Maximize Your American Rescue Plan Funding

  • Buy Link or Shortcode: {j2store}74|cart{/j2store}
  • member rating overall impact: 9.0/10 Overall Impact
  • member rating average dollars saved: $661,499 Average $ Saved
  • member rating average days saved: 8 Average Days Saved
  • Parent Category Name: Cost & Budget Management
  • Parent Category Link: /cost-and-budget-management
  • Will funding from COVID-19 stimulus opportunities mean more human and financial resources for IT?
  • Are there governance processes in place to successfully execute large projects?
  • What does a large, one-time influx of capital mean for keeping-the-lights-on budgets?
  • How will ARP funding impact your internal resourcing?
  • How can you ensure that IT is not left behind or an afterthought?

Our Advice

Critical Insight

  • Seek a one-to-many relationship between IT solutions and business problems. Use the central and overarching nature of IT to identify one solution to multiple business problems that span multiple programs, departments, and agencies.
  • Lack of specific guidance should not be a roadblock to starting. Be proactive by initiating the planning process so that you are ready to act as soon as details are clear.
  • IT involvement is the lynchpin for success. The pandemic has made this theme self-evident, and it needs to stay that way.
  • The fact that this funding is called COVID-19 relief might make you think you should only use it for recovery, but actually it should be viewed as an opportunity to help the organization thrive post-pandemic.

Impact and Result

  • Shift IT’s role from service provider to innovator. Take ARP funding as a once-in-a-lifetime opportunity to create future enterprise capabilities by thinking big to consider IT innovation that can transform the business and its initiatives for the post-pandemic world.
  • Whether your organization is eligible for a direct or an indirect transfer, be sure you understand the requirements to apply for funding internally through a business case or externally through a grant application.
  • Gain the skills to execute the project with confidence by developing a comprehensive statement of work and managing your projects and vendor relationships effectively.

Maximize Your American Rescue Plan Funding Research & Tools

Use our research to help maximize ARP funding.

Follow Info-Tech's approach to think big, align with the business, analyze budget and staffing, execute with confidence, and ensure compliance and reporting.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

[infographic]

Workshop: Maximize Your American Rescue Plan Funding

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Think Big

The Purpose

Push the boundaries of conventional thinking and consider IT innovations that truly transform the business.

Key Benefits Achieved

A list of innovative IT opportunities that your IT department can use to transform the business

Activities

1.1 Discuss the objectives of ARP and what they mean to IT departments.

1.2 Identify drivers for change.

1.3 Review IT strategy.

1.4 Augment your IT opportunities list.

Outputs

Revised IT vision

List of innovative IT opportunities that can transform the business

2 Align With the Business

The Purpose

Partner with the business to reprioritize projects and initiatives for the post-pandemic world.

Key Benefits Achieved

Assessment of the organization’s new and existing IT opportunities and alignment with business objectives

Activities

2.1 Assess alignment of current and new IT initiatives with business objectives.

2.2 Review and update prioritization criteria for IT projects.

Outputs

Preliminary list of IT initiatives

Revised project prioritization criteria

3 Analyze IT Budget and Staffing

The Purpose

Identify IT budget deficits resulting from pandemic response and discover opportunities to support innovation through new staff and training.

Key Benefits Achieved

Prioritized shortlist of business-aligned IT initiative and projects

Activities

3.1 Classify initiatives into project categories using ROM estimates.

3.2 Identify IT budget needs for projects and ongoing services.

3.3 Identify needs for new staff and skills training.

3.4 Determine business benefits of proposed projects.

3.5 Prioritize your organization’s projects.

Outputs

Prioritized shortlist of business-aligned IT initiatives and projects

4 Plan Next Steps

The Purpose

Tie IT expenditures to direct transfers or link them to ARP grant opportunities.

Key Benefits Achieved

Action plan to obtain ARP funding

Activities

4.1 Tie projects to direct transfers, where applicable.

4.2 Align list of projects to indirect ARP grant opportunities.

4.3 Develop an action plan to obtain ARP funding.

4.4 Discuss required approach to project governance.

Outputs

Action plan to obtain ARP funding

Project governance gaps

Identify and Manage Strategic Risk Impacts on Your Organization

  • Buy Link or Shortcode: {j2store}219|cart{/j2store}
  • member rating overall impact: N/A
  • member rating average dollars saved: N/A
  • member rating average days saved: N/A
  • Parent Category Name: Vendor Management
  • Parent Category Link: /vendor-management

Moreso than any other time, our world is changing. As a result, organizations – and their vendors – need to be able to adapt their strategic plans to accommodate risk on an unprecedented level.

A new global change will impact your organizational strategy at any given time. So, make sure your plans are flexible enough to manage the inevitable consequences.

Our Advice

Critical Insight

  • Identifying and managing a vendor’s potential strategic impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes affect strategic plans.
  • Organizational leadership is often taken unaware during crises, and their plans lack the flexibility needed to adjust to significant market upheavals.

Impact and Result

  • Vendor management practices educate organizations on the different potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
  • Prioritize and classify your vendors with quantifiable, standardized rankings.
  • Prioritize focus on your high-risk vendors.
  • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your strategic plan with our Strategic Risk Impact Tool.

Identify and Manage Strategic Risk Impacts on Your Organization Research & Tools

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Identify and Manage Strategic Risk Impacts to Your Organization Deck – Use the research to better understand the negative impacts of vendor actions on your strategic plans.

Use this research to identify and quantify the potential strategic impacts caused by vendors. Use Info-Tech’s approach to look at the strategic impact from various perspectives to better prepare for issues that may arise.

