. | ||
A critical aspect of any system is its ability to monitor and report on its operational outcomes.
Any system, however well architected, will break one day. Strategically place kill-switches to counter any failures and thoroughly test their functioning before releasing to production.
include kill-switchesand
architect for x-ilities over features), introduce tactics at the code and higher levels that can be used to put a system in its previous best state in case of failure.
(International Organization for Standardization, 2011)
Measurement Category 1: System performance in terms of end-user experience during different load scenarios.
Measurement Category 2: System performance in terms of load managed by computational resources.
Good architecture comes in small packages) and Principle 10 (
Architect for products, not projects), a microservices architecture based on domain-driven design helps process performance. Microservices use lightweight HTTP protocols and have loose coupling, adding a degree of resilience to the system as well. *An overly-engineered microservices architecture can become an orchestration challenge.
Performance modeling and testing helps architecture teams predict performance risks as the solution is being developed.
(CSA Principle 12: Test the solution architecture like you test your solution’s features)
Create a model for your system’s hypothetical performance testing by breaking an end-to-end process or use case into its components. *Use the SIPOC framework for decomposition.
Performance testing process should be fully integrated with software development activities and as automated as possible. In a fast-moving Agile environment, teams should attempt to:
*In a real production scenario, a combination of these tests are executed on a regular basis to monitor the performance of the system over a given period.
Download the Solution Architecture Template for documenting data architecture decisions.
| Value Stream Component | Design Decision for User Interface Layer | Design Decisions for Middle Processing Layer |
|---|---|---|
| Loan Application | Scalability: N/A Resilience: Include circuit breaker design in both mobile app and responsive websites. Performance: Cache data client. |
Scalability: Scale vertically (up) since loan application processing is very compute intensive. Resilience: Set up fail-over replica. Performance: Keep servers in the same geo-area. |
| Disbursement of Funds | *Does not have a user interface | Scalability: Scale horizontal when traffic reaches X requests/second. Resilience: Create microservices using domain-driven design; include circuit breakers. Performance: Set up application cache; synchronous communication since order of data input is important. |
| …. | …. | …. |
Download the Solution Architecture Template for documenting data architecture decisions.
This blueprint covered the domains tagged with the yellow star.
The right design decision is never the same for all perspectives. Along with varying opinions, comes the “at odds with each other set” of needs (scalability vs. performance, or access vs. security).
An evidence-based decision-making approach using a domain-driven design strategy is a good mix of techniques for creating the best (right?) solution architecture.
Ambysoft Inc. “UML 2 Sequence Diagrams: An Agile Introduction.” Agile Modeling, n.d. Web.
Bass, Len, Paul Clements, and Rick Kazman. Software Architecture in Practices: Third Edition. Pearson Education, Inc. 2003.
Eeles, Peter. “The benefits of software architecting.” IBM: developerWorks, 15 May 2006. Web.
Flexera 2020 State of the Cloud Report. Flexera, 2020. Web. 19 October 2021.
Furdik, Karol, Gabriel Lukac, Tomas Sabol, and Peter Kostelnik. “The Network Architecture Designed for an Adaptable IoT-based Smart Office Solution.” International Journal of Computer Networks and Communications Security, November 2013. Web.
Ganzinger, Matthias, and Petra Knaup. “Requirements for data integration platforms in biomedical research networks: a reference model.” PeerJ, 5 February 2015. (https://peerj.com/articles/755/).
Garlan, David, and Mary Shaw. An Introduction to Software Architecture. CMU-CS-94-166, School of Computer Science Carnegie Mellon University, January 1994.
Gupta, Arun. “Microservice Design Patterns.” Java Code Geeks, 14 April 2015. Web.
How, Matt. The Modern Data Warehouse in Azure. O’Reilly, 2020.
ISO/IEC 17788:2014: Information technology – Cloud computing, International Organization for Standardization, October 2014. Web.
ISO/IEC 18384-1:2016: Information technology – Reference Architecture for Service Oriented Architecture (SOA RA), International Organization for Standardization, June 2016. Web.
ISO/IEC 25010:2011(en) Systems and software engineering — Systems and software Quality Requirements and Evaluation (SQuaRE) — System and software quality models. International Organization for Standardization, March 2011. Web.
Kazman, R., M. Klein, and P. Clements. ATAM: Method for Architecture Evaluation. S Carnegie Mellon University, August 2000. Web.
Microsoft Developer Network. “Chapter 16: Quality Attributes.” Microsoft Application Architecture Guide. 2nd Ed., 13 January 2010. Web.
Microsoft Developer Network. “Chapter 2: Key Principles of Software Architecture.” Microsoft Application Architecture Guide. 2nd Ed., 13 January 2010. Web.
Microsoft Developer Network. “Chapter 3: Architectural Patterns and Styles.” Microsoft Application Architecture Guide. 2nd Ed., 14 January 2010. Web.
Microsoft Developer Network. “Chapter 5: Layered Application Guidelines.” Microsoft Application Architecture Guide. 2nd Ed., 13 January 2010. Web.
Mirakhorli, Mehdi. “Common Architecture Weakness Enumeration (CAWE).” IEEE Software, 2016. Web.
Moore, G. A. Crossing the Chasm, 3rd Edition: Marketing and Selling Disruptive Products to Mainstream Customers (Collins Business Essentials) (3rd ed.). Harper Business, 2014.
OASIS. “Oasis SOA Reference Model (SOA RM) TC.” OASIS Open, n.d. Web.
Soni, Mukesh. “Defect Prevention: Reducing Costs and Enhancing Quality.” iSixSigma, n.d. Web.
The Open Group. TOGAF 8.1.1 Online, Part IV: Resource Base, Developing Architecture Views. TOGAF, 2006. Web.
The Open Group. Welcome to the TOGAF® Standard, Version 9.2, a standard of The Open Group. TOGAF, 2018. Web.
Watts, S. “The importance of solid design principles.” BMC Blogs, 15 June 2020. 19 October 2021.
Young, Charles. “Hexagonal Architecture–The Great Reconciler?” Geeks with Blogs, 20 Dec 2014. Web.
Many solutions exist for improving the layers of the application stack that may address architecture issues or impact your current architecture. Solutions range from capability changes to full stack replacement.
| Method | Description | Potential Benefits | Risks | Related Blueprints |
|---|---|---|---|---|
| Business Capabilities: Enablement and enhancement |
|
|
|
Use Info-Tech’s Document Your Business Architecture blueprint to gain better understanding of business and IT alignment. |
| Removal |
|
|
|
Use Info-Tech’s Build an Application Rationalization Framework to rationalize your application portfolio. |
| Business Process: Process integration and consolidation |
|
|
|
|
| Business Process (continued): Process automation |
|
|
|
|
| Lean business processes |
|
|
|
|
| Outsource the process |
|
|
|
|
| Business Process (continued): Standardization |
|
|
|
|
| User Interface: Improve user experience (UX) |
|
|
|
|
| Code: Update coding language |
Translate legacy code into modern coding language. |
|
|
|
| Code (continued): Open source code |
|
|
|
|
| Update the development toolchain |
|
|
|
|
| Update source code management |
|
|
|
|
| Data: Outsource extraction |
|
|
|
|
| Update data structure |
|
|
|
|
| Update data mining and data warehousing tools |
|
|
|
|
| Integration: Move from point-to-point to enterprise service bus (ESB) |
|
|
|
|
| Leverage API integration |
|
|
|
|
Having shifted operations almost overnight to a remote work environment, and with the crisis management phase of the COVID-19 pandemic winding down, IT leaders and organizations are faced with the following issues:
An organization’s shift back toward the pre-pandemic state cannot be carried out in isolation. Things have changed. Budgets, resource availability, priorities, etc., will not be the same as they were in early March. Organizations must ensure that all departments work collaboratively to support office repatriation. IT must quickly identify the must-dos to allow safe return to the office, while prioritizing tasks relating to the repopulation of employees, technical assets, and operational workloads via an informed and streamlined roadmap.
As employees return to the office, PMO and portfolio leaders must sift through unclear requirements and come up with a game plan to resume project activities mid-pandemic. You need to develop an approach, and fast.
Responsibly resume IT operations in the office:
Quickly restart the engine of your PPM:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify the new risk landscape and risk tolerance for your organization post-pandemic. Determine how this may impact the second wave of pandemic transition tasks.
Prepare to return your employees to the office. Ensure that IT takes into account the health and safety of employees, while creating an efficient and sustainable working environment
Prepare the organization's assets for return to the office. Ensure that IT takes into account the off-license purchases and new additions to the hardware family that took place during the pandemic response and facilitates a secure reintegration to the workplace.
Prepare and position IT to support workloads in order to streamline office reintegration. This may include leveraging pre-existing solutions in different ways and providing additional workstreams to support employee processes.
Once you've identified IT's supporting tasks, it's time to prioritize. This phase walks through the activity of prioritizing based on cost/effort, alignment to business, and security risk reduction weightings. The result is an operational action plan for resuming office life.
Restarting the engine of the project portfolio mid-pandemic won’t be as simple as turning a key and hitting the gas. Use this concise research to find the right path forward for your organization.
Organizations are joining the wave and adopting machine learning and artificial intelligence (AI) to unlock the value in their data and power their competitive advantage. But to succeed with these complex analytics programs, they need to begin by looking at their data – empowering their people to realize and embrace the valuable insights within the organization’s data.
The key to achieve becoming a data-driven organization is to foster a strong data culture and equip employees with data skills through an organization-wide data literacy program.
Data literacy is critical to the success of digital transformation and AI analytics. Info-Tech’s approach to creating a sustainable and effective data literacy program is recognizing it is:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Data literacy as part of the data governance strategic program should be launched to all levels of employees that will help your organization bridge the data knowledge gap at all levels of the organization. This research recommends approaches to different learning styles to address data skill needs and helps members create a practical and sustainable data literacy program.
Kick off a data awareness program that explains the fundamental understanding of data and its lifecycle. Explore ways to create or mature the data literacy program with smaller amounts of information on a more frequent basis.
“Digital transformation” and “data driven” are two terms that are inseparable. With organizations accelerating in their digital transformation roadmap implementation, organizations need to invest in developing data skills with their people. Talent is scarce and the demand for data skills is huge, with 70% of employees expected to work heavily with data by 2025. There is no time like the present to launch an organization-wide data literacy program to bridge the data knowledge gap and foster a data-driven culture.
Data literacy training is as important as your cybersecurity training. It impacts all levels of the organization. Data literacy is critical to success with digital transformation and AI analytics.
Principal Advisory Director, Data & Analytics Practice
Info-Tech Research Group
Your ChallengeOrganizations are joining the wave and adopting machine learning (ML) and artificial intelligence (AI) to unlock the value in their data and power their competitive advantage. But to succeed with these complex analytics programs, they need to begin by empowering their people to realize and embrace the valuable insights within the organization’s data. The key to becoming a data-driven organization is to foster a strong data culture and equip people with data skills through an organization-wide data literacy program. |
Common ObstaclesChallenges the data leadership is likely to face as digital transformation initiatives drive intensified competition:
|
Info-Tech's ApproachWe interviewed data leaders and instructors to gather insights about investing in data:
|
By thoughtfully designing a data literacy training program for the audience's own experience, maturity level, and learning style, organizations build the data-driven and engaged culture that helps them to unlock their data's full potential and outperform other organizations.
“Data literacy is the ability to read, work with, analyze, and communicate with data. It's a skill that empowers all levels of workers to ask the right questions of data and machines, build knowledge, make decisions, and communicate meaning to others.” – Qlik, n.d.
Source: Accenture, 2020.
Source: Qlik, 2022.
“[Data debt is] when you have undocumented, unused, incomplete, and inconsistent data,” according to Secoda (2023). “When … data debt is not solved, data teams could risk wasting time managing reports no one uses and producing data that no one understands.”
Signs of data debt when considering investing in data literacy:
of organizations say a backlog of data debt is impacting new data management initiatives.
of organizations say individuals within the business do not trust data insights.
of organizations are unable to become data-driven.
Source: Experian, 2020
Image source: Welocalize, 2020.
Data represents a discrete fact or event without relation to other things (e.g. it is raining). Data is unorganized and not useful on its own.
Information organizes and structures data so that it is meaningful and valuable for a specific purpose (i.e. it answers questions). Information is a refined form of data.
When information is combined with experience and intuition, it results in knowledge. It is our personal map/model of the world.
Knowledge set with context generates insight. We become knowledgeable as a result of reading, researching, and memorizing (i.e. accumulating information).
Wisdom means the ability to make sound judgments. Wisdom synthesizes knowledge and experiences into insights.
Data-driven culture refers to a workplace where decisions are made based on data evidence, not on gut instinct.
Phase Steps |
1. Define Data Literacy Objectives1.1 Understand organization’s needs 1.2 Create vision and objective for data literacy program |
2. Assess Learning Style and Align to Program Design2.1 Create persona and identify audience 2.2 Assess learning style and align to program design 2.3 Determine the right delivery method |
3. Socialize Roadmap and Milestones3.1 Establish a roadmap 3.2 Set key performance metrics and milestones |
Phase Outcomes |
Identify key objectives to establish and grow the data literacy program by articulating the problem and solutions proposed. |
Assess each audience’s learning style and adapt the program to their unique needs. |
Show a roadmap with key performance indicators to track each milestone and tell a data story. |
– Miro Kazakoff, senior lecturer, MIT Sloan, in MIT Sloan School of Management, 2021
By thoughtfully designing a data literacy training program personalized to each audience's maturity level, learning style, and experience, organizations can develop and grow a data-driven culture that unlocks the data's full potential for competitive differentiation.
We can learn a lot from each other. Literacy works both ways – business data stewards learn to “speak data” while IT data custodians understand the business context and value. Everyone should strive to exchange knowledge.
Avoid traditional classroom teaching – create a data literacy program that is learner-centric to allow participants to learn and experiment with data.
Aligning program design to those learning styles will make participants more likely to be receptive to learning a new skill.
A data literacy program isn’t just about data but rather encompasses aspects of business, IT, and data. With executive support and partnership with business, running a data literacy program means that it won’t end up being just another technical training. The program needs to address why, what, how questions.
A lot of programs don’t include the fundamentals. To get data concepts to stick, focus on socializing the data/information/knowledge/wisdom foundation.
Many programs speak in abstract terms. We present case studies and tangible use cases to personalize training to the audience’s world and showcase opportunities enabled through data.
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of the project."
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
Session 1 | Session 2 | Session 3 | Session 4 | |
Activities | Define Data Literacy Objectives1.1 Review Data Culture Diagnostic results 1.2 Identify business context: business goals, initiatives 1.3 Create vision and objective for data literacy program | Assess Learning Style and Align to Program Design2.1 Identify audience 2.2 Assess learning style and align to program design 2.3 Determine the right delivery method | Build a Data Literacy Roadmap and Milestones3.1 Identify program initiatives and topics 3.2 Determine delivery methods 3.3 Build the data literacy roadmap | Operational Strategy to implement Data Literacy4.1 Identify key performance metrics 4.2 Identify owners and document RACI matrix 4.3 Discuss next steps and wrap up. |
Deliverables |
|
|
|
|
Foster Data-Driven Culture With Data Literacy
Input
|
Output
|
Materials
|
Participants
|
Contact your Info-Tech Account Representative for details on launching a Data Culture Diagnostic.
Input
| Output
|
Materials
| Participants
|
Data collected through Info-Tech’s Data Culture Diagnostic suggests three ways to improve data literacy:
think more can be done to define and document commonly used terms with methods such as a business data glossary.
think they can have a better understanding of the meaning of all data elements that are being captured or managed.
feel that they can have more training in terms of tools as well as on what data is available at the organization.
Source: Info-Tech Research Group's Data Culture Diagnostic, 2022; N=2,652
Start with real business problems in a hands-on format to demonstrate the value of data.
Treat data as a strategic asset to gain insight into our customers for all levels of organization.
"According to Forrester, 91% of organizations find it challenging to improve the use of data insights for decision-making – even though 90% see it as a priority. Why the disconnect? A lack of data literacy."
– Alation, 2020
Info-Tech provides various topics suited for a data literacy program that can accommodate different data skill requirements and encompasses relevant aspects of business, IT, and data.
Use discovery and diagnostics to understand users’ comfort level and maturity with data.
Foster Data-Driven Culture With Data Literacy
feel that training was too long to remember or to apply in their day-to-day work.
find training had insufficient follow-up to help them apply on the job.
Source: Grovo, 2018.
Input
| Output
|
Materials
| Participants
|
IT and data professionals need to understand the business as much as business needs to talk about data. Bidirectional learning and feedback improves the synergy between business and IT.
Choose a data role (e.g. data steward, data owner, data scientist).
Describe the persona based on goals, priorities, tenures, preferred learning style, type of work with data.
Identify data skill and level of skills required.
Tailor your data literacy program to meet your organization’s needs, filling your range of knowledge gaps and catering to different levels of users.
When it comes to rolling out a data literacy program, there is no one-size-fits-all solution. Your data literacy program is intended to spread knowledge throughout your organization. It should target everyone from executive leadership to management to subject matter experts across all functions of the business.
The imaginative learner group likes to engage in feelings and spend time on reflection. This type of learner desires personal meaning and involvement. They focus on personal values for themselves and others and make connections quickly.
For this group of learners, their question is: why should I learn this?
The analytical learner group likes to listen, to think about information, and to come up with ideas. They are interested in acquiring facts and delving into concepts and processes. They can learn effectively and enjoy doing independent research.
For this group of learners, their question is: what should I learn?
The common sense learner group likes thinking and doing. They are satisfied when they can carry out experiments, build and design, and create usability. They like tinkering and applying useful ideas.
For this group of learners, their question is: how should I learn?
The dynamic learner group learns through doing and experiencing. They are continually looking for hidden possibilities and researching ideas to make original adjustments. They learn through trial and error and self-discovery.
For this group of learners, their question is: what if I learn this?
There are four common ways to learn a new skill: by watching, conceptualizing, doing, and experiencing. The following are some suggestions on ways to implement your data literacy program through different delivery methods.
Foster Data-Driven Culture With Data Literacy
For the Gantt chart:
Input
| Output
|
Materials
| Participants
|
Name |
Position |
| Andrea Malick | Advisory Director, Info-Tech Research Group |
| Andy Neill | AVP, Data and Analytics, Chief Enterprise Architect, Info-Tech Research Group |
| Crystal Singh | Research Director, Info-Tech Research Group |
| Imad Jawadi | Senior Manager, Consulting Advisory, Info-Tech Research Group |
| Irina Sedenko | Research Director, Info-Tech Research Group |
| Reddy Doddipalli | Senior Workshop Director, Info-Tech Research Group |
| Sherwick Min | Technical Counselor, Info-Tech Research Group |
| Wayne Cain | Principal Advisory Director, Info-Tech Research Group |
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
Session 1 |
Session 2 |
Session 3 |
Session 4 |
|
Activities |
Understand the WHY and Value of Data1.1 Business context, business objectives, and goals 1.2 You and data 1.3 Data journey from data to insights 1.4 Speak data – common terminology |
Learn about the WHAT Through Data Flow2.1 Data creation 2.2 Data ingestion 2.3 Data accumulation 2.4 Data augmentation 2.5 Data delivery 2.6 Data consumption |
Explore the HOW Through Data Visualization Training3.1 Ask the right questions 3.2 Find the top five data elements 3.3 Understand your data 3.4 Present your data story 3.5 Sharing of lessons learned |
Put Them All Together Through Data Governance Awareness4.1 Data governance framework 4.2 Data roles and responsibilities 4.3 Data domain and owners |
Deliverables |
|
|
|
|
Deliver measurable business value.
Key to building and fostering a data-driven culture.
Streamline your data management program with our simplified framework.
About Learning. “4MAT overview.” About Learning., 16 Aug. 2001. Web.
Accenture. “The Human Impact of Data Literacy,” Accenture, 2020. Web.
Anand, Shivani. “IDC Reveals India Data and Content Technologies Predictions for 2022 and onwards; Focus on Data Literacy for an Elevated data Culture.” IDC, 14 Mar. 2022. Web.
Belissent, Jennifer, and Aaron Kalb. “Data Literacy: The Key to Data-Driven Decision Making.” Alation, April 2020. Web.
Brown, Sara. “How to build data literacy in your company.” MIT Sloan School of Management, 9 Feb 2021. Web.
---. “How to build a data-driven company.” MIT Sloan School of Management, 24 Sept. 2020. Web.
Domo. “Data Never Sleeps 9.0.” Domo, 2021. Web.
Dykes, Brent. “Creating A Data-Driven Culture: Why Leading By Example Is Essential.” Forbes, 26 Oct. 2017. Web.
Experian. “10 signs you are sitting on a pile of data debt.” Experian, 2020. Accessed 25 June 2021. Web.
Experian. “2019 Global Data Management Research.” Experian, 2019. Web.
Knight, Michelle. “Data Literacy Trends in 2023: Formalizing Programs.” Dataversity, 3 Jan. 2023. Web.
Ghosh, Paramita. “Data Literacy Skills Every Organization Should Build.” Dataversity, 2 Nov. 2022. Web.
Johnson, A., et al., “How to Build a Strategy in a Digital World,” Compact, 2018, vol. 2. Web.
LifeTrain. “Learning Style Quiz.” EMTrain, Web.
Lambers, E., et al. “How to become data literate and support a data-drive culture.” Compact, 2018, vol. 4. Web.
Marr, Benard. “Why is data literacy important for any business?” Bernard Marr & Co., 16 Aug. 2022. Web.
Marr, Benard. “8 simple ways to enhance your data literacy skills.” Bernard Marr & Co., 16 Aug. 2022. Web/
Mendoza, N.F. “Data literacy: Time to cure data phobia” Tech Republic, 27 Sept. 2022. Web.
Mizrahi, Etai. “How to stay ahead of data debt and downtime?” Secoda, 17 April 2023. Web.
Needham, Mass., “IDC FutureScape: Top 10 Predictions for the Future of Intelligence.” IDC, 5 Dec. 2022. Web.
Paton, J., and M.A.P. op het Veld. “Trusted Analytics.” Compact, 2017, vol. 2. Web.
Qlik. “Data Literacy to be Most In-Demand Skill by 2030 as AI Transforms Global Workplaces.” Qlik., 16 Mar 2022. Web.
Qlik. “What is data literacy?” Qlik, n.d. Web.
Reed, David. Becoming Data Literate. Harriman House Publishing, 1 Sept. 2021. Print.
Salomonsen, Summer. “Grovo’s First-Time Manager Microlearning® Program Will Help Your New Managers Thrive in 2018.” Grovos Blog, 5 Dec. 2018. Web.
Webb, Ryan. “More Than Just Reporting: Uncovering Actionable Insights From Data.” Welocalize, 1 Sept. 2020. Web.
As the world around us changes there is a higher risk that IT productivity and planned priorities will be derailed.
To meet the challenges of uncertainty head on IT leaders must adapt so their employees are supported and IT departments continue to operate successfully.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Begin your proactive Oracle licensing journey by understanding which information to gather and assessing the current state and gaps.
Review current licensing models and determine which licensing models will most appropriately fit your environment.
Review Oracle’s contract types and assess which best fit the organization’s licensing needs.
Conduct negotiations, purchase licensing, and finalize a licensing management strategy.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Assess current state and align goals; review business feedback
Interview key stakeholders to define business objectives and drivers
Have a baseline for requirements
Assess the current state
Determine licensing position
Examine cloud options
1.1 Gather software licensing data
1.2 Conduct a software inventory
1.3 Perform manual checks
1.4 Reconcile licenses
1.5 Create your Oracle licensing team
1.6 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation
Copy of your Oracle License Statement
Software inventory report from software asset management (SAM) tool
Oracle Database Inventory Tool
RASCI Chart
Oracle Licensing Effective License Position (ELP) Template
Oracle Licensing Purchase Reference Guide
Review licensing options
Review licensing rules
Understand how licensing works
Determine if you need software assurance
Discuss licensing rules, application to current environment.
Examine cloud licensing
Understand the importance of documenting changes
Meet with desktop product owners to determine product strategies
2.1 Review full, limited, restricted, and AST use licenses
2.2 Calculate license costs
2.3 Determine which database platform to use
2.4 Evaluate moving to the cloud
2.5 Examine disaster recovery strategies
2.6 Understand purchasing support
2.7 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation
Oracle TCO Calculator
Oracle Licensing Purchase Reference Guide
Review contract option types
Review vendors
Understand why a type of contract is best for you
Determine if ULA or term agreement is best
The benefits of other types and when you should change
3.1 Prepare to sign or renew your ULA
3.2 Decide on an agreement type that nets the maximum benefit
Type of contract to be used
Oracle TCO Calculator
Oracle Licensing Purchase Reference Guide
Finalize the contract
Prepare negotiation points
Discuss license management
Evaluate and develop a roadmap for future licensing
Negotiation strategies
Licensing management
Introduction of SAM
Leverage the work done on Oracle licensing to get started on SAM
4.1 Control the flow of communication terms and conditions
4.2 Use Info-Tech’s readiness assessment in preparation for the audit
4.3 Assign the right people to manage the environment
4.4 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation
Controlled Vendor Communications Letter
Vendor Communication Management Plan
Oracle Terms & Conditions Evaluation Tool
RASCI Chart
Oracle Licensing Purchase Reference Guide
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Calculate the cost of the project backlog and assess the root causes of its unmanageability.
Increase the manageability of the backlog by updating stale requests and removing dead weight.
Develop and maintain a manageable backlog growth rate by establishing disciplined backlog management processes.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Gauge the manageability of your project backlog in its current state.
Calculate the total cost of your project backlog investments.
Determine the root causes that contribute to the unmanageability of your project backlog.
An understanding of the organizational need for more disciplined backlog management.
Visibility into the costs incurred by the project backlog.
An awareness of the sources that feed the growth of the project backlog and make it a challenge to maintain.
1.1 Calculate the sunk and marginal costs that have gone into your project backlog.
1.2 Estimate the throughput of backlog items.
1.3 Survey the root causes of your project backlog.
The total estimated cost of the project backlog.
A project backlog return-on-investment score.
A project backlog root cause analysis.
Identify the most organizationally appropriate goals for your backlog cleanse.
Pinpoint those items that warrant immediate removal from the backlog and establish a game plan for putting a bullet in them.
Communicate backlog decisions with stakeholders in a way that minimizes friction and resistance.
An effective, achievable, and organizationally right-sized approach to cleansing the backlog.
Criteria for cleanse outcomes and a protocol for carrying out the near-term cleanse.
A project sponsor outreach plan to help ensure that decisions made during your near-term cleanse stick.
2.1 Establish roles and responsibilities for the near-term cleanse.
2.2 Determine cleanse scope.
2.3 Develop backlog prioritization criteria.
2.4 Prepare a communication strategy.
Clear accountabilities to ensure the backlog is effectively minimized and outcomes are communicated effectively.
Clearly defined and achievable goals.
Effective criteria for cleansing the backlog of zombie projects and maintaining projects that are of strategic and operational value.
A communication strategy to minimize stakeholder friction and resistance.
Ensure ongoing backlog manageability.
Make sure the executive layer is aware of the ongoing status of the backlog when making project decisions.
Customize a best-practice toolkit to help keep the project backlog useful.
A list of pending projects that is minimal, maintainable, and of high value.
Executive engagement with the backlog to ensure intake and approval decisions are made with a view of the backlog in mind.
A backlog management tool and processes for ongoing manageability.
3.1 Develop a project backlog management operating model.
3.2 Configure a project backlog management solution.
3.3 Assign roles and responsibilities for your long-term project backlog management processes.
3.4 Customize a project backlog management operating plan.
An operating model to structure your long-term strategy around.
A right-sized management tool to help enable your processes and executive visibility into the backlog.
Defined accountabilities for executing project backlog management responsibilities.
Clearly established processes for how items get in and out of the backlog, as well as for ongoing backlog review.
As a software space, strategic portfolio management lacks a unified definition. In the same way that it took many years for project portfolio management to stabilize as a concept distinct from traditional enterprise project management, strategic portfolio management is experiencing a similar period of formational uncertainty. Unpacking what’s truly new and valuable in helping to define strategy and drive strategic outcomes versus what’s just repackaged as SPM is an important first step, but it's not an easy undertaking.
In this concise publication, we will cut through the marketing to unpack what strategic portfolio management is, and what makes it distinct from similar capabilities. We’ll help to situate you in the space and assess the extent to which your tooling needs can be met by a strategic portfolio management offering.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
In this concise publication we introduce you to strategic portfolio management and consider the extent to which your organization can leverage an SPM application to help drive strategic outcomes.
Use this Excel workbook to determine if your organization can benefit from the features and functionality of an SPM approach or whether you need something more like a traditional project portfolio management tool.

Travis Duncan
Research Director, PPM and CIO Strategy
Info-Tech Research Group
While the market is eager to get users into what they're calling "strategic portfolio management," there's a lot of uncertainty out there about what this market is and how it's different from other, more established portfolio disciplines – most significantly, project portfolio management.
Indeed, if you look at how the space is covered within the industry, you'll encounter a dog's breakfast of players, a comparison of apples and oranges: Jira in the same quadrants as Planisware, Smartsheets in the same profiles as Planview and ServiceNow. While each of the individual players is impressive, their areas of focus are unique and the extent to which they should be compared together under the category of strategic portfolio management is questionable.
It speaks to some of the grey area within the SPM space more generally, which is at a bit of a crossroads: Will it formally shed the guardrails of its antecedents to become its own space, or will it devolve into a bait and switch through which capabilities that struggled to gain much traction beyond IT settings seek to infiltrate the business and grow their market share under a different name?
Part of it is up to the rest of us as users and potential customers. Clarifying what we need before we jump into something simply because our prior attempts failed will help determine whether we need a unique space for strategic portfolio management or whether we simply need to do portfolio management more strategically.
| Your Challenge | Common Obstacles | Info-Tech's Approach |
|
|
|
Info-Tech Insight
In the same way that it took many years for PPM to stabilize as a concept distinct from traditional enterprise project management, strategic portfolio management is experiencing a similar period of formational uncertainty. In a space that can be all things to all users, clarify your actual needs before jumping onto a bandwagon and ending up with something that you don't need, and that the organization can't adopt.
While the concept of 'strategic portfolio management' has been written about within project portfolio management circles for nearly 20 years, SPM, as a distinct organizational competence and software category, is a relatively new and largely vendor-driven capability.
First emerging in the discourse during the mid-to-late 2010s, SPM has evolved from its roots in traditional enterprise project portfolio management. Though, as we will discuss, it has other antecedents not limited to PPM.
In this publication, we'll unpack what SPM is, how it is distinct (and, in turn, how it is not distinct) from PPM and other capabilities, and we will consider the extent to which your organization can and should leverage an SPM application to help drive strategic outcomes.
–The increasing need to deliver value from digital initiatives is giving rise to strategic portfolio management, a digital investment management discipline that enables strategy realization in complex dynamic environments."
– OnePlan, "Is Strategic Portfolio Management the Future of PPM?"
Only 2% of business leaders are confident that they will achieve 80% to 100% of their strategic objectives.
Source: Smith, 2022
SPM is a new stage in the history of project portfolio management more generally. While it's emerging as a distinct capability, and it borrows from capabilities beyond PPM, unpacking its distinctiveness is best done by first understanding its source.

Triggers for the emergence of strategic portfolio management in the discourse include the pace of technology-introduced change, the waning of enterprise project management, and challenges around enterprise PPM tool adoption.

| Project Portfolio Management | Differentiator | Strategic Portfolio Management |
|---|---|---|
| Work-Level (Tactical) | Primary Orientation | High-Level (Strategic) |
| CIO | Accountable for Outcomes | CxO |
| Project Manager | Responsible for Outcomes | Product Management Organization |
| Project Managers, PMO Staff | Targeted Users | Business Leaders, ePMO Staff |
| Project Portfolio(s) | Essential Scope | Multi-Portfolio (Project, Application, Product, Program, etc.) |
| IT Project Delivery and Business Results Delivery | Core Focus | Business Strategy and Change Delivery |
| Project Scope | Change Impact Sensitivity | Enterprise Scope |
| IT and/or Business Benefit | Language of Value | Value Stream |
| Project Timelines | Main View | Strategy Roadmaps |
| Resource Capacity | Primary Currency | Money |
| Work-Assignment Details | Modalities of Planning | Value Milestones & OKRs |
| Work Management | Modalities of Execution | Governance (Project, Product, Strategy, Program, etc.) |
| Project Completion | Definitions of "Done" | Business Capability Realization |
Info-Tech Insight
The distinction between the two capabilities is not necessarily as black and white as the table above would have it (some "PPM" tools offer what we're identifying above as "SPM" capabilities), but it can be helpful to think in these binaries when trying to distinguish the two capabilities. At the very least, SPM broadens its scope to target more executive and business users, and functions best when it's speaking at a higher level, to a business audience.
Perhaps the biggest evolution from traditional PPM that strategic portfolio management promises is that it casts a wider net in terms of the types of work it tracks (and how it tracks that work) and the types of portfolios it accommodates.
Not bound to the concepts of "projects" and a "project portfolio" specifically, SPM broadens its scope to encompass capabilities like product and product portfolio management, enterprise architecture management, security and risk management, and more.

"An SPM tool will capture business strategy, business capabilities, operating models, the enterprise architecture and the project portfolio with unmatched visibility into how they all relate. This will give...a robust understanding of the impact of a proposed IT change " and enable IT and business to act like cocreators driving innovation."
– Paula Ziehr
Sixty one percent of leaders acknowledge their companies struggle to bridge the gap between creating a strategy and executing on that strategy.
Source: StrategyBlocks, 2020
| ePMO or Strategy Realization Office | Senior Leadership and Executive Stakeholders | Business Leads and IT Directors and Managers |
|---|---|---|
| SPM tools are best facilitated through enterprise PMOs or strategy realization offices. After all, in enterprises, these are the entities charged with the planning, execution, and tracking of strategy.
Their roles within the tool typically entail:
|
As those with the accountability and authority to drive the organization's strategy, you could argue that these stakeholders are the primary stakeholders for an SPM tool.
Their roles within the tool typically entail:
|
SPM targets more business users as well as senior IT managers and directors.
Their roles within the tool typically entail:
|
| Name | Description |
| Analytics and Reporting | SPM should provide access to real-time dashboards and data interpretation, which can be exported as reports in a range of formats. |
| Strategy Mapping and Road Mapping | SPM should provide access to up-to-date timeline views of strategies and initiatives, including the ability to map such things as dependencies, market needs, funding, priorities, governance, and accountabilities. |
| Value Tracking and Measurement | SPM should include the ability to forecast, track, and measure return on investment for strategic investments. This includes accommodations for various paradigms of value delivery (e.g. traditional value delivery and measurement, OKRs, as well as value mapping and value streams). |
| Ideation and Innovation Management | SPM should include the ability to facilitate innovation management processes across the organization, including the ability to support stage gates from ideation through to approval; to articulate, socialize, and test ideas; perform impact assessments; create value canvas and OKR maps; and prioritize. |
| Multi-Portfolio Management | SPM should include the ability to perform various modalities of portfolio management and portfolio optimization, including project portfolio management, applications portfolio management, asset portfolio management, etc. |
| Interoperability/APIs | An SPM tool should enable seamless integration with other applications for data interoperability. |
| Name | Description |
| Product Management | SPM can include product-management-specific functionality, including the ability to connect product families, roadmaps, and backlogs to enterprise goals and priorities, and track team-level activities at the sprint, release, and campaign levels. |
| Enterprise Architecture Management | SPM can include the ability to define and map the structure and operation of an organization in order to effectively coordinate various domains of architecture and governance (e.g. business architecture, data architecture, application architecture, security architecture, etc.) in order to effectively plan and introduce change. |
| Security and Risk Management | SPM can include the ability to identify and track enterprise risks and ensure compliance controls are met. |
| Lean Portfolio Management | SPM can include the ability to plan and report on portfolio performance independent from task level details of product, program, or project delivery. |
| Investment and Financial Management | SPM can include the ability to forecast, track, and report on financials at various levels (strategy, product, program, project, etc.). |
| Multi-Methodology Delivery | SPM can include the ability to plan and execute work in a way that accommodates various planning and delivery paradigms (predictive, iterative, Kanban, lean, etc.). |
| 1. SPM accommodates various ways of working. |
|
| 2. SPM puts the focus on value and change. |
|
| 3. SPM fosters a coherent approach to demand management. |
|
| 1. The space is rife with IT buzzwords and, as a concept, is sometimes used as a repackaging of failing concepts. |
|
| 2. Some solutions that identify as SPM are not. |
|
| 3. SPM tools may have a capacity blind spot. |
|
Download Info-Tech's Strategic Portfolio Management Needs Assessment
10 to 20 minutes
This screenshot shows a sample output from the assessment. Based upon your inputs, you'll be grouped within three ranges:

| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
If the analysis in the previous slides suggested you can benefit from an SPM tool, you can quick-start your vendor evaluation process with SoftwareReviews.
SoftwareReviews has extensive coverage of not just the SPM space, but of the project portfolio management (pictured to the top right) and project management spaces as well. So, from the tactical to the strategic, SoftwareReviews can help you find the right tools.
Further, as you settle in on a shortlist, you can begin your vendor analysis using our rapid application selection methodology (see framework on bottom right). For more information see our The Rapid Application Selection Framework blueprint.

Info-Tech's Rapid Application Selection Framework (RASF)
Develop a Project Portfolio Management Strategy
Drive IT project throughput by throttling resource capacity.
Prepare an Actionable Roadmap for your PMO
Turn planning into action with a realistic PMO timeline.
Maintain an Organized Portfolio
Align portfolio management practices with COBIT (APO05: Manage Portfolio)
Angliss, Katy, and Pete Harpum. Strategic Portfolio Management: In the Multi-Project and Program Organization. Book. Routledge. 30 Dec. 2022.
Anthony, James. "95 Essential Project Management Statistics: 2022 Market Share & Data Analysis." Finance Online. 2022. Web. Accessed 21 March 2022
Banham, Craig. "Integrating strategic planning with portfolio management." Sopheon. Webinar. Accessed 6 Feb. 2023.
Garfein, Stephen J. "Executive Guide to Strategic Portfolio Management: roadmap for closing the gap between strategy and results." PMI. Conference Paper. Oct. 2007. Accessed 6 Feb. 2023.
Garfein, Stephen J. "Strategic Portfolio Management: A smart, realistic and relatively fast way to gain sustainable competitive advantage." PMI. Conference Paper. 2 March 2005. Accessed 6 Feb. 2023.
Hontar, Yulia. "Strategic Portfolio Management." PPM Express. Blog 16 June 2022. Accessed 6 Feb. 2023.
Milsom, James. "6 Strategic Portfolio Management Trends for 2023." i-nexus. Blog. 25 Jan. 2022. Accessed 6 Feb. 2023.
Milsom, James. "Strategic Portfolio Management 101." i-nexus. 8 Dec. 2021. Blog . Accessed 6 Feb. 2023.
OnePlan, "Is Strategic Portfolio Management the Future of PPM?" YouTube. 17 Nov. 2022. Accessed 6 Feb. 2023.
OnePlan. "Strategic Portfolio Management for Enterprise Agile." YouTube. 27 May 2022. Accessed 6 Feb. 2023.
Piechota, Frank. "Strategic Portfolio Management: Enabling Successful Business Outcomes." Shibumi. Blog . 31 May 2022. Accessed 6 Feb. 2023.
ServiceNow. "Strategic Portfolio Management—The Thing You've Been Missing." ServiceNow. Whitepaper. 2021. Accessed 6 Feb. 2023.
Smith, Shepherd, "50+ Eye-Opening Strategic Planning Statistics" ClearPoint Strategy. Blog. 13 Sept. 2022. Accessed 6 Feb. 2023.
SoftwareAG. "What is Strategic Portfolio Management (SPM)?" SoftwareAG. Blog. Accessed 6 Feb. 2023.
Stickel, Robert. "What It Means to be Adaptive." OnePlan. Blog. 24 May 2021. Accessed 6 Feb. 2023.
UMT360. "What is Strategic Portfolio Management?" YouTube. Webinar. 22 Oct. 2020. Accessed 6 Feb. 2023.
Wall, Caroline. "Elevating Strategy Planning through Strategic Portfolio Management." StrategyBlocks. Blog. 26 Feb. 2020. Accessed 6 Feb. 2023.
Westmoreland, Heather. "What is Strategic Portfolio Management." Planview. Blog. 19 Oct 2002. Accessed 6 Feb. 2023.
Wiltshire, Andrew. "Shibumi Included in Gartner Magic Quadrant for Strategic Portfolio Management for the 2nd Straight Year." Shibumi. Blog. 20 Apr. 2022. Accessed 6 Feb. 2023.
Ziehr, Paula. "Keep your eye on the prize: Align your IT investments with business strategy." SoftwareAG. Blog. 5 Jul. 2022. Accessed 6 Feb. 2023.
There are three critical components to the grant application process:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify grant funding opportunities that align with your organization's priorities. Ensure the programs, services, projects, and initiatives that align with these priorities can be financially supported by grant funding.
Prioritize applying for the grant opportunities that your organization identified. Be sure to consider the feasibility of implementing the project or initiative if your organization is awarded the grant.
Write a competitive grant application that has been strategically developed and actively critiqued by various internal and external reviewers.
Submit an exemplary grant application that meets the guidelines and expectations of the granting agency prior to the due date.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Determine the key priorities of your organization and identify grant funding opportunities that align with those priorities.
Prevents duplicate grant applications from being submitted
Ensures the grant and the organization's priorities are aligned
Increases the success rate of grant applications
1.1 Discuss grant funding opportunities and their importance to the organization.
1.2 Identify organizational priorities.
An understanding of why grants are important to your organization
A list of priorities being pursued by your organization
Identify potential grant funding opportunities that align with the projects/initiatives the organization would like to pursue. Prioritize these funding opportunities and identify which should take precedent based on resourcing, importance, likelihood of success, and feasibility.
Generate a list of potential funding opportunities that can be revisited when resources allow
Obtain consensus from your working group on which grants should be pursued based on how they have been prioritized
2.1 Develop a list of potential grant funding opportunities.
2.2 Define the resource capacity your organization has to support the granting writing process.
2.3 Discuss and prioritize grant opportunities
A list of potential grant funding opportunities
Realistic expectations of your organization's capacity to undertake the grant writing lifecycle
Notes and priorities from your discussion on grant opportunities
Take the grant that was given top priority in the last section and sketch out a draft of what that application will look like. Think critically about the sketch and determine if there are opportunities to further clarify and demonstrate the goals of the grant application.
A sketch ready to be developed into a grant application
A critique of the sketch to ensure that the application will be well understood by the reviewers of your submission
3.1 Sketch the grant application.
3.2 Perform a SWOT analysis of the grant sketch.
A sketched version of the grant application ready to be drafted
A SWOT analysis that critically examines the sketch and offers opportunities to enhance the application
Have the grant application actively critiqued by various internal and external individuals. This will increase the grant application's quality and generate understanding of the application submission and post-submission process.
A list of individuals (internal and external) that can potentially review the application prior to submission
Preparation for the submission process
An understanding of why the opportunity to learn how to improve future grant applications is so important
4.1 Identify potential individuals who will review the draft of your grant application.
4.2 Discuss next steps around the grant submission.
4.3 Review grant writing best practices.
A list of potential individuals who can be asked to review and critique the grant application
An understanding of what the next steps in the process will be
Knowledge of grant writing best practices
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This research will help you choose an appropriate measurement framework, set effective measures. and communicate and review your performance measures. Use Info-Tech's process to set meaningful measures that will inspire employees and drive performance.
This tool will help you set departmental goals based on organizational mission and business goals and choose appropriate measures and weightings for each goal. Use this template to plan a comprehensive employee measurement system.
This tool will help you set departmental goals based on your organizational mission and business goals, choose appropriate measures and weightings for each goal, and visualize you progress toward set goals. Use this template to plan and implement a comprehensive employee measurement system from setting goals to communicating results.
Feedback and coaching will improve performance, increase employee engagement, and build stronger employee manager relationships. Giving feedback is an essential part of a manger's job and if done timely can help employees to correct their behavior before it becomes a bigger problem.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Ensure that individual goals are informed by business ones.
Individuals understand how their goals contribute to organizational ones.
1.1 Understand how your department contributes to larger organizational goals.
1.2 Determine the timelines you need to measure employees against.
1.3 Set Business aligned department, team, and individual goals.
Business-aligned department and team goals
Business-aligned individual goals
Create holistic performance measures.
Holistic performance measures are created.
2.1 Choose your employee measurement framework: generic or individual.
2.2 Define appropriate employee measures for preestablished goals.
2.3 Determine employee measurement weightings to drive essential behaviors.
Determined measurement framework
Define employee measures.
Determined weightings
Learn how to communicate measures to stakeholders and review measures.
Learn how to communicate to stakeholders and coach employees through blockers.
3.1 Learn how to communicate selected performance measures to stakeholders.
3.2 How to coach employees though blockers.
3.3 Reviewing and updating measures.
Effective communication with stakeholders
Coaching and feedback
When to update
Train managers in relevant areas.
Training delivered to managers.
4.1 Deliver Build a Better Manager training to managers.
4.2
Manager training delivered
Your ChallengeIn today’s competitive environment, managers must assess and inspire employee performance in order to assess the achievement of business goals. Despite the importance of performance measures, many leaders struggle with choosing appropriate metrics. Performance measures are often misaligned with the larger strategy, gamed by employees, or are too narrow to provide an accurate picture of employee achievements. |
Common ObstaclesManagers who invest time in creating more effective performance measures will be rewarded with increased employee engagement and better employee performance. Too little time setting holistic employee measures often results in unintended behaviors and gaming of the system. Conversely, too much time setting employee measures will result in overreporting and underperforming employees. |
Info-Tech’s ApproachInfo-Tech helps managers translate organizational goals to employee measures. Communicating these to employees and other stakeholders will help managers keep better track of workforce productivity, maintain alignment with the organization’s business strategy, and improve overall results. |
Performance measures are not about punishing bad performance, but inspiring higher performance to achieve business goals.
Significant components of employee engagement are tied to employee performance measures.
Impact of Engagement on Performance
Source: McLean & Company Employee Engagement Survey Jan 2020-Jan 2023; N=5,185 IT Employees; were either Engaged or Disengaged (Almost Engaged and Indifferent were not included)
Engaged employees don’t just work harder, they deliver higher quality service and products.
Engaged employees are significantly more likely to agree that they regularly accomplish more than what’s expected of them, choose to work extra hours to improve results, and take pride in the work they do.
Without this sense of pride and ownership over the quality-of-service IT provides, IT departments are at serious risk of not being able to deliver quality service, on-time and on-budget.
Create meaningful performance measures to drive employee engagement by helping employees understand how they contribute to the organization.
Too many ineffective performance measures create more work for the manager rather than inspire employee performance. Determine if your measures are worth tracking – or if they are lacking.
Meaningful performance measures are: |
Ineffective performance measures are: |
|
Clearly linked to organizational mission, values, and objectives. Based on a holistic understanding of employee performance. Relevant to organizational decision-making. Accepted by employees and managers. Easily understood by employees and managers. Valid: relevant to the role and goals and within an employee’s control. Reliable: consistently applied to assess different employees doing the same job. |
Difficult to track, update, and communicate. Easily gamed by managers or employees. Narrowly focused on targets rather than the quality of work. The cause of unintended outcomes or incentive for the wrong behaviors. Overly complex or elaborate. Easily manipulated due to reliance on simple calculations. Negotiable without taking into account business needs, leading to lower performance standards. |
Phase Steps
1.1 Create business-aligned department and team goals
1.2 Create business-aligned individual goals
Phase Outcomes
Understand how your department contributes to larger organizational goals.
Determine the timelines you need to measure employees against.
Set business-aligned department, team, and individual goals.
Phase Steps
1.1 Choose measurement framework
1.2 Define employee measures
1.3 Determine weightings
Phase Outcomes
Choose your employee measurement framework: generic or individual.
Define appropriate employee measures for preestablished goals.
Determine employee measurement weightings to drive essential behaviors.
Ensure employee measures are communicated to the right stakeholders.
Phase Steps
1.1 Communicate to stakeholders
1.2 Coaching and feedback
1.3 When to update
Phase Outcomes
Communicate selected performance measure to stakeholders.
Learn how to coach employees though blockers.
Understand how to review and when to update measures.
DIY Toolkit
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
Guided Implementation
"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
Workshop
"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."
Consulting
"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is four to six calls over the course of two to four months.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Any time a major IT outage occurs, it increases executive awareness and internal pressure to create an IT DRP. This blueprint will help you develop an actionable DRP by following our four-phase methodology to define scope, current status, and dependencies; conduct a business impact analysis; identify and address gaps in the recovery workflow; and complete, extend, and maintain your DRP.
These examples include a client who leveraged the DRP blueprint to create practical, concise, and easy-to-maintain DRP governance and incident response plans and a case study based on a hospital providing a wide range of healthcare services.
Use this tool to measure your current DRP maturity and identify gaps to address. It includes a comprehensive list of requirements for your DRP program, including core and industry requirements.
The project charter template includes details on the project overview (description, background, drivers, and objectives); governance and management (project stakeholders/roles, budget, and dependencies); and risks, assumptions, and constraints (known and potential risks and mitigation strategy).
This tool enables you to identify critical applications/systems; identify dependencies; define objective scoring criteria to evaluate the impact of application/system downtime; determine the impact of downtime and establish criticality tiers; set recovery objectives (RTO/RPO) based on the impact of downtime; record recovery actuals (RTA/RPA) and identify any gaps between objectives and actuals; and identify dependencies that regularly fail (and have a significant impact when they fail) to prioritize efforts to improve resiliency.
Use this tool to specifically record assumptions made about who and what are impacted by system downtime and record assumptions made about impact severity.
This simple format is ideal during crisis situations, easier to maintain, and often quicker to create. Use this template to document the Notify - Assess - Declare disaster workflow, document current and planned future state recovery workflows, including gaps and risks, and review an example recovery workflow.
Improving DR capabilities is a marathon, not a sprint. You likely can't fund and resource all the measures for risk mitigation at once. Instead, use this tool to create a roadmap for actions, tasks, projects, and initiatives to complete in the short, medium, and long term. Prioritize high-benefit, low-cost mitigations.
Use this template to present your results from the DRP Maturity Scorecard, BCP-DRP Fitness Assessment, DRP Business Impact Analysis Tool, tabletop planning exercises, DRP Recovery Workflow Template, and DRP Roadmap Tool.
Leverage this tool to document information regarding DRP resources (list the documents/information sources that support DR planning and where they are located) and DR teams and contacts (list the DR teams, SMEs critical to DR, and key contacts, including business continuity management team leads that would be involved in declaring a disaster and coordinating response at an organizational level).
The following tools and templates are also included as part of this blueprint to use as needed to supplement the core steps above:
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Identify key applications and dependencies based on business needs.
Understand the entire IT “footprint” that needs to be recovered for key applications.
1.1 Assess current DR maturity.
1.2 Determine critical business operations.
1.3 Identify key applications and dependencies.
Current challenges identified through a DRP Maturity Scorecard.
Key applications and dependencies documented in the Business Impact Analysis (BIA) Tool.
Quantify application criticality based on business impact.
Appropriate recovery time and recovery point objectives defined (RTOs/RPOs).
2.1 Define an objective scoring scale to indicate different levels of impact.
2.2 Estimate the impact of downtime.
2.3 Determine desired RTO/RPO targets for applications based on business impact.
Business impact analysis scoring criteria defined.
Application criticality validated.
RTOs/RPOs defined for applications and dependencies.
Determine your baseline DR capabilities (your current state).
Gaps between current and desired DR capability are quantified.
3.1 Conduct a tabletop exercise to determine current recovery procedures.
3.2 Identify gaps between current and desired capabilities.
3.3 Estimate likelihood and impact of failure of individual dependencies.
Current achievable recovery timeline defined (i.e. the current state).
RTO/RPO gaps identified.
Critical single points of failure identified.
Identify and prioritize projects to close DR gaps.
DRP project roadmap defined that will reduce downtime and data loss to acceptable levels.
4.1 Determine what projects are required to close the gap between current and desired DR capability.
4.2 Prioritize projects based on cost, effort, and impact on RTO/RPO reduction.
4.3 Validate that the suggested projects will achieve the desired DR capability.
Potential DR projects identified.
DRP project roadmap defined.
Desired-state incident response plan defined, and project roadmap validated.
Outline how to create concise, usable DRP documentation.
Summarize workshop results.
A realistic and practical approach to documenting your DRP.
Next steps documented.
5.1 Outline a strategy for using flowcharts and checklists to create concise, usable documentation.
5.2 Review Info-Tech’s DRP templates for creating system recovery procedures and a DRP summary document.
5.3 Summarize the workshop results, including current potential downtime and action items to close gaps.
Current-state and desired-state incident response plan flowcharts.
Templates to create more detailed documentation where necessary.
Executive communication deck that outlines current DR gaps, how to close those gaps, and recommended next steps.
"An effective DRP addresses common outages such as hardware and software failures, as well as regional events, to provide day-to-day service continuity. It’s not just insurance you might never cash in. Customers are also demanding evidence of an effective DRP, so organizations without a DRP risk business impact not only from extended outages but also from lost sales. If you are fortunate enough to have executive buy-in, whether it’s due to customer pressure or concern over potential downtime, you still have the challenge of limited time to dedicate to disaster recovery (DR) planning. Organizations need a practical but structured approach that enables IT leaders to create a DRP without it becoming their full-time job."
Frank Trovato,
Research Director, Infrastructure
Info-Tech Research Group
Potential Lost Revenue
The impact of downtime tends to increase exponentially as systems remain unavailable (graph at left). A current, tested DRP will significantly improve your ability to execute systems recovery, minimizing downtime and business impact. Without a DRP, IT is gambling on its ability to define and implement a recovery strategy during a time of crisis. At the very least, this means extended downtime – potentially weeks or months – and substantial business impact.
Adapted from: Philip Jan Rothstein, 2007
Cost of Downtime for the Fortune 1000
Cost of unplanned apps downtime per year: $1.25B to $2.5B.
Cost of critical apps failure per hour: $500,000 to $1M.
Cost of infrastructure failure per hour: $100,000.
35% reported to have recovered within 12 hours.
17% of infrastructure failures took more than 24 hours to recover.
13% of application failures took more than 24 hours to recover.
Source: Stephen Elliot, 2015
The cost of downtime is rising across the board, and not just for organizations that traditionally depend on IT (e.g. e-commerce). Downtime cost increase since 2010:
Hospitality: 129% increase
Transportation: 108% increase
Media organizations: 104% increase
DR planning is not your full-time job, so it can’t be a resource- and time-intensive process.
| The Traditional Approach | Info-Tech’s Approach |
|---|---|
|
Start with extensive risk and probability analysis. Challenge: You can’t predict every event that can occur, and this delays work on your actual recovery procedures. |
Focus on how to recover regardless of the incident. We know failure will happen. Focus on improving your ability to failover to a DR environment so you are protected regardless of what causes primary site failure. |
|
Build a plan for major events such as natural disasters. Challenge: Major destructive events only account for 12% of incidents while software/hardware issues account for 45%. The vast majority of incidents are isolated local events. |
An effective DRP improves day-to-day service continuity, and is not just for major events. Leverage DR planning to address both common (e.g. power/network outage or hardware failure) as well as major events. It must be documentation you can use, not shelfware. |
|
Create a DRP manual that provides step-by-step instructions that anyone could follow. Challenge: The result is lengthy, dense manuals that are difficult to maintain and hard to use in a crisis. The usability of DR documents has a direct impact on DR success. |
Create concise documentation written for technical experts. Use flowcharts, checklists, and diagrams. They are more usable in a crisis and easier to maintain. You aren’t going to ask a business user to recover your SQL Server databases, so you can afford to be concise. |
When a tornado takes out your data center, it’s an obvious DR scenario and the escalation towards declaring a disaster is straightforward.
The challenge is to be just as decisive in less-obvious (and more common) DR scenarios such as a critical system hardware/software failure, and knowing when to move from incident management to DR. Don’t get stuck troubleshooting for days when you could have failed over in hours.
Bridge the gap with clearly-defined escalation rules and criteria for when to treat an incident as a disaster.
Source: Info-Tech Research Group; N=92
Does this mean I don’t need to worry about natural disasters? No. It means DR planning needs to focus on overall service continuity, not just major disasters. If you ignore the more common but less dramatic causes of service interruptions, you are diminishing the business value of a DRP.
The traditional approach to DR starts with an in-depth exercise to identify risks to IT service continuity and the probability that those risks will occur.
Still, failure is inevitable – it’s been demonstrated multiple times1 through high-profile outages. When you surrender direct control of the systems themselves, it’s your responsibility to ensure the vendor can meet your DR requirements, including:
Sources: Kyle York, 2016; Shaun Nichols, 2017; Stephen Burke, 2017
IT DR is not an airplane disaster movie. You aren’t going to ask a business user to execute a system recovery, just like you wouldn’t really want a passenger with no flying experience to land a plane.
In reality, you write a DR plan for knowledgeable technical staff, which allows you to summarize key details your staff already know. Concise, visual documentation is:
"Without question, 300-page DRPs are not effective. I mean, auditors love them because of the detail, but give me a 10-page DRP with contact lists, process flows, diagrams, and recovery checklists that are easy to follow."
– Bernard Jones, MBCI, CBCP, CORP, Manager Disaster Recovery/BCP, ActiveHealth Management
Source: Info-Tech Research Group; N=95
*DR Success is based on stated ability to meet recovery time objectives (RTOs) and recovery point objectives (RPOs), and reported confidence in ability to consistently meet targets.
A DRP is the set of procedures and supporting documentation that enables an organization to restore its core IT services (i.e. applications and infrastructure) as part of an overall business continuity plan (BCP), as described below. Use the templates, tools, and activities in this blueprint to create your DRP.
| Overall BCP |
|---|
| IT DRP | BCP for Each Business Unit | Crisis Management Plan |
|---|---|---|
A plan to restore IT services (e.g. applications and infrastructure) following a disruption. This includes:
|
A set of plans to resume business processes for each business unit. Info-Tech’s Develop a Business Continuity Plan blueprint provides a methodology for creating business unit BCPs as part of an overall BCP for the organization. | A set of processes to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage. This includes emergency response plans, crisis communication plans, and the steps to invoke BC/DR plans when applicable. Info-Tech’s Implement Crisis Management Best Practices blueprint provides a structured approach to develop a crisis management process. |
Note: For DRP, we focus on business-facing IT services (as opposed to the underlying infrastructure), and then identify required infrastructure as dependencies (e.g. servers, databases, network).
"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Info-Tech members save an average of $22,983 and 22 days by working with an Info-Tech analyst on DRP (based on client response data from Info-Tech Research Group’s Measured Value Survey, following analyst advisory on this blueprint).
Define DRP scope (Call 1)
Scope requirements, objectives, and your specific challenges. Identify applications/ systems to focus on first.
Define current status and system dependencies (Calls 2-3)
Assess current DRP maturity. Identify system dependencies.
Conduct a BIA (Calls 4-6)
Create an impact scoring scale and conduct a BIA. Identify RTO and RPO for each system.
Recovery workflow (Calls 7-8)
Create a recovery workflow based on tabletop planning. Identify gaps in recovery capabilities.
Projects and action items (Calls 9-10)
Identify and prioritize improvements. Summarize results and plan next steps.
Your guided implementations will pair you with an advisor from our analyst team for the duration of your DRP project.
Contact your account representative or email Workshops@InfoTech.com for more information.
Industry: Manufacturing
Source: Info-Tech Research Group Client Engagement
A global manufacturer with annual sales over $1B worked with Info-Tech to improve DR capabilities.
DRP BIA
Conversations with the IT team and business units identified the following impact of downtime over 24 hours:
Tabletop Testing and Recovery Capabilities
Reviewing the organization’s current systems recovery workflow identified the following capabilities:
Findings
Because of end-user complaints, IT had invested heavily in email resiliency though email downtime had a relatively minimal impact on the business. After working through the methodology, it was clear that the business needed to provide additional support for critical systems.
Identify DR Maturity and System Dependencies
Conduct a BIA
Outline Incident Response and Recovery Workflow With Tabletop Exercises
Mitigate Gaps and Risks
This could be an annual review – but more likely, this is the first time you’ve reviewed the DR plan in years.* Maybe a failed audit might have provided a mandate for DR planning, or a real disaster might have highlighted gaps in DR capabilities. First, set appropriate expectations for what the project is and isn’t, in terms of scope, outputs, and resource commitments. Very few organizations can afford to hire a full-time DR planner, so it’s likely this won’t be your full-time job. Set objectives and timelines accordingly.
Gather a team
Find and review existing documentation
Set specific, realistic objectives
Estimated Time: 30 minutes
Identify the drivers and challenges to completing a functional DRP plan with the core DR team.
DRP Drivers
DRP Challenges
Write down insights from the meeting on flip-chart paper or a whiteboard and use the findings to inform your DRP project (e.g. challenges to address).
DRP Project Charter Template components:
Define project parameters, roles, and objectives, and clarify expectations with the executive team. Specific subsections are listed below and described in more detail in the remainder of this phase.
Note: Identify the initial team roles and responsibilities first so they can assist in defining the project charter.
Info-Tech’s DRP Maturity Scorecard evaluates completion status and process maturity for a comprehensive yet practical assessment across three aspects of an effective DRP program – Defining Requirements, Implementation, and Maintenance.
Completion Status: Reflects the progress made with each component of your DRP Program.
Process Maturity: Reflects the consistency and quality of the steps executed to achieve your completion status.
DRP Maturity Assessment: Each component (e.g. BIA) of your DRP Program is evaluated based on completion status and process maturity to provide an accurate holistic assessment. For example, if your BIA completion status is 4 out of 5, but process maturity is a 2, then requirements were not derived from a consistent defined process. The risk is inconsistent application prioritization and misalignment with actual business requirements.
Estimated Time: 30 minutes
Working through the planning process the first time can be challenging. If losing momentum is a concern, limit the BIA to a few critical systems to start.
Run this exercise if you need a structured exercise to decide where to focus first and identify the business users you should ask for input on the impact of system downtime.
| Application | Notes |
|---|---|
| CRM |
|
| Dialer |
|
Estimated Time: 1-2 hours
A high-level topology or architectural diagram is an effective way to identify dependencies, application ownership, outsourced services, hardware redundancies, and more.
Note:
In general, visual documentation is easier to use in a crisis and easier to maintain over time. Use Info-Tech’s research to help build your own visual SOPs.
Reviewing the entire ecosystem for applications identified key dependencies that were previously considered non-critical. For example, a system used to facilitate secure data transfers was identified as a key dependency for payroll and other critical business processes, and elevated to Tier 1.
Drawing a simple architectural diagram was an invaluable tool to identify key dependencies and critical systems, and to understand how systems and dependencies were interconnected. The drawing was an aha moment for IT and business stakeholders trying to make sense of their 1600-server environment.
A member of the S&P 500 used Info-Tech’s DRP Maturity Scorecard to provide a reliable objective assessment and make the case for improvements to the board of directors.
Info-Tech's DRP Project Charter enabled the CIO to clarify their DRP project scope and where it fit into their overall COOP. The project charter example provided much of the standard copy – objectives, scope, project roles, methodology, etc. – required to outline the project.
A BIA enables you to identify appropriate spend levels, maintain executive support, and prioritize DR planning for a more successful outcome. Info-Tech has found that a BIA has a measurable impact on the organization’s ability to set appropriate objectives and investment goals.
Business input is important, but don’t let a lack of it delay a draft BIA. Complete a draft based on your knowledge of the business. Create a draft within IT, and use it to get input from business leaders. It’s easier to edit estimates than to start from scratch; even weak estimates are far better than a blank sheet.
You don’t have to include every impact category in your BIA. Include categories that could affect your business. Defer or exclude other categories. For example, the bulk of revenue for governmental organizations comes from taxes, which won’t be permanently lost if IT systems fail.
Use the suggestions below as a guide as you modify scoring criteria in the DRP Business Impact Analysis Tool:
Estimated Time: 3 hours
On tab 3 of the DRP Business Impact Analysis Tool indicate the costs of downtime, as described below:
For example, if a core call center phone system was down:
Info-Tech suggests that IT leadership and staff identify the impact of downtime first to create a version that you can then validate with relevant business owners. As you work through the BIA as a team, have a notetaker record assumptions you make to help you explain the results and drive business engagement and feedback.
Some common assumptions:
Use Info-Tech’s DRP BIA Scoring Context Example as a note-taking template.
You can’t build a perfect scoring scale. It’s fine to make reasonable assumptions based on your judgment and knowledge of the business. Just write down your assumptions. If you don’t write them down, you’ll forget how you arrived at that conclusion.
Once you’ve finished estimating the impact of downtime, use the following rough guideline to create an initial sort of applications into Tiers 1, 2, and 3.
Example: Highest total score is 12
The business must validate acceptable and appropriate RTOs and RPOs, but IT can use the guidelines below to set an initial estimate.
A shorter RTO typically requires higher investment. If a short period of downtime has minimal impact, setting a low RTO may not be justifiable. As downtime continues, impact begins to increase exponentially to a point where downtime is intolerable – an acceptable RTO must be shorter than this. Apply the same thinking to RPOs – how much data loss is unnoticeable? How much is intolerable?
Estimated Time: 30 minutes
RTO and RPO tiers simplify management by setting similar recovery goals for systems and applications with similar criticality.
Use the “Debate Space” approach to set appropriate and acceptable targets.
In general, the more critical the system, the shorter the RPO. But that’s not always the case. For example, a service bus might be Tier 1, but if it doesn’t store any data, RPO might be longer than other Tier 1 systems. Some systems may have a different RPO than most other systems in that tier. As long as the targets are acceptable to the business and appropriate given the impact, that’s okay.
Most organizations discover something new about key applications, or the way stakeholders use them, when they work through the BIA and review the results with stakeholders. For example:
The DRP Business Impact Analysis Tool helped structure stakeholder consultations on DR requirements for a large university IT department. Past consultations had become an airing of grievances. Using objective impact scores helped stakeholders stay focused and make informed decisions around appropriate RTOs and RPOs.
Estimated the business impact of downtime
Set recovery targets
Up Next:Conduct a tabletop planning exercise to establish current recovery capabilities
In a tabletop planning exercise, the DRP team walks through a disaster scenario to map out what should happen at each stage, and effectively defines a high-level incident response plan (i.e. recovery workflow).
Tabletop planning had the greatest impact on meeting recovery objectives (RTOs/RPOs) among survey respondents.
*Note: Relative importance indicates the contribution an individual testing methodology, conducted at least annually, had on predicting success meeting recovery objectives, when controlling for all other types of tests in a regression model. The relative-importance values have been standardized to sum to 100%.
Success was based on the following items:
Why is tabletop planning so effective?
The goal is to define a plan to restore applications and systems following a disruption. For your first tabletop exercise, Info-Tech recommends you use a non-life-threatening scenario that requires at least a temporary relocation of your data center (i.e. failing over to a DR site/environment). Assume a gas leak or burst water pipe renders the data center inaccessible. Power is shut off and IT must failover systems to another location. Once you create the master procedure, review the plan to ensure it addresses other scenarios.
When systems fail, you are faced with two high-level options: failover or recover in place. If you document the plan to failover systems to another location, you’ll have documented the core of your DR procedures. This differs from traditional scenario planning where you define separate plans for different what-if scenarios. The goal is one plan that can be adapted to different scenarios, which reduces the effort to build and maintain your DRP.
Estimated Time: 2-3 hours
Why use flowcharts?
Use the completed tabletop planning exercise results to build this workflow.
"We use flowcharts for our declaration procedures. Flowcharts are more effective when you have to explain status and next steps to upper management." – Assistant Director, IT Operations, Healthcare Industry
Source: Info-Tech Research Group Interview
For a formatted template you can use to capture your plan, see Info-Tech’s DRP Recovery Workflow Template.
For a completed example of tabletop planning results, review Info-Tech’s Case Study: Practical, Right-Sized DRP.
What’s my RPA? Consider the following case:
When identifying RPA, remember the following:
You are planning for a disaster scenario, where on-site systems may be inaccessible and any copies of data taken during the disaster may fail, be corrupt, or never make it out of the data center (e.g. if the network fails before the backup file ships). In the scenario above, it seems likely that off-site incremental backups could be restored, leading to a 24-hour RPA. However, if there were serious concerns about the reliability of the daily incrementals, the RPA could arguably be based on the weekly full backups.
The RPA is a commitment to the maximum data you would lose in a DR scenario with current capabilities (people, process, and technology). Pick a number you can likely achieve. List any situations where you couldn’t meet this RPA, and identify those for a risk tolerance discussion. In the example above, complete loss of the primary SAN would also mean losing the snapshots, so the last good copy of the data could be up to 24-hours old.
On the “Impact Analysis” tab in the DRP Business Impact Analysis Tool, enter the estimated maximum downtime and data loss in the RTA and RPA columns.
It’s okay to round numbers to the nearest shift, day, or week for simplicity (e.g. 24 hours rather than 22.5 hours, or 8 hours rather than 7.25 hours).
Estimated Time: 1 hour
As you start to consider scenarios where injuries or loss of life are a possibility, remember that health and safety risks are the top priority in a crisis. If there’s a fire in the data center, evacuating the building is the first priority, even if that means foregoing a graceful shut down. For more details on emergency response and crisis management, see Implement Crisis Management Best Practices.
Walk through your recovery workflow in the context of additional, different scenarios to ensure there are no gaps. Collaborate with your DR team to identify changes that might be required, and incorporate these changes in the plan.
| Scenario Type | Considerations |
| Isolated hardware/software failure |
|
| Power outage or network outage |
|
| Local hazard (e.g. chemical leak, police incident) |
|
| Equipment/building damage (e.g. fire, roof collapse) |
|
| Regional natural disasters |
|
Estimated Time: 1.5 hours
It’s about finding ways to solve the problem, not about solving the problem. When you’re brainstorming solutions to problems, don’t stop with the first idea, even if the solution seems obvious. The first idea isn’t always the best or only solution; other ideas can expand on and improve that first idea.
Is it practical to invest in greater geo-redundancy that meets RTOs and RPOs during a widespread event?
Info-Tech suggests you consider events that impact both sites, and your risk tolerance for that impact. Outline the impact of downtime at a high level if both the primary and secondary site were affected. Research how often events severe enough to have impacted both your primary and secondary sites have occurred in the past. What’s the business tolerance for this type of event?
A common strategy: have a primary and DR site that are close enough to support low RPO/RTO, but far enough away to mitigate the impact of known regional events. Back up data to a remote third location as protection against a catastrophic event.
Approach site selection as a project. Leverage Select an Optimal Disaster Recovery Deployment Model to structure your own site-selection project.
Use the DRP Roadmap Tool to create a high-level roadmap to plan and communicate DR action items and initiatives. Determine the data you’ll use to define roadmap items.
Estimated Time: 30 minutes
Outline your expected future state recovery flow to demonstrate improvements once projects and action items have been completed.
Estimated Time: time required will vary
Tabletop planning is an effective way to discover gaps in recovery capabilities. Identify issues in the tabletop exercise so you can manage them before disaster strikes. For example:
A client started to back up application data offsite. To minimize data transfer and storage costs, the systems themselves weren’t backed up. Working through the restore process at the DR site, the DBA realized 30 years of COBOL and SQR code – critical business functionality – wasn’t backed up offsite.
A 500-employee professional services firm realized its internet connection could be a significant roadblock to recovery. Without internet, no one at head office could access critical cloud systems. The tabletop exercise identified this recovery bottleneck and helped prioritize the fix on the roadmap.
Hospitals rely on their phone systems for system downtime procedures. A tabletop exercise with a hospital client highlighted that if the data center were damaged, the phone system would likely be damaged as well. Identifying this provided more urgency to the ongoing VOIP migration.
A small municipality relied on a local MSP to perform systems restore, but realized it had never tested the restore procedure to identify RTA. Contacting the MSP to review capabilities became a roadmap item to address this risk.
Outlined the DRP response and risks to recovery
Brainstormed risk mitigation measures
Up Next: Leverage the core deliverables to complete, extend, and maintain your DRP
Congratulations! You’ve completed the core DRP deliverables and made the case for investment in DR capabilities. Take a moment to celebrate your accomplishments.
This milestone is an opportunity to look back and look forward.
Use the completed, updated DRP Maturity Scorecard to demonstrate the value of your continuity program, and to help you decide where to focus next.
Estimated Time: 2 hours
| Score | A: How significant are the risks this initiative will mitigate? | B: How easily can we complete this initiative? | C: How cost-effective is this initiative? |
|---|---|---|---|
| 3: High | Critical impact on +50% of stakeholders, or major impact to compliance posture, or significant health/safety risk. | One sprint, can be completed by a few individuals with minor supervision. | Within the IT discretionary budget. |
| 2: Medium | Impacts <50% of stakeholders, or minor impact on compliance, or degradation to health or safety controls. | One quarter, and/or some increased effort required, some risk to completion. | Requires budget approval from finance. |
| 1: Low | Impacts limited to <25% of stakeholders, no impact on compliance posture or health/safety. | One year, and/or major vendor or organizational challenges. | Requires budget approval from the board of directors. |
You can use a similar scoring exercise to prioritize and schedule high-benefit, low-effort, low-cost items identified in the roadmap in phase 3.
Write out the table on a whiteboard (record the results in a spreadsheet for reference). In the case below, IT might decide to work on repeating the core methodology first as they create the active testing plans, and tackle process changes later.
| Initiative | A: How significant are the risks this initiative will mitigate? | B: How easily can we complete this initiative? | C: How cost-effective is this initiative? | Aggregate score (A x B x C) |
|---|---|---|---|---|
| Repeat the core methodology for all systems | 2 – will impact some stakeholders, no compliance or safety impact. | 2 – will require about 3 months, no significant complications. | 3 – No cost. | 12 |
| Add DR to project mgmt. and change mgmt. | 1 – Mitigates some recovery risks over the long term. | 1 – Requires extensive consultation and process review. | 3 – No cost. | 3 |
| Active failover testing on plan | 2 – Mitigates some risks; documentation and cross training is already in place. | 2 – Requires 3-4 months of occasional effort to prepare for test. | 2 – May need to purchase some equipment before testing. | 8 |
Find a pace that allows you to keep momentum going, but also leaves enough time to act on the initial findings, projects, and action items identified in the DRP Roadmap Tool. Include these initiatives in the Roadmap tool to visualize how identified initiatives fit with other tasks identified to improve your recovery capabilities.
| Sample Outputs |
|---|
| Add Tier 2 & 3 systems to the BIA. |
| Complete another tabletop exercise for Tier 2 & 3 systems recovery, and add the results to the recovery workflow. |
| Identify projects to close additional gaps in the recovery process. Add projects to the project roadmap. |
Use this example of a complete, practical, right-size DR plan to drive and guide your efforts.
| Sample Outputs |
|---|
| Three to five detailed systems recovery flowcharts/checklists. |
| Documented team roles, succession plans, and contact information. |
| Notification, assessment, and disaster declaration plan. |
| DRP summary. |
| Layer 1, 2 & 3 network diagrams. |
Use this example of a complete, practical, right-size DR plan to drive and guide your efforts.
| Sample Outputs |
|---|
| Application assessment for cloud DR. |
| TCO tool for different environments. |
| Solution decision and executive presentation. |
Use Info-Tech’s blueprint, Select the Optimal Disaster Recovery Deployment Model, to help you make sense of a world of choice for your DR site.
Risks and Challenges Mitigated
| Sample Outputs |
|---|
| Business process-focused BIA for one business unit. |
| Recovery workflows for one business unit. |
| Provisioning list for one business unit. |
| BCP project roadmap. |
Use Info-Tech’s blueprint, Develop a Business Continuity Plan, to develop and deploy a repeatable BCP methodology.
| Sample Outputs |
|---|
| DR testing readiness assessment. |
| Testing handbooks. |
| Test plan summary template. |
| DR test issue log and analysis tool. |
Uncover deficiencies in your recovery procedures by using Info-Tech’s blueprint Reduce Costly Downtime Through DR Testing.
| Sample Outputs |
|---|
| Reviewed and updated change, project, and performance management processes. |
| Reviewed and updated internal SLAs. |
| Reviewed and updated data protection and backup procedures. |
| Sample Outputs |
|---|
| A customized vendor DRP questionnaire. |
| Reviewed vendor SLAs. |
| Choose to keep or change service levels or vendor offerings based on findings. |
Identified progress against targets
Prioritized further initiatives
Added initiatives to the roadmap
Myth #1: DRPs need to focus on major events such as natural disasters and other highly destructive incidents such as fire and flood.
Reality: The most common threats to service continuity are hardware and software failures, network outages, and power outages.
Myth #2: Effective DRPs start with identifying and evaluating potential risks.
Reality: DR isn’t about identifying risks; it’s about ensuring service continuity.
Myth #3: DRPs are separate from day-to-day operations and incident management.
Reality: DR must be integrated with service management to ensure service continuity.
Myth #4: I use a co-lo or cloud services so I don’t have to worry about DR. That’s my vendor’s responsibility.
Reality: You can’t outsource accountability. You can’t just assume your vendor’s DR capabilities will meet your needs.
Myth #5: A DRP must include every detail so anyone can execute the recovery.
Reality: IT DR is not an airplane disaster movie. You aren’t going to ask a business user to execute a system recovery, just like you wouldn’t really want a passenger with no flying experience to land a plane.
Select the Optimal Disaster Recovery Deployment Model Evaluate cloud, co-lo, and on-premises disaster recovery deployment models.
Develop a Business Continuity Plan Streamline the traditional approach to make BCP development manageable and repeatable.
Prepare for a DRP Audit Assess your current DRP maturity, identify required improvements, and complete an audit-ready DRP summary document.
Document and Maintain Your Disaster Recovery Plan Put your DRP on a diet: keep it fit, trim, and ready for action.
Reduce Costly Downtime Through DR Testing Improve your DR plan and your team’s ability to execute on it.
Implement Crisis Management Best Practices An effective crisis response minimizes the impact of a crisis on reputation, profitability, and continuity.
BCI Editor’s Note: In most countries “incident” and “crisis” are used interchangeably, but in the UK the term “crisis” has been generally reserved for dealing with wide-area incidents involving Emergency Services. The BCI prefers the use of “incident” for normal BCM purposes. (Source: The Business Continuity Institute)
BCMpedia. “Recovery Objectives: RTO, RPO, and MTPD.” BCMpedia, n.d. Web.
Burke, Stephen. “Public Cloud Pitfalls: Microsoft Azure Storage Cluster Loses Power, Puts Spotlight On Private, Hybrid Cloud Advantages.” CRN, 16 Mar. 2017. Web.
Elliot, Stephen. “DevOps and the Cost of Downtime: Fortune 1000 Best Practice Metrics Quantified.” IDC, 2015. Web.
FEMA. Planning & Templates. FEMA, 2015. Web.
FINRA. “Business Continuity Plans and Emergency Contact Information.” FINRA, 2015. Web.
FINRA. “FINRA, the SEC and CFTC Issue Joint Advisory on Business Continuity Planning.” FINRA, 2013. Web.
Gosling, Mel, and Andrew Hiles. “Business Continuity Statistics: Where Myth Meets Fact.” Continuity Central, 2009. Web.
Hanwacker, Linda. “COOP Templates for Success Workbook.” The LSH Group, n.d. Web.
Homeland Security. Federal Information Security Management Act (FISMA). Homeland Security, 2015. Web.
Nichols, Shaun. “AWS's S3 Outage Was So Bad Amazon Couldn't Get Into Its Own Dashboard to Warn the World.” The Register, 1 Mar. 2017. Web.
Potter, Patrick. “BCM Regulatory Alphabet Soup.” RSA Archer Organization, 2012. Web.
Rothstein, Philip Jan. “Disaster Recovery Testing: Exercising Your Contingency Plan.” Rothstein Associates Inc., 2007. Web.
The Business Continuity Institute. “The Good Practice Guidelines.” The Business Continuity Institute, 2013. Web.
The Disaster Recovery Journal. “Disaster Resource Guide.” The Disaster Recovery Journal, 2015. Web.
The Disaster Recovery Journal. “DR Rules & Regulations.” The Disaster Recovery Journal, 2015. Web.
The Federal Financial Institution Examination Council (FFIEC). Business Continuity Planning. IT Examination Handbook InfoBase, 2015. Web.
York, Kyle. “Read Dyn’s Statement on the 10/21/2016 DNS DDoS Attack.” Oracle, 22 Oct. 2016. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Determine your business requirements and build your process to meet them.
Develop the specific procedures and tools required to assess vendor risk.
Implement the process and develop metrics to measure effectiveness.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand business and compliance requirements.
Identify roles and responsibilities.
Define the process.
Understanding of key goals for process outcomes.
Documented service that leverages existing processes.
1.1 Review current processes and pain points.
1.2 Identify key stakeholders.
1.3 Define policy.
1.4 Develop process.
RACI Matrix
Vendor Security Policy
Defined process
Determine methodology for assessing procurement risk.
Develop procedures for performing vendor security assessments.
Standardized, repeatable methodologies for supply chain security risk assessment.
2.1 Identify organizational security risk tolerance.
2.2 Develop risk treatment action plans.
2.3 Define schedule for re-assessments.
2.4 Develop methodology for assessing service risk.
Security risk tolerance statement
Risk treatment matrix
Service Risk Questionnaire
Develop procedures for performing vendor security assessments.
Establish vendor inventory.
Standardized, repeatable methodologies for supply chain security risk assessment.
3.1 Develop vendor security questionnaire.
3.2 Define procedures for vendor security assessments.
3.3 Customize the vendor security inventory.
Vendor security questionnaire
Vendor security inventory
Define risk treatment actions.
Deploy the process.
Monitor the process.
Understanding of how to treat different risks according to the risk tolerance.
Defined implementation strategy.
4.1 Define risk treatment action plans.
4.2 Develop implementation strategy.
4.3 Identify process metrics.
Vendor security requirements
Understanding of required implementation plans
Metrics inventory
Attractive a target, I do not make, hmmm? Yoda-speak with a slightly inquisitive tone, indicating that he means the opposite. And many (small) business owners also feel they are no target. But 61% of SMBs were attacked already. And large corporations also still have a ways to go.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Obtain organizational buy-ins and build a standardized and formal cloud testing strategy.
Assess your people, process, and technology for cloud testing readiness and realize areas for improvement.
Organize and monitor cloud project planning tasks throughout the project's duration.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This phase will walk you through the following activities:
This phase will help you customize Level 1 Project Gates with appropriate roles and responsibilities.
This phase will help you customize Level 2 Project Gates with appropriate roles and responsibilities.
This phase will help you customize Level 3 Project Gates with appropriate roles and responsibilities. It will also help you determine next steps and milestones for the adoption of the new process.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the role of gating and why we need it.
Determine what projects will follow the gating process and how to classify them.
Establish the role of the project sponsor throughout the entire project lifecycle.
Get stakeholder buy-in for the process.
Ensure there is a standard leveling process to determine size, risk, and complexity of requests.
Engage the project sponsor throughout the portfolio and project processes.
1.1 Project Gating Review
1.2 Establish appropriate project levels
1.3 Define the role of the project sponsor
Project Intake Classification Matrix
Project Sponsor Role Description Template
This phase will help you customize Level 1 Project Gates with appropriate roles and responsibilities.
Create a lightweight project gating process for small projects.
2.1 Review level 1 project gating process
2.2 Determine what gates should be part of your custom level 1 gating process
2.3 Establish required artifacts for each gate
2.4 Define the stakeholder’s roles and responsibilities at each gate
Documented outputs in the Project Gating Strategic Template
This phase will help you customize Level 2 Project Gates with appropriate roles and responsibilities.
Create a heavier project gating process for medium projects.
3.1 Review level 2 project gating process
3.2 Determine what gates should be part of your custom level 2 gating process
3.3 Establish required artifacts for each gate
3.4 Define the stakeholder’s roles and responsibilities at each gate
This phase will help you customize Level 3 Project Gates with appropriate roles and responsibilities.
Come up with a roadmap for the adoption of the new project gating process.
Create a comprehensive project gating process for large projects.
4.1 Review level 3 project gating process
4.2 Determine what gates should be part of your custom level 3 gating process
4.3 Establish required artifacts for each gate
4.4 Define the stakeholder’s roles and responsibilities at each gate
4.5 Determine next steps and milestones for process adoption
Documented outputs in the Project Gating Strategic Template
Documented Project Gating Reference Document for all stakeholders
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Determine your organization’s rationale for cloud adoption and what that means for your security obligations.
Use the Cloud Security CAGI Tool to perform four unique assessments that will be used to identify secure cloud vendors.
Learn how to assess and communicate with cloud vendors with security in mind.
Turn your security requirements into specific tasks and develop your implementation roadmap.
Build the organizational structure of your cloud security governance program.
The current global situation, marked by significant trade tensions and retaliatory measures between major economic powers, has elevated the importance of more detailed, robust, and executable exit plans for businesses in nearly all industries. The current geopolitical headwinds create an unpredictable environment that can severely impact supply chains, technology partnerships, and overall business operations. What was once a prudent measure is now a critical necessity – a “burning platform” – for ensuring business continuity and resilience.
Here I will delve deeper into the essential components of an effective exit plan, outline the practical steps for its implementation, and explain the crucial role of testing in validating its readiness.
Organizations that take data seriously should:
Analytics is a journey, not a destination. This journey can eventually result in some level of sophisticated AI/machine learning in your organization. Every organization needs to mobilize its resources and enhance its analytics capabilities to quickly and incrementally add value to data products and services. However, most organizations fail to mobilize their resources in this way.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This phase helps you understand your organization's data landscape and current analytics environment so you gain a deeper understanding of your future analytics needs.
This phase introduces you to data operating model frameworks and provides a step-by-step guide on how to capture the right analytics operating model for your organization.
This phase helps you implement your chosen analytics operating model, as well as establish an engagement model and communications plan.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Achieve a clear understanding and case for data analytics.
A successful analytics operating model starts with a good understanding of your analytical needs.
1.1 Review the business context.
1.2 Understand your analytics needs.
1.3 Draft analytics ideas and use cases.
1.4 Capture minimum viable analytics.
Documentation of analytics products and services
Achieve a clear understanding of your organization's analytics capability and mapping across organizational functions.
Understand your organization's data landscape and current analytics environment to gain a deeper understanding of your future analytics needs.
2.1 Capture your analytics capabilities.
2.2 Map capabilities to a hub-and-spoke model.
2.3 Document operating model results.
Capability assessment results
Capture the right analytics operating model for your organization.
Explore data operating model frameworks.
Capture the right analytics operating model for your organization using a step-by-step guide.
3.1 Discuss your operating model results.
3.2 Review your organizational structure’s pros and cons.
3.3 Map resources to target structure.
3.4 Brainstorm initiatives to develop your analytics capabilities.
Target operating model
Formalize your analytics organizational structure and prepare to implement your chosen analytics operating model.
Implement your chosen analytics operating model.
Establish an engagement model and communications plan.
4.1 Document your target organizational structure and RACI.
4.2 Establish an analytics engagement model.
4.3 Develop an analytics communications plan.
Reporting and analytics responsibility matrix (RACI)
Analytics engagement model
Analytics communications plan
Analytics organizational chart
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Assist your employees in setting appropriate development goals.
Review existing and identify new development activities that employees can undertake to achieve their goals.
Establish manager and employee follow-up accountabilities.
The most successful organizations recognize that learning is critical to adjusting quickly and effectively to their new reality. This requires L&D to reimagine their approach to deliver learning that enables the organization’s immediate and evolving priorities.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Involve key stakeholders, identify immediate priorities, and conduct high-level triage of L&D.
Determine learning needs and ability to realistically deliver learning. Leverage existing or curate learning content that can support learning needs.
Identify technical requirements for the chosen delivery method and draft a four- to six-week action plan.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Engage in purposeful and effective PPM deployment planning by clearly defining what to prepare and when exactly it is time to move from planning to execution.
Provide clearer definition to specific project-related functional requirements and collect the appropriate PPM data needed for an effective PPM suite deployment facilitated by vendors/consultants.
Provide clearer definition to specific resource management functional requirements and data and create a communication and training plan.
Plan how to engage vendors/consultants by communicating functional requirements to them and evaluating changes to those requirements proposed by them.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Select a preparation team and establish clear assignments and accountabilities.
Establish clear deliverables, milestones, and metrics to ensure it is clear when the preparation phase is complete.
Preparation activities will be organized and purposeful, ensuring that you do not threaten deployment success by being underprepared or waste resources by overpreparing.
1.1 Overview: Determine appropriate functional requirements to define and data to record in preparation for the deployment.
1.2 Create a timeline.
1.3 Create a charter for the PPM deployment preparation project: record lessons learned, establish metrics, etc.
PPM Suite Deployment Timeline
Charter for the PPM Suite Preparation Project Team
Collect and organize relevant project-related data so that you are ready to populate the new PPM suite when the vendor/consultant begins their professional implementation engagement with you.
Clearly define project-related functional requirements to aid in the configuration/customization of the tool.
An up-to-date and complete record of all relevant PPM data.
Avoidance of scrambling to find data at the last minute, risking importing out-of-date or irrelevant information into the new software.
Clearly defined functional requirements that will ensure the suite is configured in a way that can be adoption in the long term.
2.1 Define project phases and categories.
2.2 Create a list of all projects in progress.
2.3 Record functional requirements for project requests, project charters, and business cases.
2.4 Create a list of all existing project requests.
2.5 Record the current project intake processes.
2.6 Define PPM dashboard and reporting requirements.
Project List (basic)
Project Request Form Requirements (basic)
Scoring/Requirements (basic)
Business Case Requirements (advanced)
Project Request List (basic)
Project Intake Workflows (advanced)
PPM Reporting Requirements (basic)
Collect and organize relevant resource-related data.
Clearly define resource-related functional requirements.
Create a purposeful transition, communication, and training plan for the deployment period.
An up-to-date and complete record of all relevant PPM data that allows your vendor/consultant to get right to work at the start of the implementation engagement.
Improved buy-in and adoption through transition, training, and communication activities that are tailored to the actual needs of your specific organization and users.
3.1 Create a portfolio-wide roster of project resources (and record their competencies and skills, if appropriate).
3.2 Record resource management processes and workflows.
3.3 Create a transition plan from existing PPM tools and processes to the new PPM suite.
3.4 Identify training needs and resources to be leveraged during the deployment.
3.5 Define training requirements.
3.6 Create a PPM deployment training plan.
Resource Roster and Competency Profile (basic)
User Roles and Permissions (basic)
Resource Management Workflows (advanced)
Transition Approach and Plan (basic)
Data Archiving Requirements (advanced)
List of Training Modules and Attendees (basic)
Internal Training Capabilities (advanced)
Training Milestones and Deadlines (basic)
Compile the data collected and the functional requirements defined so that they can be provided to the vendor and/or consultant before the implementation engagement.
Deliverables that record the outputs of your preparation and can be provided to vendors/consultants before the implementation engagement.
Ensures that the customer is an active and equal partner during the deployment by having the customer prepare their material and initiate communication.
Vendors and/or consultants have a clear understanding of the customer’s needs and expectations from the beginning.
4.1 Collect, review, and finalize the functional requirements.
4.2 Compile a functional requirements and data package to provide to the vendor and/or consultants.
4.3 Discuss how proposed changes to the functional requirements will be reviewed and decided.
PPM Suite Functional Requirements Documents
PPM Deployment Data Workbook
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Set the right resource management approach for your team and create a realistic estimate of your resource supply and organizational demand.
Build a resource management process to ensure data accuracy and sustainability, and make the best tool selection to support your processes.
Develop a plan to pilot your resource management processes to achieve maximum adoption, and anticipate challenges that could inhibit you from keeping supply and demand continually balanced.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Obtain a high-level view of current resource management practices.
Identify current and target states of resource management maturity.
Perform an in-depth time-tracking audit and gain insight into how time is spent on project versus non-project work to calculate realized capacity.
Assess current distribution of accountabilities in resource management.
Delve into your current problems to uncover root causes.
Validate capacity and demand estimations with a time-tracking survey.
1.1 Perform a root-cause analysis of resourcing challenges facing the organization.
1.2 Create a realistic estimate of project capacity.
1.3 Map all sources of demand on resources at a high level.
1.4 Validate your supply and demand assumptions by directly surveying your resources.
Root-cause analysis
Tab 2 of the Resource Management Supply-Demand Calculator, the Time Audit Workbook, and survey templates
Tabs 3 and 4 of the Resource Management Supply-Demand Calculator
Complete the Time Audit Workbook
Construct a resource management strategy that aligns with your team’s process maturity levels.
Determine the resource management tool that will best support your processes.
2.1 Action the decision points in Info-Tech’s seven dimensions of resource management.
2.2 Review resource management tool options, and depending on your selection, prepare a vendor demo script or review and set up Info-Tech’s Portfolio Manager Lite.
2.3 Customize a workflow and process steps within the bounds of your seven dimensions and informed by your tool selection.
A wireframe for a right-sized resource management strategy
A vendor demo script or Info-Tech’s Portfolio Manager Lite.
A customized resource management process and Resource Management Playbook.
Develop a plan to pilot your new processes to test whether you have chosen the right dimensions for maintaining resource data.
Develop a communication plan to guide you through the implementation of the strategy and manage any resistance you may encounter.
Identify and address improvements before officially instituting the new resource management strategy.
Identify the other factors that affect resource productivity.
Implement a completed resource management solution.
3.1 Develop a pilot plan.
3.2 Perform a resource management start/stop/continue exercise.
3.3 Develop plans to mitigate executive stakeholder, team, and structural factors that could inhibit your implementation.
3.4 Finalize the playbook and customize a presentation to help explain your new processes to the organization.
Process Pilot Plan Template
A refined resource management process informed by feedback and lessons learned
Stakeholder management plan
Resource Management Communications Template
"Who gets in trouble at the organization when too many projects are approved?
We’ve just exited a period of about 20-25 years where the answer to the above question was usually “nobody.” The officers of the corporation held nobody to account for the malinvestment of resources that comes from approving too many projects or having systemically unrealistic project due dates. Boards of directors failed to hold the officers accountable for that. And shareholders failed to hold boards of directors accountable for that.
But this is shifting right under our feet. Increasingly, PMOs are being managed with the mentality previously reserved for those in the finance department. In many cases, the PMOs are now reporting to the CFO! This represents a very simple and basic reversion to the concept of fiduciary duty: somebody will be held to account for the consumption of all those hours, and somebody should be the approver of projects who created the excess demand." – Barry Cousins Senior Director of Research, PMO Practice Info-Tech Research Group
Info-Tech Insight
Organizations tend to bite off more than they can chew when it comes to project and service delivery commitments involving IT resources.
While the need for businesses to make an excess of IT commitments is understandable, the impacts of systemically overallocating IT are clearly negative:
76% of organizations say they have too many projects on the go and an unmanageable and ever-growing backlog of things to get to. (Cooper, 2014)
Almost 70% of workers feel as though they have too much work on their plates and not enough time to do it. (Reynolds, 2016)
Traditional approaches to resource management suffer from a fundamental misconception about the availability of time in 2017.
The concept of resource management comes from a pre-World Wide Web era, when resource and project plans could be based on a relatively stable set of assumptions.
In the old paradigm, the availability of time was fairly predictable, as was the demand for IT services, so there was value to investing time into rigorous demand forecasts and planning.
Resource projections could be based in a secure set of assumptions – i.e. 8 hour days, 40 hour weeks – and staff had the time to support detailed resource management processes that provided accurate usage data.
96% of organizations report problems with the accuracy of information on employee timesheets. (Dimensional, 2013)
Part of the old resource management mythology is the idea that a person can do (for example) eight different one-hour tasks in eight hours of continuous work. This idea has gone from harmlessly mistaken to grossly unrealistic.
The predictability and focus have given way to more chaotic workplace realities. Technology is ubiquitous, and the demand for IT services is constant.
A day in IT is characterized by frequent task-switching, regular interruptions, and an influx of technology-enabled distractions.
Every 3 minutes and 5 seconds: How often the typical office worker switches tasks, either through self-directed or other-directed interruptions. (Schulte, 2015)
12 minutes, 40 seconds: The average amount of time in-between face-to-face interruptions in matrix organizations. (Anderson, 2015)
23 minutes, 15 seconds: The average amount of time it takes to become on task, productive, and focused again after an interruption. (Schulte, 2015)
759 hours: The average number of hours lost per employee annually due to distractions and interruptions. (Huth, 2015)
The validity of traditional, rigorous resource planning has long been an illusion. New realities are making the sustained focus and stable assumptions that old reality projections relied on all but impossible to maintain.
The technology revolution that began in the 1990s ushered in a new paradigm in organizational structures. Matrix reporting structures, diminished supervision of knowledge workers, massive multi-tasking, and a continuous stream of information and communications from the outside world have smashed the predictability and stability of the old paradigm.
The resource management industry has largely failed to evolve. It remains stubbornly rooted in old realities, relying on calculations and rollups that become increasingly unsustainable and irrelevant in our high-autonomy staff cultures and interruption-driven work days.
87% of organizations report challenges with traditional methods of time tracking and reporting. (Dimensional, 2013)
40% of working time is not tracked or tracked inaccurately by staff. (actiTIME, 2016)
Research shows that ineffective resource management directly impacts an organization’s bottom line, contributing to such cost drains as the systemic late delivery of projects and increased project costs.
Despite this, the majority of organizations fail to treat staff time like the precious commodity it is.
As the results of a 2016 survey show, the top three pain points for IT and PMO leaders all revolve around a wider cultural negligence concerning staff time (Alexander, TechRepublic, 2016):
Inability to complete projects on time – 52%
Inability to innovate fast enough – 39%
Increased project costs – 38%
Missed business opportunities – 34%
Dissatisfied customers or clients – 32%
12 times more waste – Organizations with poor resource management practices waste nearly 12 times more resource hours than high-performing organizations. (PMI, 2014)
In many ways, no question is more important to the organization’s bottom line – and certainly, to the effectiveness of a resource management strategy.
Historically, the answer would have been the executive layer of the organization. However, in the 1990s management largely abdicated its obligation to control resources and expenditures via “employee empowerment.”
Controls on approvals became less rigid, and accountability for choosing what to do (and not do) shifted onto the shoulders of the individual worker. This creates a current paradigm where no one is accountable for the malinvestment…
…of resources that comes from approving too many projects. Instead, it’s up to individual workers to sink-or-swim, as they attempt to reconcile, day after day, seemingly infinite organizational demand with their finite supply of working hours.
If your organization has higher demand (i.e. approved project work) than supply (i.e. people’s time), your staff will be the final decision makers on what does and does NOT get worked on.
"Everything requires time… It is the one truly universal condition. All work takes place in time and uses up time. Yet most people take for granted this unique, irreplaceable and necessary resource. Nothing else, perhaps, distinguishes effective executives as much as their tender loving care of time." – Peter Drucker (quoted in Frank)
67% of employees surveyed believe their CEOs focus too much on decisions based in short-term financial results and not enough time on decisions that create a stable, positive workplace for staff. (2016 Edelman Trust Barometer)
Realistic project resource management starts by aligning demand with capacity, and then developing tactics to sustain alignment, even in the chaos of our fast-paced, rapidly changing, interruption-driven project environments.
This blueprint will help you develop practices to promote and maintain accurate resourcing data, while developing tactics to continually inform decision makers’ assumptions about how much capacity is realistically available for project work.
This research follows a three-phase approach to sustainable practices:
Info-Tech’s three-phase framework is structured around a practical, tactical approach to resource management. It’s not about what you put together as a one-time snapshot. It’s about what you can and will maintain every week, even during a crisis. When you stop maintaining resource management data, it’s nearly impossible to catch up and you’re usually forced to start fresh.
How much time is available for projects once non-project demands are factored in?
How often is the allocation data verified, reconciled, and reported for use?
How far into the future can you realistically predict resource supply?
To whom is time allocated?
How long is each allocation period?
What’s the smallest unit of time to allocate?
What is time allocated to?
This blueprint will help you make the right decisions for your organization across each of these dimensions to ensure your resource management practices match your current process maturity levels.
Developing a process is one thing, sustaining it is another.
The goal of this research isn’t just to achieve a one-time balancing of workloads and expect that this will stand the test of time.
The true test of a resource management process is how well it facilitates the flow of accurate and usable data as workloads become chaotic, and fires and crises erupt.
Sample “rebalancing” routine
Resource management depends on the flow of information and data from the project level up to functional managers, project managers, and beyond – CIOs, steering committees, and senior executives.
Tools are required to help plan, organize, and facilitate this flow, and each phase of this blueprint is centered around tools and templates to help you successfully support your process implementation.
Tools and Templates:
Tools and Templates:
Tools and Templates:
While homegrown solutions like spreadsheets and intranet sites lack the robust functionality of commercial offerings, they have dramatically lower complexity and cost-in-use.
Info-Tech’s Portfolio Manager Lite is a sophisticated, scalable, and highly customizable spreadsheet-based solution that will get your new resource management process up and running, without a heavy upfront cost.
Homemade – 46%
Commercial – 33%
No Solution – 21%
(Info-Tech Research Group (2016), N=433)
Samples of Portfolio Manager Lite's output and reporting tabs
Resource management is one capability within Info-Tech’s larger project portfolio management (PPM) framework.
Resource visibility and capacity awareness permeates the whole of PPM, helping to ensure the right intake decisions get made, and projects are scheduled according to resource and skill availability.
Whether you have an existing PPM strategy that you are looking to optimize or you are just starting on your PPM journey, this blueprint will help you situate your resource management processes within a larger project and portfolio framework.
Info-Tech’ s PPM framework is based on extensive research and practical application, and complements industry standards such as those offered by PMI and ISACA.
| Project Portfolio Management | ||||
|---|---|---|---|---|
| Status & Progress Reporting | ||||
| Intake, Approval, & Prioritization | Resource Management | Project Management | Project Closure | Benefits Tracking |
| Organizational Change Management | ||||
| Intake → | Execution→ | Closure | ||
Improved resource management and capacity awareness will allow your organization to improve resource utilization and increase project throughput.
CIOs, PMOs, and portfolio managers can use this blueprint to improve the alignment between supply and demand. You should be able to gauge the value through the following metrics:
Near-Term Success Metrics (6 to 12 months)
Long-Term Success Metrics (12 to 24 months)
In the past 12 months, Info-Tech clients have reported an average measured value rating of $550,000 from the purchase of workshops based on this research.
Industry Education
Source Info-Tech Client
Situation
Complication
“We’re told we can’t say NO to projects. But this new tool set and approach allows us to give an informed WHEN.” – Senior PMO Director, Education
Resolution
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
| 1. Take Stock of Organizational Supply and Demand | 2. Design a Realistic Resource Management Process | 3. Implement Sustainable Resource Management Practices | |
|---|---|---|---|
| Best-Practice Toolkit |
1.1 Set a resource management course of action 1.2 Create realistic estimates of supply and demand |
2.1 Customize the seven dimensions of resource management 2.2 Determine the resource management tool that will best support your process 2.3 Build process steps to ensure data accuracy and sustainability |
3.1 Pilot your resource management process to assess viability 3.2 Plan to engage your stakeholders with your playbook |
| Guided Implementations |
|
|
|
| Onsite Workshop |
Module 1:
|
Module 2:
|
Module 3:
|
|
Phase 1 Outcome:
|
Phase 2 Outcome:
|
Phase 3 Outcome:
|
Contact your account representative or email Workshops@InfoTech.com for more information.
| Workshop Day 1 | Workshop Day 2 | Workshop Day 3 | Workshop Day 4 | Workshop Day 5 | |
|---|---|---|---|---|---|
| Activities |
Introduction to PPM and resource management 1.1 Complete and review PPM Current State Scorecard Assessment 1.2 Perform root cause analysis of resource management challenges 1.3 Initiate time audit survey of management and staff |
Take stock of supply and demand 2.1 Review the outputs of the time audit survey and analyze the data 2.2 Analyze project and non-project demands, including the sources of those demands 2.3 Set the seven dimensions of resource management |
Design a resource management process 3.1 Review resource management tool options 3.2 Prepare a vendor demo script or review Portfolio Manager Lite 3.3 Build process steps to ensure data accuracy and sustainability |
Pilot and refine the process 4.1 Define methods for piloting the strategy (after the workshop) 4.2 Complete the Process Pilot Plan Template 4.3 Conduct a mock resource management meeting 4.4 Perform a RACI exercise |
Communicate and implement the process 5.1 Brainstorm potential implications of the new strategy and develop a plan to manage stakeholder and staff resistance to the strategy 5.2 Customize the Resource Management Communications Template 5.3 Finalize the playbook |
| Deliverables |
|
|
|
|
|
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion (in weeks): 1-2 weeks
Start with an analyst kick-off call:
Then complete these activities…
Review findings with analyst:
Then complete these activities…
With these tools & templates:
Phase 1 Results & Insights:
A matrix organization creates many small, untraceable demands that are often overlooked in resource management efforts, which leads to underestimating total demand and overcommitting resources. To capture them and enhance the success of your resource management effort, focus on completeness rather than precision. Precision of data will improve over time as your process maturity grows.
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
A profound imbalance between demand (i.e. approved project work and service delivery commitments) and supply (i.e. people’s time) is the top challenge IT departments face today..
In today’s organizations, the desires of business units for new products and enhancements, and the appetites of senior leadership to approve more and more projects for those products and services, far outstrip IT’s ability to realistically deliver on everything.
The vast majority of IT departments lack the resourcing to meet project demand – especially given the fact that day-to-day operational demands frequently trump project work.
As a result, project throughput suffers – and with it, IT’s reputation within the organization.
Info-Tech Insight
Where does the time go? The portfolio manager (or equivalent) should function as the accounting department for time, showing what’s available in IT’s human resources budget for projects and providing ongoing visibility into how that budget of time is being spent.
As the results of a recent survey* show, the top three pain points for IT and PMO leaders all revolve around a wider cultural negligence concerning staff time:
A resource management strategy can help to alleviate these pain points and reconcile the imbalance between supply and demand by achieving the following outcomes:
Inability to complete projects on time – 52%
Inability to innovate fast enough – 39%
Increased project costs – 38%
Missed business opportunities – 34%
Dissatisfied customers or clients – 32%
12 times more waste – Organizations with poor resource management practices waste nearly 12 times more resource hours than high-performing organizations. (PMI, 2014)
Project portfolio management (PPM) creates a stable and secure infrastructure around projects.
PPM’s goal is to maximize the throughput of projects that provide strategic and operational value to the organization. To do this, a PPM strategy must help to:
| Info-Tech's Project Portfolio Management Process Model | ||||
|---|---|---|---|---|
| 3. Status & Progress Reporting [make sure the projects are okay] | ||||
| 1. Intake, Approval, & Prioritization [select the right projects] | 2. Resource Management [Pick the right time and people to execute the projects | Project Management |
4. Project Closure [make sure the projects get done] |
5. Benefits Tracking [make sure they were worth doing] |
| Organizational Change Management | ||||
| Intake → | Execution→ | Closure | ||
If you don’t yet have a PPM strategy in place, or would like to revisit your existing PPM strategy before implementing resource management practices, see Info-Tech’s blueprint, Develop a Project Portfolio Management Strategy.
To support the goals of PPM more generally, resource management must (1) supply quality work-hours to approved and ongoing projects, and (2) supply reliable data with which to steer the project portfolio.
To do this, a resource management strategy must address a relatively straightforward set of questions.
"In matrix organizations, complicated processes and tools get implemented to answer the deceptively simple question “what’s Bob going to work on over the next few months?” Inevitably, the data captured becomes the focus of scrutiny as functional and project managers complain about data inaccuracy while simultaneously remaining reluctant to invest the effort necessary to improve quality." – Kiron Bondale
1.1.1
10 minutes
Kick-off the discussion on the resource management process by deciding which capability level most accurately describes your organization’s current state.
| Capability Level Descriptions | |
|---|---|
| Capability Level 5: Optimized | Our organization has an accurate picture of project versus non-project workloads and allocates resources accordingly. We periodically reclaim lost capacity through organizational and behavioral change. |
| Capability Level 4: Aligned | We have an accurate picture of how much time is spent on project versus non-project work. We allocate resources to these projects accordingly. We are checking in on project progress bi-weekly. |
| Capability Level 3: Pixelated | We are allocating resources to projects and tracking progress monthly. We have a rough estimate of how much time is spent on project versus non-project work. |
| Capability Level 2: Opaque | We match resource teams to projects and check in annually, but we do not forecast future resource needs or track project versus non-project work. |
| Capability Level 1: Unmanaged | Our organization expects projects to be finished, but there is no process in place for allocating resources or tracking project progress. |
In a matrix organization, demands on a resource’s time come from many directions, each demand unaware of the others. Resources are expected to prioritize their work, but they typically lack the authority to formally reject demand, so demand frequently outstrips the supply of work-hours the resource can deliver.
When this happens, the resource has three options:
The result is an unsustainable system for those involved:
Resource management boils down to a seemingly simple question: how do we balance supply and demand? Balancing requires a decision maker to make choices; however, in a matrix organization, identifying this decision maker is not straightforward:
The individual who has the authority to make choices, and who is ultimately liable for those decisions, is an accountable person. In a matrix organization, accountability is dispersed, sometimes spilling over to those without the necessary authority.
The responsible party is the individual (or group) who actually completes the task.
Responsibility can be shared.
The accountable person is the individual who has the authority to make choices, and is ultimately answerable for the decision.
Accountability cannot be shared.
Resources often do not have the necessary scope of authority to make resource management choices, so they can never be truly accountable for the project portfolio. Instead, resources are accountable for making available trustworthy data, so the right people can make choices driven by organizational strategy.
The next activity will assess how accountability for resource management is currently distributed in your organization.
1.1.2
15 minutes
Below is a list of tasks in resource management that require choices. Discuss who is currently accountable and whether they have the right authority and ability to deliver on that accountability.
| Resource management tasks that require choices | Accountability | |
|---|---|---|
| Current | Effective? | |
| Identify all demands on resources | ||
| Prioritize identified project demands | ||
| Prioritize identified operational demands | ||
| Prioritize identified administrative demands | ||
| Prioritize all of the above demands | ||
| Enumerate resource supply | ||
| Validate resource supply | ||
| Collect and validate supply and demand data | ||
| Defer or reject work beyond available supply | ||
| Adjust resource supply to meet demand | ||
IT departments need many different technical skill sets at their disposal for their day-to-day operations and services, as well as for projects. A limited hiring budget for IT restricts the number of hires with any given skill, forcing IT to share resources between service and project portfolios.
This resource sharing produces a matrix organization divided along the lines of service and projects. Functional and project managers provide respective oversight for services and projects. Resources split their available work-hours toward service and project tasks according to priority – in theory.
However, in practice, two major challenges exist:
Because resource managers must cover both projects and services within IT, the typical solution to allocation problems in matrix organizations is to escalate the urgency and severity of demands by involving the executive steering committee. Unfortunately, the steering committee cannot expend time and resources on all demands. Instead, they often set a minimum threshold for cases – 100-1,000 work-hours depending on the organization.
Under this resource management practice, small demands – especially the quick-fixes and little projects from “the third boss” – continue to erode project capacity. Eventually, projects fail to get resources because pesky small demands have no restrictions on the resources they consumed.
Realistic resource management needs to account for demand from all three bosses; however…
Info-Tech Insight
Excess project or service request intake channels lead to the proliferation of “off-the-grid” projects and tasks that lack visibility from the IT leadership. This can indicate that there may be too much red tape: that is, the request process is made too complex or cumbersome. Consider simplifying the request process and bring IT’s visibility into those requests.
1.1.3
30 minutes to 1 hour
| People | Processes | Technology |
|---|---|---|
|
|
|
The following is a non-exhaustive example:
If precise, accurate, and complete data on resource supply and demand was consistently available, reporting on project capacity would be easy. Such data would provide managers complete control over a resource’s time, like a foreman at a construction site. However, this theoretical scenario is incompatible with today’s matrixed workplace:
Collecting and maintaining resource data is therefore nearly impossible:
This blueprint will guide you through right-sizing your resource management efforts to achieve maximum value-to-effort ratio and sustainability.
Portfolio managers looking for a resource management solution have three mutually exclusive options:
This blueprint takes you through the steps necessary to accomplish Option C, using Info-Tech’s tools and templates for managing your resources.
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
Use Info-Tech’s Resource Management Supply-Demand Calculator to create a realistic estimate of your project capacity.
The calculator tool requires minimal upfront staff participation: you can obtain meaningful results with participation from even a single person, with insight on the distribution of your resources and their average work week or month. As the number of participants increases, the quality of analysis will improve.
The first half of this step guides you through how to use the calculator. The second half provides tactical advice on how to gather additional data and validate your resourcing data with your staff.
Download Info-Tech’s Resource Management Supply-Demand Calculator
Info-Tech Insight
What’s first, process or tools? Remember that process determines the quality of your data while data quality limits the tool’s utility. Without quality data, you cannot evaluate the success of the tool, so nail down your collection process first.
1.2.1
30 minutes - 1 hour
A realistic estimate of project capacity
Resource Management Supply-Demand Calculator
We define four high-level buckets of resource time:
Instructions for working through Tab 2 of the Resource Management Supply-Demand Calculator are provided in the next two sections. Follow along to obtain your breakdown of annual resource capacity in a pie chart.
1.2.1
Resource Management Supply-Demand Calculator, Tab 2: Capacity Supply
Discover how many work-hours are at your disposal by first accounting for absences.
Hours per Year represents your total resource capacity for each role, as well as the entire department. This column is automatically calculated.
Working Time per Year represents your total resource capacity minus time employees are expected to spend out of office. This column is automatically calculated.
Info-Tech Insight
Example for a five-day work week:
Result: 7.4/52 weeks’ absence = 14.2%
1.2.1
Resource Management Supply-Demand Calculator, Tab 2: Capacity Supply
5. Enter the percentage of working time across each role that, on an annual basis, goes toward administrative duties (non-project meetings, training, time spent checking email, etc.) and keep-the-lights-on work (e.g. support and maintenance work).
While these percentages will vary by individual, a high-level estimate across each role will suffice for the purposes of this activity.
6. Express how confident you are in each resource being able to deliver the calculated project work hours in percentages.
Another interpretation for supply confidence is “supply control”: estimate your current ability to control this distribution of working time to meet the changing needs in percentages.
Percentage of your working time that goes toward project work is calculated based upon what’s left after your non-project working time allocations have been subtracted.
1.2.2
15 minutes - 30 minutes
A realistic estimate of resource demand from your project portfolio
Resource Management Supply-Demand Calculator
Estimating the resources required for a project in a project backlog can take a lot of effort. Rather than trying to create an accurate estimate for each project, a set of standard project sizes (often referred to as the “T-shirt sizing” technique) will be sufficiently accurate for estimating your project backlog’s overall demand.
Instructions for working through Tab 3 of the tool are provided here and in the next section.
1. For each type of project, enter the average number for work-hours.
| Project Types | Average Number of Work Hours for a Project |
|---|---|
| Small | 80 |
| Medium | 200 |
| Large | 500 |
| Extra-Large | 1000 |
1.2.2
Resource Management Supply-Demand Calculator, Tab 3: Project Demand
2. Using your list of projects, enter the number of projects for each appropriate field.
3. Enter your resource waste data from the PPM Current State Scorecard (see next section). Alternatively, enter your best guess on how much project capacity is spent wastefully per category.
Info-Tech Insight
The calculator estimates the project demand by T-shirt-sizing the work-hours required by projects to be delivered within the next 12 months and then adding the corresponding wasted capacity. This may be a pessimistic estimate, but it is more realistic because projects tend to be delivered late more than early.
Call 1-888-670-8889 or contact your Account Manager for more information.
Info-Tech’s PPM Current State Scorecard diagnostic provides a comprehensive view of your portfolio management strengths and weaknesses, including project portfolio management, project management, customer management, and resource utilization.
Use the wisdom-of-the-crowd to estimate resource waste in:
50% of PPM resource is wasted on average, effectively halving your available project capacity.
1.2.3
45 minutes - 1 hour
Documented non-project demands and their estimated degree of fluctuation
Resource Management Supply-Demand Calculator
When discussing project demands, non-project demands (administrative and operational) are often underestimated and downplayed – even though, in reality, they take a de facto higher priority to project work. Use Tab 4 of the tool to document these non-project demands, as well as their sources.
1. Choose a role using a drop-down list.
2. Enter the type and the source of the demand.
3. Enter the size and the frequency of the demand in hours.
4. Estimate how stable the non-project demands are for each role.
1.2.4
30 minutes - 1 hour
Completed Resource Management Supply-Demand Calculator
Supply-Demand Analysis Report
Resource Management Supply-Demand Calculator
Tab 5 of the calculator is a report that contains the following analysis:
Each analysis is described and explained in the following four sections. Examine the report and discuss the following among the activity participants:
1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis
The top of the report on Tab 5 shows a breakdown of your annual resource supply and demand, with resource capacity shown in both total hours and percentage of the total. For the purposes of the analysis, absence is averaged. If total demand is less than available resource supply, the surplus capacity will be displayed as “Free Capacity” on the demand side.
The Supply & Demand Analysis table displays the realistic project capacity, which is calculated by subtracting non-project supply deficit from the project capacity. This is based on the assumption that all non-project work must get done. The difference between the project demand and the realistic project capacity is your supply-demand gap, in work-hours.
If your supply-demand gap is zero, recognize that the project demand does not take into account the project backlog: it only takes into account the projects that are expected to be delivered within the next 12 months.
1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis
The project capacity supply and demand analysis compares your available annual project capacity with the size of your project portfolio, expressed in work-hours.
The supply side is further broken down to productive vs. wasted project capacity. The demand side is broken down to three buckets of projects: those that are active, those that sit in the backlog, and those that are expected to be added within 12 months. Percentage values are expressed in terms of total project capacity.
A key observation here is the limitation to which reducing wasteful spending of resources can get to the project portfolio backlog. In this example, even a theoretical scenario of 100% productive project capacity will not likely result in net shrinkage of the project portfolio backlog. To achieve that, either the total project capacity must be increased, or less projects must be approved.
Note: the work-hours necessary for delivering projects that are expected to be completed within 12 months is not shown in this visualization, as they should be represented within the other three categories of projects.
1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis
The non-project capacity supply and demand analysis compares your available non-project capacity and their demands in a year, for each role, in work-hours.
With this chart, you can:
Tab 5 also provides similar breakdowns for administrative and keep-the-lights-on capacity supply and demand by each role.
1.2.4
Resource Management Supply-Demand Calculator, Tab 5: Supply-Demand Analysis
In our approach, we introduce a metric called Resource Capacity Confidence (RCC). Conceptually, RCC is defined as follows:
Resource Capacity Confidence = SC × DS × SDR
| Term | Name | Description |
|---|---|---|
| SC | Supply Control | How confident are you that the supply of your resources’ project capacity will be delivered? |
| DS | Demand Stability | How wildly does demand fluctuate? If it cannot be controlled, can it be predicted? |
| SDR | Supply-Demand Ratio | How severely does demand outstrip supply? |
In this context, RCC can be defined as follows:
"Given the uncertainty that our resources can supply hours according to the assumed project/non-project ratio, the fluctuations in non-project demand, and the overall deficit in project capacity, there is about 50% chance that we will be able to deliver the projects we are expected to deliver within the next 12 months."
Industry Government
Source Info-Tech Client
"When our customers get a budget for a project, it’s all in capital. It never occurs to them that IT has a limited number of hours. "
Use Info-Tech’s time-tracking survey to validate your resourcing assumptions and get additional information to improve your understanding of resource time spent: imperfect labor efficiency and continuous partial attention.
Info-Tech Insight
Part of the old resource management mythology is the idea that a person can do (for example) eight different one-hour tasks in eight hours of continuous work. This idea has gone from harmlessly mistaken to grossly unrealistic.
“Working” on multiple tasks at once can often feel extremely gratifying in the short term because it distracts people from thinking about work that isn’t being done.
The bottom line is that continuous partial attention impedes the progress of project work.
Info-Tech Insight
It may not be possible to minimize interruptions in the workplace, as many of these are considered to be urgent at the time. However, setting guidelines for how and when individuals can be interrupted may help to limit the amount of lost project time.
"Like so many things, in small doses, continuous partial attention can be a very functional behavior. However, in large doses, it contributes to a stressful lifestyle, to operating in crisis management mode, and to a compromised ability to reflect, to make decisions, and to think creatively."
– Linda Stone, Continuous Partial Attention
1.2.5
30 minutes
Completed Resource Management Supply-Demand Calculator
Survey design for the time-tracking survey
N/A
Customize these questions to suit your needs.
Info-Tech Insight
Maximize the number of survey responses you get by limiting the number of questions you ask. Info-Tech finds that participation drops off rapidly after five questions.
Info-Tech Insight
Make sure that employees understand the purpose of the survey. It is important that they give honest responses that reflect the struggles they are encountering with balancing project and non-project work, not simply telling management what they want to hear.
Ensuring that employees know this survey is being used to help them, rather than scolding them for not completing work, will give you useful, insightful data on employee time.
Use Info-Tech’s Time-Tracking Survey Email Template for facilitating your communications.
Info-Tech Best Practice
Provide guidance to your resources with examples on how to differentiate project work vs. non-project work, administrative vs. keep-the-lights-on work, what counts as interruptions, etc.
Based on desired outcomes for this phase, we have
In the next phase, we will:
Screenshots from tab 6 of the Time Audit Workbook.
Info-Tech Insight
The validity of traditional, rigorous resource planning has long been an illusion because the resource projections were typically not maintained. New realities such as faster project cycles, matrix organizations, and high-autonomy staff cultures have made the illusion impossible to maintain.
Discuss who is currently accountable for various facets of resource management, and whether they have the right authority and ability to deliver on that accountability.
Derive actionable, quantitative insight into the resourcing challenges facing the organization by using Info-Tech’s methodology that prioritizes completeness over precision.
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion (in weeks): 3-6 weeks
Start with an analyst kick-off call:
Then complete these activities…
With these tools & templates:
Resource Management Playbook
Discuss with the analyst:
Then complete these activities…
With these tools & templates:
Discuss with the analyst:
Then complete these activities…
With these tools & templates:
Phase 2 Results & Insights:
Draft the resource management practice with sustainability in mind. It is about what you can and will maintain every week, even during a crisis: it is not about what you put together as a one-time snapshot. Once you stop maintaining resource data, it's nearly impossible to catch up.
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
Resource management strategies are commonly implemented “out-of-the-box,” via a commercial PPM or time-tracking tool, or an external third-party consultant in partnership with those types of tools.
While these solutions and best practices have insights to offer – and provide admirable maturity targets – they often outstrip the near-term abilities of IT teams to successfully implement, adopt, and support them.
Tailor an approach that makes sense for your department and organization. You don’t need complex and granular processes to get usable resourcing data; you just need to make sure that you’ve carved out a process that works in terms of providing data you can use.
Info-Tech Insight
Put processes before tools. Most commercial PPM tools include a resource management function that was designed for hourly granularity. This is part of the fallacy of an old reality that was never real. Determine which goals are realistic and fit your solution to your problem.
Default project vs. non-project ratio
How much time is available for projects once non-project demands are factored in?
Reporting frequency
How often is the allocation data verified, reconciled, and reported for use?
Forecast horizon
How far into the future can you realistically predict resource supply?
Scope of allocation
To whom is time allocated?
Allocation cadence
How long is each allocation period?
Granularity of time allocation
What’s the smallest unit of time to allocate?
Granularity of work assignment
What is time allocated to?
Info-Tech Best Practice
Ensure that both the functional managers and the project managers participate in the following discussions. Without buy-in from both dimensions of the matrix organization, you will have difficulty making meaningful resource management data and process decisions.
2.1.1
30 minutes
The default project vs. non-project work ratio (P-NP Ratio) is a starting point for functional and project managers to budget the work-hours at their disposal as well as for resources to split their time – if not directed otherwise by their managers.
How to set this dimension. The Resource Management Supply-Demand Calculator from step 1.2 shows the current P-NP ratio for the department, and how the percentages translate into work-hours. The Time Audit Workbook from step 1.2 shows the ratio for specific roles.
For the work of setting this dimension, you can choose to keep the current ratio from step 1.2 as your default, or choose a new ratio based on the advice below.
2.1.2
15-30 minutes
Scope of allocation is the “who” of the equation. At the lowest and most detailed level, allocations are made to individual resources. At the highest and most abstract level, though, allocations can be made to a department. Other “whos” in scope of allocation can include teams, roles, or skills.
How to set this dimension. Consider how much granularity is required for your overall project capacity visibility, and the process overhead you’re willing to commit to support this visibility. The more low-level and detailed the scope of allocation (e.g. skills or individuals) the more data maintenance required to keep it current.
2.1.3
15-30 minutes
How long is each individual allocation period? In what “buckets of time” do you plan to spend time – week by week, month by month, or quarter by quarter? The typical allocation cadence is monthly; however, depending on the scope of allocation and the nature of work assigned, this cadence can differ.
How to set this dimension. Allocation cadence can depend on a number of factors. For instance, if you’re allocating time to agile teams, the cadence would most naturally be bi-weekly; if work is assigned via programs, you might allocate time by quarters.
2.1.3
15-30 minutes
Granularity of time allocation refers to the smallest unit of time that can be allocated. You may not need to set firm limits on this, given that it could differ from PM to PM, and resource manager to resource manager. Nevertheless, it can be helpful to articulate an “as-low-as-you’ll-go” limit to help avoid getting too granular too soon in your data aspirations.
How to set this dimension. At a high level, the granularity of allocation could be as high as a week. At its lowest level, it could be an hour. Other options include a full day (e.g. 8 hours), a half day (4 hours), or 2-hour increments.
2.1.4
15-30 minutes
Determine a realistic granularity for your allocation. This is the “what” of the equation: what your resources are working on or the size of work for which allocations are managed.
How to set this dimension. A high level granularity of work assignment would assign an entire program, a mid-level scope would involve allocating a project or a phase of a project, and a low level, rigorous scope would involve allocating an individual task.
2.1.5
15-30 minutes
Determine a realistic forecasting horizon for your allocation. At this point you have decided “what” “who” is working on and how frequently this will be updated. Now it is time to decide how far resource needs will be forecasted, e.g. “what will this person be working on in 3 months?”
How to set this dimension. A high-level forecast horizon would only look forward week-to-week, with little consideration of the long-term future. A mid-level forecast would involve predicting one quarter in advance and a low-level, rigorous scope would involve forecasting one or more years in advance.
See the diagram below for further explanation
Between today and the forecast horizon (“forecast window”), all stakeholders in resource management commit to reasonable accuracy of data. The aim is to create a reliable data set that can be used to determine true resource capacity, as well as the available resource capacity to meet unplanned, urgent demands.
Info-Tech Insight
Ensure data accuracy. It is important to note that forecasting a year in advance does not necessarily make your organization more mature, unless you can actually rely on these estimates and use them. It is important to only forecast as far in advance as you can accurately predict.
2.1.6
30 minutes
How often will you reconcile and rebalance your allocations? Your update frequency will determine this. It is very much the heartbeat of resource management, dictating how often reports on allocations will be updated and published for stakeholders’ consumption.
How to set this dimension. Determine a realistic frequency with which to update project reports. This will be how you determine who is working on what during each measurement period.
2.1.7
10 minutes
Document the outputs from the preceding seven activities. These determinations will form the foundation of your resource management strategy, which we will go on to define in more detail in the subsequent steps of this phase.
| RM Core Dimensions | Decision |
|---|---|
| Default P-NP ratio | 40%-60$ + exception by roles |
| Scope of allocation | Individual resource |
| Allocation cadence | Monthly |
| Granularity of time allocation | 4 hours |
| Granularity of work assignment | Projects |
| Forecast horizon | 3 months |
| Reporting frequency | Twice a month |
Document these dimensions in Section 1.1 of Info-Tech’s Resource Management Playbook. We will be further customizing this template in steps 2.3 and 3.1.
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
This step will walk you through the following activities:
This step involves the following participants:
Outcomes of this step
Resource management depends on the flow of information and data from the project level up to functional managers, project managers, and beyond.
Tools are required to help facilitate this flow, and the project portfolio management landscape is littered with endless time-tracking and capacity management options.
These options can each have their merits and their drawbacks. The success of implementing a resource management strategy very much hinges upon weighing these, and then choosing the right solution for your project eco-system.
Info-Tech Insight
Establish a book of record. While it is possible to succeed using ad hoc tools and data sources, a centralized repository for capacity data works best. Your tool choice should help establish a capacity book of record to help ensure ongoing reconciliation of supply and demand at the portfolio level.
At a high level, those looking for a resource management solution have two broad options: a commercial project portfolio management (PPM) or time-tracking software on the one hand, and a spreadsheet-based tool, like Google Sheets or Excel, on the other.
Obviously, if your team or department already has access to a PPM or time-tracking software, it makes sense to continue using this, as long as it will accommodate the process that was wireframed in the previous step.
Otherwise, pursue the tool option that makes the most sense given both the strategy that you’ve wireframed and other organizational factors. See the table below and the next section for guidance.
“If you’re planning on doing resource allocation by hand, you’re not going to get very far.”
| Commercial Solutions | Spreadsheet-Based Solutions | |
|---|---|---|
| Description |
|
|
| Pros |
|
|
| Cons |
|
|
While commercial options offer the most robust functionality for automation, collaboration, and reporting, they are also costly, difficult to implement, and onerous to sustain over the long run.
It’s not uncommon for organizations to sink vast amounts of money into commercial PPM tools, year after year, and never actually get any usable resource or forecasting data from these tools.
The reasons for this can vary, but in many cases it is because organizations mistake a tool for a PPM or a resource management strategy.
A tool is no substitute for having a clearly defined process that staff can support. Be aware of these two factors before investing in a commercial tool:
47%
Of those companies using automated software to assist in resource management, almost half report that those systems failed to accurately calculate resource forecasts.
Info-Tech Insight
Put process sustainability before enhanced tool functionality.
Ensure that you have sustainable processes in place before investing in an expensive commercial tool. Your tool selection should help facilitate capability-matched processes and serve user adoption.
Trying to establish processes around a tool with a functionality that exceeds your process maturity is a recipe for failure.
Use the table below as a starting point to help ensure you are pursuing a resource management tool that is right for your organization’s size and process maturity level.
| Tool Category | Characteristics | # of Users | PPM Maturity | Sample Vendors |
|---|---|---|---|---|
| Enterprise tools |
|
1,000> | High |
|
| Mid-market tools |
|
100> | Intermediate-to-High |
|
| Entry-level tools |
|
<100 | Low-to-Intermediate |
|
For a more in-depth treatment of choosing and implementing a commercial PPM tool to assist with your resource management practice, see Info-Tech’s blueprint, Select and Implement a PPM Solution.
PPM Solution Vendor Demo Script (optional)
To ensure your investment in a commercial tool meets your resource management needs, use Info-Tech’s PPM Solution Vendor Demo Script to structure your tool demos and interactions with vendors.
For instance, some important scenarios to consider when looking at potential tools include:
Any deficiencies in answering these types of questions should alert you to the fact that a potential solution may not adequately meet the needs of your resource management strategy.
Download Info-Tech’s PPM Solution Vendor Demo Script
"[H]ow (are PPM solutions) performing in a matrix organization? Well, there are gaps. There will be employees who do not submit timesheets, who share their time between project and operational activities, and whose reporting relationships do not fit neatly into the PPM database structure. This creates exceptions in the PPM application, and you may just have the perfect solution to a small subset of your problems." – Vilmos Rajda
When it comes to resource management at a portfolio level, spreadsheets can be just as effective as commercial tools for facilitating the flow of accurate and maintainable resourcing data and for communicating resource usage and availability.
Some of the benefits of spreadsheets over commercials tools include:
To be clear: spreadsheets have their drawbacks (for instance, they are easy to break, require a centralized data administrator, and are yours and yours alone to maintain). If your department has the budget and the process maturity to support a commercial tool, you should pursue the options covered in the previous sections.
However, if you are looking for a viable alternative to an expensive tool, spreadsheets have the ability to support a rigorous resource management practice.
"Because we already have enterprise licensing for an expensive commercial tool, everyone else thinks it’s logical to start there. I think we’re going to start with something quick and dirty like Excel." – EPMO Director, Law Enforcement Services
Info-Tech Insight
Make the choice to ensure adoption.
When making your selection, the most important consideration across all the solution categories is data maintenance. You must be assured that you and your team can maintain the data.
As soon as your portfolio data becomes inconsistent and unreliable, decision makers will lose trust in your resource data, and the authority of your resource management strategy will become very tenuous.
Spreadsheets are the most common PPM tool – and it’s not hard to understand why: they can be created with minimal cost and effort.
But when something is easy to do, it’s important to keep in mind that it’s also easy to do badly. As James Kwak says in his article, “The Importance of Excel,” “The biggest problem is that anyone can create Excel Spreadsheets—badly.”
Download Info-Tech’s Portfolio Manager Lite 2017
Info-Tech Insight
Balance functionality and adoption. Clients often find it difficult to gain adoption with commercial tools. Though homegrown solutions may have less functionality, the higher adoption level can make up for this and also potentially save your organization thousands a year in licensing fees.
2.2.1
Times will vary
Based on input from the previous slides, determine the resource management solution option you will pursue and implement to help support your resource management strategy. Record this selection in section 1.2 of the Resource Management Playbook.
| RM Core Dimensions | Default Value |
|---|---|
| Default P-NP ratio | Role-specific |
| Scope of allocation | Individual resource |
| Allocation cadence | Monthly |
| Granularity of allocation | (not defined) |
| Granularity of work assignment | Project |
| Forecast horizon | 6 months |
| Reporting frequency | (not defined) |
Portfolio Manager Lite has comprehensive sample data to help you understand its functions.
As you can see in this table, the tool itself assumes five of the seven resource management core dimensions. You will need to determine departmental values for granularity of allocation and reporting frequency. The other dimensions are determined by the tool.
If you’re piloting Info-Tech’s Portfolio Manager Lite, review the subsequent slides in this step before proceeding to step 2.3. If you are not piloting Portfolio Manager Lite, proceed directly to step 2.3.
Portfolio Manager Lite has two set-up tabs, three data entry tabs, and six output-only tabs. The next 15 slides show how to use them. To use this tool, you need Excel 2013 or 2016. If you’re using Excel 2013, you must download and install Microsoft Power Query version 2.64 or later, available for download from Microsoft.
Excel tables enable you to manage and analyze a group of related data. Since Portfolio Manager Lite uses tables extensively, maintaining the table’s integrity is critical. Here are some things to know for working with Excel tables.
Adjust the sizing handle to eliminate empty rows.
Default pasting behavior can interrupt formula references and introduce unwanted external links. Always right-click and select Paste Values.
Do not use row headings; instead, always right-click inside a table to manipulate table rows.
2.2.1
Portfolio Manager Lite, Tab 2a: Org Setup
The Org Setup tab is divided into two sections, Resources and Projects. Each section contains several categories to group your resources and projects. Items listed under each category will be available via drop-down lists in the data tabs.
These categorizations will be used later to “slice” your resource allocation data. For example, you’ll be able to visualize the resource allocations for each team, for each division, or for each role.
1. Role and Default Non-Project Ratio columns: From the Supply-Demand Calculator, copy the list of roles, and how much of each role’s time is spent on non-projects by default (see below; add the values marked with yellow arrows).
2. Resource Type column: List the type of resource you have available.
3. Team and Skill columns: List the teams, and skills for your resources.
In the Resources tab, items in drop-down lists will appear in the same order as shown here. Sort them to make things easy to find.
Do not delete tables you won’t use. Instead, leave or hide tables.
2.2.1
Portfolio Manager Lite, Tab 2a: Org Setup
The projects section of the Org Setup tab contains several categories for entering project data. Items listed under each category will be available via drop-down lists in the Projects tab. These categorizations will be used later to analyze how your resources are allocated.
1. Project Type: Enter the names of project types, in which projects will be grouped. All projects must belong to a type. Examples of types may include sub-portfolios or programs.
2. Project Category: Enter the names of project categories, in which projects will be grouped. Unlike types, category is an optional grouping.
3. Phase: Enter the project phases. Ensure that your phases list has “In Progress” and “Complete” options. They are needed for the portfolio-wide Gantt chart (the Gantt tab).
4. Priority and Status: Define the choices for project priorities and statuses if necessary (optional).
5. Unused: An extra column with predefined choices is left for customization (optional).
2.2.1
Portfolio Manager Lite, Tab 2b: Calendar Setup
Portfolio Manager Lite is set up for a monthly allocation cadence out of the box. Use this tab to set up the start date, the default resource potential capacity, and the months to include in your reports.
1. Enter a start date for the calendar, e.g. start of your fiscal or calendar year.
2. Enter how many hours are assumed in a working day. It is used to calculate the default maximum available hours in a month.
Maximum Available Hours, Weekdays, and Business Days are automatically generated.
The current month is highlighted in green.
3. Enter the number of holidays to correct the number of business days for each month.
Year to Date Reporting and Forecast Reporting ranges are controlled by this table. Use the period above Maximum Available Hours.
Info-Tech Best Practice
Both Portfolio Manager Lite and Portfolio Manager 2017 can be customized for non-monthly resource allocation. Speak to an Info-Tech analyst to ask for more information.
2.2.2
Portfolio Manager Lite, Tab 3: Resources
Portfolio Manager Lite is set up for allocating time to individual resources out of the box. Information on these resources is entered in the Resources tab. It has four sections, arranged horizontally.
1. Enter basic information on your resources. Resource type, team, role, and skill will be used to help you analyze your resource data.
Ensure that the resource names are unique.
Sort or filter the table using the filter button in the header row.
2. Their total capacity in work-hours is automatically calculated for each month, using the default numbers from the Calendar Setup tab. If necessary, overwrite the formula and enter in custom values.
Cells with less than 120 hours are highlighted in blue.
Do not add or delete any columns, or modify this header row.
2.2.2
Portfolio Manager Lite, Tab 3: Resources
3. Enter the resources’ out-of-office time for each month, as they are reported.
Do not add or delete any columns, or modify the header row, below the dates.
4. Resources’ percentages of time spent on non-projects are automatically calculated, based on their roles’ default P-NP ratios. If necessary, overwrite the formula and enter in custom values.
Do not add or delete any columns, or modify the header row, below the dates.
2.2.3
Portfolio Manager Lite, Tab 4: Projects
Portfolio Manager Lite is set up for allocating time to projects out of the box. Information on these projects is entered in the Projects tab.
1. Enter project names and some basic information. These fields are mandatory.
Ensure that the project names are unique.
Do not modify or change the headers of the first seven columns. Do not add to or delete these columns.
2. Continue entering more information about projects. These fields are optional and can be customized.
Headers of these columns can be changed. Extra columns can be added to the right of the Status column if desired. However, Info-Tech strongly recommends that you speak to an Info-Tech analyst before customizing.
The Project Category, Phase, and Priority fields are entered using drop-down lists from the Org Setup tab.
2.2.4
Portfolio Manager Lite, Tab 5: Allocations
Project capacity for each resource is calculated as follows, using the data from the Resources tab:
Project capacity = (total project capacity – absence) x (100% – non-project%)
In the Allocations tab, project capacity is allocated in percentages with 100% representing the allocation of all available project time of a resource to a project.
This allocation-by-percentage model has some advantages and drawbacks:
Advantages
Drawbacks
The Allocations tab has a few features to help you mitigate these disadvantages.
Info-Tech Best Practice
For organizations with lower resource management practice maturity, start with percentages. In Portfolio Manager 2017, allocations are entered in work-hours to avoid the above drawbacks altogether, but this may require a higher practice maturity.
2.2.4
Portfolio Manager Lite, Tab 5: Allocations
A line item in the Allocations tab requires three pieces of information: a project, a resource, and the percentage of project capacity for each month.
1. Choose a project. Type, Start date, and End date are automatically displayed.
2. Choose a resource. Team is automatically displayed.
3. Enter the resource’s allocated hours for the project in percentages.
2.2.4
Portfolio Manager Lite, Tab 5: Allocations
The Allocations tab helps you preview the available project capacity of a resource, as well as the work-hours represented by each allocation line item, to mitigate the drawbacks of percentage allocations.
In addition, overallocations (allocations for a given month add up to over 100%) are highlighted in red. These functions help resource managers balance the project supply and demand.
To preview a resource’s project capacity in work-hours, choose a resource using a drop down. The resource’s available project capacity for each month is displayed to the right.
Sort or filter the table using the filter button in the header row. Here, the Time table is sorted by Resource.
The total work-hours for each line item is shown in the Hours column. Here, 25% of Bethel’s project capacity for 4 months adds up to only 16 work-hours for this project.
A resource is overallocated when project capacity allocations add up to more than 100% for a given month. Overallocations are highlighted in red.
2.2.5
Portfolio Manager Lite, Tab 6: Gantt
The Gantt tab is a pivot-table-driven chart that graphically represents the start and end dates of projects and their project statuses.
Filter entries by project type above the chart.
The current month (9-17) is highlighted.
You can filter and sort entries by project name, sponsor, or project manager.
In progress (under Phase column) projects show the color of their overall status.
Projects that are neither completed nor in progress are shown in grey.
Completed (under Phase column) projects are displayed as black.
2.2.6
Portfolio Manager Lite, Tab 7: Resource Load
The Resource Load tab is a PivotTable showing the available project capacity for each resource.
Change the thresholds for indicating project overallocation at the top right.
You can filter and sort entries by resource or role.
Values in yellow and red highlight overallocation.
Values in green indicate resource availability.
This table provides a bird’s-eye view of all available project capacity. Highlights for overallocated resources yield a simple heat map that indicates resourcing conflicts that need attention.
The next two tabs contain graphical dashboards of available capacity.
Tip: Add more resource information by dragging a column name into the Rows box in the PivotTable field view pane.
Example: add the Team column by dragging it into the Rows box
2.2.7
Portfolio Manager Lite, Tab 8: Capacity Slicer
The Capacity Slicer tab is a set of pivot charts showing the distribution of resource allocation and how they compare against the potential capacity.
At the top left of each chart, you can turn Forecast Reporting on (true) or off (false). For Year to Date reporting, replace Forecast with YTD in the Field View pane’s Filter field.
In the Allocated Capacity, in % chart, capacity is shown as a % of total available capacity. Exceeding 100% indicates overallocation.
In the Realized Project Capacity, in hours chart, the vertical axis is in work-hours. This gap between allocation and capacity represents available project capacity.
The bottom plots show how allocated project capacity is distributed. If the boxes are empty, no allocation data is available.
2.2.7
Portfolio Manager Lite, Tab 8: Capacity Slicer
A slicer filters the data shown in a PivotTable, a PivotChart, or other slicers. In this tab, the team slicer enables you to view resource capacity and allocation by each team or for multiple teams.
The button next to the Team header enables multiple selection.
The next button to the right clears the filter set by this slicer.
All teams with capacity or allocation data are listed in the slicers.
For example, if you select "App Dev":
The vertical axis scales automatically for filtered data.
The capacity and allocation data for all application division teams is shown.
Resources not in the App Dev team are filtered out.
2.2.8
Portfolio Manager Lite, Tab 9: Capacity Locator
The Capacity Locator tab is a group of PivotCharts with multiple slicers to view available project capacity.
For example: click on “Developer” under Role:
Primary skills of all developers are displayed on the left in the Primary Skill column. You can choose a skill to narrow down the list of resources from all developers to all developers with that skill.
The selected resources are shown in the Resources column. Data on the right pertains to these resources.
Where you see the filter button with an x, you can clear the filter imposed by this slicer.
2.2.9
Portfolio Manager Lite, Tab 10: Project Viewer
The Project Viewer tab is a set of PivotCharts with multiple slicers to view how resources are allocated to different projects.
Filtering by sponsor or project manager is useful for examining a group of projects by accountability (sponsor) or responsibility (project manager).
The graphs show how project budgets are distributed across different categories and priorities of projects, and how resource allocations are distributed across different categories and priorities of projects.
2.2.10
Portfolio Manager Lite, Tab 11: Project Updates
The Project Updates tab is a PivotTable showing various fields from the Projects table to rapidly generate a portfolio-wide status report. You can add or remove fields from the Projects table using the PivotTable’s Field View pane.
Filter entries by phase. The screenshot shows an expansion of this drop down at the top left.
Rearrange the columns by first clicking just below the header to select all cells in the column, and then dragging it to the desired position. Alternatively, arrange them in the Field View pane.
2.2.11
10 minutes
| Maturity Level | Dimensions | Time needed per month | |||
|---|---|---|---|---|---|
| Small (1-25 employees) | Medium (25-75) | Large (75-100) | Enterprise (100+) | ||
| 1-2 | %, team, project, monthly update, 1 month forecast | 2 hours | 6 hours | 20 hours | 50 hours |
| 3-4 | %, person, phase, weekly update, 1 quarter forecast | 4 hours | 12 hours | 50 hours | 150 hours |
| 5 | %, person, task, continuous update, 1 year forecast | 8+ hours | 20+ hours | 100+ hours | 400+ hours |
If you are looking for a more robust resource management solution, or prefer to allocate staff time in hours rather than percentages, see Info-Tech’s Portfolio Manager 2017.
Similar to Portfolio Manager Lite, Portfolio Manager 2017 is a Microsoft Excel-based PPM solution that provides project visibility, forecasting, historical insight, and portfolio analytics capabilities for your PMO without a large upfront investment for a commercial solution.
Watch Info-Tech’s Portfolio Manager 2017 Video – Introduction and Demonstration.
To use all functions of Portfolio Manager 2017, you need Excel 2013 or Excel 2016 running on Windows, with the following add-ins:
Power View is only available on select editions of Excel 2013 and 2016, but you can still use Portfolio Manager 2017 without Power View.
If you are unsure, speak to your IT help desk or an Info-Tech analyst for help.
Industry Law Enforcement
Source Info-Tech Client
“Because we already have enterprise licensing for an expensive commercial tool, everyone else thinks it’s logical to start there. I think we’re going to start with something quick and dirty like Excel.” – EPMO Director, Law Enforcement Services
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
When resource management strategies fail, it can typically be tied back to the same culprit: unrealistic expectations from the outset.
If a resource management process strives for a level of data precision that staff cannot juggle day to day, over the long run, then things will eventually fall apart as staff and decision makers alike lose faith in the data and the relevancy of the process.
Two things can be done to help avoid this fate:
Info-Tech Insight
It's not about what you put together as a one-time snapshot. It's about what you can and will maintain every week, even during a crisis. When you stop maintaining resource management data, it’s nearly impossible to catch up and you’re usually forced to start fresh.
1. Collect resource supply data
2. Collect project demand data
3. Identify sources of supply/demand imbalance
4. Resolve conflicts and balance project and non-project allocations
5. Approve allocations for forecast window
This is a sample workflow with sample roles and responsibilities. This step will help you customize the appropriate steps for your department.
Info-Tech Insight
This process aims to control the resource supply to meet the demand – project and non-project alike. Coordinate this process with other portfolio management processes, ensuring that up-to-date resource data is available for project approval, portfolio reporting, closure, etc.
2.3.1
60 to 90 minutes
Conduct a table-top planning exercise to map out, at a high-level, your required and desired process steps.
While Info-Tech recommends a simple five-step process (see previous slide), you may need to flesh out your process into additional steps, depending upon the granularity of your seven dimensions and the complexity of your resource management tool. A table-top planning exercise can be helpful to ensure the right process steps are covered.
For the purposes of this activity, avoid getting into too much detail by keeping to your focus on the high-level data points that will be required to keep supply and demand balanced on an ongoing basis.
"[I]t’s important not to get too granular with your time tracking. While it might be great to get lots of insight into how your team is performing, being too detailed can eat into your team’s productive work time. A good rule of thumb to work by is if your employees’ timesheets include time spent time tracking, then you’ve gone too granular."
Use Info-Tech’s Resource Management Playbook to help determine and communicate the “who, what, when, where, why, and how” of each of your high-level process steps.
The playbook template is intended to function as your resource management standard operating procedure. Customize Section 3 of the template to record the specific organizational details of how data will be collected at each process step, and the actions and decisions the data collection process will necessitate.
Download Info-Tech’s Resource Management Playbook
2.3 Resource Management Playbook
Each of the slides for activities 2.3.2-2.3.6 are comprised of a task-at-a glance box as well as “important decisions to document” for each step.
Work as a group to complete the task-at-a-glance boxes for each step. Use the “important decisions to document” notes to help brainstorm the “how” for each step. These details should be recorded below the task-at-a-glance boxes in the playbook – see point 6 in the legend below.
Screenshot of Section 3 of the RM Playbook.
Screenshot Legend:
2.3.2
20 minutes
Resource supply in this context should be understood as the time, per your scope of allocation (i.e. individual, team, skill, etc.) that is leftover or available once non-project demands have been taken out of the equation. In short, the goal of this process step is to determine the non-project demands for the forecast period.
The important decisions to document for this step include:
Document your process for determining resource supply in Section 3.1 of Info-Tech’s Resource Management Playbook.
Task-at-a-glance:
| Inputs | Artifacts | i.e. historical usage data |
|---|---|---|
| Consulted | i.e. project resources | |
| Tools & Templates | i.e. time tracking template | |
| Outputs | Artifacts | i.e. updated template |
| Informed | i.e. portfolio analyst | |
| Timing | i.e. every second Monday | |
| Responsible | i.e. functional managers | |
| Accountable | i.e. IT directors | |
2.3.3
20 minutes
Project demand in this context can entail both in-flight projects as well as new project plans or new project requests that are proposing to consume capacity during the forecast period. In short, the goal of this process step is to determine all of the project demands for the forecast period.
The important decisions to document for this step include:
Document your process for determining project demand in Section 3.2 of Info-Tech’s Resource Management Playbook.
Task-at-a-glance
| Inputs | Artifacts | i.e. historical usage data |
|---|---|---|
| Consulted | i.e. project resources | |
| Tools & Templates | i.e. project demand template | |
| Outputs | Artifacts | i.e. updated demand table |
| Informed | i.e. portfolio analyst | |
| Timing | i.e. every second Monday | |
| Responsible | i.e. project managers | |
| Accountable | i.e. PMO director | |
2.3.4
20 minutes
Once the supply-demand data has been compiled, it will need to be analyzed for points of imbalance and conflict. The goal of this process step is to analyze the raw data and to make it consumable by other stakeholders in preparation for a reconciliation or rebalancing process.
The important decisions to document for this step include:
Document your process for identifying resource constraints and issues in Section 3.3 of Info-Tech’s Resource Management Playbook.
Task-at-a-glance
| Inputs | Artifacts | i.e. supply/demand data |
|---|---|---|
| Consulted | i.e. no one | |
| Tools & Templates | i.e. Portfolio Manager Lite | |
| Outputs | Artifacts | i.e. list of issues |
| Informed | i.e. no one | |
| Timing | i.e. every second Tuesday | |
| Responsible | i.e. portfolio analyst | |
| Accountable | i.e. PMO director | |
2.3.5
20 minutes
The reconciliation process will likely take place at a meeting amongst the management of the PMO and representatives from the various functional groups within the department. The goal of this step is to get the right roles and individuals to agree upon proposed reconciliations and to sign-off on resource allocations.
The important decisions to document for this step include:
Document your process for resolving resource constraints and issues in Section 3.4 of Info-Tech’s Resource Management Playbook.
| Inputs | Artifacts | i.e. meeting agenda |
|---|---|---|
| Consulted | i.e. meeting participants | |
| Tools & Templates | i.e. capacity reports | |
| Outputs | Artifacts | i.e. minutes and resolutions |
| Informed | i.e. steering committee | |
| Timing | i.e. every second Thursday | |
| Responsible | i.e. PMO director | |
| Accountable | i.e. CIO | |
2.3.6
20 minutes
Once a plan to rebalance supply and demand for the reporting period has been agreed on, you will need to ensure that the appropriate data is updated in your resource management book of record, and that allocation decisions are communicated to the appropriate stakeholders.
The important decisions to document for this step include:
Document your process for approving and finalizing allocation in Section 3.5 of Info-Tech’s Resource Management Playbook.
Task-at-a-glance
| Inputs | Artifacts | i.e. minutes and resolutions |
|---|---|---|
| Consulted | i.e. CIO, IT directors | |
| Tools & Templates | i.e. Portfolio Manager Lite | |
| Outputs | Artifacts | i.e. updated availability table |
| Informed | i.e. steering committee | |
| Timing | i.e. every second Friday | |
| Responsible | i.e. portfolio analyst | |
| Accountable | i.e. PMO director | |
2.3 Resource Management Playbook
Throughout this phase, we have been customizing sections 1, 2, and 3 of the Resource Management Playbook.
Before we move to pilot and implement your resource management strategy in the next phase of this blueprint, ensure that sections 1-3 of your playbook have been drafted and are ready to be communicated and shared with stakeholders.
"People are spending far more time creating these elaborate [time-tracking] systems than it would have taken just to do the task. You’re constantly on your app refiguring, recalculating, re-categorizing... A better strategy would be [returning] to the core principles of good time management…Block out your calendar for the non-negotiable things. [Or] have an organized prioritized task list." – Laura Stack (quoted in Zawacki)
Action the decision points across Info-Tech’s seven dimensions to ensure your resource management process is guided by realistic data and process goals.
Customize Info-Tech’s five-step resource management process model. Then, document how the process will operate by customizing the Resource Management Playbook.
Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.
Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.
Proposed Time to Completion (in weeks): 4-12 weeks
Start with an analyst kick-off call:
Then complete these activities…
With these tools & templates:
Review findings with analyst:
Then complete these activities…
With these tools & templates:
Phase 3 Results & Insights:
Engagement paves the way for smoother adoption. An engagement approach (rather than simply communication) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
This step will walk you through the following activities:
This step involves the following participants:
Outcomes of this step
Resist the urge to deploy a big-bang rollout of your research management practices. This approach is ill advised for two main reasons:
Start with a pilot phase. Identify receptive project managers and functional managers to work with, and leverage their insights to help iron out the kinks in your process before unveiling your practices to IT and business users at large.
This step will help you:
Info-Tech Insight
Engagement paves the way for smoother adoption. An engagement approach (rather than simply communication) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.
A process pilot is a limited scope of an implementation (constrained by time and resources involved) to test the viability and effectiveness of the process as it has been designed.
"The advantages to a pilot are several. First, risk is constrained. Pilots are closely monitored so if a problem does occur, it can be fixed immediately. Second, the people working in the pilot can become trainers as you roll the process out to the rest of the organization. Third, the pilot is another opportunity for skeptics to visit the pilot process and learn from those working in it. There’s nothing like seeing a new process working for people to change their minds." – Daniel Madison
Download Info-Tech’s Process Pilot Plan Template
3.1.1
20 to 60 minutes
Info-Tech recommends selecting project managers and functional managers who are aware of your role and some of the supply-demand challenges to assist in the implementation process.
Document the project and functional managers involved in your pilot in Section 3 of Info-Tech’s Process Pilot Plan Template.
Use Info-Tech’s Process Pilot Plan Template to design the details of your pilot.
Investing time into planning your pilot phase strategically will ensure a clear scope, better communications for those piloting the processes, and overall, better, more actionable results during the pilot phase. The Process Pilot Plan Template is broken into five sections to assist in these goals:
While you should invest time in this planning document, continue to lean on the Resource Management Playbook as well as a process guide throughout the pilot phase.
Some things to keep in mind during the pilot include:
3.1.3
30 minutes
Pilot projects allow you to validate your assumptions and leverage lessons learned. During the planning of the pilot, you should have scheduled a retrospective meeting with the pilot team to formally assess strengths and weaknesses in the process you have drafted.
An example of how to structure a stop/start/continue activity on a whiteboard using sticky notes.
See below for additional instructions
3.1.4
30 minutes
As a group, discuss everyone’s responses and organize according to top priority (mark with a 1) and lower priority/next steps (mark with a 2). At this point, you can also remove any sticky notes that are repetitive or no longer relevant.
Once you have organized based on priority, be sure to come to a consensus with the group regarding which actions to take. For example, if the group agrees that they should “stop holding meetings weekly,” come to a consensus regarding how often meetings will be held, i.e. monthly.
Create an action plan for the top priority items that require changes (the stops and starts). Record in this slide or your preferred medium. Be sure to include who is responsible for the action and the date that it will be implemented.
| Priority | Action Required | Who is Responsible | Implementation Date |
|---|---|---|---|
| Stop: Holding meetings weekly | Hold meetings monthly | Jane Doe, PMO | Next Meeting: November 1, 2017 |
| Start: Discussing backlog during meetings | Ensure that backlog data is up to date for discussion on date of next meeting | John Doe, Portfolio Manager | November 1, 2017 |
Document the outcomes of the start/stop/continue exercise and your action plan in Section 6 of Info-Tech’s Process Pilot Plan Template.
| Situation | Action | Next Steps |
|---|---|---|
| The dimensions that we chose for our strategy have proven to be too difficult to accurately maintain. | The dimensions that we chose for our strategy have proven to be too difficult to accurately maintain. | Reassess the dimensions that you chose for your strategy. Make sure that you are not overcommitting yourself based on your maturity level. You can always go back and adjust for a higher level of resource management maturity once you have mastered your current level. For example, if you chose “weekly” as your update frequency and this has proven to be too much to maintain, try updating monthly for a few months. Once you have mastered this update frequency, it will be easier to adjust to a weekly update process. |
| We were able to maintain the data for our pilot based on the dimensions that we chose. However, allocating projects based on realized capacity did not alleviate any of our resourcing issues and resources still seem to be working on more projects than they can handle. | Determine other factors at the organization that would help to maintain the data and work toward reclaiming capacity. | Continue working with the dimensions that you chose and maintain the accuracy of this data. The next step is to identify other factors that are contributing to your resource allocation problems and begin reclaiming capacity. Continue forward to the resource management roadmap section and work on changing organizational structures and worker behavior to maximize capacity for project work. |
| We were able to easily and accurately maintain the data, which led to positive results and improvement in resource allocation issues. | If your strategy is easily maintained, identify factors that will help your organization reclaim capacity. | Continue to maintain this data, and eventually work toward maintaining it at a more precise level. For example, if you are currently using an update frequency of “monthly” and succeeding, think about moving toward a “weekly” frequency within a few months. Once you feel confident that you can maintain project and resource data, continue on to the roadmap section to discover ways to reclaim resource capacity through organizational and behavioral change. |
3.1.5
15 to 30 minutes
Perform a RACI exercise to help standardize terminology around roles and responsibilities and to ensure that expectations are consistent across stakeholders and teams.
Responsible
Accountable
Consulted
Informed
| Roles | CIO | PMO | Portfolio Analyst | Project Manager | Functional Manager |
|---|---|---|---|---|---|
| Collect supply data | I | A | R | I | C |
| Collect demand data | I | A | R | C | I |
| Identify conflicts | I | C/A | R | C | C |
| Resolve conflicts | C | A/R | I | R | R |
| Approve allocations | A | R | I | R | I |
Document your roles and responsibilities in Section 2 of Info-Tech’s Resource Management Playbook.
3.1 Project Portfolio Analyst/PMO Analyst Job Description
You will need to determine responsibilities and accountabilities for portfolio management functions within your team.
If you do not have a clearly identifiable portfolio manager at this time, you will need to clarify who will wear which hats in terms of facilitating intake and prioritization, high-level capacity awareness, and portfolio reporting.
Download Info-Tech’s Project Portfolio Analyst Job Description Template
Revisit your RM Playbook from step 2.3 and ensure it has been updated to reflect the process changes that were identified in activity 3.1.4.
Download Info-Tech’s Resource Management Playbook
Info-Tech Best Practice
Make your process standardization comprehensive. The RM Playbook should serve as your resource management standard operating procedure. In addition to providing a walk-through of the process, an SOP also clarifies project governance by clearly defining roles and responsibilities.
1.1 Set a course of action
1.2 Estimate supply and demand
2.1 Select resource management dimensions
2.2 Select resource management tools
2.3 Build process steps
3.1 Pilot your process for viability
3.2 Plan stakeholder engagement
This step will walk you through the following activities:
This step involves the following participants:
Outcomes of this step
This step of the project will ensure the new strategy is adopted and applied with maximum success by helping you manage challenges and opportunities across three dimensions:
1. Executive Stakeholder Factors
For example, resistance to adopting new assumptions about ratio of project versus non-project work.
2. Workforce/Team Factors
For example, resistance to moving from individual- to team-based allocations.
3. Structural Factors
For example, ensuring priorities are stable within the chosen resource planning horizon.
See Info-Tech’s Drive Organizational Change from the PMOfor comprehensive tools and guidance on achieving organizational buy-in for your new resource management practices.
Info-Tech Insight
Communicate, communicate, communicate. Staff are 34% more likely to adapt to change quickly during the implementation and adoption phases when they are provided with a timeline of impending changes specific to their department. (McLean & Company)
While your mandate may be backed by an executive sponsor, you will need to influence stakeholders from throughout the organization in order to succeed. Indeed, as EPMO leader, success will depend upon your ability to confirm and reaffirm commitments on soft or informal grounds. Prepare an engagement strategy that anticipates a wide range of responses.
| Enthusiasts | Fence-sitters | Skeptics | Saboteurs | |
|---|---|---|---|---|
| What they look like: | Put all their energy into learning new skills and behaviors. | Start to use new skills and behaviors at a sluggish pace. | Look for alternate ways of implementing the change. | Refuse to learn anything new or try new behaviors. |
| How they contribute: | Lead the rest of the group. | Provide an undercurrent of movement from old behaviors to new. | Challenge decisions and raise risk points with managers. | May raise valid points about the process that should be fixed. |
| How to manage them: | Give them space to learn and lead others. | Keep them moving forward by testing their progress. | Listen to them, but don’t give in to their demands. | Keep communicating with them until you convert them. |
| How to leverage them: | Have them lead discussions and training sessions. | Use them as an example to forecast the state once the change is adopted. | Test new processes by having them try to poke holes in them. | If you can convert them, they will lead the Skeptics and Fence-sitters. |
Info-Tech Insight
Hone your stakeholder engagement strategy. Most people affected by an IT-enabled change tend to be fence-sitters. Small minorities will be enthusiasts, saboteurs, and skeptics. Your communication strategy should focus on engaging the skeptics, saboteurs, and enthusiasts. Fence-sitters will follow.
Info-Tech Insight
Communicate well and engage often. Agility and continuous improvement are good, but can degenerate into volatility if change isn’t managed properly. People will perceive change to be volatile if their expectations aren’t managed through communications and engagement planning.
Info-Tech Best Practice
The individuals best positioned to provide insight and influence change positively are also best positioned to create resistance.
These people should be engaged early and often in the implementation process – not just to make them feel included or part of the change, but also because their insight could very likely identify risks, barriers, and opportunities that need to be addressed.
3.2.1
30 minutes
Brainstorm potential implications and objections that executive stakeholders might raise about your new processes.
| Dimension | Decision | Potential Impact, Implications, and Objections | Possible Responses and Actions |
|---|---|---|---|
| i.e. Default Project Ratio | 50% | “This can’t be right...” | “We conducted a thorough time audit to establish this ratio.” |
| “We need to spend more time on project work.” | “Realistic estimates will help us control new project intake, which will help us optimize time allocated to projects.” | ||
| i.e. Frequency | Monthly | “This data isn’t detailed enough, we need to know what people are working on right now.” | “Maintaining an update frequency of weekly would require approximately [X] extra hours of PMO effort. We can work toward weekly as we mature.” |
| i.e. Scope | Person | “That is a lot of people to keep track of.” | “Managing individuals is still the job of the project manager; we are responsible for allocating individuals to projects.” |
| i.e. Granularity of Work Assignment | Project | “We need to know exactly what tasks are being worked on and what the progress is.” | “Assigning at task level is very difficult to accurately maintain. Once we have mastered a project-level granularity we can move toward task level.” |
| i.e. Forecast Horizon | One month | “We need to know what each resource is working on next year.” | “With a monthly forecast, our estimates are dependable. If we forecast a year in advance, this estimate will not be accurate.” |
Document the outcomes of this activity on slide 26 of Info-Tech’s Resource Management Communications Template.
3.2.2
30 minutes
Brainstorm potential implications and objections that individual staff and members of project teams might raise about your new processes.
| Dimension | Decision | Potential Impact, Implications, and Objections | Possible Responses and Actions |
|---|---|---|---|
| i.e. Default Project Ratio | 50% | “There’s too much support work.” | “We conducted a thorough time audit to establish this ratio. Realistic estimates will help us control new project intake, which will help us optimize your project time.” |
| i.e. Frequency | Monthly | “I don’t have time to give you updates on project progress.” | “This update frequency requires only [X] amount of time from you per week/month.” |
| i.e. Granularity | Project | “I need more clarity on what I’m working on.” | “Team members and project managers are in the best position to define and assign (or self-select) individual tasks.” |
| i.e. Forecast Horizon | One month | “I need to know what my workload will be further in advance.” | “You will still have a high-level understanding of what you will be working on in the future, but projects will only be officially forecasted one month in advance.” |
| i.e. Allocation Cadence | Monthly | “We need a more frequent cadence.” | “We can work toward weekly cadence as we mature.” |
Document the outcomes of this activity on slide 27 of Info-Tech’s Resource Management Communications Template.
3.2.3
30 minutes
Brainstorm a plan to manage other risks and challenges to implementing your processes.
| Dimension | Decision | Potential Impact, Implications, and Objections | Possible Responses and Actions |
|---|---|---|---|
| i.e. Default Project Ratio | 50% | “We have approved too many projects to allocate so little time to project work.” | Nothing has changed – this was always the amount of time that would actually go toward projects. If you are worried about a backlog, stop approving projects until you have completed the current workload. |
| i.e. Frequency | Monthly | “Status reports aren’t reliably accurate and up to date more than quarterly.” | Enforce strict requirements to provide monthly status updates for 1-3 key KPIs. |
| i.e. Scope | Person | “How can we keep track of what each individual is working on?” | Establish a simple, easy reporting mechanism so that resources are reporting their own progress. |
| i.e. Granularity | Project | “How will we know the status of a project without knowing what tasks are completed?” | It is in the domain of the project manager to know what tasks have been completed and to report overall project progress. |
| i.e. Forecast Horizon | One Month | “It will be difficult to plan for resource needs in advance.” | Planning a month in advance allows you to address conflicts or issues before they are urgent. |
Document the outcomes of this activity on slide 28 of Info-Tech’s Resource Management Communications Template.
Highlight organizational factors that necessitated the change.
Determine goals and benefits for implementation success.
Clearly indicate what is required of people to adopt new processes.
Download Info-Tech’s Resource Management Communications Template
"You need to be able to communicate effectively with major stakeholders – you really need their buy-in. You need to demonstrate credibility with your audience in the way you communicate and show how portfolio [management] is a structured decision-making process." – Dr. Shan Rajegopal (quoted in Akass, “What Makes a Successful Portfolio Manager”)
Once the strategy is adopted, the next step is to be prepared to address challenges as they come up. Review the tactics in the table below for assistance.
| Challenge | Resolution | Next Step |
|---|---|---|
| Workers are distracted because they are working on too many projects at once; their attention is split and they are unproductive. | Workers are distracted because they are working on too many projects at once; their attention is split and they are unproductive. | Review portfolio practices for ways to limit work in progress (WIP). |
| Employees are telling project managers what they want to hear and not giving honest estimates about the way their time is spent. | Ensure that employees understand the value of honest time tracking. If you’re allocating your hours to the wrong projects, it is your projects that suffer. If you are overallocated, be honest and share this with management. | Display employee time-tracking reports on a public board so that everyone will see where their time is spent. If they are struggling to complete projects by their deadlines they must be able to demonstrate the other work that is taking up their time. |
| Resources are struggling with projects because they do not have the necessary expertise. | Perform a skills audit to determine what skills employees have and assign them to projects accordingly. | If an employee with a certain skill is in high demand, consider hiring more resources who are able to complete this work. |
See below for additional challenges and tactics
Once the strategy is adopted, the next step is to use the outputs of the strategy to reclaim capacity and ensure supply and demand remain aligned. Review the tactics in the table below for assistance.
| Challenge | Resolution | Next Step |
|---|---|---|
| There is insufficient project capacity to take on new work, but demand continues to grow. | Extend project due date and manage the expectations of project sponsors with data. If possible, reclaim capacity from non-project work. | Customize the playbook to address insufficient project capacity. |
| There is significant fluctuation in demand, making it extremely challenging to stick to allocations. | Project managers can build in additional contingencies to project plans based on resourcing data, with plans for over-delivering with surplus capacity. In addition, the CIO can leverage business relationships to curb chaotic demand. The portfolio manager should analyze the project portfolio for clues on expanding demand. | Customize the playbook to address large fluctuations in demand. |
| On a constant basis, there are conflicting project demands over specific skills. | Re-evaluate the definition of a project to guard the value of the portfolio. Continually prioritize projects based on their business values as of today. | Customize the playbook to address conflicting project demands. Feed into any near- and long-term staffing plans. |
Industry Manufacturing
Source Info-Tech Client
“We were concerned that the staff would not want to do timesheets. With one level of task definition, it’s not really timesheets. It’s more about reconciling our allocations.” – PMO Director, Manufacturing
An effective pilot lowers implementation risk, enhances the details and steps within a process, and improves stakeholder relations prior to a full scale rollout.
Proactively plan for communicating responses and objections to show people that you understand their point of view and win their buy-in.
A matrix organization creates many small, untraceable demands that are often overlooked in resource management efforts, which lead to underestimating total demand and overcommitting resources. To capture them and enhance the success of your resource management effort, focus on completeness rather than precision. Precision of data will improve over time as your process maturity grows.
Draft the resource management practice with sustainability in mind. It is about what you can and will maintain every week, even during a crisis: it is not about what you put together as a one-time snapshot. Once you stop maintaining resource data, it’s nearly impossible to catch up.
Engagement paves the way for smoother adoption. An engagement approach (rather than simply communication) turns stakeholders into advocates who can help boost your message, sustain the change, and realize benefits without constant intervention or process command-and-control.
Trevor Bramwell, ICT Project Manager Viridor Waste Management
John Hansknecht, Director of Technology University of Detroit Jesuit High School & Academy
Brian Lasby, Project Manager Toronto Catholic District School Board
Jean Charles Parise, CIO & DSO Office of the Auditor General of Canada
Darren Schell, Associate Executive Director of IT Services University of Lethbridge
Develop a Project Portfolio Management Strategy
Optimize Project Intake, Approval, and Prioritization
Maintain and Organized Portfolio
Establish the Benefits Realization Process
Tailor Project Management Processes to Fit Your Projects
Project Portfolio Management Diagnostic Program
The Project Portfolio Management Diagnostic Program is a low-effort, high-impact program designed to help project owners assess and improve their PPM practices. Gather and report on all aspects of your PPM environment to understand where you stand and how you can improve.
actiTIME. “How Poor Tracking of Work Time Affects Your Business.” N.p., Oct. 2016. Web.
Akass, Amanda. “What Makes a Successful Portfolio Manager.” Pcubed, n.d. Web.
Alexander, Moira. “5 Steps to avoid overcommitting resources on your IT projects.” TechRepublic. 18 July 2016. Web.
Anderson, Ryan. “Some Shocking Statistics About Interruptions in Your Work Environment.” Filevine, 9 July 2015. Web.
Bondale, Kiron. “Focus less on management and more on the resources with resource management.” Easy in Theory, Difficult in Practice. 16 July 2014. Web.
Burger, Rachel. “10 Software Options that Will Make Your Project Resource Allocation Troubles Disappear.” Capterra Project Management Blog, 6 January 2016. Web.
Cooper, Robert, G. “Effective Gating: Make product innovation more productive by using gates with teeth.” Stage-Gate International and Product Development Institute. March/April 2009. Web.
Dimensional Research. “Lies, Damned Lies and Timesheet Data.” Replicon, July 2013. Web.
Edelman Trust Barometer. “Leadership in a Divided World.” 2016. Web.
Frank, T.A. “10 Execs with Time-Management Secrets You Should Steal.” Monday*. Issue 2: Nov-Dec 2014. Drucker Institute. Web.
Huth, Susanna. “Employees waste 759 hours each year due to workplace distractions.” The Telegraph, 22 Jun 2015. Web.
Jacobeus, Nicolas. “How Detailed Does Your Agency Time Tracking Need to Be?” Scale Blog, 18 Jul 2016. Web.
Lessing, Lawrence. Free Culture. Lulu Press Inc.: 30 July 2016.
Kwak, James. “The Importance of Excel. The Baseline Scenario, 9 Feb 2013. Web.
Madison, Daniel. “The Five Implementation Options to Manage the Risk in a New Process.” BPMInstitute.org. n.d. Web.
Mark, Gloria. Multitasking in the Digital Age. Morgan & Claypool Publishers. 1 April 2015
Maron, Shim. “Accountability Vs. Responsibility In Project Management.” Workfront, 10 June 2016. Web.
PM Solutions. “Resource Management and the PMO: Three Strategies for Addressing Your Biggest Challenge.” N.p., 2009. Web.
Project Management Institute. “Pulse of the Profession 2014.” PMI, 2014. Web.
Planview. “Capacity Planning Fuels Innovation Speed.” 2016. Web.
Rajda, Vilmos. “The Case Against Project Portfolio Management.” PMtimes, 1 Dec 2010. Web.
Reynolds, Justin. “The Sad Truth about Nap Pods at Work.” TINYpulse, 22 Aug 2016. Web.
Schulte, Brigid. “Work interrupts can cost you 6 hours a day. An efficiency expert explains how to avoid them.” Washington Post, 1 June 2015. Web.
Stone, Linda. "Continuous Partial Attention." Lindastone.net. N.p., n.d. Web.
Zawacki, Kevin. “The Perils of Time Tracking.” Fast Company, 26 Jan 2015. Web.
Organizations consider application oversight a low priority and app portfolio knowledge is poor:
Build an APM program that is actionable and fit for size:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Enterprises have more applications than they need and rarely apply oversight to monitor the health, cost, and relative value of applications to ensure efficiency and minimal risk. This blueprint will help you build a streamlined application portfolio management process.
Visibility into your application portfolio and APM practices will help inform and guide your next steps.
Capture your APM roles and responsibilities and build a repeatable process.
This tool is the central hub for the activities within Application Portfolio Management Foundations.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Work with key corporate stakeholders to come to a shared understanding of the benefits and aspects of application portfolio management.
Establish the goals of APM.
Set the scope of APM responsibilities.
Establish business priorities for the application portfolio.
1.1 Define goals and metrics.
1.2 Define application categories.
1.3 Determine steps and roles.
1.4 Weight value drivers.
Set short- and long-term goals and metrics.
Set the scope for applications.
Set the scope for the APM process.
Defined business value drivers.
Gather information on your applications to build a detailed inventory and identify areas of redundancy.
Populated inventory based on your and your team’s current knowledge.
Understanding of outstanding data and a plan to collect it.
2.1 Populate inventory.
2.2 Assign business capabilities.
2.3 Review outstanding data.
Initial application inventory
List of areas of redundancy
Plan to collect outstanding data
Work with the application subject matter experts to collect and compile data points and determine the appropriate disposition for your apps.
Dispositions for individual applications
Application rationalization framework
3.1 Assess business value.
3.2 Assess end-user perspective.
3.3 Assess TCO.
3.4 Assess technical health.
3.5 Assess redundancies.
3.6 Determine dispositions.
Business value score for individual applications
End-user satisfaction scores for individual applications
TCO score for individual applications
Technical health scores for individual applications
Feature-level assessment of redundant applications
Assigned dispositions for individual applications
Work with application delivery specialists to determine the strategic plans for your apps and place these in your portfolio roadmap.
Prioritized initiatives
Initial application portfolio roadmap
Ongoing structure of APM
4.1 Prioritize initiatives
4.2 Populate roadmap.
4.3 Determine ongoing APM cadence.
4.4 Build APM action plan.
Prioritized new potential initiatives.
Built an initial portfolio roadmap.
Established an ongoing cadence of APM activities.
Built an action plan to complete APM activities.
Many lack visibility into their overall application portfolio, focusing instead on individual projects or application development. Inevitably, application sprawl creates process and data disparities, redundant applications, and duplication of resources and stands as a significant barrier to business agility and responsiveness. The shift from strategic investment to application maintenance creates an unnecessary constraint on innovation and value delivery.
With the rise and convenience of SAAS solutions, IT has an increasing need to discover and support all applications in the organization. Unmanaged and unsanctioned applications can lead to increased reputational risk. What you don’t know WILL hurt you.
You can outsource development, you can even outsource maintenance, but you cannot outsource accountability for the portfolio. Organizations need a holistic dashboard of application performance and dispositions to help guide and inform planning and investment discussions. Application portfolio management (APM) can’t tell you why something is broken or how to fix it, but it is an important tool to determine if an application’s value and performance are up to your standards and can help meet your future goals.
Hans Eckman
Principal Research Director
Info-Tech Research Group
Research Navigation
Managing your application portfolio is essential regardless of its size or whether your software is purchased or developed in house. Each organization must have some degree of application portfolio management to ensure that applications deliver value efficiently and that their risk or gradual decline in technical health is appropriately limited.
|
Your APM goals |
If this describes your primary goal(s) |
|
|
|
|
|
|
|
|
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|
|
|
Modern software options have decreased the need for organizations to have robust in-house application management capabilities. Your applications’ future and governance of the portfolio still require a centralized IT oversight to ensure the best return on investment.
Source: National Small Business Association, 2019 |
Having more applications than an organization needs means unnecessarily high costs and additional burden on the teams who support the applications. Especially in the case of small enterprises, this is added pressure the IT team cannot afford. A poorly maintained portfolio will eventually hurt the business more than it hurts IT. Legacy systems, complex environments, or anything that leads to a portfolio that can’t adapt to changing business needs will eventually become a barrier to business growth and accomplishing objectives. Often the blame is put on the IT department. |
56%
of small businesses cited inflexible technology as a barrier to growth Source: Salesforce as quoted by Tech Republic, 2019 |
||||||||||||||
A hidden and inefficient application portfolio is the root cause of so many pains experienced by both IT and the business.
The benefits of APM
APM identifies areas where you can reduce core spending and reinvest in innovation initiatives.
Other benefits can include:
Application Inventory
The artifact that documents and informs the business of your application portfolio.
Application Rationalization
The process of collecting information and assessing your applications to determine recommended dispositions.
Application Alignment
The process of revealing application information through interviewing stakeholders and aligning to business capabilities.
Application Roadmap
The artifact that showcases the strategic directions for your applications over a given timeline.
The ongoing practice of:
Product Lifecycle Management
Align your product and service improvement and execution to enterprise strategy and value realization in three key areas: defining your products and services, aligning product/service owners, and developing your product vision.
Product Delivery Lifecycle (Agile DevOps)
Enhance business agility by leveraging an Agile mindset and continuously improving your delivery throughput, quality, value realization, and adaptive governance.
Application Portfolio Management
Transform your application portfolio into a cohesive service catalog aligned to your business capabilities by discovering, rationalizing, and modernizing your applications while improving application maintenance, management, and reuse.
Inefficiencies within your application portfolio are created by the gradual and non-strategic accumulation of applications.
You have more apps than you need.
Only 34% of software is rated as both IMPORTANT and EFFECTIVE by users.
|
Directionless portfolio of applications |
Info-Tech’s Five Lens Model |
Assigned dispositions for individual apps |
||||
|
Application Alignment |
Business Value |
Technical Health |
End-User Perspective |
Total Cost of Ownership (TCO) |
Maintain: Keep the application but adjust its support structure. Modernize: Create a new initiative to address an inadequacy. Consolidate: Create a new initiative to reduce duplicate functionality. Retire: Phase out the application. Disposition: The intended strategic direction or implied course of action for an application. |
|
How well do your apps support your core functions and teams? |
How well are your apps aligned to value delivery? |
Do your apps meet all IT quality standards and policies? |
How well do your apps meet your end users’ needs? |
What is the relative cost of ownership and operation of your apps? |
||
|
Application rationalization requires the collection of several data points that represent these perspectives and act as the criteria for determining a disposition for each of your applications. |
||||||
| Determine Scope and categories | Build your list of applications and capabilities | Score each application based on your values | Determine outcomes based on app scoring and support for capabilities | |||
|---|---|---|---|---|---|---|
|
1. Lay Your Foundations 1.1 Assess the state of your current application portfolio. 1.2 Determine narrative. 1.3 Define goals and metrics. 1.4 Define application categories. 1.5 Determine APM steps and roles (SIPOC). |
⇒ |
2. Improve Your Inventory 2.1 Populate your inventory. 2.2 Align to business capabilities. *Repeat |
⇒ |
3. Rationalize Your Apps 3.1 Assess business value. 3.2 Assess technical health. 3.3 Assess end-user perspective. 3.4 Assess total cost of ownership. *Repeat |
⇒ |
4. Populate Your Roadmap 4.1 Review APM Snapshot results. 4.2 Review APM Foundations results. 4.3 Determine dispositions. 4.4 Assess redundancies (optional). 4.5 Determine dispositions for redundant applications (optional). 4.6 Prioritize initiatives. 4.7 Determine ongoing cadence. *Repeat |
INDUSTRY: Retail
SOURCE: Deloitte, 2017
|
Supermarket Company The grocer was a smaller organization for the supermarket industry with a relatively low IT budget. While its portfolio consisted of a dozen applications, the organization still found it difficult to react to an evolving industry due to inflexible and overly complex legacy systems. The IT manager found himself in a scenario where he knew the applications well but had little awareness of the business processes they supported. Application maintenance was purely in keeping things operational, with little consideration for a future business strategy. As the business demanded more responsiveness to changes, the IT team needed to be able to react more efficiently and effectively while still securing the continuity of the business. The IT manager found success by introducing APM and gaining a better understanding of the business use and future needs for the applications. The organization started small but then increased the scope over time to produce and develop techniques to aid the business in meeting strategic goals with applications. Results The IT manager gained credibility and trust within the organization. The organization was able to build a plan to move away from the legacy systems and create a portfolio more responsive to the dynamic needs of an evolving marketplace. |
The application portfolio management initiative included the following components: Train teams and stakeholders on APM Model the core business processes Collect application inventory Assign APM responsibilities Start small, then grow |
|
1. Lay Your Foundations |
2. Improve Your Inventory |
3. Rationalize Your Apps |
4. Populate Your Roadmap |
|
|---|---|---|---|---|
|
Phase Activities |
1.1 Assess your current application portfolio 1.2 Determine narrative 1.3 Define goals and metrics 1.4 Define application categories 1.5 Determine APM steps and roles |
2.1 Populate your inventory 2.2 Align to business capabilities |
3.1 Assess business value 3.2 Assess technical health 3.3 Assess end-user perspective 3.4 Assess total cost of ownership |
4.1 Review APM Snapshot results 4.2 Review APM Foundations results 4.3 Determine dispositions 4.4 Assess redundancies (optional) 4.5 Determine dispositions for redundant applications (optional) 4.6 Prioritize initiatives 4.7 Determine ongoing APM cadence |
|
Phase Outcomes |
Work with the appropriate management stakeholders to:
|
Gather information on your own understanding of your applications to build a detailed inventory and identify areas of redundancy. |
Work with application subject matter experts to collect and compile data points and determine the appropriate disposition for your apps. |
Work with application delivery specialists to determine the strategic plans for your apps and place these in your portfolio roadmap. |
Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.
|
Application Portfolio Management Foundations Playbook |
Application Portfolio Management Snapshot and Foundations Tool |
|
This template allows you to capture your APM roles and responsibilities and build a repeatable process. |
This tool stores all relevant application information and allows you to assess your capability support, execute rationalization, and build a portfolio roadmap. |
|
|
Key deliverable:
Blueprint Storyboard
This is the PowerPoint document you are viewing now. Follow this guide to understand APM, learn how to use the tools, and build a repeatable APM process that will be captured in your playbook.
DIY Toolkit |
Guided Implementation |
Workshop |
Consulting |
| “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.” | “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.” | “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.” | “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.” |
Diagnostics and consistent frameworks used throughout all four options
| Phase 1 | Phase 2 | Phase 3 | Phase 4 |
|---|---|---|---|
|
Call #1: Establish goals and foundations for your APM practice. |
Call #2: Initiate inventory and determine data requirements. |
Call #3: Initiate rationalization with group of applications. Call #4: Review result of first iteration and perform retrospective. |
Call #5: Initiate your roadmap and determine your ongoing APM practice. |
Note: The Guided Implementation will focus on a subset or group of applications depending on the state of your current APM inventory and available time. The goal is to use this first group to build your APM process and models to support your ongoing discovery, rationalization, and modernization efforts.
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our right-sized best practices in your organization. A typical GI, using our materials, is 3 to 6 calls over the course of 1 to 3 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
1. Lay Your Foundations | 2. Improve Your Inventory | 3. Rationalize Your Apps | 4. Populate Your Roadmap | Post Workshop Steps | |
|---|---|---|---|---|---|
Activities | 1.1 Assess your current 1.2 Determine narrative 1.3 Define goals and metrics 1.4 Define application categories 1.5 Determine APM steps and roles | 2.1 Populate your inventory 2.2 Align to business capabilities | 3.1 Assess business value 3.2 Assess technical health 3.3 Assess end-user perspective 3.4 Assess total cost of ownership | 4.1 Review APM Snapshot results 4.2 Review APM Foundations results 4.3 Determine dispositions 4.4 Assess redundancies (optional) 4.5 Determine dispositions for redundant applications (optional) 4.6 Prioritize initiatives 4.7 Determine ongoing APM cadence |
|
Outcomes | Work with the appropriate management stakeholders to:
| Work with your applications team to:
| Work with the SMEs for a subset of applications to:
| Work with application delivery specialists to:
| Info-Tech analysts complete:
|
Note: The workshop will focus on a subset or group of applications depending on the state of your current APM inventory and available time. The goal is to use this first group to build your APM process and models to support your ongoing discovery, rationalization, and modernization efforts.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
|
Outcomes |
1-Day Snapshot |
3-Day Snapshot and Foundations (Key Apps) |
4-Day Snapshot and Foundations (Pilot Area) |
|---|---|---|---|
|
APM Snapshot
|
✓ | ✓ | ✓ |
|
APM Foundations
|
✓ Establish APM practice with a small sample set of apps and capabilities. |
✓ Establish APM practice with a pilot group of apps and capabilities. |
|
APM Lead/Owner (Recommended) ☐ Applications Lead or the individual responsible for application portfolio management, along with any applications team members, if available Key Corporate Stakeholders Depending on size and structure, participants could include: ☐ Head of IT (CIO, CTO, IT Director, or IT Manager) ☐ Head of shared services (CFO, COO, VP HR, etc.) ☐ Compliance Officer, Steering Committee ☐ Company owner or CEO Application Subject Matter Experts Individuals who have familiarity with a specific subset of applications ☐ Business owners (product owners, Head of Business Function, power users) ☐ Support owners (Operations Manager, IT Technician) Delivery Leads ☐ Development Managers ☐ Solution Architects ☐ Project Managers |
1.Diagnostic
|
5. Foundations: Chart
|
|
2. Data Journey
|
6. App Comparison
|
|
3. Snapshot
|
7. Roadmap
|
|
4. Foundations: Results
|
|
Examples and explanations of these tools are located on the following slides and within the phases where they occur.
One of the primary purposes of application portfolio management is to get what we know and need to know on paper so we can share a common vision and understanding of our portfolio. This enables better discussions and decisions with your application owners and stakeholders.
|
|
TCO, compared relatively to business value, helps determine the practicality of a disposition and the urgency of any call to action. Application alignment is factored in when assessing redundancies and has a separate set of dispositions.
|
Phase 1 1.1 Assess Your Current Application Portfolio 1.2 Determine Narrative 1.3 Define Goals and Metrics 1.4 Define Application Categories 1.5 Determine APM Steps and Roles |
Phase 2 2.1 Populate Your Inventory 2.2 Align to Business Capabilities |
Phase 3 3.1 Assess Business Value 3.2 Assess Technical Health 3.3 Assess End-User Perspective 3.4 Assess Total Cost of Ownership |
Phase 4 4.1 Review APM Snapshot Results 4.2 Review APM Foundations Results 4.3 Determine Dispositions 4.4 Assess Redundancies (Optional) 4.5 Determine Dispositions for Redundant Applications (Optional) 4.6 Prioritize Initiatives 4.7 Determine Ongoing APM Cadence |
This phase involves the following participants:
Applications Lead
Key Corporate Stakeholders
Additional Resources
Building an APM process requires a proper understanding of the underlying business goals and objectives of your organization’s strategy. Effectively identifying these drivers is paramount to gaining buy-in and the approval for any changes you plan to make to your application portfolio.
After identifying these goals, you will need to ensure they are built into the foundations of your APM process.
“What is most critical?” but also “What must come first?”
|
Discover |
Improve |
Transform |
|---|---|---|
|
Collect Inventory Uncover Shadow IT Uncover Redundancies Anticipate Upgrades Predict Retirement |
Reduce Cost Increase Efficiency Reduce Applications Eliminate Redundancy Limit Risk |
Improve Architecture Modernize Enable Scalability Drive Business Growth Improve UX |
One of the primary purposes of application portfolio management is to get what we know and need to know on paper so we can share a common vision and understanding of our portfolio. This enables better discussions and decisions with your application owners and stakeholders.
Estimated time: 1 hour
Download the Application Portfolio Management Diagnostic Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
|
|
|
|
|
|
Portfolio Governance |
Transformative Initiatives |
Event-Driven Rationalization |
|
Improves:
Impact on your rationalization framework:
|
Enables:
Impact on your rationalization framework:
|
Responds to:
Impact on your rationalization framework:
|
Different motivations will influence the appropriate approach to and urgency of APM or, specifically, rationalizing the portfolio. When rationalizing is directly related to enabling or in response to a broader initiative, you will need to create a more structured approach with a formal budget and resources.
Estimated time: 30 minutes-2 hours
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
|
Root Cause |
IT Pain Points |
Business Pain Points |
Business Goals |
Narrative |
Technical Objectives |
|---|---|---|---|---|---|
|
Sprawl Shadow IT/decentralized oversight Neglect over time Poor delivery processes |
Back-End Complexity Disparate Data/Apps Poor Architectural Fit Redundancy Maintenance Demand/ Low Maintainability Technical Debt Legacy, Aging, or Expiring Apps Security Vulnerabilities Unsatisfied Customers |
Hurdles to Growth/Change Poor Business Analytics Process Inefficiency Software Costs Business Continuity Risk Data Privacy Risk Data/IP Theft Risk Poor User Experience Low-Value Apps |
Scalability Flexibility/Agility Data-Driven Insights M&A Transition Business Unit Consolidation/ Centralization Process Improvement Process Modernization Cost Reduction Stability Customer Protection Security Employee Enablement Business Enablement Innovation |
Create Strategic Alignment Identify specific business capabilities that are incompatible with strategic initiatives. Reduce Application Intensity Highlight the capabilities that are encumbered due to functional overlaps and complexity. Reduce Software Costs Specific business capabilities come at an unnecessarily or disproportionately high cost. Mitigate Business Continuity Risk Specific business capabilities are at risk of interruption or stoppages due to unresolved back-end issues. Mitigate Security Risk Specific business capabilities are at risk due to unmitigated security vulnerabilities or breaches. Increase Satisfaction Applications Specific business capabilities are not achieving their optimal business value. |
Platform Standardization Platform Standardization Consolidation Data Harmonization Removal/Consolidation of Redundant Applications Legacy Modernization Application Upgrades Removal of Low-Value Applications |
Estimated time: 1 hour
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
|
Goals |
Metric |
Target |
||
|---|---|---|---|---|
|
Short Term |
Improve ability to inform the business |
Leading Indicators |
|
|
|
Improve ownership of applications |
|
|
||
|
Reduce costs of portfolio |
|
|
||
|
Long Term |
Migrate platform |
Lagging Indicators |
|
|
|
Improve overall satisfaction with portfolio |
|
|
||
|
Become more customer-centric |
|
|
|
Code: A body of code that's seen by developers as a single unit. |
|
Functionality: A group of functionality that business customers see as a single unit. |
|
|
Funding: An initiative that those with the money see as a single budget. |
|
| ?: What else? |
“Essentially applications are social constructions.”
Source: Martin Fowler
APM focuses on business applications.
“Software used by business users to perform a business function.”
Unfortunately, that definition is still quite vague.
|
1. Many individual items can be considered applications on their own or components within or associated with an application. |
2. Different categories of applications may be out of scope or handled differently within the activities and artifacts of APM. |
|
Different categories of applications may be out of scope or handled differently within the activities and artifacts of APM.
|
Apps can be categorized by generic categories
|
|
Apps can be categorized by bought vs. built or install types
|
|
|
Apps can be categorized by the application family
|
Apps can be categorized by the group managing them
|
|
Apps can be categorized by tiers
|
Set boundaries on what is an application or the individual unit that you’re making business decisions on. Also, determine which categories of applications are in scope and how they will be included in the activities and artifacts of APM. Use your product families defined in Deliver Digital Products at Scale to help define your application categories, groups, and boundaries.
Estimated time: 1 hour
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
|
Category |
Definition/Description |
Examples |
Documented in your application inventory? |
Included in application rationalization? |
Listed in your application portfolio roadmap? |
|
Business Application |
End-user facing applications that directly enable specific business functions. This includes enterprise-wide and business-function-specific applications. Separate modules will be considered a business application when appropriate. |
ERP system, CRM software, accounting software |
Yes |
Yes. Unless currently in dev. TCO of the parent application will be divided among child apps. |
Yes |
|
Software Components |
Back-end solutions are self-contained units that support business functions. |
ETL, middleware, operating systems |
No. Documentation in CMDB. These will be listed as a dependency in the application inventory. |
No. These will be linked to a business app and included in TCO estimates and tech health assessments. |
No |
|
Productivity Tools |
End-user-facing applications that enable standard communication of general document creation. |
MS Word, MS Excel, corporate email |
Yes |
No |
Yes |
|
End-User- Built Microsoft Tools |
Single instances of a Microsoft tool that the business has grown dependent on. |
Payroll Excel tool, Access databases |
No. Documentation in Business Tool Glossary. |
No | No |
|
Partner Applications |
Partners or third-party applications that the business has grown dependent on but are internally owned or managed. |
Supplier’s ERP portal, government portal |
No | No |
Yes |
|
Shadow IT |
Business-managed applications. |
Downloaded tools |
Yes |
Yes. However, just from a redundancy perspective. |
Yes |
|
Application Portfolio Manager
|
Business Owner
|
|
Support Owner
|
Project Portfolio Manager
|
Corner-of-the-Desk Approach
Dedicated Approach
Create the full list of applications and capture all necessary attributes.
Engage with appropriate SMEs and collect necessary data points for rationalization.
Apply rationalization framework and toolset to determine dispositions.
Present dispositions for validation and communicate any decisions or direction for applications.
Estimated time: 1-2 hours
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
|
Suppliers |
Inputs |
Process |
Outputs |
Customers |
|---|---|---|---|---|
|
|
Build Inventory Create the full list of applications and capture all necessary attributes. Resp: Applications Manager & IT team member |
|
|
|
|
Collect & Compile Engage with appropriate SMEs and collect necessary data points for rationalization. Resp: IT team member |
|
|
|
|
Assess & Recommend Apply rationalization framework and toolset to determine dispositions. Resp: Applications Manager |
|
|
|
|
Validate & Roadmap Present dispositions for validation and communicate any decisions or direction for applications. Resp: Applications Manager |
|
|
|
|
Project Intake Build business case for project request. Resp: Project Manager |
|
|
| Discovery | Rationalization | Disposition | Roadmap |
|---|---|---|---|
|
Enter your pilot inventory.
|
Score your pilot apps to refine your rationalization criteria and scoring.
|
Determine recommended disposition for each application.
|
Populate your application roadmap.
|
Phase 1 1.1 Assess Your Current Application Portfolio 1.2 Determine Narrative 1.3 Define Goals and Metrics 1.4 Define Application Categories 1.5 Determine APM Steps and Roles | Phase 2 2.1 Populate Your Inventory 2.2 Align to Business Capabilities | Phase 3 3.1 Assess Business Value 3.2 Assess Technical Health 3.3 Assess End-User Perspective 3.4 Assess Total Cost of Ownership | Phase 4 4.1 Review APM Snapshot Results 4.2 Review APM Foundations Results 4.3 Determine Dispositions 4.4 Assess Redundancies (Optional) 4.5 Determine Dispositions for Redundant Applications (Optional) 4.6 Prioritize Initiatives 4.7 Determine Ongoing APM Cadence |
This phase involves the following participants:
Additional Resources
Document Your Business Architecture
The more information you plan to capture, the larger the time and effort, especially as you move along toward advanced and strategic items. Capture the information most aligned to your objectives to make the most of your investment.
If you completed Deliver Digital Products at Scale, use your product families and products to help define your applications.
Learn more about automated application discovery:
High Application Satisfaction Starts With Discovering Your Application Inventory
Estimated time: 1-4 hours per group
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
For the purposes of an inventory, business capabilities help all stakeholders gain a sense of the functionality the application provides.
However, the true value of business capability comes with rationalization.
Upon linking all the organization’s applications to a standardized and consistent set of business capabilities, you can then group your applications based on similar, complementary, or overlapping functionality. In other words, find your redundancies and consolidation opportunities.
Important Consideration
Defining business capabilities and determining the full extent of redundancy is a challenging undertaking and often is a larger effort than APM all together.
Business capabilities should be defined according to the unique functions and language of your organization, at varying levels of granularity, and ideally including target-state capabilities that identify gaps in the future strategy.
This blueprint provides a simplified and generic list for the purpose of categorizing similar functionality. We strongly encourage exploring Document Your Business Architecture to help in the business capability defining process, especially when visibility into your portfolio and knowledge of redundancies is poor.
For a more detailed capability mapping, use the Application Portfolio Snapshot and the worksheets in your current workbook.
A business capability map (BCM) is an abstraction of business operations that helps describe what the enterprise does to achieve its vision, mission, and goals. Business capabilities are the building blocks of the enterprise. They are typically defined at varying levels of granularity and include target-state capabilities that identify gaps in the future strategy. These are the people, process, and tool units that deliver value to your teams and customers.
Info-Tech’s Industry Coverage and Reference Architectures give you a head start on producing a BCM fit for your organization. The visual to the left is an example of a reference architecture for the retail industry.
These are the foundational piece for our Application Portfolio Snapshot. By linking capabilities to your supporting applications, you can better visualize how the portfolio supports the organization at a single glance. More specifically, you can highlight how issues with the portfolio are impacting capability delivery.
Reminder: Best practices imply that business capabilities are methodologically defined by business stakeholders and business architects to capture the unique functions and language of your organization.
The approach laid out in this service is about applying minimal time and effort to make the case for proper investment into the best practices, which can include creating a tailored BCM. Start with a good enough example to produce a useful visual and generate a positive conversation toward resourcing and analyses.
We strongly encourage exploring Document Your Business Architecture and the Application Portfolio Snapshot to understand the thorough methods and tactics for BCM.
Having to address redundancy complicates the application rationalization process. There is no doubt that assessing applications in isolation is much easier and allows you to arrive at dispositions for your applications in a timelier manner.
Rationalization has two basic steps: first, collect and compile information, and second, analyze that information and determine a disposition for each application. When you don’t have redundancy, you can analyze an application and determine a disposition in isolation. When you do have redundancies, you need to collect information for multiple applications, likely across departments or lines of business, then perform a comparative analysis.
Most likely your approach will fall somewhere between the examples below and require a hybrid approach.
Benefits of a high-level application alignment:
Estimated time: 1-4 hours per grouping
The APM tool provides up to three different grouping comparisons to assess how well your applications are supporting your enterprise. Although business capabilities are important, identify your organizational perspectives to determine how well your portfolio supports these functions, departments, or value streams. Each grouping should be a consistent category, type, or arrangement of applications.
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
|
Capability, Department, or Function 1 |
Capability, Department, or Function 2 |
Capability, Department, or Function 3 |
Capability, Department, or Function 4 |
Capability, Department, or Function 5 |
Capability, Department, or Function 6 |
|
|---|---|---|---|---|---|---|
|
Application A |
x | |||||
|
Application B |
x | |||||
|
Application C |
x | |||||
|
Application D |
x | |||||
|
Application E |
x | x | ||||
|
Application F |
x | |||||
|
Application G |
x | |||||
|
Application H |
x | |||||
|
Application I |
x | |||||
|
Application J |
x |
In this example:
BC 1 is supported by App A
BC 2 is supported by App B
BC 3 is supported by Apps C & D
BCs 4 & 5 are supported by App E
BC 6 is supported by Apps F-G. BC 6 shows an example of potential redundancy and portfolio complexity.
The APM tool supports three different Snapshot groupings. Repeat this exercise for each grouping.
Phase 1 1.1 Assess Your Current Application Portfolio 1.2 Determine Narrative 1.3 Define Goals and Metrics 1.4 Define Application Categories 1.5 Determine APM Steps and Roles | Phase 2 2.1 Populate Your Inventory 2.2 Align to Business Capabilities | Phase 3 3.1 Assess Business Value 3.2 Assess Technical Health 3.3 Assess End-User Perspective 3.4 Assess Total Cost of Ownership | Phase 4 4.1 Review APM Snapshot Results 4.2 Review APM Foundations Results 4.3 Determine Dispositions 4.4 Assess Redundancies (Optional) 4.5 Determine Dispositions for Redundant Applications (Optional) 4.6 Prioritize Initiatives 4.7 Determine Ongoing APM Cadence |
This phase involves the following participants:
Additional Resources
Application Rationalization | Additional Information Sources | Ideal Stakeholders |
|---|---|---|
| Business Value
| |
| End User
| |
| TCO
| |
| Technical Health
| |
| Application Alignment
|
Disposition: The intended strategic direction or course of action for an application.
|
Directionless portfolio of applications |
Assigned dispositions for individual apps High-level examples: |
|---|---|
|
Maintain: Keep the application but adjust its support structure.
Modernize: Create a new project to address an inadequacy.
Consolidate: Create a new project to reduce duplicate functionality.
Retire: Phase out the application.
|
Directionless portfolio of applications | Info-Tech’s Five Lens Model | Assigned dispositions for individual apps | ||||
![]() | Application Alignment | Business Value | Technical Health | End-User Perspective | Total Cost of Ownership (TCO) | Maintain: Keep the application but adjust its support structure. Modernize: Create a new initiative to address an inadequacy. Consolidate: Create a new initiative to reduce duplicate functionality. Retire: Phase out the application. Disposition: The intended strategic direction or implied course of action for an application. |
How well do your apps support your core functions and teams? | How well are your apps aligned to value delivery? | Do your apps meet all IT quality standards and policies? | How well do your apps meet your end users’ needs? | What is the relative cost of ownership and operation of your apps? | ||
Application rationalization requires the collection of several data points that represent these perspectives and act as the criteria for determining a disposition for each of your applications. Disposition: The intended strategic direction or implied course of action for an application. | ||||||
| The Business | Business Value of Applications | IT |
|---|---|---|
| Keepers of the organization’s mission, vision, and value statements that define IT success. The business maintains the overall ownership and evaluation of the applications. | Technical subject matter experts of the applications they deliver and maintain. Each IT function works together to ensure quality applications are delivered to stakeholder expectations. |
First, the authorities on business value need to define and weigh their value drivers that describe the priorities of the organization.
This will then allow the applications team to apply a consistent, objective, and strategically aligned evaluation of applications across the organization.
In this context…business value is the value of the business outcome that the application produces and how effective the application is at producing that outcome.
Business value IS NOT the user’s experience or satisfaction with the application.
|
Financial vs. Human Benefits Financial benefits refer to the degree to which the value source can be measured through monetary metrics and are often quite tangible. Human benefits refer to how an application can deliver value through a user’s experience. Inward vs. Outward Orientation Inward orientation refers to value sources that have an internal impact and improve your organization’s effectiveness and efficiency in performing its operations. Outward orientation refers to value sources that come from your interaction with external factors, such as the market or your customers. |
|
|---|
|
Increased Revenue |
Reduced Costs |
Enhanced Services |
Reach Customers |
|---|---|---|---|
|
Application functions that are specifically related to the impact on your organization’s ability to generate revenue and deliver value to your customers. |
Reduction of overhead. The ways in which an application limits the operational costs of business functions. |
Functions that enable business capabilities that improve the organization’s ability to perform its internal operations. |
Application functions that enable and improve the interaction with customers or produce market information and insights. |
Record the results in the APM Snapshot and Foundations Tool
| Input | Output |
|
|
| Materials | Participants |
|
|
For additional support in implementing a balanced value framework, refer to Build a Value Measurement Framework.
MAINTAINABILITY (RAS)
RAS refers to an app’s reliability, availability, and serviceability. How often, how long, and how difficult is it for your resources to keep an app functioning, and what are the resulting continuity risks? This can include root causes of maintenance challenges.
SECURITY
Applications should be aligned and compliant with ALL security policies. Are there vulnerabilities or is there a history of security incidents? Remember that threats are often internal and non-malicious.
ADAPTABILITY
How easily can the app be enhanced or scaled to meet changes in business needs? Does the app fit within the business strategy?
INTEROPERABILITY
The degree to which an app is integrated with current systems. Apps require comprehensive technical planning and oversight to ensure they connect within the greater application architecture. Does the app fit within your enterprise architecture strategy?
BUSINESS CONTINUITY/DISASTER RECOVERY
The degree to which the application is compatible with business continuity/disaster recovery (BC/DR) policies and plans that are routinely tested and verified.
Unfortunately, the business only cares about what they can see or experience. Rationalization is your opportunity to get risk on the business’ radar and gain buy-in for the necessary action.
Estimated time: 1-4 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Data Quality
To what degree do the end users find the data quality sufficient to perform their role and achieve their desired outcome?
Effectiveness
To what degree do the end users find the application effective for performing their role and desired outcome?
Usability
To what degree do the end users find the application reliable and easy to use to achieve their desired outcome?
Satisfaction
To what degree are end users satisfied with the features of this application?
What else matters to you?
Tune your criteria to match your values and priorities.
When facing large user groups, do not make assumptions or use lengthy methods of collecting information. Use Info-Tech’s Application Portfolio Assessment to collect data by surveying your end users’ perspectives.
Estimated time: 1-4 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
LICENSING AND SUBSCRIPTIONS: Your recurring payments to a vendor.
Many commercial off-the-shelf applications require a license on a per-user basis. Review contracts and determine costs by looking at per-user or fixed rates charged by the vendor.
MAINTENANCE COSTS: Your internal spending to maintain an app.
These are the additional costs to maintain an application such as support agreements, annual maintenance fees, or additional software or hosting expenses.
INDIRECT COSTS: Miscellaneous expenses necessary for an app’s continued use.
Expenses like end-user training, developer education, and admin are often neglected, but they are very real costs organizations pay regularly.
RETURN ON INVESTMENT: Perceived value of the application related to its TCO.
Some of our most valuable applications are the most expensive. ROI is an optional criterion to account for the value and importance of the application.
The TCO assessment is one area where what you are considering the ”application” matters quite a bit. An application’s peripherals or software components need to be considered in your estimates. For additional help calculating TCO, use the Application TCO Calculator from Build a Rationalization Framework.
Estimated time: 1-4 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Phase 1 1.1 Assess Your Current Application Portfolio 1.2 Determine Narrative 1.3 Define Goals and Metrics 1.4 Define Application Categories 1.5 Determine APM Steps and Roles | Phase 2 2.1 Populate Your Inventory 2.2 Align to Business Capabilities | Phase 3 3.1 Assess Business Value 3.2 Assess Technical Health 3.3 Assess End-User Perspective 3.4 Assess Total Cost of Ownership | Phase 4 4.1 Review APM Snapshot Results 4.2 Review APM Foundations Results 4.3 Determine Dispositions 4.4 Assess Redundancies (Optional) 4.5 Determine Dispositions for Redundant Applications (Optional) 4.6 Prioritize Initiatives 4.7 Determine Ongoing APM Cadence |
his phase involves the following participants:
Additional Resources
Estimated time: 1-2 hours
| Input | Output |
|
|
Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Estimated time: 1-2 hours
The APM Foundations Results dashboard (“App Rationalization Results” worksheet) provides a detailed summary of your relative app scoring to serve as input to demand planning.
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
|
|
TCO, compared relatively to business value, helps determine the practicality of a disposition and the urgency of any call to action. Application alignment is factored in when assessing redundancies and has a separate set of dispositions.
Estimated time: 1-4 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Solving application redundancy is a lot more complicated than simply keeping one application and eliminating the others.
First, you need to understand the extent of the redundancy. The applications may support the same capability, but do they offer the same functions? Determine which apps offer which functions within a capability. This means you cannot accurately arrive at a disposition until you have evaluated all applications.
Next, you need to isolate the preferred system. This is completed by comparing the same data points collected for rationalization and the application alignment analysis. Cost and coverage of all necessary functions become the more important factors in this decision-making process.
Lastly, for the non-preferred redundant applications you need to determine: What will you do with the users? What will you do with the data? And what can you do with the functionality (can the actual coding be merged onto a common platform)?
|
Disposition |
Description & Additional Analysis |
Call to Action (Priority) |
|---|---|---|
|
Keep & Absorb Higher value, health satisfaction, and cost than alternatives |
These are the preferred apps to be kept. However, additional efforts are still required to migrate new users and data and potentially configure the app to new processes. |
Application or Process Initiative (Moderate) |
|
Shift & Retire Lower value, health satisfaction, and cost than alternatives |
These apps will be decommissioned alongside efforts to migrate users and data to the preferred system. *Confirm there are no unique and necessary features. |
Process Initiative & Decommission (Moderate) |
|
Merge Lower value, health satisfaction, and cost than alternatives but still has some necessary unique features |
These apps will be merged with the preferred system onto a common platform. *Determine the unique and necessary features. *Determine if the multiple applications are compatible for consolidation. |
Application Initiative (Moderate) |
Estimated rime: 1 hour per group
This exercise is best performed after aligning business capabilities to applications across the portfolio and identifying your areas of redundancy. At this stage, this is still an information collection exercise, and it will not yield a consolidation-based disposition until applied to all relevant applications. Lastly, this exercise may still be at too high a level to outline the full details of redundancy, but it is still vital information to collect and a starting point to determine which areas require more concentrated analysis.
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
|
Account Management |
Call Management |
Order/Transaction Processing |
Contract Management |
Lead/Opportunity Management |
Forecasting/Planning |
Customer Surveying |
Email Synchronization |
|
|---|---|---|---|---|---|---|---|---|
| M | M | M | M | S | S | C | W | |
|
CRM 1 |
✓ |
✓ | ✓ | ✓ | ✓ | ✓ | ✓ | |
|
CRM 2 |
✓ | ✓ | ✓ | ✓ | ||||
|
CRM 3 |
✓ | ✓ | ✓ |
Estimated time: 1 hour per group
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Roadmaps are used for different communication purposes and at varying points in your application delivery practice. Some use a roadmap to showcase strategy and act as a feedback mechanism that allows stakeholders to validate any changes (process 1). Others may use it to illustrate and communicate approved and granular elements of a change to an application to inform appropriate stakeholders of what to anticipate (process 2).
|
Select Dispositions & Identify New Initiatives |
Add to Roadmap |
Validate Direction |
Plan Project |
Execute Project |
|
Select Dispositions & Identify New Initiatives |
|
Approve Project |
Add to Roadmap |
Execute Project |
The steps between selecting a disposition and executing on any resulting project will vary based on the organization’s project intake standards (or lack thereof).
This blueprint focuses on building a strategic portfolio roadmap prior to any in-depth assessments related to initiative/project intake, approval, and prioritization. For in-depth support related to intake, approval, prioritization, or planning, review the following resources.
|
|
A roadmap should not be limited to what is approved or committed to. A roadmap should be used to present the items that need to happen and begin the discussion of how or if this can be put into place. However, not every idea should make the cut and end up in front of key stakeholders.
Estimated time: 1-4 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Info-Tech’s Build an Application Rationalization Framework provides additional TCO and value tools to help build out your portfolio strategy.
| Determine scope and categories | Build your list of applications and capabilities | Score each application based on your values | Determine outcomes based on app scoring and support for capabilities |
|---|---|---|---|
|
1. Lay Your Foundations
|
2. Improve Your Inventory
|
3. Rationalize Your Apps
|
4. Populate Your Roadmap
|
Repeat according to APM cadence and application changes
Estimated time: 1-2 hours
| Input | Output |
|
|
| Materials | Participants |
|
|
Record the results in the APM Snapshot and Foundations Tool
Artifact | Owner | Update Cadence | Update Scope | Audience | Presentation Cadence |
|---|---|---|---|---|---|
Inventory | Greg Dawson |
|
|
|
|
Rationalization Tool | Judy Ng |
|
|
|
|
Portfolio Roadmap | Judy Ng |
|
|
|
|
Worksheet Data Mapping | Application and Capability List | Group Alignment Matrix (1-3) | Rationalization Inputs | Group 1-3 Results | Application Inventory Details | App Rationalization Results | Roadmap | App Redundancy Comparison |
|---|---|---|---|---|---|---|---|---|
Application and Capability List | App list, Groupings | App list | App list, Groupings | App list, Categories | App list, Categories | App list | App list | |
Groups 1-3 Alignment Matrix | App to Group Tracing | |||||||
Application Categories | Category | Category | Category | |||||
Rationalization Inputs | Lens Scores (weighted input to Group score) | Lens Scores (weighted input) | ||||||
Disposition Options | Disposition list, Priorities list, Recommended Disposition and Priority | Lens Scores (weighted input) | ||||||
App Rationalization Results | Disposition |
| Attribute | Description | Common Collection Method |
|---|---|---|
| Name | Organization’s terminology used for the application. | Auto-discovery tools will provide names for the applications they reveal. However, this may not be the organizational nomenclature. You may adapt the names by leveraging pre-existing documentation and internal knowledge or by consulting business users. |
| ID | Unique identifiers assigned to the application (e.g. app number). | Typically an identification system developed by the application portfolio manager. |
| Description | A brief description of the application, often referencing core capabilities. | Typically completed by leveraging pre-existing documentation and internal knowledge or by consulting business users. |
| Business Units | A list of all business units, departments, or user groups. | Consultation, surveys, or interviews with business unit representatives. However, this doesn’t always expose hidden applications. Application-capability mapping is the most effective way to determine all the business units/user groups of an app. |
| Business Capabilities | A list of business capabilities the application is intended to enable. | Application capability mapping completed via interviews with business unit representatives. |
| Criticality | A high-level grading of the importance of the application to the business, typically used for support prioritization purposes (i.e. critical, high, medium, low). | Typically the criticality rating is determined by a committee representing IT and business leaders. |
| Ownership | The individual accountable for various aspect of the application (e.g. product owner, product manager, application support, data owner); typically includes contact information and alternatives. | If application ownership is an established accountability in your organization, typically consulting appropriate business stakeholders will reveal this information. Otherwise, application capability mapping can be an effective means of identifying who that owner should be. |
| Application SMEs | Any relevant subject matter experts who can speak to various aspects of the application (e.g. business process owners, development managers, data architects, data stewards, application architects, enterprise architects). | Technical SMEs should be known within an IT department, but shadow IT apps may require interviews with the business unit. Application capability mapping will determine the identity of those key users/business process SMEs. |
| Type | An indication of whether the application was developed in-house, commercial off-the-shelf, or a hybrid option. | Consultation, surveys, or interviews with product owners or development managers. |
| Active Status | An indication of whether the application is currently active, out of commission, in repair, etc. | Consultation, surveys, or interviews with product owners or operation managers. |
| Attribute | Description | Common Collection Method |
|---|---|---|
| Vendor Information | Identification of the vendor from whom the software was procured. May include additional items such as the vendor’s contact information. | Consultation with business SMEs, end users, or procurement teams, or review of vendor contracts or license agreements. |
| Links to Other Documentation | Pertinent information regarding the other relevant documentation of the application (e.g. SLA, vendor contracts, data use policies, disaster recovery plan). Typically includes links to documents. | Consultation with product owners, service providers, or SMEs, or review of vendor contracts or license agreements. |
| Number of Users | The current number of users for the application. This can be based on license information but will often require some estimation. Can include additional items of quantities at different levels of access (e.g. admin, key users, power users). | Consultation, surveys, or interviews with product owners or appropriate business SMEs or review of vendor contracts or license agreements. Auto-discovery tools can reveal this information. |
| Software Dependencies | List of other applications or operating components required to run the application. | Consultation with application architects and any architectural tools or documentation. This information can begin to reveal itself through application capability mapping. |
| Hardware Dependencies | Identification of any hardware or infrastructure components required to run the application (i.e. databases, platform). | Consultation with infrastructure or enterprise architects and any architectural tools or documentation. This information can begin to reveal itself through application capability mapping. |
| Development Language | Coding language used for the application. | Consultation, surveys, or interviews with development managers or appropriate technical SMEs. |
| Platform | A framework of services that application programs rely on for standard operations. | Consultation, surveys, or interviews with infrastructure or development managers. |
| Lifecycle Stage | Where an application is within the birth, growth, mature, end-of-life lifecycle. | Consultation with business owners and technical SMEs. |
| Scheduled Updates | Any major or minor updates related to the application, including the release date. | Consultation with business owners and vendor managers. |
| Planned or In-Flight Projects | Any projects related to the application, including estimated project timeline. | Consultation with business owners and project managers. |
”2019 Technology & Small Business Survey.” National Small Business Association (NSBA), n.d. Accessed 1 April 2020.
“Application Rationalization – Essential Part of the Process for Modernization and Operational Efficiency.” Flexera, 2015. Web.
“Applications Rationalization during M&A: Standardize, Streamline, Simplify.” Deloitte Consulting, 2016. Web.
Bowling, Alan. “Clearer Visibility of Product Roadmaps Improves IT Planning.” ComputerWeekly.com, 1 Nov. 2010. Web.
Brown, Alex. “Calculating Business Value.” Agile 2014 Orlando, 13 July 2014. Scrum Inc. 2014. Web.
Brown, Roger. “Defining Business Value.” Scrum Gathering San Diego 2017. Agile Coach Journal. Web.
“Business Application Definition.” Microsoft Docs, 18 July 2012. Web.
“Connecting Small Businesses in the US.” Deloitte Consulting, 2017. Accessed 1 April. 2020.
Craveiro, João. “Marty meets Martin: connecting the two triads of Product Management.” Product Coalition, 18 Nov. 2017. Web.
Curtis, Bill. “The Business Value of Application Internal Quality.” CAST, 6 April 2009. Web.
Fleet, Neville, Joan Lasselle, and Paul Zimmerman. “Using a Balance Scorecard to Measure the Productivity and Value of Technical Documentation Organizations.” CIDM, April 2008. Web.
Fowler, Martin. “Application Boundary.” MartinFowler.com, 11 Sept. 2003. Web.
Harris, Michael. “Measuring the Business Value of IT.” David Consulting Group, 2007. Web.
“How Application Rationalization Contributes to the Bottom Line.” LeanIX, 2017. Web.
Jayanthi, Aruna. “Application Landscape Report 2014.” Capgemini, 4 March 2014. Web.
Lankhorst, Marc., et al. “Architecture-Based IT Valuation.” Via Nova Architectura, 31 March 2010. Web.
“Management of business application.” ServiceNow, Jan.2020. Accessed 1 April 2020.
Mauboussin, Michael J. “The True Measures of Success.” HBR, Oct. 2012. Web.
Neogi, Sombit., et al. “Next Generation Application Portfolio Rationalization.” TATA, 2011. Web.
Riverbed. “Measuring the Business Impact of IT Through Application Performance.” CIO Summits, 2015. Web.
Rouse, Margaret. “Application Rationalization.” TechTarget, March 2016. Web.
Van Ramshorst, E.A. “Application Portfolio Management from an Enterprise Architecture Perspective.” Universiteit Utrecht, July 2013.
“What is a Balanced Scorecard?” Intrafocus, n.d. Web.
Whitney, Lance. “SMBs share their biggest constraints and great challenges.” Tech Republic, 6 May 2019. Web.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
By defining your goals, framing solutions based on end-user workloads, and understanding the pros and cons of various solutions, you can visualize what success looks like for your VDI/DaaS deployment. This includes defining your KPIs by end-user experience, knowing the decision gates for a successful deployment, and defining your hypothesis for value to make your decision more accurate and gain C-suite buy-in.
Virtual desktop infrastructure (VDI)/desktop as a service (DaaS) users expect their user experience to be at least equal to that provided by a physical PC, and they do not care about the underlying infrastructure. If the experience is less, then IT has failed in the considerations for VDI/ DaaS. In this research we analyze the data that the IT industry tracks but doesn't use or sometimes even look at regarding user experience (UX).
Understanding the strengths and weaknesses in your in-house technical skills and business requirements will assist you in making the right decision when it comes to VDI or DaaS solutions. In the case of DaaS this will include a managed service provider for small to medium-sized IT teams. Many IT teams lack a seasoned IT project manager who can identify gaps, risks, and weaknesses in the organization's preparedness. Redeploy your IT staff to new roles that impact management and monitoring of UX.
Ultimately, IT needs to reduce its complexity, increase user satisfaction, reduce management and storage costs, and maintain a secure and effective environment for both the end user and the business. They must also ensure productivity standards throughout the considerations, strategically, tactically, and in support of a move to a VDI or DaaS solution.
| Your Challenge With the evolution of VDI over the last 15-plus years, there has been a proliferation of solutions, such as Citrix desktop services, VMware Horizon, and in-house hypervisor solutions (e.g. ESX hosts). There has also been a great deal of growth and competition of DaaS and SaaS solutions in the cloud space. Hybrid work environments, remote from anywhere and any device, and the security concerns that go hand-in-hand with these strategies have certainly accelerated the move to VDI and DaaS. How will you manage and navigate the right solution for your organization? | Common Obstacles IT departments can encounter many obstacles to VDI and DaaS, many of which will be determined by your business model and other factors, such as:
| Info-Tech’s Approach By defining your end goals, framing solutions based on end-user workloads, and understanding the pros and cons of what solution(s) will meet your needs, you can visualize what success looks like.
|
Every IT organization needs to be asking what success looks like. If you do not consider how your end user will be impacted, whether they are doing something as simple as holding a team meeting with voice and video or working with highly technical workloads on a virtual environment, you will run into multiple issues that affect end-user satisfaction, productivity, and adoption. Understand the tension metrics that may conflict with meeting business objectives and KPIs.
Client-Driven InsightDifferent industries have different requirements and issues, so they look at solutions differently. Info-Tech InsightIf end-user experience is at the forefront of business requirements, then any solution that fits the business KPIs can be successful. |
|