  • Identify and Manage Strategic Risk Impacts on Your Organization Storyboard

2. What If Vendor Strategic Impact Tool – Use this tool to help identify and quantify the strategic impacts of negative vendor actions

By playing the “what if” game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

  • Strategic Risk Impact Tool
[infographic]

Further reading

Identify and Manage Strategic Risk Impacts on Your Organization

The world is in a perpetual state of change. Organizations need to build adaptive resiliency into their strategic plans to adjust to ever-changing market dynamics.

Analyst perspective

Organizations need to build flexible resiliency into their strategic plans to be able to adjust to ever-changing market dynamics.

This is a picture of Frank Sewell, Research Director, Vendor Management at Info-Tech Research Group

Like most people, organizations are poor at assessing the likelihood of risk. If the past few years have taught us anything, it is that the probability of a risk occurring is far more flexible in the formula Risk = Likelihood * Impact than we ever thought possible. The impacts of these risks have been catastrophic, and organizations need to be more adaptive in managing them to strengthen their strategic plans.

Frank Sewell,
Research Director, Vendor Management
Info-Tech Research Group

Executive Summary

Your Challenge

Moreso than any other time, our world is changing. As a result, organizations – and their vendors – need to be able to adapt their strategic plans to accommodate risk on an unprecedented level.

A new global change will impact your organizational strategy at any given time. So, make sure your plans are flexible enough to manage the inevitable consequences.

Common Obstacles

Identifying and managing a vendor’s potential strategic impact on your organization requires multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how these changes affect strategic plans.

Organizational leadership is often taken unaware during crises, and their plans lack the flexibility needed to adjust to significant market upheavals.

Info-Tech’s Approach

Vendor management practices educate organizations on the different potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.

Prioritize and classify your vendors with quantifiable, standardized rankings.

Prioritize focus on your high-risk vendors.

Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your strategic plan with our Strategic Impacts Tool.

Info-Tech Insight

Organizations must evolve their strategic risk assessments to be more adaptive to respond to global changes in the market. Ongoing monitoring of the market and the vendors tied to company strategies is imperative to achieving success.

Info-Tech’s multi-blueprint series on vendor risk assessment

There are many individual components of vendor risk beyond cybersecurity.

This image depicts a cube divided into six different coloured sections. The sections are labeled: Financial; Reputational; Operational; Strategic; Security; Regulatory & Compliance.

This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

Out of Scope:

This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

Strategic risk impacts

Potential losses to the organization due to risks to the strategic plan

  • In this blueprint, we’ll explore strategic risks (risks to the Strategic Plans of the organization) and their impacts.
  • Identify potentially disruptive events to assess the overall impact on organizations and implement adaptive measures to correct strategic plans.
This image depicts a cube divided into six different coloured sections. The section labeled Strategic is highlighted.

The world is constantly changing

The IT market is constantly reacting to global influences. By anticipating changes, leaders can set expectations and work with their vendors to accommodate them.

When the unexpected happens, being able to adapt quickly to new priorities ensures continued long-term business success.

Below are some things no one expected to happen in the last few years:

62%

of IT professionals are more concerned about being a victim of ransomware than they were a year ago.

82%

of Microsoft’s non-essential employees shifted to working from home in 2020, joining the 18% already remote.

89%

of organizations invested in web conferencing technology to facilitate collaboration.

Source: Info-Tech Tech Trends Survey 2022

Strategic risks on a global scale

Odds are at least one of these is currently affecting your strategic plans

  • Vendor Acquisitions
  • Global Pandemic
  • Global Shortages
  • Gas Prices
  • Poor Vendor Performance
  • Travel Bans
  • War
  • Natural Disasters
  • Supply Chain Disruptions
  • Security Incidents

Make sure you have the right people at the table to identify and plan to manage impacts.

Identify & manage strategic risks

Global Pandemic

Very few people could have predicted that a global pandemic would interrupt business on the scale experienced today. Organizations should look at their lessons learned and incorporate adaptable preparations into their strategic planning moving forward.

Vendor Acquisitions

The IT market is an ever-shifting environment. Larger companies often gobble up smaller ones to control their sectors. Incorporating plans to manage those shifts in ownership will be key to many strategic plans that depend on niche vendor solutions for success. Be sure to monitor the potentially affected markets on an ongoing cadence.

Global Shortages

Organizations need to accept that shortages will recur periodically and that preparing for them will significantly increase the success potential of long-term strategic plans. Understand what your business needs to stock for project needs and where those supplies are located, and plan how to rapidly access and distribute them as required if supply chain disruptions occur.

What to look for in vendors

Identify strategic risk impacts

  • A vendor acquires many smaller, seemingly irrelevant IT products. Suddenly their revenue model includes aggressive license compliance audits.
    • Ensure that your installed software meets license compliance requirements with good asset management practices.
    • Monitor the market for such acquisitions or news of audits hitting companies.
  • A vendor changes their primary business model from storage and hardware to becoming a self-proclaimed “professional services guru,” relying almost entirely on their name recognition to build their marketing.
    • Be wary of self-proclaimed experts and review their successes and failures with other organizations before adopting them into your business strategy.
    • Review the backgrounds their “experts” have and make sure they have the industry and technical skill sets to perform the services to the required level.

Not preparing for your growth can delay your goals

Why can’t I get a new laptop?

For example:

  • An IT professional services organization plans to take advantage of the growing work-from-home trend to expand its staff by 30% over the coming year.
  • Logically, this should include a review of the necessary tasks involved, including onboarding.
    • Suppose the company does not order enough equipment in preparation to cover the new staff plus routine replacement. In that case, this will delay the output of the new team members immeasurably as they wait for their company equipment and will delay existing staff whose equipment breaks, preventing them from getting back to work efficiently.