Questions you should be asking before you create your RFP
| How would you rate the user experience on your VDI/DaaS solution?
Info-Tech InsightAsking critical use-case questions should give you a clear picture of the end-user experience outcome. |
Security is always quoted as a primary justification for VDI/DaaS, while UX is far down the list of KPIs. WHY?IT engineers use network and performance metrics to manage end-user complaints of “slowness,” which in reality is not what the user is experiencing.IT needs to invest in more meaningful metrics to manage end-user pain:
| ![]() (Source: Enterprise Strategy Group, 2020) |
The dimensions of end-user experience can be broken down into four distinct categories that will impact not only the end user but also the business. Picturing your landscape in this framework will help clearly define your considerations when deciding on whether a VDI or DaaS solution is right for your business. We will investigate how these scenarios impact the end user, what that means, and how that can guide the questions that you are asking as you move to an RFP. Info-Tech InsightIn the world of VDI and DaaS, if you do not get buy-in from the end user, the rate of adoption and the overall success of the implementation will prove difficult to measure. It will be impossible to calculate ROI even as you feel the impact of your TCO.
| ![]() |
What IT measuresMost business KPI objectives concentrate on business goals, whether it be cost containment, security, simplification, ease of management, or centralization of apps and data, but rarely is there a KPI for end-user experience. You can’t fix what you can’t see. Putting a cost benefit to end-user satisfaction may come in the form of productivity. This may be a central reason why VDI has not been widely adopted as an architecture since it came to the marketplace more than 15 years ago. | ![]() |
Monitoring end-user metrics will mitigate the tension between business KPIs and end-user satisfaction
Metric | Description | ||
End-User | PERFORMANCE | Logon duration | Once the user puts in their password, how long does it take to get to their desktop? What is the measurement and how do you measure? |
| App load time | When an app is launched by the user there should be immediate indication that it is loading. | ||
| App response time | When the user performs a task, there should be no wait time, or hourglass icon, waiting for the app to catch up to the user input. (There is no succinct way to measure this.) | ||
| Session response time | How does the user’s OS respond to I/O? The user should not experience any latency issues when doing a drag and drop, clicking on a menu item, or doing a search. | ||
| AVAILABILITY | SLAs | When something goes wrong in the VDI/DaaS environment, how quickly can the user expect to get back to their tasks? | |
| Geographic location | When all other considerations are configured correctly, the user experience may be impacted by their location. So, for example, a user working out of Mexico and logging into a VDI may experience latency based on location compared to a user in California, for example, where the resources are stored, managed, and monitored. | ||
| Application availability | Much like app load time and response time, the only factor affecting the user experience is the back-end load on the app itself, for example a CAD or heavy resource app not properly resourced. | ||
| FUNCTIONALITY | Configuration of user desktop | Degradation in functionality is caused by improper allocation of CPU, RAM, and GPU for the tasks at hand, creating a bad UX and end-user satisfaction score. | |
| Graphics quality and responsiveness | The user should have the same experience as if on their own physical machine. A video experience should not have any lag in it, for example. MS Teams should not have latency or sound quality issues. | ||
| Predictive analysis | Continuous performance and availability monitoring. | ||
| END USER | Browser real user monitoring (RUM) | A real-time view into how the web application is performing from the point of view of a real end user. | |
| Customer satisfaction score | Survey-based metrics on customer satisfaction. | ||
“If employees are the competitive edge and key differentiator for a business, I&O has a duty of care to ensure that the employees’ digital experience enables and does not impede the value of that asset.” (John Annand, Principal Director, Info-Tech Research Group)
Is security and data sovereignty the only reason?
| Technical capability | |
| AVAILABILITY | VDI is a better fit than DaaS in organizations that have limited or unreliable internet connectivity. |
| FUNCTIONALITY | Application flexibility: Resource-intensive applications may require specific virtual desktop configurations, for example in-house GIS apps, CAD, and gaming software requiring specific GPU configurations. |
| SECURITY | Data protection is often stated as a need to maintain an on-premises VDI solution, ensuring sensitive and highly privileged data does not travel across the internet. |
| AVAILABILITY | While some cloud providers will allow you to bring your OS licensing along with a cloud migration, many subscriptions already include OS licensing, and you may be paying additional licensing costs. |
| SECURITY | VDI makes sense if security and control are primary business KPIs, the IT resources are experienced virtual infrastructure engineers and administrators, and funding is not a hindrance. |
| PERFORMANCE | When processing power is a functional requirement, such as CPU, GPU, and storage capacity, VDI offers performance benefits over a standard PC, reducing the need to deploy high-powered PCs to end users. |
“Though the desktops are moving to the cloud, accountability is not.” (Gary Bea, Director of Consulting Services and Technical Operations, Goliath Technologies)
Any device anywhere: key benefits of DaaS
| Technical capability | Challenges | |
| AVAILABILITY | Delivers a consistent user experience regardless of location or device. | Info-Tech InsightThe total cost of the solution will be higher than you anticipate, and management is complex. Additionally, your ability to set your conditions and controls is limited. Info-Tech InsightDepending on your technical abilities and experience with cloud services, you will likely benefit from professional third-party services, technical services, and consulting, which can be critical when deciding if DaaS can fit into your current IT architecture, processes, and security posture. |
| SECURITY | Enhances security posture by eliminating your client VPN and keeping sensitive data off the endpoint device. | |
| FUNCTIONALITY | Onboard and offboard users quickly and securely. | |
| FUNCTIONALITY | Provides centralize workspace management. | |
| FUNCTIONALITY | Scale up or down on demand with a consumption- and subscription-based contract. | |
| FUNCTIONALITY | Significantly reduce operational overhead compared to managing a traditional VDI deployment. |