Sometimes an organization has the right mindset to take advantage of the changes in the market but can fail to plan for the particulars.

When your strategic plan changes, you need to revisit all the steps in the processes to ensure a successful outcome.

Strategic risks

Poor or uninformed business decisions can lead to organizational strategic failures

  • Supply chain disruptions and global shortages
    • Geopolitical disruptions and natural disasters have caused unprecedented interruptions to business. Incorporate forecasting of product and ongoing business continuity planning into your strategic plans to adapt as events unfold.
  • Poor vendor performance
    • Consider the impact of a vendor that fails to perform midway through the implementation. Organizations need to be able to manage the impact of replacing that vendor and cutting their losses rather than continuing to throw good money away after bad performance.
  • Vendor acquisitions
    • A lot of acquisition is going on in the market today. Large companies are buying competitors and either imposing new terms on customers or removing the competing products from the market. Prepare options for any strategy tied to a niche product.

It is important to identify potential risks to strategic plans to manage the risk and be agile enough in planning to adapt to the changing environments.

Info-Tech Insight
Few organizations are good at identifying risks to their strategic plan. As a result, almost none realistically plan to monitor, manage, and adapt their strategies to those risks.

Prepare your strategic risk management for success

Due diligence will enable successful outcomes

  1. Obtain top-level buy-in; it is critical to success.
  2. Build enterprise risk management (ERM) through incremental improvement.
  3. Focus initial efforts on the “big wins” to prove the process works.
  4. Use existing resources.
  5. Build on any risk management activities that already exist in the organization.
  6. Socialize ERM throughout the organization to gain additional buy‑in.
  7. Normalize the process long term with ongoing updates and continuing education for the organization.

(Adapted from COSO)

How to assess strategic risk

  1. Review Organizational Strategy
    Understand the organizational strategy to prepare for the “What If” game exercise.
  2. Identify & Understand Potential Strategic Risks
    Play the “What If” game with the right people at the table.
  3. Create a Risk Profile Packet for Leadership
    Pull all the information together in a presentation document.
  4. Validate the Risks
    Work with leadership to ensure that the proposed risks are in line with their thoughts.
  5. Plan to Manage the Risks
    Lower the overall risk potential by putting mitigations in place.
  6. Communicate the Plan
    It is important not only to have a plan but also to socialize it in the organization for awareness.
  7. Enact the Plan
    Once the plan is finalized and socialized, put it in place with continued monitoring for success.

Insight summary

Insight 1

Organizations build portions of their strategies around chosen vendors and should protect those plans against the risks of unforeseen acquisitions in the market.
Is your vendor solvent? Does it have enough staff to accommodate your needs? Has its long-term planning been affected by changes in the market? Is it unique in its space?

Insight 2

Organizations’ strategic plans need to be adaptable to avoid vendors’ negative actions causing an expedited shift in priorities.
For example, Philip's recall of ventilators impacted its products and the availability of its competitor’s products as demand overwhelmed the market.

Insight 3

Organizations need to become better at risk assessment and actively manage the identified risks to their strategic plans.
Few organizations are good at identifying risks to their strategic plan. As a result, almost none realistically plan to monitor, manage, and adapt their strategies to those risks.

Strategic risk impacts are often unanticipated, causing unforeseen downstream effects. Anticipating the potential changes in the global IT market and continuously monitoring vendors’ risk levels can help organizations modify their strategic alignment with the new norms.

Identifying strategic risk

Who should be included in the discussion

  • While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make informed decisions.
  • Getting input from operational experts at your organization will enhance the long-term potential for success of your strategies.
  • Involving those who directly manage vendors and understand the market will aid operational experts in determining the forward path for relationships with your current vendors and identifying new emerging potential strategic partners.

Review your strategic plans for new risks and evolving likelihood on a regular basis.

Keep in mind Risk = Likelihood x Impact (R=L*I).

Impact (I) tends to remain the same, while Likelihood (L) is a very flexible variable.

See the blueprint Build an IT Risk Management Program

Managing strategic risk impacts

What can we realistically do about the risks?

  • Review business continuity plans and disaster recovery testing.
  • Institute proper contract lifecycle management.
  • Re-evaluate corporate policies frequently.
  • Develop IT governance and change control.
  • Ensure strategic alignment in contracts.
  • Introduce continual risk assessment to monitor the relevant vendor markets.
    • Regularly review your strategic plans for new risks and evolving likelihood.
    • Risk = Likelihood x Impact (R=L*I)
      • Impact (I) tends to remain the same and be well understood, while Likelihood (L) turns out to be highly variable.
  • Be adaptable and allow for innovations that arise from the current needs.
    • Capture lessons learned from prior incidents to improve over time, and adjust your strategy based on the lessons.

Organizations need to be reviewing their strategic risk plans considering the likelihood of incidents in the global market.

Pandemics, extreme weather, and wars that affect global supply chains are a current reality, not unlikely scenarios.

Ongoing Improvement

Incorporating lessons learned

  • Over time, despite everyone’s best observations and plans, incidents will catch us off guard.
  • When it happens, follow your incident response plans and act accordingly.
  • An essential step is to document what worked and what did not – collectively known as the “lessons learned.”
  • Use the lessons learned document to devise, incorporate, and enact a better risk management process.

Sometimes disasters occur despite our best plans to manage them.

When this happens, it is important to document the lessons learned and improve our plans going forward.