From an end-user experience perspective, what makes sense in terms of usage and cost?
Thin Client
| Desktop as a Service
| Thick Client
| Device as a Service
| Web Client
|
What is the better security posture and control plane? Clarify your stakeholders’ objectives, then see if VDI is an adequate solution.
![]() | Modernize and Transform Your End-User Computing Strategy Phase 3.2 of this research set covers virtual desktop infrastructure. |
![]() | Implement Desktop Virtualization and Transition to Everything as a Service Follow Info-Tech’s process for implementing the right desktop virtualization solution to create a project plan that will help ensure that you not only choose the right solution but also implement it effectively. |
![]() | Cloud Strategy Workbook Use this tool to assess cloud services (desktop-as-a-service). |
![]() | Desktop Virtualization TCO Calculator This tool is designed to help you understand what desktop virtualization looks like from a cost perspective. |
Anderson, Joseph. “Five Ways VDI Will Grow in 2022 Thanks to Hybrid Work.” StratoDesk, 28 Feb. 2022. Web.
Bowker, Mark. “Are Desktops Doomed? Trends in Digital Workspaces, VDI, and DaaS.” ESG, May 2020. Web.
“The CISO's Dilemma: How Chief Information Security Officers Are Balancing Enterprise Endpoint Security and Worker Productivity in Response to COVID-19.” Hysolate, Oct. 2020. Web.
King, Val. “Why the End-User Experience Is Not Good for Your Remote Workforce .” Whitehat Virtual Technologies, 2 Dec. 2021. Web.
Perry, Yifat. “VDI vs DaaS: 5 Key Differences and 6 Leading Solutions.” NetApp, 26 Aug. 2020. Web.
Rigg, Christian. “Best virtual desktop services 2022.” TechRadar, 20 Jan. 2022 . Web.
Seget, Vladan. “Key metrics to consider when assessing the performance of your VDI/DaaS environment.” vladan.fr, 19 April 2021. Web.
Spruijt, Ruben. “Why Should You Care About VDI and Desktop-as-a-Service?” Nutanix, 28 Jan. 2020. Web.
Stowers, Joshua. “The Best Desktop as a Service (DaaS) Providers 2022.” business.com, 21 Dec. 2021. Web.
“Virtual Desktop Infrastructure(VDI) Market 2022.” MarketWatch, 5 Jan. 2022. Web. Press release.
Zamir, Tal. “VDI Security Best Practices: Busting the Myths.” Hysolate, 29 Nov. 2021. Web.
Zychowicz, Paul. “Why do virtual desktop deployments fail?” Turbonomic Blog, 16 Dec. 2016. Web.
Let’s make the case for enterprise business analysis!
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
We commonly recognize the value of effective business analysis at a project or tactical level. A good business analysis professional can support the business by identifying its needs and recommending solutions to address them.
Now, wouldn't it be great if we could do the same thing at a higher level?
Enterprise (or strategic) business analysis is all about seeing that bigger picture, an approach that makes any business analysis professional a highly valuable contributor to their organization. It focuses on the enterprise, not a specific project or line of business.
Leading the business analysis effort at an enterprise level ensures that your business is not only doing things right, but also doing the right things; aligned with the strategic vision of your organization to improve the way decisions are made, options are analyzed, and successful results are realized.