The “what if” game

1-3 hours

Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible adverse outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

  1. Break into smaller groups (or if too small, continue as a single group).
  2. Use the Strategic Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potentials but manage the overall process to keep the discussion pertinent and on track.
  3. Collect the outputs and ask the subject matter experts (SMEs) for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

Download the Strategic Risk Impact Tool

Input Output
  • List of identified potential risk scenarios scored by likelihood and financial impact
  • List of potential management of the scenarios to reduce the risk
  • Comprehensive strategic risk profile on the specific vendor solution
Materials Participants
  • Whiteboard/flip charts
  • Strategic Risk Impact Tool to help drive discussion
  • Vendor Management – Coordinator
  • Organizational Leadership
  • Operations Experts (SMEs)
  • Legal/Compliance/Risk Manager

Case Study

Airline Industry Strategic Adaptation

Industry: Airline

Impact categories: Pandemic, Lockdowns, Travel Bans, Increased Fuel Prices

  • In 2019 the airline industry yielded record profits of $35.5 billion.
  • In 2020 the pandemic devastated the industry with losses around $371 billion.
  • The industry leaders engaged experts to conduct a study on how the pandemic impacted them and propose measures to ensure the survival of their industry in the future after the pandemic.
  • They determined that “[p]recise decision-making based on data analytics is essential and crucial for an effective Covid-19 airline recovery plan.”

Results

The pandemic prompted systemic change to the overall strategic planning of the airline industry.

Summary

Be vigilant and adaptable to change

  • Organizations need to learn how to assess the likelihood of potential risks in the changing global world.
  • Those organizations that incorporate adaptive risk management processes can prepare their strategic plans for greater success.
  • Bring the right people to the table to outline potential risks in the market.
  • Socialize the risk management process throughout the organization to heighten awareness and enable employees to help protect the strategic plan.
  • Incorporate lessons learned from incidents into your risk management process to build better plans for future issues.

Organizations must evolve their strategic risk assessments to be more adaptive to respond to global changes in the market.

Ongoing monitoring of the market and the vendors tied to company strategies is imperative to achieving success.

Related Info-Tech Research

Identify and Manage Financial Risk Impacts on Your Organization

This image contains a screenshot from Info-Tech's Identify and Manage Financial Risk Impacts on Your Organization.
  • Vendor management practices educate organizations on the different potential financial impacts that vendors may incur and suggest systems to help manage them.
  • Prioritize and classify your vendors with quantifiable, standardized rankings.
  • Prioritize focus on your high-risk vendors.
  • Standardize your processes for identifying and monitoring vendor risks to manage financial impacts with our Financial Risk Impact Tool.

Identify and Reduce Agile Contract Risk

This image contains a screenshot from Info-Tech's Identify and Reduce Agile Contract Risk
  • Customer maturity levels with Agile are low, with 67% of organizations using Agile for less than five years.
  • Customer competency levels with Agile are also low, with 84% of organizations stating they are below a high level of competency.
  • Contract disputes are the number one or two types of disputes faced by organizations across all industries.

Build an IT Risk Management Program

This image contains a screenshot from Info-Tech's Build an IT Risk Management Program
  • Transform your ad hoc IT risk management processes into a formalized, ongoing program, and increase risk management success.
  • Take a proactive stance against IT threats and vulnerabilities by identifying and assessing IT’s greatest risks before they occur.
  • Involve key stakeholders including the business senior management team to gain buy-in and to focus on IT risks most critical to the organization.

Bibliography

Olaganathan, Rajee. “Impact of COVID-19 on airline industry and strategic plan for its recovery with special reference to data analytics technology.” Global Journal of Engineering and Technology Advances, vol 7, no 1, 2021, pp. 033-046.

Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012.

Frigo, Mark L., and Richard J. Anderson. “Embracing Enterprise Risk Management: Practical Approaches for Getting Started.” COSO, 2011.

Research Contributors and Experts

  • Frank Sewell
    Research Director, Info-Tech Research Group
  • Steven Jeffery
    Principal Research Director, Info-Tech Research Group
  • Scott Bickley
    Practice Lead, Info-Tech Research Group
  • Donna Glidden
    Research Director, Info-Tech Research Group
  • Phil Bode
    Principal Research Director, Info-Tech Research Group
  • David Espinosa
    Senior Director, Executive Services, Info-Tech Research Group
  • Rick Pittman
    Vice President, Research, Info-Tech Research Group
  • Patrick Philpot
    CISSP
  • Gaylon Stockman
    Vice President, Information Security
  • Jennifer Smith
    Senior Director

Manage an IT Budget

  • Buy Link or Shortcode: {j2store}70|cart{/j2store}
  • member rating overall impact: 8.0/10 Overall Impact
  • member rating average dollars saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
  • member rating average days saved: Read what our members are saying
  • Parent Category Name: Cost & Budget Management
  • Parent Category Link: /cost-and-budget-management
  • IT is viewed as a cost center without a clear understanding of the value it provides.
  • After completing the budget, the CIO is faced with changing expectations, disruptions, new risks, and new threats.
  • IT departments often lack a reliable budget management process to keep itself on track towards its budget goals.
  • Over budgeting risks credibility if projects are not all delivered, while under budgeting risks not being able to execute important projects.

Our Advice

Critical Insight

  • Managing your budget is not just about numbers; it’s also about people and processes. Better relationships and a proper process leads to better management of your budget. Understand how your relationships and current processes might be leveraged to manage your budget.
  • No one likes to be over budget, but being under budget isn’t necessarily good either. Coming in under budget may mean that you are not accomplishing the initiatives that you promised you would, reflecting poor job performance.

Impact and Result

  • Implement a formal budget management process that documents your planned budget and actual expenditures, tracks variances, and responds to those variances to stay on track towards budget goals.
  • Manage the expectations of business stakeholders by communicating the links between IT spend and business value in a way that is easily understood by the business.
  • Control for under- or overspending by using Info Tech’s budget management tool and tactics.