Vincent Mirabelli
Principal Research Director, Applications Delivery and Management
Info-Tech Research Group
Your Challenge
Common Obstacles
Info-Tech's Approach
Let's make the case for enterprise business analysis!
Enterprise business analysis can help you reframe the debate between IT and the business, since it sees everyone as part of the business. It can effectively break down silos, support the development of holistic strategies to address internal and external risks, and remove bias and politics from decision making.
Phase 1 |
Phase 2 |
|---|---|
1.1 Define enterprise business analysis 1.2 Identify your pains and opportunities |
2.1 Set your vision 2.2 Define your roadmap and next steps 2.3 Complete your executive communications deck |
Effective business analysis helps guide an organization through improvements to processes, products, and services. Business analysts "straddle the line between IT and the business to help bridge the gap and improve efficiency" in an organization (CIO, 2019).
They are most heavily involved in:
In a survey, business analysts indicated that of their total working time, they spend 31% performing business analysis planning and 41% performing elicitation and analysis (PMI, 2017).
By including a business analyst in a project, organizations benefit by:
(IAG, 2009)
87% |
Reduced time overspending |
|---|---|
75% |
Prevented budget overspending |
78% |
Reduction in missed functionality |
Input
Output
Materials
Participants
Download the Communicate the Case for Enterprise Business Analysis template
Info-Tech's CIO Business Vision Survey data highlights the importance of IT projects in supporting the business to achieve its strategic goals.
However, Info-Tech's CEO-CIO Alignment Survey (N=124) data indicates that CEOs perceive IT as poorly aligned with the business' strategic goals.
Info-Tech's CIO-CEO Alignment Diagnostics
43% |
of CEOs believe that business goals are going unsupported by IT. |
|---|---|
60% |
of CEOs believe that IT must improve understanding of business goals. |
80% |
of CIOs/CEOs are misaligned on the target role of IT. |
30% |
of business stakeholders support their IT departments. |
According to famed management and quality thought leader and pioneer W. Edwards Deming, 94% of issues in the workplace are systemic cause significant organizational pain.
Yet we continue to address them on the surface, rather than acknowledge how ingrained they are in our culture, systems, and processes.
For example, we:
Band-aid solutions rarely have the desired effect, particularly in the long-term.
Our solutions should likewise focus on the systemic/macro environment. We can do this via projects, products and services, but those don't always address the larger issues.
If we take the work our business analysis currently does in defining needs and solutions, and elevate this to the strategic level, the results can be impactful.
Only 18% of organizations have mature (optimized or established) business analysis practices.
With that higher level of maturity comes increased levels of capability, efficiency, and effectiveness in delivering value to people, processes, and technology. Through such efforts, they're better equipped and able to connect the strategy of their organization to the projects, processes, and products they deliver.
They shift focus from "figuring business analysis out" to truly unleashing its potential, with business analysts contributing in strategic and tactical ways.

(Adapted from PMI, 2017)
Business analysts are best suited to connect the strategic with the tactical, the systems, and the operations. They maintain the most objective lens regarding how people, process, and technology connect and relate, and the most skilled of them can remove bias and politics from their perspective.
Input
Output
Materials
Participants
Download the Communicate the Case for Enterprise Business Analysis template
Enterprise business analysis (sometimes referred to as strategy analysis) "…focuses on defining the future and transition states needed to address the business need, and the work required is defined both by that need and the scope of the solution space. It covers strategic thinking in business analysis, as well as the discovery or imagining of possible solutions that will enable the enterprise to create greater value for stakeholders and/or capture more value for itself."
(Source: "Business Analysis Body of Knowledge," v3)
Organizations with high-performing business analysis programs experience an enhanced alignment between strategy and operations. This contributes to improved organizational performance. We see this in financial (69% vs. 45%) and strategic performance (66% vs. 21%), also organizational agility (40% vs. 14%) and management of operational projects (62% vs. 29%). (PMI, 2017)
When comparing enterprise with traditional business analysis, we see stark differences in the size and scope of their view, where they operate, and the role they play in organizational decision making.
| Enterprise | Traditional | |
|---|---|---|
| Decision making | Guides and influences | Executes |
| Time horizon | 2-10 years | 0-2 years |
| Focus | Strategy, connecting the strategic to the operational | Operational, optimizing how business is done, and keeping the lights on |
| Domain | Whole organization Broader marketplace |
Only stakeholder lines of business relevant to the current project, product or service |
| Organizational Level | Executive/Leadership | Project |
(Adapted from Schulich School of Business)
Maturity can't be rushed. Build your enterprise business analysis program on a solid foundation of leading and consistent business analysis practices to secure buy-in and have a program that is sustainable in the long term.

(Adapted from PMI, 2017)
The biggest sources of project failure include:
Source: MindTools.com, 2023.
Enterprise business analysis addresses these sources and more.
It brings a holistic view of the organization, improving collaboration and decision making across the many lines of business, effectively breaking down silos.
In addition to ensuring we're doing the right things, not just doing things right in the form of improved requirements and more accurate business cases, or ensuring return on investment (ROI) and monitoring the broader landscape, enterprise business analysis also supports:
Pains, gains, threats, and opportunities can come at your organization from anywhere. Be it a new product launch, an international expansion, or a new competitor, it can be challenging to keep up.
This is where an enterprise business analyst can be the most helpful.
By keeping a pulse on the external and internal environments, they can support growth, manage risks, and view your organization through multiple lenses and perspectives to get a single, complete picture.
External |
Internal |
|
|---|---|---|
Identifying competitive forces |
In the global environment |
Organizational strengths and weaknesses |
|
|
|
Download the Communicate the Case for Enterprise Business Analysis template
Input
Output
Materials
Participants
Phase 1 | Phase 2 |
|---|---|
1.1 Define enterprise business analysis 1.2 Identify your pains and opportunities | 2.1 Set your vision 2.2 Define your roadmap and next steps 2.3 Complete your executive communications deck |
This phase will walk you through the following activities:
This phase involves the following participants:
Your vision becomes your "north star," guiding your journey and decisions.
When thinking about a vision statement for enterprise business analysis, think about:
Always remember: Your goal is not your vision!
Not knowing the difference will prevent you from both dreaming big and achieving your dream.
Your vision represents where you want to go. It's what you want to do.
Your goals represent how you want to achieve your vision.
Your vision shouldn't be so far out that it doesn't feel real, nor so short term that it gets bogged down in details. Finding balance will take some trial and error and will be different depending on your organization.
Download the Communicate the Case for Enterprise Business Analysis template
Input
Output
Materials
Participants
Training
Competencies and capabilities
Structure and alignment
Methods and processes
Tools, techniques, and templates
Governance
Download the Communicate the Case for Enterprise Business Analysis template
Input
Output
Materials
Participants
From completing the enterprise business analysis inventory, you will have a comprehensive list of all available assets.
The next question is, how can this be leveraged to start building for the future?
To operationalize enterprise business analysis, consider:
The Now, Next, Later technique is a method for prioritizing and planning improvements or tasks. This involves breaking down a list of tasks or improvements into three categories:
By using this technique, you can prioritize and plan the most important tasks, while allowing the flexibility to adjust as necessary.
This technique also helps clarify what must be done first vs. what can wait. This prioritizes the most important things while keeping track of what must be done next, maintaining a smooth development/improvement process.

Ultimately, the choice of priority and timing is yours. Recognize that items may change categories as new information arises.
Download the Communicate the Case for Enterprise Business Analysis template
Input
Output
Materials
Participants
Use the results of your completed exercises to build your executive communication slide deck, to make the case for enterprise business analysis
| Slide Header | Associated Exercise | Rationale |
|---|---|---|
| Pains and opportunities | 1.1.2 Discuss your disconnects between strategy and tactics 1.2.1 Identify your pains and opportunities |
This helps build the case for enterprise business analysis (EBA), leveraging the existing pains felt in the organization. This will draw the connection for your stakeholders. |
| Our vision and goals | 2.1.1 Define your vision and goals | Defines where you want to go and what effort will be required. |
| What is enterprise business analysis | 1.1.1 How is BA being used in our organization today? |
Defines the discipline of EBA and how it can support and mature your organization. |
| Expected benefits | Pre-populated supporting content | What's in it for us? This section helps answer that question. What benefits can we expect, and is this worth the investment of time and effort? |
| Making this a reality | 2.1.2 Identify your EBA inventory | Identifies what the organization presently has that makes the effort easier. It doesn't feel as daunting if there are existing people, processes, and technologies in place and in use today. |
| Next steps | 2.2.1 Now, Next, Later | A prioritized list of action items. This will demonstrate the work involved, but broken down over time, into smaller, more manageable pieces. |
| Metric | Description | Target Improvement/Reduction |
|---|---|---|
| Improved stakeholder satisfaction | Lines of business and previously siloed departments/divisions will be more satisfied with time spent on solution involvement and outcomes. | 10% year 1, 20% year 2 |
| Reduction in misaligned/non-priority project work | Reduction in projects, products, and services with no clear alignment to organizational goals. With that, resource costs can be allocated to other, higher-value solutions. | 10% year 1, 25% year 2 |
| Improved delivery agility/lead time | With improved alignment comes reduced conflict and political infighting. As a result, the velocity of solution delivery will increase. | 10% |
Bossert, Oliver and Björn Münstermann. "Business's 'It's not my problem' IT problem." McKinsey Digital. 30 March, 2023.
Brule, Glenn R. "The Lay of the Land: Enterprise Analysis." Modern Analyst.
"Business Analysis: Leading Organizations to Better Outcomes." Project Management Institute (PMI), 2017
Corporate Finance Institute. "Strategic Analysis." Updated 14 March 2023
IAG Consulting. Business Analysis Benchmark Report, 2009.
International Institute of Business Analysis. "A Guide to the Business Analysis Body of Knowledge" (BABOK Guide) version 3.
Mirabelli, Vincent. "Business Analysis Foundations: Enterprise" LinkedIn Learning, February 2022.
- - "Essential Techniques in Enterprise Analysis" LinkedIn Learning, September 2022.
- - "The Essentials of Enterprise Analysis" Love the Process Academy. May 2020.
- - "The Value of Enterprise Analysis." VincentMirabelli.com
Praslova, Ludmila N. "Today's Most Critical Workplace Challenges Are About Systems." Harvard Business Review. 10 January 2023.
Pratt, Mary K. and Sarah K. White. "What is a business analyst? A key role for business-IT efficiency." CIO. 17 April, 2019.
Project Management Institute. "Business Analysis: Leading Organizations to Better Outcomes." October 2017.
Sali, Sema. "The Importance of Strategic Business Analysis in Successful Project Outcomes." International Institute of Business Analysis. 26 May 2022.
- - "What Does Enterprise Analysis Look Like? Objectives and Key Results." International Institute of Business Analysis. 02 June 2022.
Shaker, Kareem. "Why do projects really fail?" Project Management Institute, PM Network. July 2010.
"Strategic Analysis: Definition, Types and Benefits" Voxco. 25 February 2022.
"The Difference Between Enterprise Analysis and Business Analysis." Schulich School of Business, Executive Education Center. 24 September 2018 (Updated June 2022)
"Why Do Projects Fail: Learning How to Avoid Project Failure." MindTools.com. Accessed 24 April 2023.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This storyboard will help you build a strategy for your Microsoft licensing renewal from conducting a thorough needs assessment to examining your licensing position, evaluating Microsoft's licensing options, and negotiations.
The Microsoft Cloud Products Cost Modeler will provide a rough estimate of what you can expect to pay for Office 365 or Dynamics CRM licensing, before you enter into negotiations. This is not your final cost, but it will give you an idea.
The Microsoft Licensing Purchase Reference Guide can be used throughout the process of licensing review: from initial meetings to discuss compliance state and planned purchases, to negotiation meetings with resellers. Use it in conjunction with Info-Tech's Microsoft Licensing Effective License Position Template.
This tool will help you plot out your negotiation timeline, depending on where you are in your contract negotiation process.
This template helps organizations to determine the difference between the number of software licenses they own and the number of software copies deployed. This is known as the organization’s effective license position (ELP).
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Create a light business case to gain buy-in and define goals, milestones, and use cases.
Create your list of requirements and shortlist vendors.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identify and prioritize stakeholder and IT/networking concerns.
Learn about emerging technologies and identify essential features of a modernized network solution.
Compose a presentation for stakeholders and prepare the RFP for vendors.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand current stakeholder and IT needs pertaining to the network.
Prioritized lists of stakeholder and IT needs.
1.1 Assess and prioritize stakeholder concerns.
1.2 Assess and prioritize design considerations.
1.3 Assess and prioritize use cases.
1.4 Assess and prioritize network infrastructure concerns.
1.5 Assess and prioritize care and control concerns.
Current State Register
Analyze emerging technologies to determine whether or not to include them in the network modernization.
Identify and shortlist networking features that will be part of the network modernization.
An understanding of what emerging technologies are suitable for including in your network modernization.
A prioritized list of features, aligned with business needs, that your modernized network must or should have.
2.1 Analyze emerging technologies.
2.2 Identify features to support drivers, practices, and pain points.
Emerging technology assessment
Prioritize lists of modernized network features
Estimate future port, bandwidth, and latency requirements for all sites on the network.
Planning for capacity ensures the network is capable of delivering until the next refresh cycle and beyond.
3.1 Estimate port, bandwidth, and latency requirements.
3.2 Group sites according to capacity requirements.
3.3 Create standardized capacity plans for each group.
A summary of capacity requirements for each site in the network
Create a presentation to pitch the project to executives.
Compose key elements of RFP.
Communication to executives, summarizing the elements of the modernization project that business decision makers will want to know, in order to gain approval.
Communication to vendors detailing the network solution requirements so that proposed solutions are aligned to business and IT needs.
4.1 Build the executive presentation.
4.2 Compose the scope of work.
4.3 Compose technical requirements.
Executive Presentation
Request for Proposal/Quotation
Internal and external obstacles beyond IT’s control make these challenges with gaining IT budget approval even harder to overcome:
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This deck applies Info-Tech’s proven ITFM Cost Model to the IT budgeting process and offers five phases that cover the purpose of your IT budget and what it means to your stakeholders, key budgeting resources, forecasting, selecting and fine-tuning your budget message, and delivering your IT budget executive presentation for approval.
This Excel workbook offers a step-by-step approach for mapping your historical and forecasted IT expenditure and creating visualizations you can use to populate your IT budget executive presentation.
This sample workbook offers a completed example of the “IT Cost Forecasting and Budgeting Workbook” that accompanies the Create a Transparent & Defensible IT Budget blueprint.
This presentation template offers a recommended structure for presenting your proposed IT budget for next fiscal year to your executive stakeholders for approval.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand your IT budget in the context of your organization and key stakeholders, as well as gather your budgeting data and review previous years’ financial performance.
Understand your organization’s budget process and culture.
Understand your stakeholders’ priorities and perspectives regarding your IT budget.
Gain insight into your historical IT expenditure.
Set next fiscal year’s IT budget targets.
1.1 Review budget purpose.
1.2 Understand stakeholders and approvers.
1.3 Gather your data.
1.4 Map and review historical financial performance.
1.5 Rationalize last year’s variances and set next year's budget targets.
Budget process and culture assessment.
Stakeholder alignment assessment and pre-selling strategy.
Data prepared for next steps.
Mapped historical expenditure.
Next fiscal year’s budget targets.
Develop a forecast of next fiscal year’s proposed capital IT expenditure driven by your organization’s strategic projects.
Develop project CapEx forecast according to the four different stakeholder views of Info-Tech’s ITFM Cost Model.
Ensure that no business projects that have IT implications (and their true costs) are missed.
2.1 Review the ITFM cost model
2.2 List projects.
2.3 Review project proposals and costs.
2.4 Map and tally total project CapEx.
2.5 Develop and/or confirm project-business alignment, ROI, and cost-benefit statements.
Confirmed ITFM cost mdel.
A list of projects.
Confirmed list of project proposals and costs.
Forecasted project-based capital expenditure mapped against the four views of the ITFM Cost Model.
Projects financials in line.
Develop a forecast of next fiscal year’s proposed “business as usual” non-project capital and operating IT expenditure.
Develop non-project CapEx and non-project OpEx forecasts according to the four different stakeholder views of Info-Tech’s ITFM Cost Model.
Make “business as usual” costs fully transparent and rationalized.
3.1 Review non-project capital and costs.
3.2 Review non-project operations and costs.
3.3 Map and tally total non-project CapEx and OpEx.
3.4 Develop and/or confirm proposed expenditure rationales.
Confirmation of non-project capital and costs.
Confirmation of non-project operations and costs.
Forecasted non-project-based capital expenditure and operating expenditure against the four views of the ITFM Cost Model.
Proposed expenditure rationales.
Aggregate and sanity-check your forecasts, harden your rationales, and plan/develop the content for your IT budget executive presentation.
Create a finalized proposed IT budget for next fiscal year that offers different views on your budget for different stakeholders.
Select content for your IT budget executive presentation that will resonate with your stakeholders and streamline approval.
4.1 Aggregate forecast totals and sanity check.
4.2 Generate graphical outputs and select content to include in presentation.
4.3 Fine-tune rationales.
4.4 Develop presentation and write commentary.
Final proposed IT budget for next fiscal year.
Graphic outputs selected for presentation.
Rationales for budget.
Content for IT Budget Executive Presentation.
Finalize and polish the IT budget executive presentation.
An approval-ready presentation that showcases your business-aligned proposed IT budget backed up with rigorous rationales.
5.1 Complete in-progress deliverables from previous four days.
5.2 Set up review time for workshop deliverables and to discuss next steps.
Completed IT Budget Executive Presentation.
Review scheduled.
EXECUTIVE BRIEF
![]() |
It’s that time of year again – budgeting. Most organizations invest a lot of time and effort in a capital project selection process, tack a few percentage points onto last year’s OpEx, do a round of trimming, and call it a day. However, if you want to improve IT financial transparency and get your business stakeholders and the CFO to see the true value of IT, you need to do more than this. Yourcrea IT budget is more than a once-a-year administrative exercise. It’s an opportunity to educate, create partnerships, eliminate nasty surprises, and build trust. The key to doing these things rests in offering a range of budget perspectives that engage and make sense to your stakeholders, as well as providing iron-clad rationales that tie directly to organizational objectives. The work of setting and managing a budget never stops – it’s a series of interactions, conversations, and decisions that happen throughout the year. If you take this approach to budgeting, you’ll greatly enhance your chances of creating and presenting a defensible annual budget that gets approved the first time around. |
Jennifer Perrier |
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
IT struggles to gain budget approval year after year, largely driven by a few key factors:
|
Internal and external obstacles beyond IT’s control make these challenges even harder to overcome:
|
CIOs need a straightforward way to create and present an approval-ready budget.
|
Info-Tech Insight
CIOs need a straightforward way to create and present an approval-ready IT budget that demonstrates the value IT is delivering to the business and speaks directly to different stakeholder priorities.
Capability challenges |
Administrative challenges |
Operating challenges |
Visibility challenges |
Relationship challenges |
||
|---|---|---|---|---|---|---|
IT is seen as a cost center, not an enabler or driver of business strategy. |
IT leaders are not seen as business leaders. |
Economic pressures drive knee-jerk redirection of IT’s budgetary focus from strategic initiatives back to operational tactics. |
The vast majority of IT’s |
Most business leaders don’t know how many IT resources their business units are really consuming. |
Other departments in the organization see IT as a competitor for funding, not a business partner. |
Lack of transparency |
IT and the business aren’t speaking the same language. |
IT leaders don’t have sufficient access to information about, or involvement in, business decisions and objectives. |
Outmoded finance department expenditure categorizations don’t accommodate IT’s real cost categories. |
IT absorbs unplanned spend because business leaders don’t realize or consider the impact of their decisions on IT. |
The business doesn’t understand what IT is, what it does, or what it can offer. |
IT and the business don’t have meaningful conversations about IT costs, opportunities, or investments. |
|
Defining and demonstrating the value of IT and its investments isn’t straightforward. |
IT leaders may not have the financial literacy or acumen needed to translate IT activities and needs into business terms. |
CapEx and OpEx approval and tracking mechanisms are handled separately when, in reality, they’re highly interdependent. |
IT activities usually have an indirect relationship with revenue, making value calculations more complicated. |
Much of IT, especially infrastructure, is invisible to the business and is only noticed if it’s not working. |
The relationship between IT spending and how it supports achievement of business objectives is not clear. |

Principle 1: |
Principle 2: |
Principle 3: |
|---|
The three principles above are all about IT’s changing relationship to the business. IT leaders need a systematic and repeatable approach to budgeting that addresses these principles by:
“The culture of the organization will drive your success with IT financial management.”
– Dave Kish, Practice Lead, IT Financial Management Practice, Info-Tech Research Group
IT budget approval cycle

The Info-Tech difference:
This blueprint provides a framework, method, and templated exemplars for building and presenting your IT budget to different stakeholders. These will speed the approval process and ensure that a higher percentage of your proposed spend is approved.
1. Lay Your Foundation |
2. Get Into Budget-Starting Position |
3. Develop Your Forecasts |
4. Build Your Proposed Budget |
5. Create and Deliver Your Budget Presentation |
|
|---|---|---|---|---|---|
Phase steps |
|
|
|
|
|
Phase outcomes |
An understanding of your stakeholders and what your IT budget means to them. |
Information and goals for planning next fiscal year’s IT budget. |
Completed forecasts for project and non-project CapEx and OpEx. |
A final IT budget for proposal including scenario-based alternatives. |
An IT budget presentation. |
Overarching insight: Create a transparent and defensible IT budget
CIOs need a straightforward way to create and present an approval-ready IT budget that demonstrates the value IT is delivering to the business and speaks directly to different stakeholder priorities.
Phase 1 insight: Lay your foundation
IT needs to step back and look at it’s budget-creation process by first understanding exactly what a budget is intended to do and learning what the IT budget means to IT’s various business stakeholders.
Phase 2 Insight: Get into budget-starting position
Presenting your proposed IT budget in the context of past IT expenditure demonstrates a pattern of spend behavior that is fundamental to next year’s expenditure rationale.
Phase 3 insight: Develop your forecasts
Forecasting costs according to a range of views, including CapEx vs. OpEx and project vs. non-project, and then positioning it according to different stakeholder perspectives, is key to creating a transparent budget.
Phase 4 insight: Build your proposed budget
Fine-tuning and hardening the rationales behind every aspect of your proposed budget is one of the most important steps for facilitating the budgetary approval process and increasing the amount of your budget that is ultimately approved.
Phase 5 insight: Create and deliver your budget presentation
Selecting the right content to present to your various stakeholders at the right level of granularity ensures that they see their priorities reflected in IT’s budget, driving their interest and engagement in IT financial concerns.
IT Cost Forecasting and Budgeting Workbook This Excel tool allows you to capture and work through all elements of your IT forecasting from the perspective of multiple key stakeholders and generates compelling visuals to choose from to populate your final executive presentation. |
![]() |
Also download this completed sample:
Sample: IT Cost Forecasting and Budgeting Workbook
IT Budget Executive Presentation Template
Phase 5: Create a focused presentation for your proposed IT budget that will engage your audience and facilitate approval.

IT benefits |
Business benefits |
|---|---|
|
|
Ease budgetary approval and improve its accuracy.
Near-term goals
Long-term goal
In Phases 1 and 2 of this blueprint, we will help you understand what your approvers are looking for and gather the right data and information.
In Phase 3, we will help you forecast your IT costs it terms of four stakeholder views so you can craft a more meaningful IT budget narrative.
In Phases 4 and 5, we will help you build a targeted presentation for your proposed IT budget.
Value you will receive:
“A budget isn’t like a horse and cart – you can’t get in front of it or behind it like that. It’s more like a river…
When developing an annual budget, you have a good idea of what the OpEx will be – last year’s with an annual bump. You know what that boat is like and if the river can handle it.
But sometimes you want to float bigger boats, like capital projects. But these boats don’t start at the same place at the same time. Some are full of holes. And does your river even have the capacity to handle a boat of that size?
Some organizations force project charters by a certain date and only these are included in the following year’s budget. The project doesn’t start until 8-12 months later and the charter goes stale. The river just can’t float all these boats! It’s a failed model. You have to have a great governance processes and clear prioritization so that you can dynamically approve and get boats on the river throughout the year.”
– Mark Roman, Managing Partner, Executive Services,
Info-Tech Research Group and Former Higher Education CIO
“Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”
“Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”
“We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”
“Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”
Phase 1: Lay Your Foundation |
Phase 2: Get Into Budget-Starting Position |
Phase 3: Develop Your Forecasts |
Phase 4: Build Your Proposed Budget |
Phase 5: Create and Deliver Your Budget Presentation |
|---|---|---|---|---|
Call #1: Discuss the IT budget, processes, and stakeholders in the context of your unique organization. |
Call #2: Review data requirements for transparent budgeting. Call #3: Set budget goals and process improvement metrics. |
Call #4: Review project CapEx forecasts. Call #5: Review non-project CapEx and OpEx forecasts. |
Call #6: Review proposed budget logic and rationales. |
Call #7: Identify presentation inclusions and exclusions. Call #8: Review final budget presentation. |
A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.
A typical GI is 8 to 12 calls over the course of 4 to 6 months.
Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889
| Day 1 | Day 2 | Day 3 | Day 4 | Day 5 | |
|---|---|---|---|---|---|
Get into budget-starting position |
Forecast project CapEx |
Forecast non-project CapEx and OpEx |
Finalize budget and develop presentation |
Next Steps and |
|
Activities |
1.1 Review budget purpose. 1.2 Understand stakeholders and approvers. 1.3 Gather your data. 1.4 Map and review historical financial performance. 1.5 Rationalize last year’s variances. 1.5 Set next year’s budget targets. |
2.1 Review the ITFM Cost Model. 2.2 List projects. 2.3 Review project proposals and costs. 2.4 Map and tally total project CapEx. 2.5 Develop and/or confirm project-business alignment, ROI, and cost-benefit statements. |
3.1 Review non-project capital and costs. 3.2 Review non-project operations and costs. 3.3 Map and tally total non-project CapEx and OpEx. 3.4 Develop and/or confirm proposed expenditure rationales. |
4.1 Aggregate forecast totals and sanity check. 4.2 Generate graphical outputs and select content to include in presentation. 4.3 Fine-tune rationales. 4.4 Develop presentation and write commentary. |
5.1 Complete in-progress deliverables from previous four days. 5.2 Set up review time for workshop deliverables and to discuss next steps. |
Deliverables |
|
|
|
|
|
Lay Your |
Get Into Budget-Starting Position |
Develop Your |
Build Your |
Create and Deliver Your Presentation |
|---|---|---|---|---|
1.1 Understand what your budget is 1.2 Know your stakeholders 1.3 Continuously pre-sell your budget |
2.1 Assemble your resources 2.2 Understand the four views of the ITFM Cost Model 2.3 Review last year’s budget vs. 2.4 Set your high-level goals |
3.1 Develop assumptions and 3.2 Forecast your project CapEx 3.3 Forecast your non-project CapEx and OpEx |
4.1 Aggregate your numbers 4.2 Stress test your forecasts 4.3 Challenge and perfect your |
5.1 Plan your content 5.2 Build your presentation 5.3 Present to stakeholders 5.4 Make final adjustments and submit your IT budget |
This phase will walk you through the following activities:
This phase involves the following participants:
This phase is about understanding the what, why, and who of your IT budget.
“IT finance is more than budgeting. It’s about building trust and credibility in where we’re spending money, how we’re spending money. It’s about relationships. It’s about financial responsibility, financial accountability. I rely on my entire leadership team to all understand what their spend is. We are a steward of other people’s money.”
– Rick Hopfer, CIO, Hawaii Medical Service Association
Most people know what a budget is, but it’s important to understand its true purpose and how it’s used in your organization before you engage in any activity or dialogue about it.
In strictly objective terms:
Simply put, a budget’s fundamental purpose is to plan and communicate how an organization will avoid deficit and debt and remain financially viable while meeting its various accountabilities and responsibilities to its internal and external stakeholders.
“CFOs are not thinking that they want to shut down IT spend. Nobody wants to do that. I always looked at things in terms of revenue streams – where the cash inflow is coming from, where it’s going to, and if I can align my cash outflows to my revenue stream. Where I always got suspicious as a CFO is if somebody can’t articulate spending in terms of a revenue stream. I think that’s how most CFOs operate.”
– Carol Carr, Technical Counselor,
Info-Tech Research Group and Former CFO
It’s a competition: The various units in your organization are competing for the biggest piece they can get of the limited projected income pie. It’s a zero-sum game. The organization’s strategic and operational priorities will determine how this projected income is divvied up.
Direct-to-revenue units win: Business units that directly generate revenue often get bigger relative percentages of the organizational budget since they’re integral to bringing in the projected income part of the budget that allows the expenditure across all business units to happen in the first place.
Indirect-to-revenue units lose: Unlike sales units, for example, IT’s relationship to projected income tends to be indirect, which means that IT must connect a lot more dots to illustrate its positive impact on projected income generation.
In financial jargon, IT really is a cost center: This indirect relationship to revenue also explains why the focus of IT budget conversations is usually on the expenditure side of the equation, meaning it doesn’t have a clear positive impact on income.
Contextual metrics like IT spend as a percentage of revenue, IT OpEx as a percentage of organizational OpEx, and IT spend per organizational employee are important baseline metrics to track around your budget, internally benchmark over time, and share, in order to illustrate exactly where IT fits into the broader organizational picture.
Many organizations have an annual budgeting and planning event that takes place during the back half of the fiscal year. This is where all formal documentation around planned projects and proposed spend for the upcoming year is consolidated, culminating in final presentation, adjustment, and approval. It’s basically a consolidation and ranking of organization-wide priorities at the highest level.
If things are running well, this culmination point in the overall budget development and management process is just a formality, not the beginning, middle, and end of the real work. Ideally:
"A well developed and presented budget should be the numeric manifestation of your IT strategy that’s well communicated and understood by your peers. When done right, budgets should merely affirm what’s already been understood and should get approved with minimal pushback.“
– Patrick Gray, TechRepublic, 2020
While not a contract per se, your IT budget is an objective and transparent statement made in good faith that shows:
When it comes to your budget (and all things financial), your job is to be ethical, careful, and wise:
What’s the same everywhere… |
What’s unchangeable… |
What’s changeable… |
|---|---|---|
For right or wrong, most budgeting processes follow these general steps: |
There are usually only three things about an organization’s budgeting process that are untouchable and can’t be changed: |
Budgeting processes are rarely questioned. It never occurs to most people to challenge this system, even if it doesn’t work. Who wants to challenge the CFO? No one. Review your organization’s budgeting culture to discover the negotiable and non-negotiable constraints. Specifically, look at these potentially-negotiable factors if they’re obstacles to IT budgeting success: |
|
|
|
1 hour
| Input | Output | Materials | Participants |
|---|---|---|---|
|
|
|
|
Budgeting area of assessment |
Rating 1 = very ineffective 10 = very effective |
Challenges |
Opportunities for change |
|---|---|---|---|
Legal and regulatory mandates |
7 | Significant regulation but compliance steps not clear or supported within departments. |
Create, communicate, and train management on compliance procedures and align the financial management tools accordingly. |
Accounting rules |
6 | IT not very familiar with them. |
Learn more about them and their provisions to see if IT spend can be better represented. |
Timeframes and deadlines |
5 | Finalize capital project plans for next fiscal four months before end of current fiscal. |
Explore flexible funding models that allow changes to budget closer to project execution. |
Order of operations |
3 | Setting CapEx before OpEx leads to paring of necessary OpEx based on CapEx commitments. |
Establish OpEx first as a baseline and then top up to target budget with CapEx. |
Areas of focus |
6 | Lack of focus on OpEx means incremental budgeting – we don’t know what’s in there. |
Perform zero-based budgeting on OpEx every few years to re-rationalize this spend. |
Funding sources and ownership |
4 | IT absorbing unplanned mid-cycle spend due to impact of unknown business actions. |
Implement a show-back mechanism to change behavior or as precursor to limited charge-back. |
Review/approval mechanisms |
8 | CFO is fair and objective with information presented but could demand more evidence. |
Improve business sponsorship/fronting of new initiative business cases and IT partnership. |
Templates and tools |
2 | Finance budget template largely irrelevant and unreflective of IT: only two relevant categories. |
Adjust account buckets over a period of time, starting with SW/HW and cloud breakouts. |
The key to being heard and understood is first to hear and understand the perspective of the people with whom you’re trying to communicate – your stakeholders. This means asking some questions:
The next step of this blueprint shows the perspectives of IT’s key stakeholders and how they’re best able to absorb and accept the important information contained in your IT budget. You will:
There are certain principles, mandates, and priorities that drive your stakeholders; they’ll want to see these reflected in you, your work, and your budget.