Manage an IT Budget Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to understand the increasing expectations for IT departments to better manage their budgets, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Document

Create a streamlined documentation process that also considers the elements of people and technology.

  • Manage an IT Budget – Phase 1: Document
  • Manage Your IT Budget Tool

2. Track

Track your planned budget against actual expenditures to catch areas of over- and underspending in a timely manner.

  • Manage an IT Budget – Phase 2: Track

3. Control

Leverage control mechanisms to manage variances in your budget.

  • Manage an IT Budget – Phase 3: Control
[infographic]

Workshop: Manage an IT Budget

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Document Budget

The Purpose

The first step of managing your IT budget is to make sure there is a properly documented budget that everyone agrees upon.

Key Benefits Achieved

A properly documented budget facilitates management and communication of the budget.

Activities

1.1 Review budget for the year.

1.2 Document each budget in the tool.

1.3 Review CAPEX vs. OPEX.

1.4 Customize accounts to match your organization.

Outputs

Budget broken out into monthly increments and by each account.

Budget documented in tool.

Tool customized to reflect organization's specific accounts and terminology.

2 Optimize Documentation Process

The Purpose

A proper documentation process forms the backbone for effective budget management.

Key Benefits Achieved

A streamlined documentation process with accurate inputs that also considers the elements of people and technology.

Activities

2.1 Draw out process flow of current documentation.

2.2 Identify bottlenecks.

2.3 Discuss and develop roadmap to solving bottlenecks.

Outputs

Process flow of current documentation process with identified bottlenecks.

Plan to mitigate bottlenecks.

3 Track and Control for Over- and Underspending

The Purpose

Track your planned budget against actual expenditures to catch areas of over- and underspending in a timely manner. Then, leverage control mechanisms to manage variances in your budget.

Key Benefits Achieved

Tracking and controlling for variances will help the IT department stay on track towards its budget goals. It will also help with communicating IT’s value to the business.

Activities

3.1 Walk through the “Overview Bar.”

3.2 Document actual expenses incurred in fiscal to date.

3.3 Review the risk of over- and underspending.

3.4 Use the reforecast column to control for over- and underspend.

Outputs

Assess the “Overview Bar.”

Document actual expenditures and committed expenses up to the current date.

Develop a strategy and roadmap for how you will mitigate any current under- or overspends.

Reforecast expenditures for each account for each month for the remainder of the fiscal year.

Design an Enterprise Architecture Strategy

  • Buy Link or Shortcode: {j2store}580|cart{/j2store}
  • member rating overall impact: 9.4/10 Overall Impact
  • member rating average dollars saved: $63,181 Average $ Saved
  • member rating average days saved: 30 Average Days Saved
  • Parent Category Name: Strategy & Operating Model
  • Parent Category Link: /strategy-and-operating-model
  • The enterprise architecture (EA) team is constantly challenged to articulate the value of its function.
  • The CIO has asked the EA team to help articulate the business value the team brings.
  • Traceability from the business goals and vision to the EA contributions often does not exist.
  • Also, clients often struggle with complexity, priorities, and agile execution.

Our Advice

Critical Insight

  • EA can deliver many benefits to an organization. However, to increase the likelihood of success, the EA group needs to deliver value to the business and cannot be seen solely as IT.
  • Support from the organization is needed.
  • An EA strategy anchored in a value proposition will ensure that EA focuses on driving the most critical outcomes in support of the organization’s enterprise strategy.
  • As agility is not just for project execution, architects need to understand ways to deliver their guidance to influence project execution in real time, to enable the enterprise agility, and to enhance their responsiveness to changing conditions.

Impact and Result

  • Create an EA value proposition based on enterprise needs that clearly articulates the expected contributions of the EA function.
  • Establish the EA fundamentals (vision and mission statement, goals and objectives, and principles) needed to position the EA function to deliver the promised value proposition.
  • Identify the services that EA has to provide to the organization to deliver on the promised value proposition.

Design an Enterprise Architecture Strategy Research & Tools

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Design an Enterprise Architecture Strategy Deck – A guide to help you define services that your EA function will provide to the organization.

Establish an effective EA function that will realize value for the organization with an EA strategy.

  • Design an Enterprise Architecture Strategy – Phases 1-4

2. EA Function Strategy Template – A communication tool to secure the approval of the EA strategy from organizational stakeholders.

Use this template to document the outputs of the EA strategy and to communicate the EA strategy for approval by stakeholders.

  • EA Function Strategy Template

3. Stakeholder Power Map Template – A template to help visualize the importance of various stakeholders and their concerns.

Identify and prioritize the stakeholders that are important to your IT strategy development effort.

  • Stakeholder Power Map Template

4. PESTLE Analysis Template – A template to help you complete and document a PESTLE analysis.

Use this template to analyze the effect of external factors on IT.

  • PESTLE Analysis Template

5. EA Value Proposition Template – A template to communicate the value EA can provide to the organization.

Use this template to create an EA value proposition that explicitly communicates to stakeholders how an EA function can contribute to addressing their needs.

  • EA Value Proposition Template

6. EA Goals and Objectives Template – A template to identify the EA goals that support the identified promises of value from the EA value proposition.

Use this template to help set goals for your EA function based on the EA value proposition and identify objectives to measure the progression towards those EA goals.

  • EA Goals and Objectives Template

7. EA Principles Template – A template to identify the universal EA principles relevant to your organization.

Use this template to define relevant universal EA principles and create new EA principles to guide and inform IT investment decisions.

  • EA Principles Template – EA Strategy

8. EA Service Planning Tool – A template to identify the EA services your organization will provide to deliver on the EA value proposition.

Use this template to identify the EA services relevant to your organization and then define how those services will be accessed.

  • EA Service Planning Tool
[infographic]

Workshop: Design an Enterprise Architecture Strategy

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Map the EA Contributions to Business Goals

The Purpose

Show an example of traceability.

Key Benefits Achieved

Members have a real-world example of traceability between business goals and EA contributions.

Activities

1.1 Start from the business goals of the organization.

1.2 Document business and IT drivers.

1.3 Identify EA contributions that help achieve the business goals.

Outputs

Business goals documented.

Business and IT drivers documented.

Identified EA contributions and traced them to business goals.

2 Determine the Role of the Architect in the Agile Ceremonies of the Organization

The Purpose

Create an understanding about role of architect in Agile ceremonies.

Key Benefits Achieved

Understanding of the role of the EA architect in Agile ceremonies.

Activities

2.1 Document the Agile ceremony used in the organization (based on SAFe or other Agile approaches).

2.2 Determine which ceremonies the system architect will participate in.

2.3 Determine which ceremonies the solution architect will participate in.

2.4 Determine which ceremonies the enterprise architect will participate in.

2.5 Determine architect syncs, etc.

Outputs

Documented the Agile ceremonial used in the organization (based on SAFe or other Agile approaches).

Determined which ceremonies the system architect will participate in.

Determined which ceremonies the solution architect will participate in.

Determined which ceremonies the enterprise architect will participate in.

Determined architect syncs, etc.

Further reading

Design an Enterprise Architecture Strategy

Develop a strategy that fits the organization’s maturity and remains adaptable to unforeseen future changes.

EXECUTIVE BRIEF

Build a right-size enterprise architecture strategy

Enterprise Architecture Strategy

Business & IT Strategy
  • Organizational Goals and Objectives
  • Business Drivers
  • Environment and Industry Trends
  • EA Capabilities and Services
  • Business Architecture
  • Data Architecture
  • Application Architecture
  • Integration Architecture
  • Innovation
  • Roles and Organizational Structure
  • Security Architecture
  • Technology Architecture
  • Integration Architecture
  • Insight and Knowledge
  • EA Operating Model
Unlock the Value of Architecture
  • Increased Business and IT Alignment
  • Robust, Flexible, Scalable, Interoperable, Extensible and Reliable Solutions
  • Timely/Agile Service Delivery and Operations
  • Cost-Effective Solutions
  • Appropriate Risk Management to Address the Risk Appetite
  • Increased Competitive Advantage
Current Environment
  • Business and IT Challenges
  • Opportunities
  • Enterprise Architecture Maturity

Enterprise Architecture – Thought Model

A thought model built around 'Enterprise Architecture', represented by a diagram on a cross-section of a ship which will be explained in the next slide. It begins with an arrow that says 'Organizational goals are the driving force and the ultimate goal' pointing to a bubble titled 'Organization' containing 'Analysis', 'Decisions', 'Actions'. An blue arrow on the right side with one '$' is labelled 'Iterations' and connects 'Organization' to 'Enterprise Architecture', 'Enterprise architecture creates new business value'. A green arrow on the left side with five '$' is labelled 'Goals' and connects back to 'Organization'. A the bottom, a bubble titled 'External forces, pressures, trends, data, etc.' has a blue arrow on the right side with one '$' connecting back to 'Enterprise Architecture'. Another blue arrow representing an output is labelled 'Outcomes' and originates from 'Enterprise Architecture'.

Enterprise Architecture Capabilities

A diagram on a cross-section of a ship representing 'Enterprise Architecture', including a row of process arrows beneath the ship pointing forward all labelled 'Agile iteration' and one airborne arrow above the stern pointing forward labelled 'Business Strategy'. Overlaid on the ship, starting at the back, are 'EA Strategy', 'EA Operating Model', 'Enterprise Principles, Methods, etc.', 'Foundational enterprise decisions: Business, Data/Apps, Technology, Integration, Security', 'Enterprise Reference Architecture', 'Goals, Value Chain, Capability, Business Processes', 'Enterprise Governance (e.g., Standard Mgmt.)', 'Domain Arch', 'Data & App Architecture', 'Security Architecture', 'Infrastructure: Cloud, Hybrid, etc.', at the very front is 'Implementation', and running along the bottom from back to front is 'Operations, Monitoring, and Continuous Improvement'.

Analyst Perspective

Enterprise architecture (EA) needs to be right-sized for the needs of the organization.

Photo of Milena Litoiu, Principal/Senior Director, Enterprise Architecture, Info-Tech Research Group

Enterprise architecture is NOT a one-size-fits-all endeavor. It needs to be right-sized to the needs of the organization.

Enterprise architects are boots on the ground and part of the solution; in addition, they need to have a good understanding of the corporate strategy, vision, and goals and have a vested interest on the optimization of the outcomes for the enterprise. They also need to anticipate the moves ahead, to be able to determine future trends and how they will impact the enterprise.

Milena Litoiu
Principal/Senior Director, Enterprise Architecture
Info-Tech Research Group

Analyst Perspective

EA provides business options based on a deep understanding of the organization.

“Enterprise architects need to think about and consider different areas of expertise when formulating potential business options. By understanding the context, the puzzle pieces can combine to create a positive business outcome that aligns with the organization’s strategies. Sometimes there will be missing pieces; leveraging what you know to create an outline of the pieces and collaborating with others can provide a general direction.”

Jean Bujold
Senior Workshop Delivery Director
Info-Tech Research Group

“The role of enterprise architecture is to eliminate misalignment between the business and IT and create value for the organization.”