What are the CFO’s role and responsibilities?
What’s important to the CFO?
“Often, the CFO sees IT requests as overhead rather than a need. And they hate increasing overhead.”
– Larry Clark, Executive Counselor, Info-Tech Research Group and Former CIO
The CFO carries big responsibilities focused on mitigating organizational risks. It’s not their job to be generous or flexible when so much is at stake. While the CEO appears higher on the organizational chart than the CFO, in many ways the CFO’s accountabilities and responsibilities are on par with, and in some cases greater than, those of the CEO.
Your CFO’s IT budget to-do list: |
Remember to: |
|---|---|
|
|
Potential challenges |
Low trust Poor financial literacy and historical sloppiness among business unit leaders means that a CFO may come into budget conversations with skepticism. This can put them on the offensive and put you on the defensive. You have to prove yourself. |
Competition You’re not the only department the CFO is dealing with. Everyone is competing for their piece of the pie, and some business unit leaders are persistent. A good CFO will stay out of the politics and not be swayed by sweet talk, but it can be an exhausting experience for them. |
Mismatched buckets IT’s spend classes and categories probably won’t match what’s in Finance’s budget template or general ledger. Annual budgeting isn’t the best time to bring this up. Respect Finance’s categories, but plan to tackle permanent changes at a less busy time. |
|---|---|---|---|
Potential opportunities |
Build confidence Engaging in the budgeting process is your best chance to demonstrate your knowledge about the business and your financial acumen. The more that the CFO sees that you get it and are taking it seriously, the more confidence and trust they’ll have in you. |
Educate The CFO will not know as much as you about the role technology could and should play in the organization. Introduce new language around technology focused on capabilities and benefits. This will start to shift the conversation away from costs and toward value. |
Initiate alignment An important governance objective is to change the way IT expenditure is categorized and tracked to better reveal and understand what’s really happening. This process should be done gradually over time, but definitely communicate what you want to do and why. |
What are the CXO’s role and responsibilities?
Like you, the CXO’s job is to help the organization realize its goals and objectives. How each CXO does this is specific to the domain they lead. Variations in roles and responsibilities typically revolve around:
What’s important to the CXO?
Disagreement is common between business-function leaders – they have different primary focus areas, and conflict and misalignment are natural by-products of that fact. It’s also hard to make someone care as much about your priorities as you do. Focus your efforts on sharing and partnering, not converting.
Your CXO’s IT budget to-do list: | Remember to: |
|---|---|
|
|
Potential challenges | Different priorities Other business unit leaders will have bigger concerns than your IT budget. They have their own budget to figure out plus other in-flight issues. The head of sales, for instance, is going to be more concerned with hitting sales goals for this fiscal year than planning for next. | Perceived irrelevance Some business unit leaders may be completely unaware of how they use IT, how much they use, and how they could use it more or differently to improve their performance. They may have a learning curve to tackle before they can start to see your relationship as collaborative. | Bad track record If a business unit has had friction with IT in the past or has historically been underserved, they may be hesitant to let you in, may be married to their own solutions, or perhaps do not know how to express what they need. |
|---|---|---|---|
Potential opportunities | Start collaborating You and other business unit leaders have a lot in common. You all share the objective of helping the organization succeed. Focus in on your shared concerns and how you can make progress on them together before digging into your unique challenges. | Practice perspective taking Be genuinely curious about the business unit, how it works, and how they overcome obstacles. See the organization from their point of view. For now, keep your technologies completely out of the discussion – that will come later on. | Build relationships You only need to solve one problem for a business unit to change how they think of you. Just one. Find that one thing that will make a real difference – ideally small but impactful – and work it into your budget. |
What are the CEO’s role and responsibilities?
What’s important to the CEO?
Unlike the CFO and CXOs, the CEO is responsible for seeing the big picture. That means they’re operating in the realm of big problems and big ideas – they need to stay out of the weeds. IT is just one piece of that big picture, and your problems and ideas are sometimes small in comparison. Use any time you get with them wisely.
Your CEO’s IT budget to-do list: | Remember to: |
|---|---|
|
|
Potential challenges | Lack of interest Your CEO may just not be enthusiastic about technology. For them, IT is strictly a cost center operating on the margins. If they don’t have a strategic vision that includes technology, IT’s budget will always be about efficiency and cost control and not investment. | Deep hierarchy The executive-level CIO role isn’t yet pervasive in every industry. There may be one or more non-IT senior management layers between IT and the office of the CEO, as well as other bureaucratic hurdles, which prohibit your direct access. | Uncertainty What’s happening on the outside will affect what needs to be done on the inside. The CEO has to assess and respond quickly, changing priorities and plans in an instant. An indecisive CEO that’s built an inflexible organization will make it difficult to pivot as needed. |
|---|---|---|---|
Potential opportunities | Grow competency Sometimes, IT just needs to wait it out. The biggest shifts in technology interest often come with an outright change in the organization’s leadership. In the meantime, fine-tune your operational excellence, brush up on business skills, and draft out your best ideas on paper. | Build partnerships Other business-function executives may need to be IT’s voice. Investment proposals may be more compelling coming from them anyway. Behind-the-scenes partnerships and high-profile champions are something you want regardless of your degree of CEO access. | Bake in resilience Regardless of who’s at the helm, systematic investment in agile and flexible solutions that can be readily scaled, decoupled, redeployed, or decommissioned is a good strategy. Use recent crises to help make the strategic case for a more resilient posture. |
The CFO expense view, CXO business view, and CEO innovation view represent IT’s stakeholders. The CIO service view, however, represents you, the IT budget creator. This means that the CIO service view plays a slightly different role in developing your IT budget communications.
An IT team effort… |
A logical starting point |
A supporting view |
|---|---|---|
Most budget drafts start with internal IT management discussion. These managers are differentially responsible for apps dev and maintenance, service desk and user support, networks and data center, security, data and analytics, and so forth. |
These common organizational units and their managers tend to represent discrete IT service verticals. This means the CIO service view is a natural structural starting point for your budget-building process. Stakeholder views of your budget will be derived from this first view. |
You probably don’t want to lead your budget presentation with IT’s perspective – it won’t make sense to your stakeholders. Instead, select certain impactful pieces of your view to drop in where they provide valued information and augment the IT budget story. |
Things to bring forward… |
Things to hold back… |
|---|---|
|
|
1 hour
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Stakeholder |
Relationship status |
Understanding of needs |
Budget changes/additions |
|---|---|---|---|
CFO |
Positive |
Wants at least 30% of budget to be CapEx. Needs more detail concerning benefits and tracking of realization. |
Do more detailed breakouts of CapEx vs. OpEx as 30% CapEx not realistic – pre-meet. Talk to Enterprise PMO about improving project benefits statement template. |
VP of Sales |
Negative |
Only concerned with hitting sales targets. Needs to respond/act quickly based on reliable data. |
Break out sales consumption of IT resources in detail focusing on CRM and SFA tool costs. Propose business intelligence enhancement project. |
Director of Marketing |
Neutral |
Multiple manual processes – would benefit from increased automation of campaign management and social media posting. |
Break out marketing consumption of IT resources and publicly share/compare to generate awareness/support for tech investment. Work together to build ROI statements |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
[Name/Title] |
[Positive/Neutral/Negative] |
[Insert text] |
[Insert text] |
When IT works well, nobody notices. When it doesn’t, the persistent criticism about IT not delivering value will pop up, translating directly into less funding. Cut this off at the pass with an ongoing communications strategy based on facts, transparency, and perspective taking.
Identify all the communication channels you can leverage including meetings, committees, reporting cycles, and bulletins. Set up new channels if they don’t exist.
Nothing’s better than having a team of supporters when pitch day comes. Quietly get them on board early and be direct about the role each of you will play.
Have information and materials about proposed initiatives at-the-ready. You never know when you’ll get your chance. But if your facts are still fuzzy, do more homework first.
Talking about IT all the time will turn people off. Plan chats that don’t mention IT at all. Ask questions about their world and really listen. Empathy’s a powerful tool.
Describe what you will be doing and how it will benefit the business in language that makes sense to the beneficiaries of the initiative.
Carry the same narrative forward through to the end and tell the whole story. Include comments from stakeholders and beneficiaries about the value they’re receiving.
A partner is an influencer, advocate, or beneficiary of the expenditure or investment you’re proposing. Partners can:
When partners agree to pitch or fund an initiative, IT can lose control of it. Make sure you set specific expectations about what IT will help with or do on an ongoing basis, such as:
A collaborative approach tends to result in a higher level of commitment than a selling approach.
Put yourself in their shoes using their language. Asking “How will this affect you?” focuses on what’s in it for them.
Example:
CIO: “We’re thinking of investing in technology that marketing can use to automate posting content to social media. Is that something you could use?”
CMO: “Yes, we currently pay two employees to post on Facebook and Twitter, so if it could make that more efficient, then there would be cost savings there.”
An approver is the CFO, CEO, board, council, or committee that formally commits funding support to a program or initiative. Approvers can:
When approvers cool to an idea, it’s hard to warm them up again. Gradually socializing an idea well in advance of the formal pitch gives you the chance to isolate and address those cooling factors while they’re still minor. Things you can address if you get an early start with future approvers include:
Blindsiding approvers with a major request at a budget presentation could trigger an emotional response, not the rational and objective one you want.
Make approvers part of the solution by soliciting their advice and setting their expectations well in advance.
Example:
CIO: “The underwriting team and I think there’s a way to cut new policyholder approval turnaround from 8 to 10 days down to 3 or 4 using an online intake form. Do you see any obstacles?”
CFO: “How do the agents feel about it? They submit to underwriting differently and might not want to change. They’d all need to agree on it. Exactly how does this impact sales?”
1 hour
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Stakeholder | Current interactions | Opportunities and actions | ||
|---|---|---|---|---|
Forum | Frequency | Content | ||
CFO | One-on-one meeting | Monthly | IT expenditure updates and tracking toward budgeted amount. | Increase one-on-one meeting to weekly. Alternate focus – retrospective update one week, future-looking case development the next. Invite one business unit head to future-looking sessions to discuss their IT needs. |
VP of Sales | Executive meeting | Quarterly | General business update - dominates. | Set up bi-weekly one-on-one meeting – initially focus on what sales does/needs, not tech. Later, when the relationship has stabilized, bring data that shows Sales’ consumption of IT resources. |
Director of Marketing | Executive meeting | Quarterly | General business update - quiet. | Set up monthly one-on-one meeting. Temporarily embed BA to better discover/understand staff processes and needs. |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
[Name/Title] | [Insert text] | [Insert text] | [Insert text] | [Insert text] |
You should now have a deeper understanding of the what, why, and who of your IT budget. These elements are foundational to streamlining the budget process, getting aligned with peers and the executive, and increasing your chances of winning budgetary approval in the end.
In this phase, you have:
“Many departments have mostly labor for their costs. They’re not buying a million and a half or two million dollars’ worth of software every year or fixing things that break. They don’t share IT’s operations mindset and I think they get frustrated.”
– Matt Johnson, IT Director Governance and Business Solutions, Milwaukee County
Lay Your | Get Into Budget-Starting Position | Develop Your | Build Your | Create and Deliver Your Presentation |
|---|---|---|---|---|
1.1 Understand what your budget is 1.2 Know your stakeholders 1.3 Continuously pre-sell your budget | 2.1 Assemble your resources 2.2 Understand the four views of the ITFM Cost Model 2.3 Review last year’s budget vs. 2.4 Set your high-level goals | 3.1 Develop assumptions and 3.2 Forecast your project CapEx 3.3 Forecast your non-project CapEx and OpEx | 4.1 Aggregate your numbers 4.2 Stress test your forecasts 4.3 Challenge and perfect your | 5.1 Plan your content 5.2 Build your presentation 5.3 Present to stakeholders 5.4 Make final adjustments and submit your IT budget |
This phase will walk you through the following activities:
This phase involves the following participants:
This phase is about clarifying your context and defining your boundaries.
“A lot of the preparation is education for our IT managers so that they understand what’s in their budgets and all the moving parts. They can actually help you keep it within bounds.”
– Trisha Goya, Director, IT Governance & Administration, Hawaii Medical Service Association
In addition to your CFO, CXOs, and CEO, there are other people who will provide important information, insight, and skill in identifying IT budget priorities and costs.
Role |
Skill set |
Responsibilities |
|---|---|---|
IT Finance Lead |
|
IT finance personnel will guide the building of cost forecasting methodologies for operating and capital costs, help manage IT cash flows, help identify cost reduction options, and work directly with the finance department to ensure they get what they need. |
IT Domain Managers |
|
They will be active participants in budgeting for their specific domains, act as a second set of eyes, assist with and manage their domain budgets, and engage with stakeholders. |
Project Managers |
|
Project managers will assist in capital and operational forecasting and will review project budgets to ensure accuracy. They will also assist in forecasting the operational impacts of capital projects. |
As the head of IT, your role is as the budgeting team lead. You understand both the business and IT strategies, and have relationships with key business partners. Your primary responsibilities are to guide and approve all budget components and act as a liaison between finance, business units, and IT.
Your responsibilities and accountabilities.
|
Goals and requirements.
|
Budgeting fundamentals.
|
Their responsibilities and accountabilities.
|
Timeframes and deadlines.
|
Available resources.
|
2 hours
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Each of the four views breaks down IT costs into a different array of categories so you and your stakeholders can see expenditure in a way that’s meaningful for them.
You may decide not to use all four views based on your goals, audience, and available time. However, let’s start with how you can use the first two views, the CFO expense view and the CIO service view.
The CFO expense view is fairly traditional – workforce and vendor. However, Info-Tech’s approach breaks down the vendor software and hardware buckets into on-premises and cloud. Making this distinction is increasingly critical given key differences in CapEx vs. OpEx treatment. Forecasting this view is mandatory |
These two views provide information that will help you optimize IT costs. They’re designed to allow the CFO and CIO to find a common language that will allow them to collaboratively make decisions about managing IT expenditure effectively. |
The CIO service view is your view, i.e. it’s how IT tends to organize and manage itself and is often the logical starting point for expenditure planning and analysis. Sub-categories in this view, such as security and data & BI, can also resonate strongly with business stakeholders and their priorities. Forecasting this view is recommended |
Some views take a bit more work to map out, but they can be powerful tools for communicating the value of IT to the business. Let’s look at the last two views, the CXO business view and the CEO innovation view.
The CXO business view looks at IT expenditure business unit by business unit so that each can understand their true consumption of IT resources. This view relies on having a fair and reliable cost allocation formula, such as one based on relative headcount, so it runs the risk of inaccuracy. Forecasting this view is recommended
| These two views provide information that will help you optimize IT support to the business. These views also have a collaborative goal in mind, enabling IT to talk about IT spend in terms that will promote transparency and engage business stakeholders. | The CEO innovation view is one of the hardest to analyze and forecast since a single spend item may apply to innovation, growth, and keeping the lights on. However, if you have an audience with the CEO and they want IT to play a more strategic or innovative role, then this view is worth mapping. Forecasting this view is optional
|
30 minutes
The IT Cost Forecasting and Budgeting Workbook contains standalone sections for each view, as well as rows for each lowest-tier sub-category in a view, so each view can be analyzed and forecasted independently.
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Ensure you have the following data and information available to you and your budgeting team before diving in:
Past data
Current data
Future data
If you’re just getting started building a repeatable budgeting process, treat it like any other project, complete with a formal plan/ charter and a central repository for all related data, information, and in-progress and final documents.
Once you’ve identified a repeatable approach that works for you, transition the budgeting project to a regular operational process complete with policies, procedures, and tools.
But first, some quick definitions:
For last fiscal year, pinpoint the following metrics and information:
Budgeted and actual IT expenditure overall and by major cost category. Categories will include workforce (employees/contractors) and vendors (hardware, software, contracted services) at a minimum. |
Actual IT expenditure as a percentage of organizational revenue. This is a widely-used benchmark that your CFO will expect to see. |
The known and likely drivers behind budgeted vs. actual variances. Your rationales will affect your perceived credibility. Be straightforward, avoid defending or making excuses, and just show the facts. Ask your CFO what they consider acceptable variance thresholds for different cost categories to guide your variance analysis, such as 1% for overall IT expenditure. |
Actual IT CapEx and OpEx. CapEx is often more variable than OpEx over time. Separate them so you can see the real trends for each. Consider:
|
For the previous five fiscal years, focus on the following:
Actual IT expenditure as a percentage of organizational revenue.
Again, for historical years 2-5, you can break this down into granular cost categories like workforce, software, and infrastructure like you did for last fiscal year. Avoid getting bogged down and focusing on the past – you ultimately want to redirect stakeholders to the future.
Percentage expenditure increase/decrease year to year.
You may choose to show overall IT expenditure amounts, breakdowns by CapEx and OpEx, as well as high-level cost categories.
As you go back in time, some data may not be available to you, may be unreliable or incomplete, or employ the same cost categories you’re using today. Use your judgement on the level of granularity you want to and can apply when going back two to five years in the past.
So, what’s the trend? Consider these questions:
Your CFO will look for evidence that you’re gaining efficiencies by controlling costs, which is often a prerequisite for them approving any new funding requests.
Your objective here is threefold:
This step is about establishing credibility, demonstrating IT value, building trust, and showing the CFO you’re on their team.
Do the following:
“Eliminate the things you don’t need. People will give you what you need when you need it if you’re being responsible with what you already have.”
– Angela Hintz, VP of PMO & Integrated Services,
Blue Cross and Blue Shield of Louisiana
8 hours
| Input | Output | Materials | Participants |
|---|---|---|---|
|
|
|
|
Knowing what happened in the past can provide good insights and give you a chance to show stakeholders your money-management track record. However, what stakeholders really care about is “now” and “next”. For them, it’s all about current business context.
Ask these questions about your current context to assess the relevance of your historical trend data:
What’s the state of |
What are the |
What has the business |
What’s the business |
|---|---|---|---|
Some industries are very sensitive to economic cycles, causing wild budget fluctuations year to year. This uncertainty can reduce the volume of spend you automatically carry over one year to the next, making past spend patterns less relevant to your current budgeting effort. |
These can change year to year as well, and often manifest on the CapEx side in the form of strategic projects selected. Since this is so variable, using previous years’ CapEx to determine next fiscal’s CapEx isn’t always useful except in regard to multi-year, ongoing capital projects. |
Do your best to honor mandates. However, if cuts are suggested that could jeopardize core service delivery, tread cautiously, and pick your battles. You may be able to halt new capital spend to generate cuts, but these projects may get approved anyway, with IT expected to make cuts to OpEx. |
If the CFO and others rail against even the most necessary inflation-driven increases, you’ll need to take a conservative approach, focus on cost-saving initiatives, and plan to redirect last year’s expenditures instead of pursuing net-new spend. |
Step back and think about other budget and expenditure goals you have.
Do you want to:
Establish appropriate metrics and targets that will allow you to define success, track progress, and communicate achievement on these higher-level goals.
Check out some example metrics in the table below.
Budgeting metric |
Improvement driver |
Current value |
Future target |
|---|---|---|---|
Percentage of spend directly tied to an organizational goal. |
Better alignment via increased communication and partnership with the business. |
72% |
90% |
Number of changes to budget prior to final acceptance. |
Better accuracy and transparency via use of zero-based budgeting and enhanced stakeholder views. |
8 |
2 |
Percentage variance between budgeted vs. actuals. |
Improved forecasting through better understanding of business plans and in-cycle show-back. |
+4% |
+/-2% |
Percentage of budget approved after first presentation. |
Improved business rationales and direct mapping of expenditure to org priorities. |
76% |
95% |
Percentage of IT-driven project budget approved. |
More rigor around benefits, ROI calculation, and quantifying value delivered. |
80% |
100% |
First things first: Zero-based or incremental for OpEx? |
Set your OpEx targets |
|
|---|---|---|
Incremental budgeting is the addition of a few percentage onto next year’s budget, assuming the previous year’s OpEx is all re-occurring. The percentage often aligns with rates of inflation.
|
Zero-based budgeting involves rebuilding your budget from scratch, i.e. zero. It doesn’t assume that any of last year’s costs are recurring or consistent year to year.
|
Pick a range of percentage change based on your business context and past spend.
|
If cost-cutting or optimization is a priority, then a zero-based approach is the right decision. If doing this every year is too onerous, plan to do it for your OpEx at least every few years to examine what’s actually in there, clean house, and re-set.
A lot of IT CapEx is conceived in business projects, so your proposed expenditure here may not be up to you. Exercise as much influence as you can.
First things first: Is it project CapEx, or “business as usual” CapEx? |
||
|---|---|---|
Project CapEx is tied to one-time strategic projects requiring investment in new assets.
|
User-driven “business as usual” CapEx manifests via changes (often increases) in organizational headcount due to growth.
|
Network/data center-driven “business-as-usual” CapEx is about core infrastructure maintenance.
|
Unanticipated hiring and the need to buy end-user hardware is cited as a top cause of budget grief by IT leaders – get ahead of this. Project CapEx, however, is usually determined via business-based capital project approval mechanisms well in advance. And don’t forget to factor in pre-established capital asset depreciation amounts generated by all the above!
8 hours
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output | Materials | Participants |
|---|---|---|---|
|
|
|
|
Now you’re ready to do the deep dive into forecasting your IT budget for next year.
In this phase, you clarified your business context and defined your budgetary goals, including:
“We only have one dollar but five things. Help us understand how to spend that dollar.”
– Trisha Goya, Director, IT Governance & Administration, Hawaii Medical Service Association
Lay Your | Get Into Budget-Starting Position | Develop Your | Build Your | Create and Deliver Your Presentation |
|---|---|---|---|---|
1.1 Understand what your budget is 1.2 Know your stakeholders 1.3 Continuously pre-sell your budget | 2.1 Assemble your resources 2.2 Understand the four views of the ITFM Cost Model 2.3 Review last year’s budget vs. 2.4 Set your high-level goals | 3.1 Develop assumptions and 3.2 Forecast your project CapEx 3.3 Forecast your non-project CapEx and OpEx | 4.1 Aggregate your numbers 4.2 Stress test your forecasts 4.3 Challenge and perfect your | 5.1 Plan your content 5.2 Build your presentation 5.3 Present to stakeholders 5.4 Make final adjustments and submit your IT budget |
This phase will walk you through the following activities:
This phase involves the following participants:
This phase focuses on putting real numbers on paper based on the research and data you’ve collected. Here, you will:
“Our April forecast is what really sets the bar for what our increase is going to be next fiscal year. We realized that we couldn’t change it later, so we needed to do more upfront to get that forecast right.
If we know that IT projects have been delayed, if we know we pulled some things forward, if we know that a project isn’t starting until next year, let’s be really clear on those things so that we’re starting from a better forecast because that’s the basis of deciding two percent, three percent, whatever it’s going to be.”
– Kristen Thurber, IT Director, Office of the CIO, Donaldson Company
Assumptions are things you hold to be true. They may not actually be true, but they are your logical foundation and must be shared with stakeholders so they can follow your thinking.
Start with understanding your constraints. These are either negotiable (adjustable) or non-negotiable (non-adjustable). However, what is non-negotiable for IT may be negotiable for the organization as a whole, such as its strategic objectives. Consider each of the constraints below, determine how it relates to IT expenditure options, and decide if it’s ultimately negotiable or non-negotiable.
Organizational |
Legal and Regulatory |
IT/Other |
Example: |
|---|---|---|---|
|
|
|
You’re in year one of a three-year vendor contract. All contracts are negotiable, but this one isn’t for two years. This contact should be considered a non-negotiable for current budget-planning purposes. |
Identifying your negotiable and non-negotiable constraints is about knowing what levers you can pull. Government entities have more non-negotiable constraints than private companies, which means IT and the organization as a whole have fewer budgetary levers to pull and a lot less flexibility.
An un-pullable lever and a pullable lever (and how much you can pull it) have one important thing in common – they are all fundamental assumptions that influence your decisions.
My current employees will still be here 18 months from now. |
My current vendors aren’t going to discontinue the products we have. |
| My organization’s executive team will be the same 18 months from now. | My current key vendors will be around for years to come. |
My organization’s departments, divisions, and general structure will be the same 18 months from now. |
IT has to be an innovation leader. |
We won’t be involved in any merger/acquisition activity next fiscal year. |
IT has always played the same role here and that won’t change. |
There won’t be a major natural disaster that takes us offline for days or even weeks. |
We must move everything we can to the cloud. |
We won’t be launching any new products or services next fiscal year. |
Most of our IT expenditure has to be CapEx, as usual. |
You won’t put some of these assumptions into your final budget presentation. It’s simply worthwhile knowing what they are so you can challenge them when forecasting.
Now it’s time to outline your primary scenario.
A note on probability…
What could or will be your organization’s new current state at the end of next fiscal year?
Primary scenario approval can be helped by putting that scenario alongside alternatives that are less attractive due to their cost, priority, or feasibility. Alternative scenarios are created by manipulating or eliminating your negotiable constraints or treating specific unknowns as knowns. Here are some common alternative scenarios.
The high-cost scenario: Assumes very positive economic prospects. Characterized by more of everything – people and skills, new or more sophisticated technologies, projects, growth, and innovation. Remember to consider the long-term impact on OpEx that higher capital spend may bring in subsequent years.
Target 10-20% more expenditure than your primary scenario
The low-cost scenario: Assumes negative economic prospects or cost-control objectives. Characterized by less of everything, specifically capital project investment, other CapEx, and OpEx. Must assume that business service-level expectations will be down-graded and other sacrifices will be made.
Target 5-15% less expenditure than your primary scenario
The dark horse scenario: This is a more radical proposition that challenges the status quo. For example, what would the budget look like if all data specialists in the organization were centralized under IT? What if IT ran the corporate PMO? What if the entire IT function was 100% outsourced?
No specific target
INDUSTRY: Manufacturing
SOURCE: Anonymous
A manufacturing IT Director gets budgetary approval by showing what the business would have to sacrifice to get the cheap option.
Challenge |
Solution |
Results |
|---|---|---|
A manufacturing business had been cutting costs endlessly across the organization, but specifically in IT. IT was down to the bone. The IT Director had already been doing zero-based budgeting to rationalize all expenditure, stretching asset lifecycles as long as possible, and letting maintenance work slide. There were no obvious options left to reduce costs based on what the business wanted to do. |
The IT Director got creative. He put together three complete budgets:
In the budget presentation, he led with the “super cheap” budget where IT was 100% outsourced. |
He proceeded to review the things they wouldn’t have under the extreme outsourced scenario, including the losses in service levels that would be necessary to make it happen. The executive was shocked by what the IT Director showed them. The executive immediately approved the IT Director’s preferred budget. He was able to defend the best budget for the business by showing them what they stood to lose. |
2 hours
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Traditional, binary “CapEx vs. OpEx” distinctions don’t seem adequate for showing where expenditure is really going. We’ve added a new facet to help further differentiate one-time project costs from recurring “business as usual” expenses.
Project CapEx
Includes all workforce and vendor costs associated with planning and execution of projects largely focused on the acquisition or creation of new capital assets.
Non-project CapEx
Includes “business as usual” capital asset acquisition in the interest of managing, maintaining, or supporting ongoing performance of existing infrastructure or services, such as replacement network equipment, end-user hardware (e.g. laptops), or disaster recovery/business continuity redundancies. Also includes ongoing asset depreciation amounts.
Non-project OpEx
Includes all recurring, non-CapEx “business as usual” costs such as labor compensation and training, cloud-based software fees, outsourcing costs, managed services fees, subscriptions, and other discretionary spend.
Depreciation is technically CapEx. However, for practical purposes, most organizations list it under OpEx, which can cause it to get lost in the noise. Here, depreciation is under non-project CapEx to keep its true CapEx nature visible and in the company of other “business as usual” capital purchases that will ultimately join the depreciation ranks.
This process can be simple as far as overall budget forecasting is concerned. If it isn’t simple now, plan to make it simpler next time around.
What to expect…
Key forecasting principles…
Develop rigorous business cases
Secure funding approval well in advance
Tie back costs benefitting business units
Consider the longer-term OpEx impact
For more information about putting together sound business cases for different projects and circumstances, see the following Info-Tech blueprints:
Build a Comprehensive Business Case
Tip #1: Don’t surprise your approvers. Springing a capital project on approvers at your formal presentation isn’t a good idea and stands a good chance of rejection, so do whatever you can to lock these costs down well in advance.
Tip #2: Project costs should be entirely comprised of CapEx if possible. Keep in mind that some of these costs will convert to depreciated non-project CapEx and non-project OpEx as they transition from project costs to ongoing “business as usual” costs, usually in the fiscal year following the year of expenditure. Creating projections for the longer-term impacts of these project CapEx costs on future types of expenditure is a good idea. Remember that a one-time project is not the same thing as a one-time cost.
Tip #3: Capitalize any employee labor costs on capital projects. This ensures the true costs of projects are not underestimated and that operational staff aren’t being used for free at the expense of their regular duties.
Tip #4: Capitalizing cloud costs in year one of a formal implementation project is usually acceptable. It’s possible to continue treating cloud costs as CapEx with some vendors via something called reserved instances, but organizations report that this is a lot of work to set up. In the end, most capitalized cloud will convert into non-project OpEx in years two and beyond.
Tip #5: Build in some leeway. By the time a project is initiated, circumstances may have changed dramatically from when it was first pitched and approved, including business priorities and needs, vendor pricing, and skillset availability. Your costing may become completely out of date. It’s a good practice to work within more general cost ranges than with specific numbers, to give you the flexibility to respond and adapt during actual execution.
Time: Depends on size of project portfolio
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
What to expect…
Central to the definition of OpEx is the fact that it’s ongoing. It rarely stops, and tends to steadily increase over time due to factors like inflation, rising vendor prices, growing organizational growth, increases in the salary expectations of employees, and other factors.
The only certain ways to reduce OpEx are to convert it to capitalizable expenditure, decrease staffing costs, not pursue cloud technologies, or for the organization to simply not grow. For most organizations, none of these approaches are feasible. Smaller scale efficiencies and optimizations can keep OpEx from running amok, but they won’t change its overall upward trajectory over time. Expect it to increase.
Key forecasting principles…
Focus on optimization and efficiency.
Aim for full spend transparency.
Think about appropriate chargeback options.
Give it the time it deserves.
For more information about how to make the most out of your IT OpEx, see the following Info-Tech blueprints:
Develop Your Cost Optimization Roadmap
Achieve IT Spend & Staffing Transparency
Tip #1: Consider zero-based budgeting. You don’t have to do this every year, but re-rationalizing your OpEx every few years, or a just a segment of it on a rotational basis, will not only help you readily justify the expenditure but also find waste and inefficiencies you didn’t know existed.
Tip #2: Capitalize your employee capital project work. While some organizations aren’t allowed to do this, others who can simply don’t bother. Unfortunately, this act can bloat the OpEx side of the equation substantially. Many regular employees spend a significant amount of their time working on capital projects, but this fact is invisible to the business. This is why the business keeps asking why it takes so many people to run IT.
Tip #3: Break out your cloud vs. on-premises costs. Burying cloud apps costs in a generic software bucket works against any transparency ambitions you may have. If you have anything resembling a cloud strategy, you need to track, report, and plan for these costs separately in order to measure benefits realization. This goes for cloud infrastructure costs, too.
Tip #4: Spend time on your CIO service view forecast. Completing this view counts as a first step toward service-based costing and is a good starting point for setting up an accurate service catalog. If looking for cost reductions, you’ll want to examine your forecasts in this view as there will likely be service-level reductions you’ll need to propose to hit your cost-cutting goals.
Tip #5: Budget with consideration for chargeback. chargeback mechanisms for OpEx can be challenging to manage and have political repercussions, but they do shift accountability back to the business, guarantee that the IT bills get paid, and reduce IT’s OpEx burden. Selectively charging business units for applications that only they use may be a good entry point into chargeback. It may also be as far as you want to go with it. Doing the CXO business view forecast will provide insight into your opportunities here.
These costs are often the smallest percentage of overall expenditure but one of the biggest sources of financial grief for IT.
What to expect…
Key forecasting principles…
Discuss hiring plans with the business.
Pay close attention to your asset lifecycles.
Prepare to advise about depreciation schedules.
Build in contingency for the unexpected.
For more information about ensuring IT isn’t left in the lurch when it comes to non-project CapEx, see the following Info-Tech blueprints:
Tip #1: Top up new hire estimations: Talk to every business unit leader about their concrete hiring plans, not their aspirations. Get a number, increase that number by 25% or 20 FTEs (whichever is less), and use this new number to calculate your end-user non-project CapEx.
Tip #2: Make an arrangement for who’s paying for operational technology (OT) devices and equipment. OT involves specialized devices such as in-the-field sensors, scanners, meters, and other networkable equipment. Historically, operational units have handled this themselves, but this has created security problems and they still rely on IT for support. Sort the financials out now, including whose budget device and equipment purchases appear on, as well as what accommodations IT will need to make in its own budget to support them.
Tip #3: Evaluate cloud infrastructure and managed services. These can dramatically reduce your non-project CapEx, particularly on the network and data center fronts. However, these solutions aren’t necessarily less expensive and will drive up OpEx, so tread cautiously.
Tip #4: Definitely do an inventory. If you haven’t invested in IT asset management, put it on your project and budgetary agenda. You can’t manage what you don’t know you have, so asset discovery should be your first order of business. From there, start gathering asset lifecycle information and build in alerting to aid your spend planning.
Tip #5: Think about retirement: What assets are nearing end of life or the end of their depreciation schedule? What impact is this having on non-project OpEx in terms of maintenance and support? Deciding to retire, replace, or extend an IT operational asset will change your non-project CapEx outlook and will affect costs in other areas.
Tip #6: Create a contingency fund: You need one to deal with surprises and emergencies, so why wait?
A powerful metric to share with business stakeholders is expenditure per employee or FTE. It’s powerful because:
This metric is one of the simplest to calculate. The challenge is in getting your hands on the data in the first place.
Short-term forecasting: |
Long-term forecasting: |
|---|---|
“It’s a great step in the right direction. We look at – Kristen Thurber, IT Director, Office of the CIO, |
“This approach was much better. We now – Trisha Goya, Director, IT Governance & Administration, |
Time: Depends on size of vendor portfolio and workforce
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
INDUSTRY: Insurance
SOURCE: Anonymous
Challenge | Solution | Results |
|---|---|---|
In his first run at the annual budgeting process, a new CIO received delivery dates from Finance and spent the next three months building the budget for the next fiscal year. He discovered that the organization had been underinvesting in IT for a long time. There were platforms without support, no accounting for currency exchange rates on purchases, components that had not be upgraded in 16 years, big cybersecurity risks, and 20 critical incidences a month. | In his budget, the CIO requested a 22-24% increase in IT expenditure to deal with the critical gaps, and provided a detailed defense of his proposal But the new CIO’s team and Finance were frustrated with him. He asked his IT finance leader why. She said she didn’t understand what his direction was and why the budgeting process was taking so long – his predecessor did the budget in only two days. He would add up the contracts, add 10% for inflation, and that’s it. | Simply put, the organization hadn’t taken budgeting seriously. By doing it right, the new CIO had inadvertently challenged the status quo. The CIO ended up under-executing his first budget by 12% but is tracking closer to plan this year. Significantly, he’s been able cut critical incidences from 20 down to only 2-3 per month. Some friction persists with the CFO, who sees him as a “big spender,” but he believes that this friction has forced him to be even better. |
The hard math is done. Now it’s time to step back and craft your final proposed budget and its key messages.
This phase focused on developing your forecasts and proposed budget for next fiscal year. It included:
“Ninety percent of your projects will get started but a good 10% will never get off the ground because of capacity or the business changes their mind or other priorities are thrown in. There are always these sorts of challenges that come up.”
– Theresa Hughes, Executive Counselor,
Info-Tech Research Group
and Former IT Executive
Lay Your | Get Into Budget-Starting Position | Develop Your | Build Your | Create and Deliver Your Presentation |
|---|---|---|---|---|
1.1 Understand what your budget is 1.2 Know your stakeholders 1.3 Continuously pre-sell your budget | 2.1 Assemble your resources 2.2 Understand the four views of the ITFM Cost Model 2.3 Review last year’s budget vs. 2.4 Set your high-level goals | 3.1 Develop assumptions and 3.2 Forecast your project CapEx 3.3 Forecast your non-project CapEx and OpEx | 4.1 Aggregate your numbers 4.2 Stress test your forecasts 4.3 Challenge and perfect your | 5.1 Plan your content 5.2 Build your presentation 5.3 Present to stakeholders 5.4 Make final adjustments and submit your IT budget |
This phase will walk you through the following activities:
This phase involves the following participants:
Triple check your numbers and put the finishing touches on your approval-winning rationales.
This phase is where your analysis and decision making finally come together into a coherent budget proposal. Key steps include:
“We don’t buy servers and licenses because we want to. We buy them because we have to. IT doesn’t need those servers out at our data center provider, network connections, et cetera. Only a fraction of these costs are to support us in the IT department. IT doesn’t have control over these costs because we’re not the consumers.”
– Matt Johnson, IT Director Governance and Business Solutions, Milwaukee County
Rationales build credibility and trust in your business capabilities. They can also help stop the same conversations happening year after year.
Any item in your proposed budget can send you down a rabbit hole if not thoroughly defensible.
You probably won’t need to defend every item, but it’s best to be prepared to do so. Ask yourself:
“Budgets get out of control when one department fails to care for the implications of change within another department's budget. This wastes time, reduces accuracy and causes conflict.”
– Tara Kinney, Atomic Revenue, LLC.
Not all spending serves the same purpose. Some types require deeper or different justifications than others.
For the business, there are two main purposes for spend:
“Approval came down to ROI and the ability to show benefits realization for years one, two, and three through five.”
– Duane Cooney, Executive Counselor, Info-Tech Research Group, and Former Healthcare CIO
Regardless of its ultimate purpose, all expenditure needs statements of assumptions, obstacles, and likelihood of goals being realized behind it.
Rationales aren’t only for capital projects – they can and should be applied to all proposed OpEx and CapEx. Business project rationales tend to drive revenue and the customer experience, demanding ROI calculations. Internal IT-projects and non-project expenditure are often focused on mitigating and managing risk, requiring cost-benefit analysis.
Overall |
Non-Project OpEx |
Non-Project CapEx |
Project CapEx |
|---|---|---|---|
|
|
|
|
2 hours
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output | Materials | Participants |
|---|---|---|---|
|
|
|
|
INDUSTRY: Healthcare
SOURCE: Anonymous
Challenge | Solution | Results |
|---|---|---|
A senior nursing systems director needed the CIO’s help. She wanted to get a project off the ground, but it wasn’t getting priority or funding. Nurses were burning out. Many were staying one to two hours late per shift to catch up on patient notes. Their EHR platform had two problematic workflows, each taking up to about 15 minutes per nurse per patient to complete. These workflows were complex, of no value, and just not getting done. She needed a few million dollars to make the fix. | The CIO worked with the director to do the math. In only a few hours, they realized that the savings from rewriting the workflows would allow them to hire over 500 full-time nurses. The benefits realized would not only help reduce nurse workload and generate savings, but also increase the amount of time spent with patients and number of patients seen overall. They redid the math several times to ensure they were right. | The senior nursing systems director presented to her peers and leadership, and eventually to the Board of Directors. The Board immediately saw the benefits and promoted the project to first on the list ahead of all other projects. This collaborative approach to generating project benefits statements helped the CIO gain trust and pave the way for future budgets. |
First, recall what budgets are really about.
The completeness, accuracy, and granularity of your numbers and thorough ROI calculations for projects are essential. They will serve you well in getting the CFO’s attention. However, the numbers will only get you halfway there. Despite what some people think, the work in setting a budget is more about the what, how, and why – that is, the rationale – than about the how much.
Next, revisit Phase 1 of this blueprint and review:
Then, look at each component of your proposed budget through each of these three rationale-building lenses.
Business goals
What are the organization’s strategic priorities?
Governance culture
How constrained is the decision-making process?
Feasibility
Can we make it happen?
Business goals What are the organization’s strategic priorities? |
Context This is all about external factors, namely the broader economic, political, and industry contexts in which the organization operates. |
Lifecycle position The stage the organization is at in terms of growth, stability, or decline will drive decisions, priorities, and the ability to spend or invest. |
Opportunities Context and lifecycle position determine opportunities, which are often defined in terms of potential cost savings |
Tie every element in your proposed budget to an organizational goal. |
Non-project OpEx
|
Non-project CapEx
|
Project CapEx
|
Governance Culture How rigorous/ constrained |
Risk tolerance This is the organization’s willingness to be flexible, take chances, make change, and innovate. It is often driven by legal and regulatory mandates. |
Control Control manifests in the number and nature of rules and how authority and accountability are centralized or distributed in the organization. |
Speed to action How quickly decisions are made and executed upon is determined by the amount of consultation and number of approval steps. |
Ensure all parts of your proposed budget align with what’s tolerated and allowed. |
Non-project OpEx
| Non-project CapEx
| Project CapEx
|
Feasibility Can we do it, and what sacrifices will we have to make? |
Funding The ultimate determinant of feasibility is the availability, quantity, and reliability of funding next fiscal year and over the long term to support investment. |
Capabilities Success hinges on both the availability and accessibility of required skills and knowledge to execute on a spend plan in the required timeframe. |
Risk Risk is not just about obstacles to success and what could happen if you do something – it’s also about what could happen if you do nothing at all. |
Vet every part of your proposed budget to ensure what you’re asking for is both realistic and possible. |
Non-project OpEx
| Non-project CapEx
| Project CapEx
|
Detailed data and information checklist:
|
High-level rationale checklist:
|
For more on creating detailed business cases for projects and investments, see Info-Tech’s comprehensive blueprint, Build a Comprehensive Business Case.
2 hours
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
This phase is where everything came together into a coherent budget proposal. You were able to:
“Current OpEx is about supporting and aligning with past business strategies. That’s alignment. If the business wants to give up on those past business strategies, that’s up to them.”
– Darin Stahl, Distinguished Analyst and Research Fellow, Info-Tech Research Group
Lay Your | Get Into Budget-Starting Position | Develop Your | Build Your | Create and Deliver Your Presentation |
|---|---|---|---|---|
1.1 Understand what your budget is 1.2 Know your stakeholders 1.3 Continuously pre-sell your budget | 2.1 Assemble your resources 2.2 Understand the four views of the ITFM Cost Model 2.3 Review last year’s budget vs. 2.4 Set your high-level goals | 3.1 Develop assumptions and 3.2 Forecast your project CapEx 3.3 Forecast your non-project CapEx and OpEx | 4.1 Aggregate your numbers 4.2 Stress test your forecasts 4.3 Challenge and perfect your | 5.1 Plan your content 5.2 Build your presentation 5.3 Present to stakeholders 5.4 Make final adjustments and submit your IT budget |
This phase will walk you through the following activities:
This phase involves the following participants:
This phase focuses on developing your final proposed budget presentation for delivery to your various stakeholders. Here you will:
“I could have put the numbers together in a week. The process of talking through what the divisions need and spending time with them is more time consuming than the budget itself.”
– Jay Gnuse, IT Director, Chief Industries
Mandatory: Just about every CFO or approving body will expect to see this information. Often high level in nature, it includes:
|
Recommended: This information builds on the mandatory elements, providing more depth and detail. Inclusion of recommended content depends on:
|
Optional: This is very detailed information that provides alternative views and serves as reinforcement of your key messages. Consider including it if:
|
Deciding what to include or exclude depends 100% on your target audience. What will fulfill their basic information needs as well as increase their engagement in IT financial issues?
These represent the contextual framework for your proposal and explain why you made the decisions you did.
Stating your assumptions and presenting at least two alternative scenarios helps in the following ways:
Your assumptions and alternative scenarios may not appear back-to-back in your presentation, yet they’re intimately connected in that every unique scenario is based on adjustments to your core assumptions. These tweaks – and the resulting scenarios – reflect the different degrees of probability that a variable is likely to land on a certain value (i.e. an alternative assumption).
Your primary scenario is the one you believe is most likely to happen and is represented by the complete budget you’re recommending and presenting.
Target timeframe for presentation: 2 minutes
Key objectives: Setting context, demonstrating breadth of thought.
Potential content for section:
“Things get cut when the business
doesn’t know what something is,
doesn’t recognize it, doesn’t understand it. There needs to be an education.”
– Angie Reynolds, Principal Research Director, ITFM Practice,
Info-Tech Research Group,
See Tabs “Planning Variables” and 9, “Alternative Scenarios” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
Core assumptions |
Primary target scenario |
Alternative scenarios |
Full alternative scenario budgets |
|---|---|---|---|
List |
Slide |
Slide |
Budget |
Mandatory: This is a listing of both internal and external factors that are most likely to affect the challenges and opportunities your organization will have and how it can and will operate. This includes negotiable and non-negotiable internal and external constraints, stated priorities, and the expression of known risk factors. |
Mandatory: Emanating from your core assumptions, this scenario is a high-level statement of goals, initial budget targets, and proposed budget based on your core assumptions. |
Recommended: Two alternatives are typical, with one higher spend and one lower spend than your target. The state of the economy and funding availability are the assumptions usually tweaked. More radical scenarios, like the cost and implications of completely outsourcing IT, can also be explored. |
Optional: This is a lot of work, but some IT leaders do it if an alternative scenario is a strong contender or is necessary to show that a proposed direction from the business is costly or not feasible. |

This retrospective on IT expenditure is important for three reasons:
You probably won’t have a lot of time for this section, so everything you select to share should pack a punch and perform double duty by introducing concepts you’ll need your stakeholders to have internalized when you present next year’s budget details.
Target timeframe for presentation: 7 minutes
Key objectives: Definitions, alignment, expectations-setting.
Potential content for section:
“If they don’t know the consequences of their actions, how are they ever going to change their actions?”
– Angela Hintz, VP of PMO & Integrated Services,
Blue Cross and Blue Shield of Louisiana
See Tabs 1 “Historical Events & Projects,” 3 “Historical Analysis,” and 6 “Vendor Worksheet” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
Total budgeted vs. total actuals | Graph | Mandatory: Demonstrates the variance between what you budgeted for last year and what was actually spent. Explaining causes of variance is key. |
|---|---|---|
l actuals by expenditure type | Graph | Mandatory: Provides a comparative breakdown of last year’s expenditure by non-project OpEx, non-project CapEx, and project CapEx. This offers an opportunity to explain different types of IT expenditure and why they’re the relative size they are. |
Major capital projects completed | List | Mandatory: Illustrates progress made toward strategically important objectives. |
Top vendors | List | Recommended: A list of vendors that incurred the highest costs, including their relative portion of overall expenditure. These are usually business software vendors, i.e. tools your stakeholders use every day. The number of vendors shown is up to you. |

See Tab 1, “Historical Events & Projects” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
| Cost drivers | List | Mandatory: A list of major events, circumstances, business decisions, or non-negotiable factors that necessitated expenditure. Be sure to focus on the unplanned or unexpected situations that caused upward variance. |
|---|---|---|
Savings drivers | List | Mandatory: A list of key initiatives pursued, or circumstances that resulted in efficiencies or savings. Include any deferred or canceled projects. |

Also calculate and list the magnitude of costs incurred or savings realized in hard financial terms so that the full impact of these events is truly understood by your stakeholders.
“What is that ongoing cost?
If we brought in a new platform, what
does that do to our operating costs?”
– Kristen Thurber, IT Director, Office of the CIO, Donaldson Company
See Tab 3 “Historical Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
IT actual expenditure |
Graph |
Mandatory: This is crucial for showing overall IT expenditure patterns, particularly percentage changes up or down year to year, and what the drivers of those changes were. |
|---|---|---|
IT actuals as a % of organizational revenue |
Graph |
Mandatory: You need to set the stage for the proposed percentage of organizational revenue to come. The CFO will be looking for consistency and an overall decreasing pattern over time. |
IT expenditure per FTE year over year |
Graph |
Optional: This can be a powerful metric as it’s simple and easily to understand. |

The historical analysis you can do is endless. You can generate many more cuts of the data or go back even further – it’s up to you.
Keep in mind that you won’t have a lot of time during your presentation, so stick to the high-level, high-impact graphs that demonstrate overarching trends or themes.
See Tab 3 “Historical Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
Budgeted vs. actuals CFO expense view | Graph | Mandatory: Showing different types of workforce expenditure compared to different types of vendor expenditure will be important to the CFO. |
|---|---|---|
Budgeted vs. actuals CIO services view | Graph | Optional: Showing the expenditure of some IT services will clarify the true total costs of delivering and supporting these services if misunderstandings exist. |
Budgeted vs. actuals CXO business view | Graph | Optional: A good way to show true consumption levels and the relative IT haves and have-nots. Potentially political, so consider sharing one-on-one with relevant business unit leaders instead of doing a big public reveal. |
Budgeted vs. actual CEO innovation view | Graph | Optional: Clarifies how much the organization is investing in innovation or growth versus keeping the lights on. Of most interest to the CEO and possibly the CFO, and good for starting conversations about how well funding is aligned with strategic directions. |

30 minutes
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Build a logical bridge between what happened in the past to what’s coming up next year using a comparative approach and feature major highlights.
This transitional phase between the past and the future is important for the following reasons:
Consider this the essential core of your presentation – this is the key message and what your audience came to hear.
Target timeframe for presentation: 10 minutes
Key objectives: Transition, reveal proposed budget.
Potential content for section:
“The companies...that invest the most in IT aren’t necessarily the best performers.
On average, the most successful small and medium companies are more frugal when it comes to
company spend on IT (as long as they do it judiciously).”
– Source: Techvera, 2023
See Tab 8, “Proposed Budget Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
Last year’s total actuals vs. next year’s total forecast | Proposed budget in context: Year-over-year expenditure | Last year’s actuals vs. next year’s proposed by expenditure type | Last year’s expenditure per FTE vs. next year’s proposed |
|---|---|---|---|
Graph | Graph | Graph | Graph |
Mandatory: This is the most important graph for connecting the past with the future and is also the first meaningful view your audience will have of your proposed budget for next year. | Mandatory: Here, you will continue the long-term view introduced in your historical data by adding on next year’s projections to your existing five-year historical trend. The percentage change from last year to next year will be the focus. | Recommended: A double-comparative breakdown of last year vs. next year by non-project OpEx, non-project CapEx, and project CapEx illustrates where major events, decisions, and changes are having their impact. | Optional: This graph is particularly useful in demonstrating the success of cost-control if the actual proposed budget is higher that the previous year but the IT cost per employee has gone down. |
![]() | |||
See Tab 5, “Project CapEx Forecast” in your IT Cost Forecasting and Budgeting Workbook for the data and information to create these outputs.
Major project profile | Slide | Mandatory: Focus on projects for which funding is already committed and lean toward those that are strategic or clearly support business goal attainment. How many you profile is up to you, but three to five is suggested. |
|---|---|---|
Minor project overview | List | Optional: List other projects on IT’s agenda to communicate the scope of IT’s project-related responsibilities and required expenditure to be successful. Include in-progress projects that will be completed next year and net-new projects on the roster. |

You can’t profile every project on the list, but it’s important that your stakeholders see their priorities clearly reflected in your budget; projects are the best way to do this.
If you’ve successfully pre-sold your budget and partnered with business-unit leaders to define IT initiatives, your stakeholders should already be very familiar with the project summaries you put in front of them in your presentation.
30 minutes
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
The graphs you select here will be specific to your audience and any particular message you need to send.
This detailed phase of your presentation is important because it allows you to:
Target timeframe for presentation: 7 minutes, but this phase of the presentation may naturally segue into the final Q&A.
Key objectives: Transparency, dialogue, buy-in.
Potential content for section:
“A budget is a quantified version of
your service-level agreements.”
– Darin Stahl, Distinguished Analysis & Research Fellow,
Info-Tech Research Group,
See Tab 8, “Proposed Budget Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
Proposed budget: Workforce and vendors by expenditure type | Graph | Mandatory: This is the traditional CFO’s view, so definitely show it. The compelling twist here is showing it by expenditure type, i.e. non-project OpEx, non-project CapEx, and project CapEx. |
|---|---|---|
Proposed budget: Cloud vs. on-premises vendor expenditure | Graph | Optional: If this is a point of contention or if an active transition to cloud solutions is underway, then show it. |
Top vendors | Graph | Recommended: As with last year’s actuals, showing who the top vendors are slated to be next year speaks volumes to stakeholders about exactly where much of their money is going. |
If you have a diverse audience with diverse interests, be very selective – you don’t want to bore them with things they don’t care about.
See Tab 8, “Proposed Budget Analysis” in your IT Cost Forecasting and Budgeting Workbook for these outputs.
Proposed budget: IT services by expenditure type | Graph | Optional: Business unit leaders will be most interested in the application services. Proposed expenditure on security and data and BI services may be of particular interest given business priorities. Don’t linger on infrastructure spend unless chargeback is in play. |
|---|---|---|
Proposed budget: Business units by expenditure type | Graph | Optional: The purpose of this data is to show varying business units where they stand in terms of consumption. It may be more appropriate to show this graph in a one-on-one meeting or other context. |
Proposed budget: Business focus by expenditure type | Graph | Optional: The CEO will care most about this data. If they’re not in the room, then consider bypassing it and discuss it separately with the CFO. |
Inclusion of these graphs really depends on the makeup of your audience. It’s a good decision to show all of them to your CFO at some point before the formal presentation. Consider getting their advice on what to include and exclude.
30 minutes
Download the IT Cost Forecasting and Budgeting Workbook
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Download Info-Tech’s IT Budget Executive Presentation Template