Reddy Doddipalli
Senior Workshop Director, Research
Info-Tech Research Group

“Every transformation journey is an opportunity to learn: ‘Tell me and I forget. Teach me and I remember. Involve me and I learn.’ Benjamin Franklin.”

Graham Smith
Senior Lead Enterprise Architect and Independent Consultant

Develop an enterprise architecture strategy that:

  • Helps the organization make decisions that are hard to change in a complex environment.
  • Fits the current organization’s maturity and remains flexible and adaptable to unforeseen future changes.

Executive Summary

Your Challenge

We need to make decisions today for an unknown future. Decisions are influenced by:

  • Changes in the environment you operate in.
  • Complexity of both the business and IT landscapes.
  • IT’s difficulty in keeping up with business demands and remaining agile.
  • Program/project delivery pressure and long-term planning needs.
  • Other internal and external factors affecting your enterprise.

Common Obstacles

Decisions are often made:

  • Without a clear understanding of the business goals.
  • Without a holistic understanding; sometimes in conflict with one another.
  • That hinder the continuity of the organization.
  • That prevent value optimization at the enterprise level.

The more complex an organization, the more players involved, the more difficult it is to overcome these obstacles.

Info-Tech’s Approach

  • Is a holistic, top-down approach, from the business goals all the way to implementation.
  • Has EA act as the canary in the coal mine. EA will identify and mitigate risks in the organization.
  • Enables EA to provide an essential service rather than be an isolated kingdom or an ivory tower.
  • Acknowledges that EA is a balancing act among competing demands.
  • Makes decisions using guiding principles and guardrails, to create a flexible architecture that can evolve and expand, enabling enterprise agility.

Info-Tech Insight

There is no “right architecture” for organizations of all sizes, maturities, and cultural contexts. The value of enterprise architecture can only be measured against the business goals of a single organization. Enterprise architecture needs to be right-sized for your organization.

Info-Tech insight summary on arch. agility

Continuous innovation is of paramount importance in achieving and maintaining competitive advantage in the marketplace.

Business engagement

It is important to trace architectural decisions to business goals. As business goals evolve, architecture should evolve as well.

As new business input is provided during Agile cycles, architecture is continuously evolving.

EA fundamentals

EA fundamentals will shape how enterprise architects think and act, how they engage with the organization, what decisions they make, etc.

Start small and lean and evolve as needed.

Continuously align strategy with delivery and operations.

Architects should establish themselves as business partners as well as implementation/delivery leaders.

Enterprise services

Definitions of enterprise services should start from the business goals of the organization and the capabilities IT needs to perform for the organization to survive in the marketplace.

Continuous delivery and continuous innovation are the two facets of architecture.

Tactical insight

Your current maturity should be reflected as a baseline in the strategy.

Tactical insight

Take Agile/opportunistic steps toward your strategic North star.

Tactical insight

EA services differ based on goals, maturity, and the Agile appetite of the enterprise.

From the best industry experts

“The trick to getting value from enterprise architecture is to commit to the long haul.”

Jeanne W. Ross, MIT CISR
Co-author of Enterprise Architecture as Strategy: Creating a Foundation for Business Execution,
Harvard Business Press, 2006.

Typical EA maturity stages

A line chart that moves through multiple stages titled 'Enterprise Architecture Maturity Stages (MIT CISR)' The five stages of the chart, starting on the left, are 'Business Silos', 'Standardized Technology', 'Optimized Core', 'Business Componentization', and 'Digital Ecosystem'. 'The trick to getting value from enterprise architecture is to commit to the long haul.' The line begins at the bottom left of the chart and gradually creates a stretched S shape to the top right. Points along the line, respective to the aforementioned stages, are 'Locally Optimal Business Solutions', 'Technology Infrastructure Platform', 'Digitized Process Platform', 'Repository of Reusable Business Components', 'Components Connecting with Partners' Components', and at the end of the line, outside of the chart is 'Strategic Business Value from Technology'. Percentages along the bottom, respective to the aforementioned stages, read 20%, 36%, 45%, 7%, 2%. Percentages are rough approximations based on findings reported in Mocker, M., Ross, J.W., Beath, C.M., 'How Companies Use Digital Technologies to Enhance Customer Offerings--Summary of Survey Findings,' MIT CISR Working Paper No. 434, Feb. 2019. Copyright MIT, 2019.

Enterprise Architecture maturity

A maturity ladder visualization for 'Enterprise Architecture' with five color-coded levels. From the bottom up, the colors and designations are Red: 'Unstable', Orange: 'Firefighter', Yellow: 'Trusted Operator', Blue: 'Business Partner', and Green: 'Innovator'. Beside the visualization at the bottom it says 'EA is here', then an arrow in the direction of the top where it says 'EA needs to be here'.
  • Innovator – Transforms the Business
    Reliable Technology Innovation
  • Business Partner – Expands the Business
    Effective Use of Enterprise Architecture in all Business Projects, Enterprise Architecture Is Strategically Engaged
  • Trusted Operator – Optimizes the Business
    Enterprise Architecture Provides Business, Data, Application & Technology Architectures for All IT Projects
  • Firefighter – Supports the Business
    Reliable Architecture for Some Practices/Projects
  • Unstable – Struggles to Support
    Inability to Provide Reliable Architectures

Info-Tech Insight

There is no “absolute maturity” for organizations of all sizes, maturities, and cultural contexts. The maturity of enterprise architecture can only be measured against the business goals of the organization.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

Guided Implementation

Workshop

Consulting

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks used throughout all four options

Workshop Overview

Contact your account representative for more information.
workshops@infotech.com1-888-670-8889