If you prefer, use your own internal presentation standard template instead and Info-Tech’s template as a structural guide.
Regardless of the template you use, Info-Tech recommends the following structure:
Leave the details for the speaker’s notes.
Remember that this is an executive presentation. Use tags, pointers, and very brief sentences in the body of the presentation itself. Avoid walls of text. You want your audience to be listening to your words, not reading a slide.
Speak to everything that represents an increase or decrease of more than 5% or that simply looks odd.
Being transparent is essential. Don’t hide anything. Acknowledge the elephant in the room before your audience does to quickly stop suspicious or doubtful thoughts
Identify causes and rationales.
This is why your numbers are as they are. However, if you’re not 100% sure what all driving factors are, don’t make them up. Also, if the line between cause and effect isn’t straight, craft in advance a very simple way of explaining it that you can offer whenever needed.
Be neutral and objective in your language.
You need to park strong feelings at the door. You’re presenting rational facts and thoroughly vetted recommendations. The best defense is not to be defensive, or even offensive for that matter. You don’t need to argue, plead, or apologize – let your information speak for itself and allow the audience to arrive at their own logical conclusions.
Re-emphasize your core themes to create connections.
If a single strategic project is driving cost increases across multiple cost categories, point it out multiple times if needed to reinforce its importance. If an increase in one area is made possible by a significant offset in another, say so to demonstrate your ongoing commitment to efficiencies. If a single event from last year will continue having cost impacts on several IT services next year, spell this out.
Duration: 2 hours
Note: Refer to your organization’s standards and norms for executive-level presentations and either adapt the Info-Tech template accordingly or use your own.
Download the IT Budget Executive Presentation template
| Input | Output |
|---|---|
|
|
| Materials | Participants |
|
|
Some final advice on presenting your proposed budget…
Partner up If something big in your budget is an initiative that’s for a specific business unit, let that business unit’s leader be the face of it and have IT play the role of supporting partner. |
Use your champions Let your advocates know in advance that you’d appreciate hearing their voice during the presentation if you encounter any pushback, or just to reinforce your main messages. |
Focus on the CFO The CFO is the most important stakeholder in the room at the end of the day, even more than the CEO in some cases. Their interests should take priority if you’re pressed for time. |
Avoid judgment Let the numbers speak for themselves. Do point out highlights and areas of interest but hold off on offering emotion-driven opinions. Let your audience draw their own conclusions. |
Solicit questions You do want dialogue. However, keep your answers short and to the point. What does come up in discussion is a good indication of where you’ll need to spend more time in the future. |
The only other thing that can boost your chances is if you’re lucky enough to be scheduled to present between 10:00 and 11:00 on a Thursday morning when people are most agreeable. Beyond that, apply the standard rules of good presentations to optimize your success.
You’ve reached the end of the budget creation and approval process. Now you can refocus on using your budget as a living governance tool.
This phase focused on developing your final proposed budget presentation for delivery to your various stakeholders. Here, you:
“Everyone understands that there’s never enough money. The challenge is prioritizing the right work and funding it.”
– Trisha Goya, Director, IT Governance & Administration, Hawaii Medical Service Association
“Keep that conversation going throughout the year so that at budgeting time no one is surprised…Make sure that you’re telling your story all year long and keep track of that story.”
– Angela Hintz, VP of PMO & Integrated Services,
Blue Cross and Blue Shield of Louisiana
This final section will provide you with:
By following the phases and steps in this blueprint, you have:
What’s next?
Use your approved budget as an ongoing IT financial management governance tool and track your budget process improvement metrics.
If you would like additional support, have our analysts guide you through an Info-Tech full-service engagement or Guided Implementation.
Contact your account representative for more information.
1-888-670-8889
Monica Braun Research Director, ITFM Practice Info-Tech Research Group |
Carol Carr Technical Counselor (Finance) Info-Tech Research Group |
Larry Clark Executive Counselor Info-Tech Research Group |
Duane Cooney Executive Counselor Info-Tech Research Group |
Lynn Fyhrlund Former Chief Information Officer Milwaukee County |
Jay Gnuse Information Technology Director Chief Industries |
Trisha Goya Director, IS Client Services Hawaii Medical Service Association |
Angela Hintz VP of PMO & Integrated Services Blue Cross and Blue Shield of Louisiana |
Rick Hopfer Chief Information Officer Hawaii Medical Service Association |
Theresa Hughes Executive Counselor Info-Tech Research Group |
Dave Kish Practice Lead, IT Financial Management Practice Info-Tech Research Group | Matt Johnson IT Director Governance and Business Solutions Milwaukee County |
Titus Moore Executive Counselor Info-Tech Research Group | Angie Reynolds Principal Research Director, IT Financial Management Practice Info-Tech Research Group |
Mark Roman Managing Partner, Executive Services Info-Tech Research Group | Darin Stahl Distinguished Analyst & Research Fellow Info-Tech Research Group |
Miguel Suarez Head of Technology Seguros Monterrey New York Life | Kristen Thurber IT Director, Office of the CIO Donaldson Company |
Achieve IT Spend & Staffing Transparency
IT Spend & Staffing Benchmarking Service
Build Your IT Cost Optimization Roadmap
“How Much Should a Company Spend on IT?” Techvera, no date. Accessed 3 Mar. 2023.
“State of the CIO Study 2023.” Foundry, 25 Jan. 2023. Accessed 3 Mar. 2023.
Aberdeen Strategy & Research. “The State of IT 2023.” Spiceworks. Ziff Davis, 2022. Accessed 28 Feb. 2023.
Ainsworth, Paul. “Responsibilities of the Modern CFO - A Function in Transition.” TopTal, LLC., no date. Accessed 15 Feb. 2023.
Balasaygun, Kaitlin. “For the first time in a long time, CFOs can say no to tech spending.” CNBC CFO Council, 19 Jan. 2023. Accessed 17 Feb. 2023.
Bashir, Ahmad. “Objectives of Capital Budgeting and factors affecting Capital Budget Decisions.” LinkedIn, 27 May 2017. Accessed 14 Apr. 2023.
Blackmon, Kris. “Building a Data-Driven Budget Pitch the C-Suite Can't Refuse.” NetSuite Brainyard, 21 Sep. 2021. Accessed 17 Feb. 2023
Butcher, Daniel. “CFO to CFO: Budgeting to Fund Strategic Plans.” Strategic Finance Magazine/Institute of Management Accountants, 1 Dec. 2021. Accessed 17 Feb. 2023
Gray, Patrick. “IT Budgeting: A Cheat Sheet.” TechRepublic, 29 Jul. 2020. Accessed 28 Feb. 2023.
Greenbaum, David. “Budget vs. Actuals: Budget Variance Analysis & Guide.” OnPlan, 15 Mar. 2022. Accessed 22 Mar. 2023.
Huber, Michael and Joan Rundle. “How to Budget for IT Like a CFO.” Huber & Associates, no date. Accessed 15 Feb. 2023.
Kinney, Tara. “Executing Your Department Budget Like a CFO.” Atomic Revenue, LLC., no date. Accessed 15 Feb. 2023.
Lafley, A.G. “What Only the CFO Can Do.” Harvard Business Review, May 2009. Accessed 15 Mar. 2009.
Moore, Peter D. “IN THE DIGITAL WORLD, IT should be run as a profit center, not a cost center.” Wild Oak Enterprise, 26 Feb. 2020. Accessed 3 Mar. 2023.
Nordmeyer, Bille. “What Factors Are Going to Influence Your Budgeting Decisions?” bizfluent, 8 May 2019. Accessed 14 Apr. 2023
Ryan, Vincent. “IT Spending and 2023 Budgets Under Close Scrutiny.” CFO, 5 Dec. 2022. Accessed 3 Mar. 2023.
Stackpole, Beth. “State of the CIO, 2022: Focus turns to IT fundamentals.” CIO Magazine, 21 Mar. 2022. Accessed 3 Mar. 2023.
Business process automation (BPA) has gained momentum, especially as pilots result in positive outcomes such as improved customer experience, efficiencies, and cost savings. Stakeholders want to invest more in BPA solutions and scale initial successes across different business and IT functions.
But it’s critical to get it right and not fall into the hype so that the costs don’t outweigh the benefits.
Ultimately, all BPA initiatives should align with a common vision.
Organizations should adopt a methodical approach to growing their BPA, taking cost, talent availability, and goals into account.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This blueprint helps you develop a strategy justify the scaling and maturing of your business process automation (BPA) practices and capabilities to fulfill your business priorities.
Document your business process automation strategy in the language your stakeholders understand. Tailor this document to fit your BPA objectives and initiatives.
Evaluate the maturity of the key capabilities of your BPA practice to determine its readiness to support complex and scaled BPA solutions.
Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Understand the business priorities and your stakeholders' needs that are driving your business process automation initiatives while abiding by the risk and change appetite of your organization.
Translate business priorities to the context of business process automation.
Arrive at a common definition of business value.
Come to an understanding of the needs, concerns, and problems of BPA stakeholders.
Discover organizational risk and change tolerance and appetite.
1.1 Set the Business Context
1.2 Understand Your Stakeholder Needs
1.3 Build Your Risk & Change Profile
Business problem, priorities, and business value definition
Customer and end-user assessment (e.g. personas, customer journey)
Risk and change profile
Set reasonable and achievable expectations for your BPA initiatives and practices, and select the right BPA opportunities to meet these expectations.
Align BPA objectives and metrics to your business priorities.
Create guiding principles that support your organization’s and team’s culture.
Define a vision of your target-state BPA practice
Create a list of BPA opportunities that will help build your practice and meet business priorities.
2.1 Define Your BPA Expectations
2.2 List Your Guiding Principles
2.3 Envision Your BPA Target State
2.4 Build Your Opportunity Backlog
BPA problem statement, objectives, and metrics
BPA guiding principles
Desired scaled BPA target state
Prioritized BPA opportunities
Evaluate the current state of your BPA practice and its readiness to support scaled and complex BPA solutions.
List key capabilities to implement and optimize to meet the target state of your BPA practice.
Brainstorm solutions to address the gaps in your BPA capabilities.
3.1 Assess Your BPA Maturity
BPA maturity assessment
Identify high-priority key initiatives to support your BPA objectives and goals, and establish the starting point of your BPA strategy.
Create an achievable roadmap of BPA initiatives designed to deliver good practices and valuable automations.
Perform a risk assessment of your BPA initiatives and create mitigations for high-priority risks.
Find the starting point in the development of your BPA strategy.
4.1 Roadmap Your BPA Initiatives
4.2 Assess and Mitigate Your Risks
4.3 Complete Your BPA Strategy
List of BPA initiatives and roadmap
BPA initiative risk assessment
Initial draft of your BPA strategy
It is now 2020 and the GDPR has been in effect for almost 2 years. Many companies thought: been there, done that. And for a while the regulators let some time go by.
The first warnings appeared quickly enough. Eg; in September 2018, the French regulator warned a company that they needed to get consent of their customers for getting geolocation based data.
That same month, an airline was hacked and, on top of the reputational damage and costs to fix the IT systems, it faced the threat of a stiff fine.
Even though we not have really noticed, fines started being imposed as early as January 2019.
Wrong! The fines are levied in a number of cases. And to make it difficult to estimate, there are guidelines that will shape the decision making process, but no hard and fast rules!
The GDPR is very complex and consists of both articles and associated recitals that you need to be in compliance with. it is amuch about the letter as it is about the spirit.
We have a clear view on what most of those cases are.
And more importantly, when you follow our guidelines, you will be well placed to answer any questions by your clients and cooperate with the regulator in a proactive way.
They will never come after me. I'm too small.
And besides, I have my privacy policy and cookie notice in place
Company size has nothing to do with it.
While in the beginning, it seemed mostly a game for the big players (for names, you have to contact us) that is just perception.
As early as March 2018 a €10M revenue company was fined around €120,000. 2 days later another company with operating revenues of around €6.2M was fined close to €200.000 for failing to abide by the DSRR stipulatons.
Don't know what these are?
Fill out the form below and we'll let you in on the good stuff.
When the economy is negatively influenced by factors beyond any organization’s control, the impact can be felt almost immediately on the bottom line. This decline in revenue as a result of a weakening economy will force organizations to reconsider every dollar they spend.
By following our process, we can provide your organization with the direction, tools, and best practices to lay off employees. This will need to be done with careful consideration into your organization’s short- and longer-term strategic goals.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Understand the most effective cost-cutting solutions and set layoff policies and guidelines.
Develop an objective layoff selection method and plan for the transfer of essential responsibilities.
Plan logistics, training, and a post-layoff plan communication.
Collaborate with necessary departments and deliver layoffs notices.
Plan communications for affected employee groups and monitor organizational performance.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Use Info-Tech's 2020 Applications Priorities Report to learn about the five initiatives that IT should prioritize for the coming year.
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
This research focuses on verified digital identity ecosystems and explores risks, opportunities, and challenges of relying on verified digital IDs and also how adopting digital identity initiatives can improve customer experience and operational efficiency. It covers:
|
Your Challenge |
Common Obstacles |
Info-Tech’s Approach |
|---|---|---|
|
Amid the pandemic-fueled surge of online services, organizations require secure solutions to safeguard digital interactions. These solutions must be uniform, interoperable, and fortified against security threats. Although the digital identity ecosystem has garnered significant attention and investment, many organizations remain uncertain about its potential for authentication and authorization required for B2B and B2C transactions. They still wonder if digital ID can help reduce cost of operations and transfer data risks. |
Limited or lack of understanding of the global Digital ID ecosystem and its varying approaches across countries handicap businesses in defining the potential benefits Digital ID can bring to customer interactions and overall business management. In addition, key obstacles exist in balancing customer privacy (including the right to be forgotten), data security, and regulatory requirements while pursuing desired end-user experience and high customer adoption. |
Digital ID has many dimensions, and its ecosystem's sustainability lies in the key principles it is built on. Understanding the digital identity ecosystem and its responsibilities is crucial to formulate an approach to adopt it. Also, focusing on key success factors drives digital ID adoption. Before embarking on the digital identity adoption journey, it is essential to assess your readiness. It is also necessary to understand the risks and challenges. Specific steps to digital ID adoption can help realize the potential of digital identity and enhance the customers' experience. |
Info-Tech Insight
Focusing on customer touchpoints and transforming them is key to excellent user experience and increasing their lifetime value (LTV) to them and to your organization. Digital ID is that tool of transformation.
|
Manish Jain Principal Research Director |
“I just believed. I believed that the technology would change people's lives. I believed putting real identity online - putting technology behind real identity - was the missing link.” - Sheryl Sandberg (Brockes, Emma. “Facebook’s Sheryl Sandberg: who are you calling bossy?” The Guardian, 5 April 2014)Sometimes dismissed as mere marketing gimmicks, digital identity initiatives are anything but. While some argue that any online credential is a "Digital ID," rendering the hype around it pointless, the truth is that a properly built digital ID ecosystem has the power to transform laggard economies into global digital powerhouses. Moreover, digital IDs can help businesses transfer some of their cybersecurity risks and unlock new revenue channels by enabling a foundation for secure and efficient value delivery. In addition, digital identity is crucial for digital and financial inclusion, simplifying onboarding processes and opening up new opportunities for previously underserved populations. For example, in India, the Aadhaar digital ID ecosystem brought over 481 million1 people into the formal economy by enabling access to financial services. Similarly, in Indonesia, the e-KIP digital ID program paved the way for 10 million new bank accounts, 94% of which were for women2. However, digital identity initiatives also come with valid concerns, such as the risk of a single point of failure and the potential to widen the digital divide. This research focuses on the verified digital identity ecosystem, exploring the risks, opportunities, and challenges organizations face relying on these verified digital IDs to know their customers before delivering value. By understanding and adopting digital identity initiatives, organizations can unlock their full potential and provide a seamless customer experience while ensuring operational efficiency. 1 India Aadhaar PMJDY (https://pmjdy.gov.in/account)2 Women’s World Banking, 2020. |
“Digital identity (ID) is a set of attributes that links a physical person with their online interactions. Digital ID refers to one’s online persona - an online footprint. It touches important aspects of one’s everyday life, from financial services to health care and beyond.” - DIACC Canada
“Digital identity is a digital representation of a person. It enables them to prove who they are during interactions and transactions. They can use it online or in person.” - UK Digital Identity and Attributes Trust Framework
“Digital identity is an electronic representation of an entity (person or other entity such as a business) and it allows people and other entities to be recognized online.” - Australia Trusted Digital Identity Framework
A digital identity is primarily an electronic form of identity representing an entity uniquely , while abstracting all other identity attributes of the entity. In addition to an electronic form, it may also exist in a physical form (identity certificate), linked through an identifier representing the same entity.
|
Trust
|
Subject
|
|
Usability
|
Provider
|
|
Jurisdiction
|
Form
|
|
Governance
|
Expiry
|
|
Usage Mode
|
Purpose
|
Info-Tech Insight
Digital ID has taken different meanings for different people, serving different purposes in different environments. Based on various aspects of Digital Identification, it can be categorized in several types. However, most of the time when people refer to a form of identification as Digital ID, they refer to a verified id with built-in trust either from the government OR the eco-system.
Info-Tech Insight
Digital identity ecosystems comprise many entities playing different roles, and sometimes more than one. In addition, variations in approach by jurisdictions drive how many active players are in the ecosystem for that jurisdiction.
For example, in countries like Estonia and India, government plays the role of trust and governance authority as well as ID provider, but didn’t start with any Digital ID wallet. In contrast, in Ukraine, Diia App is primarily a Digital ID Wallet. Similarly, in the US, different states are adopting private Digital ID Wallet providers like Apple.
Social, economic, and legal alignment with target stakeholders
Transparent governance and operation
Legally auditable and enforceable
Robust and Resilient – High availability
Security – At rest, in progress, and in transit
Privacy and Control with users
Omni-channel Convenience – User and Operations
Minimum data transfer between entities
Technical interoperability enabled through open standards and protocol
Scalable and interoperable at policy level
Cost effective – User and operations
Inclusive and accessible
Info-Tech Insight
A transparent, resilient, and auditable digital ID system must be aligned with socio-economic realities of the target stakeholders. It not only respects their privacy and security of their data by minimizing the data transfer between entities, but also drives desired customer experience by providing an omni-channel, interoperable, scalable, and inclusive ecosystem while still being cost-effective for the collaborators.
Digital ID success factors
Legislative regulatory framework – Removes uncertainty
Security & Privacy Assurance- builds trust
Smooth user experience – Drives preferences
Transparent ecosystem – Drives inclusivity
Multi-channel – Drive consistent experience online / offline
Inter-operability thorough open standards
Digital literacy – Education and awareness
Multi-purpose & reusable – Reduce consumer burden
Collaborative ecosystem –Build network effect
Info-Tech Insight
Driving adoption of Digital ID requires affirmative actions from all ecosystem players including governing authorities, identity providers, and identity consumers (relying parties).
These nine success factors can help drive sustainable adoption of the Digital ID.
|
|
|
Info-Tech Insight
The world became global a long time ago; however, it sustained economic progress without digital IDs for most of the world's population.
With the pandemic, when political rhetoric pointed to the demand for localized supply chains, economies became irreversibly digital. In this digital economy, the digital ID ecosystem is the fulcrum of sustainable growth.
At a time in overlapping jurisdictions, multiple digital IDs can exist. For example, one is issued by a local municipality, one by the province, and another by the national government.
Info-Tech Insight
Countries’ approach to the digital ID is rooted in their socio-economic environment and global aspirations.
Emerging economies with large underserved populations prioritize fast implementation of digital ID through centralized systems.
Developed economies with smaller populations, low trust in government, and established ID systems prioritize developing trust frameworks to drive decentralized full-scale implementation.
There is no right way except the one which follows Digital ID principles and aligns with a country’s and its people’s aspirations.
|
|
Uniqueness Estonia pioneered the digital ID implementation with a centralized approach and later transitioned to a decentralized ecosystem driving trust to attract non-citizens into Estonia’s digital economy. |
99% Of Estonian residents have an ID card enabling use of electronic ID 1.4 B Digital signatures given (2021) 99% Public Services available as e-Services 17K+ Productive years saved (five working days/citizen/year saved accessing public services) 25K E-resident companies contributed more than €32 million in tax *Source: https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf ; |
|
| 1.36B People enrolled 80% Beneficiaries feel Aadhaar has made PDS, employment guarantee and social pensions more reliable 91.6% Are very satisfied or somewhat satisfied with Aadhaar 14B eKYC transactions done by 218 eKYC authentication agencies (KUA) Source: https://uidai.gov.in/aadhaar_dashboard/india.php; https://www.stateofaadhaar.in/ | Uniqueness “The Aadhaar digital identity system could reduce onboarding costs for Indian firms from 1,500 rupees to as low as an estimated 10 rupees.” -World Bank Report on Private Sector Impacts from ID With lack of public trust in private sector, government brought in private sector executives in public ecosystem to lead the largest identity program globally and build the India stack to leverage the power of Digital Identity. |
Regulatory Accountability and Operational Governance: Ministry of Digital Transformation. Identity provider: Federated govt. agencies. Digital identity form: Diia App & Portal as a digital wallet for all IDs including digital driving license. |
| 18.5M People downloaded the Diia app. 14 Digital IDs provided by other ID providers are available through Diia. 70 Government services are available through Diia. ~1M Private Entrepreneurs used Diia to register their companies. 1300 Tons of paper estimated to be saved by reducing paper applications for new IDs and replacements. Source:
| Uniqueness “One of the reasons for the Diia App's popularity is its focus on user experience. In September 2022, the Diia App simplified 25 public services and digitized 16 documents. The Ministry of Digital Transformation aims to make 100% of all public services available online by 2024.” - Vladyslava Aleksenko Project Lead—digital Identity, Ukraine |
|
| ![]() | 82% People supportive of Digital ID. 2/3 Canadians prefer public-private partnership for Pan-Canadian digital ID framework. >40% Canadians prefer completing various tasks and transactions digitally. 75% Canadians are willing to share personal information for better experience. >80% Trust government, healthcare providers, and financial institutions with their personal information. Source: DIACC Survey 2021 | Uniqueness Although a few provinces in Canada started their Digital ID journey already, federally, Canada lacked an approach. Now Canada is developing a federated Digital ID ecosystem driven through the Pan-Canadian Trust Framework (PCTF) led by a non-profit (DIACC) formed with public and private partnership. |
| 8.6M People using myGovID by Jun-2022 117 Services accessible through Digital Id System
| Uniqueness Australia started its journey of Digital ID with a centralized Digital ID ecosystem. However, now it preparing to transition to a centrally governed Trust framework-based ecosystem expanding to private sector. |
| ![]() | Uniqueness UK embarked its Digital ID journey through Gov.UK Verify but decided to scrap it recently. It is now preparing to build a trust framework-based federated digital ID ecosystem with roles like schema-owners and orchestration service providers for private sector and drive the collaboration between industry players. |
|
Cross Industry |
Financial Services |
Insurance |
E-governance |
Healthcare & Lifesciences |
Travel and Tourism |
E-Commerce |
|
|
|
|
|
|
|
INDUSTRY: Travel & Tourism
Source: Info-Tech Research Group
|
Challenge |
Solution |
Results |
|---|---|---|
|
Verifying the driver’s license (DL) is the first step a car rental company takes before handing over the keys. While the rental company only need to know the validity of the DL and if it belongs to the presenter, is bears the liability of much more data presented to them through the DL. For customers, it is impossible to rent a car if they forget their DL. If the customer has their driver’s license, they compromise their privacy and security as they hand over their license to the representative. The process is not only time consuming, it also creates unnecessary risks to both the business and the renter. |
A digital id-based rental process allows the renter to present the digital id online or in person. As the customer approaches the car rental they present their digital id on the mobile app, which has already authenticated the presenter though the biometrics or other credentials. The customer selects the purpose of the business as “Car Rental”, and only the customer’s name, photo, and validity of the DL appear on the screen for the representative to see (selective disclosures). If the car pick-up is online, only this information is shared with the car rental company, which in turn shares the car and key location with the renter. |
A digital identity-based identity verification can ensure a rental company has access to the minimum data it needs to comply with local laws, which in turn reduces its data leak risk. It also reduces customer risks linked to forgetting the DL, and data privacy. Digital identity also reduces the risk originated from identity fraud leading to stolen cars. |
INDUSTRY: Government
Source: Info-Tech Research Group
Challenge | Solution | Results |
|---|---|---|
In both emerging and developed economies, public distribution of resources – food, subsidies, or cash – is a critical process through which many people (especially from marginalized sections) survive on. They often either don’t have required valid proof of identity or fall prey to low-level corruption when someone defrauds them by claiming the benefit. As a result, they either completely miss out on claiming government-provided social benefits OR only receive a part of what they are eligible for. | A Digital ID based public distribution can help created a Direct Benefit Transfer ecosystem. Here beneficiaries register (manually OR automatically from other government records) for the benefits they are eligible for. On the specific schedule, they receive their benefit – monetary benefit in their bank accounts, and non-cash benefits, in person from authorized points-of-sales (POS), without any middleman with discretionary decision powers on the distribution. | India launched its Financial Inclusion Program (Prime Minister's Public Finance Scheme) in 2014. The program was linked with India’s Digital Id Aadhaar to smoothen the otherwise bureaucratic and discretionary process for opening a bank account. In last eight years, ~481M (Source: PMJDY) beneficiaries have opened a bank account and deposited ~ ₹1.9Trillion (USD$24B), a part of which came as social benefits directly deposited to these accounts from the government of India. |
INDUSTRY: Asset Management
Source: Info-Tech Research Group
Challenge | Solution | Results |
|---|---|---|
“Impersonators posing as homeowners linked to 32 property fraud cases in Ontario and B.C.” – Global News Canada1 “The level of fraud in the UK is such that it is now a national security threat” – UK Finance Lobby Group2 Real estate is the most expensive investment people make in their lives. However, lately it has become a soft target for title fraud. Fraudsters steal the title to one’s home and sell it or apply for a new mortgage against it. At the root cause of these fraud are usually identity theft when a fraudster steals someone’s identity and impersonates them as the title owner. | Digital identity tagged to the home ownership / title record can reduce the identity fraud in title transfer. When a person wants to sell their house OR apply for a new mortgage on house, multiple notifications will be triggered to their contact attributes on digital ID – phone, email, postal address, and digital ID Wallet, if applicable. The homeowner will be mandated to authorize the transaction on at least two channels they had set as preferred, to ensure that the transaction has the consent of the registered homeowner. | This process will stop any fraud transactions until at least two modes are compromised. Even if two modes are compromised, the real homeowner will receive the notification on offline communication modes, and they can then alert the institution or lawyer to block the transaction. It will especially help elderly people, who are more prone to fall prey to identity frauds when somebody uses their IDs to impersonate them. |
1 Global News (https://globalnews.ca/news/9437913/homeowner-impersonators-lined-32-fraud-cases-ontario-bc/)
2 UK Finance Lobby Group (https://www.ukfinance.org.uk/system/files/Half-year-fraud-update-2021-FINAL.pdf)
|
Governments & identity providers (public & private) |
Customers and end users (subjects) |
Identity consumer (relying parties) |
|---|---|---|
|
|
|
|
Governments and identity providers (public and private) |
|---|
|
|
Customers and end users (subjects) |
|---|
|
|
Identity consumer (relying parties) |
|---|
|
Does your target jurisdiction have adequate legislative framework to enable uses of digital identities in your industry?
If the Digital ID ecosystem in your target jurisdiction is trust framework-based, do you have adequate understanding of it?
Do you have exact understanding of value stream and customer touch-points where you interact with user identity?
Do you have exact understanding of the identity attributes that your business processes need to deliver customer value?
Do you have required systems to ensure your compliance with industry regulations around customer PII and identity?
Is your existing identity management system interoperable with Open-source Digital Identity ecosystem?
Have you established an integrated enterprise governance framework covering business processes, technical systems, and risk management?
Do have a clear strategy (mode, method, means) to communicate with your target customer and persuade them to adopt digital identity?
Do you have security operations center coordinating detection, response, resolution, and communication of potential data breaches?
|
Considering the complexity of digital identity adoption, and its impact on customer experience, it is vital to assess the ecosystem and adopt an MVP approach before a big-bang launch.
|
|
|
Digital ID adoption is a major change for everyone in the ecosystem. Manage associated risks to avoid the derailing of integration with your business processes and a negative impact on customer experience.
|
|
| 1 |
Customer-centricity Digital identity initiative should prioritize customer experience when evaluating its fit in the value stream. Adopting it should not sacrifice end-user experience to gain a few brownie points. See Info-Tech’s Adopt Design Thinking in Your Organization blueprint, to ensure customer remains at the center of your Digital Adoption initiative. |
|---|---|
| 2 |
Privacy and security Adopting digital identity reduces data risk by minimizing data transfer between providers and consumers. However, securing identity attributes in value streams still requires strengthening enterprise security systems and processes. See Info-Tech’s Assess and Govern Identity Security blueprint for the actions you may take to secure and govern digital identity. |
| 3 |
Inclusion and awareness Adopting digital identity may alter customer interaction with an organization. To avoid excluding target customer segments, design digital identity accordingly. Educating and informing customers about the changes can facilitate faster adoption. See Info-Tech’s Social Media blueprint and IT Diversity & Inclusion Tactics to make inclusion and awareness part of digital adoption |
| 4 |
Quantitative success metrics To measure the success of a digital ID adoption program, it's essential to use quantitative metrics that align with business KPIs. Some measurable KPIs may include:
|
Continues..
Attributes: An identity attribute is a statement or information about a specific aspect of entity’s identity ,substantiating they are who they claim to be, own, or have.
Attribute (or Credential) provider: An attribute or credential provider could be an organization which issues the primary attribute or credential to a subject or entity. They are also responsible for identity-attribute binding, credential maintenance, suspension, recovery, and authentication.
Attribute (or Credential) service provider: An attribute service provider could be an organization which originally vetted user’s credentials and certified a specific attribute of their identity. It could also be a software, such as digital wallet, which can store and share a user’s attribute with a third party once consented by the user. (Source: UK Govt. Trust Framework)
Attribute binding: This is a process an attribute service providers uses to link the attributes they created to a person or an organization through an identifier. This process makes attributes useful and valuable for other entities using these attributes. For example, when a new employee joins a company, they are given a unique employee number (an identifier), which links the person with their job title and other aspects (attributes) of his job. (Source: UK Govt. Trust Framework)
Authentication service provider: An organization which is responsible for creating and managing authenticators and their lifecycle (issuance, suspension, recovery, maintenance, revocation, and destruction of authenticators). (Source: DIACC)
Authenticator: Information or biometric characteristics under the control of an individual that is a specific instance of something the subject has, knows, or does. E.g. private signing keys, user passwords, or biometrics like face, fingerprints. (Source: Canada PCTF)
Authentication (identity verification): The process of confirming or denying that the identity presented relates to the subject who is making the claim by comparing the credentials presented with the ones presented during identity proofing.
Authorization: The process of validating if the authenticated entity has permission to access a resource (service or product).
Biometrics attributes: Human attributes like retina (iris), fingerprint, heartbeat, facial, handprint, thumbprint, voice print.
Centralized identity: Digital identities which are fully governed by a centralized government entity. It may have enrollment or registration agencies, private or public sector, to issue the identities, and the technical system may still be decentralized to keep data federated.
Certificate Authority (CA or accredited assessors): An organization or an entity that conducts assessments to validate the framework compliance of identity or attribute providers (such as websites, email addresses, companies, or individual persons) serving other users, and binding them to cryptographic keys through the issuance of electronic documents known as digital certificates.
Continues..
Collective (non-resolvable) attributes: Nationality, domicile, citizenship, immigration status, age group, disability, income group, membership, (outstanding) credit limit, credit score range.
Contextual identity: A type of identity which establishes an entity’s existence in a specific context – real or virtual. These can be issued by public or private identity providers and are governed by the organizational policies. E.g. employee ID, membership ID, social media ID, machine ID.
Credentials: A physical or a digital representation of something that establishes an entity’s eligibility to do something for which it is seeking permission, or an association/affiliation with another, generally well-known entity. E.g. Passport, DL, password. In the context of Digital Identity, every identity needs to be attached with a credential to ensure that the subject of the identity can control how and by whom that identity can be used.
Cryptographic hash function: A hash function is a one-directional mathematical operation performed on a message of any length to get a unique, deterministic, and fixed size numerical string (the hash) which can’t be reverse engineered to get the input data without deploying disproportionate resources. It is the foundation of modern security solutions in DLT / blockchain as they help in verifying the integrity and authenticity of the message.
Decentralized identity (DID) or self-sovereign identity: This is a way to give back the control of identity to the subject whose identity it is, using an identity wallet in which they collect verified information about themselves from certified issuers (such as the government). By controlling what information is shared from the wallet to requesting third parties (e.g. when registering for a new online service), the user can better manage their privacy, such as only presenting proof that they’re over 18 without needing to reveal their date of birth. Source: (https://www.gsma.com/identity/decentralised-identity)
Digital identity wallet: A type of digital wallet refers to a secure, trusted software applications (native mobile app, mobile web apps, or Rivas-hosted web applications) based on common standards, allowing a user to store and use their identity attributes, identifiers, and other credentials without loosing or sharing control of them. This is different than Digital Payment Wallets used for financial transactions. (Source: https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf)
Digital identity: A digital identity is primarily an electronic form of identity representing an entity uniquely , while abstracting all other identity attributes of the entity. In addition to an electronic form, it may also exist in a physical form (identity certificate), linked through an identifier representing the same entity. E.g. Estonia eID , India Aadhar, digital citizenship ID.
Digital object architecture: DOA is an open architecture for interoperability among various information systems, including ID wallets, identity providers, and consumers. It focuses on digital objects and comprises three core components: the identifier/resolution system, the repository system, and the registry system. There are also two protocols that connect these components. (Source: dona.net)
Digital signature: A digital signature is an electronic, encrypted stamp of authentication on digital information such as email messages, macros, or electronic documents. A signature confirms that the information originated from the signer and has not been altered. (Source: Microsoft)
Continues..
Entity (or Subject): In the context of identity, an entity is a person, group, object, or a machine whose claims need to be ascertained and identity needs to be established before his request for a service or products can be fulfilled. An entity can also be referred to as a subject whose identity needs to be ascertained before delivering a service.
Expiry: This is another dimension of an identity and determines the validity of an ID. Most of the identities are longer term, but there can be a few like digital tokens and URLs which can be issued for a few hours or even minutes. There are some which can be revoked after a pre-condition is met.
Federated identity: Federated identity is an agreement between two organizations about the definition and use of identity attributes and identifiers of a consumer entity requesting a service. If successful, it allows a consumer entity to get authenticated by one organization (identity provider) and then authorized by another organization. E.g. accessing a third-party website using Google credentials.
Foundational identity: A type of identity which establishes an entity’s existence in the real world. These are generally issued by public sector / government agencies, governed by a legal farmwork within a jurisdiction, and are widely accepted at least in that jurisdiction. E.g. birth certificate, citizenship certificate.
Governance: This is a dimension of identity that covers the governance model for a digital ID ecosystem. While traditionally it has been under the sovereign government or a federated structure, in recent times, it has been decentralized through DLT technologies or trust-framework based. It can also be self-sovereign, where individuals fully control their data and ID attributes.
Identifier: A digital identifier is a string of characters that uniquely represents an entity’s identity in a specific context and scope even if one or more identity attributes of the subject change over time. E.g. driver’s license, SSN, SIN, email ID, digital token, user ID, device ID, cookie ID.
Identity: An identity is an instrument used by an entity to provide the required information about itself to another entity in order to avail a service, access a resource, or exercise a privilege. An identity formed by 1-n identity attributes and a unique identifier.
Identity and access management (IAM): IAM is a set of frameworks, technologies, and processes to enable the creation, maintenance, and use of digital identity, ensuring that the right people gain access to the right materials and records at the right time. (Source: https://iam.harvard.edu/)
Identity consumer (Relying party): An organization, or an entity relying on identity provider to mitigate IT risks around knowing its customers before delivering the end-user value (product/service) without deteriorating end-user experience. E.g. Canada Revenue Agency using SecureKey service and relying on Banking institutions to authenticate users; Telecom service providers in India relying on Aadhaar identity system to authenticate the customer's identity.
Identity form: A dimension of identity that defines its forms depending on the scope it wants to serve. It can be a physical card for offline uses, a virtual identifier like a number, or an app/account with multiple identity attributes. Cryptographic keys and tokens can also be forms of identity.
Continues...
Identity infrastructure provider: Organizations involved in creating and maintaining technological infrastructure required to manage the lifecycle of digital identities, attributes, and credentials. They implement functions like security, privacy, resiliency, and user experience as specified in the digital identity policy and trust framework.
Identity proofing: A process of asserting the identification of a subject at a useful identity assurance level when the subject provides evidence to a credential service provider (CSP), reliably identifying themselves. (Source: NIST Special Publication 800-63A)
Identity provider (Attestation authority): An organization or an entity validating the foundation or contextual claims of a subject and establishing identifier(s) for a subject. E.g. DMV (US) and MTA (Canada) issuing drivers’ licenses; Google / Facebook issuing authentication tokens for their users logging in on other websites.
Identity validation: The process of confirming or denying the accuracy of identity information of a subject as established by an authorized party. It doesn’t ensure that the presenter is using their own identity.
Identity verification (Authentication): The process of confirming or denying that the identity presented relates to the subject who is making the claim by comparing the credentials presented with the ones presented during identity proofing.
Internationalized resource identifier (IRI): IRIs are equivalent to URIs except that IRIs also allow non-ascii characters in the address space, while URIs only allow us-ascii encoding. (Source: w3.org)
Jurisdiction: A dimension of identity that covers the physical area or virtual space where an identity is legally acceptable for the purpose defined under law. It can be global, like it is for passport, or it can be local within a municipality for specific services. For unverified digital IDs, it can be the social network.
Multi-factor Authentication (MFA): Multi-factor authentication is a layered approach to securing digital assets (data and applications), where a system requires a user to present a combination of two or more credentials to verify a user’s identity for login. These factors can be a combination of (i) something you know like a password/PIN; (ii) something you have like a token on mobile device; and (iii) something you are like a biometric. (Adapted from https://www.cisa.gov/publication/multi-factor-authentication-mfa)
Oauth (Open authorization): OAuth is a standard authorization protocol and used for access delegation. It allows internet users to access websites by using credentials managed by a third-party authorization server / Identity Provider. It is designed for HTTP and allows access tokens to be issued by an authorization server to third-party websites. E.g. Google, Facebook, Twitter, LinkedIn use Oauth to delegate access.
OpenID: OpenID is a Web Authentication Protocol and implements reliance authentication mechanism. It facilitates the functioning of federated identity by allowing a user to use an existing account (e.g. Google, Facebook, Yahoo) to sign into third-party websites without needing to create new credentials. (Source: https://openid.net/).
Continues...
Personally identifiable information (PII): PII is a set of attributes which can be used, through direct or indirect means, to infer the real-world identity of the individual whose information is input. E.g. National ID (SSN/SIN/Aadhar) DL, name, date of birth, age, address, age, identifier, university credentials, health condition, email, domain name, website URI (web resolvable) , phone number, credit card number, username/password, public key / private key. (Source: https://www.dol.gov)
Predicates: The mathematical or logical operations such as equality or greater than on attributes (e.g. prove your salary is greater than x or your age is greater than y) to prove a claim without sharing the actual values.
Purpose: This dimension of a digital id defines for what purpose digital id can be used. It can be one or many of these – authentication, authorization, activity linking, historical record keeping, social interactions, and machine connectivity for IoT use cases.
Reliance authentication: Relying on a third-party authentication before providing a service. It is a method followed in a federated entity system.
Risk-based authentication: A mechanism to protect against account compromise or identity theft. It correlates an authentication request with transitional facts like requester’s location, past frequency of login, etc. to reduce the risk of potential fraud.
Scheme in trust framework: A specific set of rules (standard and custom) around the use of digital identities and attributes as agreed by one or more organizations. It is useful when those organizations have similar products, services, business processes. (Source: UK Govt. Trust Framework). E.g. Many credit unions agree on how they will use the identity in loan origination and servicing.
Selective disclosure (Assertion): A way to present one’s identity by sharing only a limited amount information that is critical to make an authentication / authorization decision. E.g. when presenting your credentials, you could share something proving you are 18 years or above, but not share your name, exact age, address, etc.
Trust: A dimension of an identity, which essentially is a belief in the reliability, truth, ability, or strength of that identity. While in the physical world all acceptable form of identities come with a verified trust, in online domain, it can be unverified. Also, where an identity is only acceptable as per the contract between two entities, but not widely.
Trust framework: The trust framework is a set of rules that different organizations agree to follow to deliver one or more of their services. This includes legislation, standards, guidance, and the rules in this document. By following these rules, all services and organizations using the trust framework can describe digital identities and attributes they’ve created in a consistent way. This should make it easier for organizations and users to complete interactions and transactions or share information with other trust framework participants. (Source: UK Govt. Trust Framework)
Continues...
Uniform resource identifier (URI): A universal name in registered name spaces and addresses referring to registered protocols or name spaces.
Uniform resource locator (URL): A type of URI which expresses an address which maps onto an access algorithm using network protocols. (Source: https://www.w3.org/)
Uniform resource name (URN): A type of URI that includes a name within a given namespace but may not be accessible on the internet.
Usability: A dimension of identity that defines how many times it can be used. While most of the identities are multi-use, a few digital identities are in token form and can be used only once to authenticate oneself.
Usage mode: A dimension of identity that defines the service mode in which a digital ID can be used. While all digital IDs are made for online usage, many can also be used in offline interactions.
Verifiable credentials: This W3C standard specification provides a standard way to express credentials on the Web in a way that is cryptographically secure, privacy-respecting, and machine-verifiable. (Source: https://www.w3.org/TR/vc-data-model/)
X.509 Certificates: X.509 certificates are standard digital documents that represent an entity providing a service to another entity. They're issued by a certification authority (CA), subordinate CA, or registration authority. These certificates play an important role in ascertaining the validity of an identity provider and in turn the identities issued by it. (Source: https://learn.microsoft.com/en-us/azure/iot-hub/reference-x509-certificates)
Zero-knowledge proofs: A method by which one party (the prover) can prove to another party (the verifier) that something is true, without revealing any information apart from the fact that this specific statement is true. (Source: 1989 SIAM Paper)
Zero-trust security: A cybersecurity paradigm focused on resource protection and the premise that trust is never granted implicitly but must be continually evaluated. It evaluates each access request as if it is a fraud attempt, and grants access only if it passes the authentication and authorization test. (Source: Adapted from NIST, SP 800-207: Zero Trust Architecture, 2020)
Build a Zero Trust Roadmap
Leverage an iterative and repeatable process to apply zero trust to your organization.
Assess and Govern Identity Security
Strong identity security and governance are the keys to the zero-trust future.
Adopt Design Thinking in Your Organization
Innovation needs design thinking to ensure customer remains at the center of everything the organization does.
Social Media
Leveraging Social Media to connect with your customers and educate them to drive the value proposition of your efforts.
IT Diversity & Inclusion Tactics
Equip your teams to create an inclusive environment and mobilize inclusion efforts across the organization.
|
David Wallace |
|
Erik Avakian |
|
Matthew Bourne |
|
Mike Tweedie |
|
Aaron Shum |
India Aadhaar PMJDY (https://pmjdy.gov.in/account)
Theis, S., Rusconi, G., Panggabean, E., Kelly, S. (2020). Delivering on the Potential of Digitized G2P: Driving Women’s Financial Inclusion and Empowerment through Indonesia’s Program Keluarga Harapan. Women’s World Banking.
DIACC Canada (https://diacc.ca/the-diacc/)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
Australia Trusted Digital Identity Framework (https://www.digitalidentity.gov.au/tdif#changes)
eIDAS (https://digital-strategy.ec.europa.eu/en/policies/eidas-regulation)
Europe Digital Wallet – POTENTIAL (https://www.digital-identity-wallet.eu/)
Canada PCTF (https://diacc.ca/trust-framework/)
Identification Revolution: Can Digital ID be harnessed for Development? (Gelb & Metz), 2018
e-Estonia website (https://e-estonia.com/solutions/e-identity/id-card/)
Aadhaar Dashboard (https://uidai.gov.in/)
DIACC Website (https://diacc.ca/the-diacc/)
Australia Digital ID website (https://www.digitalidentity.gov.au/tdif#changes)
UK Policy paper - digital identity & attributes trust framework (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
Ukraine Govt. website (https://ukraine.ua/invest-trade/digitalization/)
Singapore SingPass Website (https://www.tech.gov.sg/products-and-services/singpass/)
Norway BankID Website (https://www.bankid.no/en/private/about-us/)
Brazil National ID Card website (https://www.gov.br/casacivil/pt-br/assuntos/noticias/2022/julho/nova-carteira-de-identidade-nacional-modelo-unico-a-partir-de-agosto)
Indonesia Coverage in Professional Security Magazine (https://www.professionalsecurity.co.uk/products/id-cards/indonesian-cards/)
Philippine ID System (PhilSys) website (https://www.philsys.gov.ph/)
China coverage on eGovReview (https://www.egovreview.com/article/news/559/china-announces-plans-national-digital-ids)
Thales Group Website - DHS’s Automated Biometric Identification System IDENT (https://www.thalesgroup.com/en/markets/digital-identity-and-security/government/customer-cases/ident-automated-biometric-identification-system)
FranceConnect (https://franceconnect.gouv.fr/)
Germany: Office for authorization cert. (https://www.personalausweisportal.de/Webs/PA/DE/startseite/startseite-node.html)
Italian Digital Services Authority (https://www.spid.gov.it/en/)
Monacco Mconnect (https://mconnect.gouv.mc/en)
Estonia eID (https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf)
E-Residency Dashboard (https://www.e-resident.gov.ee/dashboard)
Unique ID authority of India (https://uidai.gov.in/aadhaar_dashboard/india.php)
State of Aadhaar (https://www.stateofaadhaar.in/)
World Bank (https://documents1.worldbank.org/curated/en/219201522848336907/pdf/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf)
WorldBank - ID4D 2022 Annual Report (https://documents.worldbank.org/en/publication/documents-reports/documentdetail/099437402012317995/idu00fd54093061a70475b0a3b50dd7e6cdfe147)
Ukraine Govt. Website for Invest and trade (https://ukraine.ua/invest-trade/digitalization/)
Diia Case study prepared for the office of Canadian senator colin deacon (https://static1.squarespace.com/static/63851cbda1515c69b8a9a2b9/t/6398f63a9d78ae73d2fd5725/1670968891441/2022-case-study-report-diia-mobile-application.pdf)
Canadian Digital Identity Research (https://diacc.ca/wp-content/uploads/2022/04/DIACC-2021-Research-Report-ENG.pdf)
Voilà Verified Trustmark (https://diacc.ca/voila-verified/)
Digital Identity, 06A Federation Onboarding Guidance paper, March 2022 (https://www.digitalidentity.gov.au/sites/default/files/2022-04/TDIF%2006A%20Federation%20Onboarding%20Guidance%20-%20Release%204.6%20%28Doc%20Version%201.2%29.pdf)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
A United Nations Estimate of KYC/AML (https://www.imf.org/Publications/fandd/issues/2018/12/imf-anti-money-laundering-and-economic-stability-straight)
India Aadhaar PMJDY (https://pmjdy.gov.in/account)
Global News (https://globalnews.ca/news/9437913/homeowner-impersonators-lined-32-fraud-cases-ontario-bc/)
UK Finance Lobby Group (https://www.ukfinance.org.uk/system/files/Half-year-fraud-update-2021-FINAL.pdf)
McKinsey Digital ID report (
https://www.mckinsey.com/capabilities/mckinsey-digital/our-insights/digital-identification-a-key-to-inclusive-growth)
International Peace Institute (
https://www.ipinst.org/2016/05/information-technology-and-governance-estonia#7)
E-Estonia Report (https://e-estonia.com/wp-content/uploads/e-estonia-211022_eng.pdf)
2022 Budget Statement (https://diacc.ca/2022/04/07/2022-budget-statement/)
World Bank ID4D - Private Sector Economic Impacts from Identification Systems 2018 (https://documents1.worldbank.org/curated/en/219201522848336907/Private-Sector-Economic-Impacts-from-Identification-Systems.pdf)
DIACC Canada (https://diacc.ca/the-diacc/)
UK digital identity & attributes trust framework alpha v2 (0.2) - GOV.UK (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
https://www.gsma.com/identity/decentralised-identity
https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf
Microsoft Digital signatures and certificates (https://support.microsoft.com/en-us/office/digital-signatures-and-certificates-8186cd15-e7ac-4a16-8597-22bd163e8e96)
https://www.worldbank.org/content/dam/photos/1440x300/2022/feb/eID_WB_presentation_BS.pdf
https://www.dona.net/digitalobjectarchitecture
IAM (https://iam.harvard.edu/)
NIST Special Publication 800-63A (https://pages.nist.gov/800-63-3/sp800-63a.html)
https://www.cisa.gov/publication/multi-factor-authentication-mfa
https://openid.net/
U.S. DEPARTMENT OF LABOR (https://www.dol.gov/)
UK govt. trust framework (https://www.gov.uk/government/publications/uk-digital-identity-attributes-trust-framework-updated-version/uk-digital-identity-and-attributes-trust-framework-alpha-version-2)
https://www.w3.org/
Verifiable Credentials Data Model v1.1 (https://www.w3.org/TR/vc-data-model/)
https://learn.microsoft.com/en-us/azure/iot-hub/reference-x509-certificates
Besides the small introduction, subscribers and consulting clients within this management domain have access to:
Identifying and planning sources of financial contingency will help ensure CIOs can meet unforeseen and emergent operational and business needs throughout the year.
The start of 2021 is a time to refocus and redouble IT risk management and business continuity planning to bring it up to the standards of our “new normal.” Indeed, if last year taught us anything, it’s that no “black swan” should be off the table in terms of scenarios or possibilities for business disruption.
At its heart, resilience is having the capacity to deal with unexpected change. Organizational change management can help build up this capacity, providing the ability to strategically plot known changes while leaving some capacity to absorb the unknowns as they present themselves.
Capacity awareness facilitates resilience by providing capital in the form of resource data. With this data, CIOs can make better decisions on what can be approved and when it can be scheduled for.
Having an up-to-date view of emerging technologies will enable the resilient CIO to capitalize on and deploy leading-edge innovations as the business requires.