Session 1 Session 2 Session 3 Session 4 Session 5
Activities
Identify organizational needs and landscape

1.0 Interview stakeholders to identify business and technology needs

1.1 Review organization perspective, including business needs, challenges, and strategic directions

1.2 Conduct PESTLE analysis to identify business and technology trends

1.3 Conduct SWOT analysis to identify business and technology internal perspective

Create the EA value proposition

2.1 Identify and prioritize EA stakeholders

2.2 Create business and technology drivers from needs

2.3 Define the EA value proposition

2.4 Identify EA maturity and target

Define the EA fundamentals

3.1 Define the EA goals and objectives

3.2 Determine EA scope

3.3 Create a set of EA principles

3.4. Define the need of a methodology/agility

3.5 Create the EA vision and mission statement

Identify the EA framework and communicate the EA strategy

4.1 Define initial EA operating model and governance mechanism

4.2 Define the activities and services the EA function will provide, derived from business goals

4.3 Determine effectiveness measures

4.4 Create EA roadmap and next steps

4.5 Build communication plan for stakeholders

Next Steps and Wrap-Up (offsite)

5.1 Generate workshop report

5.2 Set up review time for workshop report and to discuss next steps

Outcomes
  1. Stakeholder insights
  2. Organizational needs, challenges, and direction summary
  3. PESTLE & SWOT analysis
  1. Stakeholder power map
  2. List of business and technology drivers with associated pains
  3. Set of EA contributions articulating the promises of value in the EA value proposition
  4. EA maturity assessment
  1. EA scope
  2. List of EA principles
  3. EA vision statement
  4. EA mission statement
  5. Statement about role of enterprise architect relative to agility
  1. EA capabilities mapped to business goals of the organization
  2. List of EA activities and services the EA function is committed to providing
  3. KPI definitions
  4. EA roadmap
  5. EA communication plan
  1. Completed workshop report on EA strategy with roadmap, recommendations, and outcomes from workshop

Guided Implementation

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 8 to 12 calls over the course of 4 to 6 months.

While variations depend on the maturity of the organization as well as its aspirations, these are some typical steps:

    Phase 1

  • Call #1: Explore the role of EA in your organization.
  • Phase 2

  • Call #2: Identify and prioritize stakeholders.
  • Call #3: Use a PESTLE analysis to identify business and technology needs.
  • Call #4: Prepare for stakeholder interviews.
  • Call #5: Discuss your EA value proposition.
  • Phase 3

  • Call #5: Understand the importance of EA fundamentals.
  • Call #6: Define the relevant EA services and their contributions to the organization.
  • Call #7: Measure EA effectiveness.
  • Phase 4

  • Call #8: Build your EA roadmap and communication plan.
  • Call #9: Discuss the EA role relative to agility.
  • Call #10: Summarize results and plan next steps.

Design an Enterprise Architecture Strategy

Phase 1

Explore the Role of Enterprise Architecture

Phase 1

  • 1.1 Explore a general EA strategy approach
  • 1.2 Introduce Agile EA architecture

Phase 2

  • 2.1 Define the business and technology drivers
  • 2.2 Define your value proposition

Phase 3

  • 3.1 Realize the importance of EA fundamentals
  • 3.2 Finalize the EA fundamentals

Phase 4

  • 4.1 Select relevant EA services
  • 4.2 Finalize the set of services and secure approval

This phase will walk you through the following activities:

Define the role of the group and different roles inside the enterprise architecture competency.

This phase involves the following participants:

  • CIO
  • IT Leaders
  • Business Leaders

Enterprise architecture optimizes the outcomes of the entire organization

Corporate Strategy –› Enterprise Architecture Strategy

Info-Tech Insight

Enterprise architecture needs to have input from the corporate strategy of the organization. Similarly, EA governance needs to be informed by corporate governance. If this is not the case, it is like planning and governing with your eyes closed.

Existing EA functions vary in the value they achieve due to their level of maturity

EA Functions
Operationalized
  • EA function is operationalized and operates as an effective core function.
  • Effectively aligns the business and IT through governance, communication, and engagement.
–––› Common EA value
Decreased cost Reduced risk
Emerging
  • Emerging but limited ad hoc EA function.
  • Limited by lack of alignment to the business and IT.
–x–› Cut through complexity Increased agility
(Source: Booz & Co., 2009)

Benefits of enterprise architecture

  1. Focuses on business outcomes (business centricity)
  2. Provides traceability of architectural decisions to/from business goals
  3. Provides ways to measure results
  4. Provides consistency across different lines of business: establishes a common vocabulary, reducing inconsistencies
  5. Reduces duplications, creating additional efficiencies at the enterprise level
  6. Presents an actionable migration to the strategy/vision, through short-term milestones/steps

Benefits of enterprise architecture continued

  1. Done right, increases agility
  2. Done right, reduces costs
  3. Done right, mitigates risks
  4. Done right, stimulates innovation
  5. Done right, helps achieve the stated business goals (e.g. customer satisfaction) and improves the enterprise agility.
  6. Done right, enhances competitive advantage of the enterprise

Qualities of a well-established and practical enterprise architecture

  1. Objective
  2. Impartial
  3. Credible
  4. Practical
  5. Measurable
  6. (Source: University of Toronto, 2021)

Role of the enterprise architecture

  • Primarily to set up guardrails for the enterprise, so Agile teams work independently in a safe, ready-to-integrate environment
  • Establish strategy
  • Establish priorities
  • Continuously innovate
  • Establish enterprise standards and enterprise guardrails to guide Solution/Domain/Portfolio Architectures
  • Align with and be informed by the organization’s direction

Members of the Architecture Board:

  • Chief (Business) Strategist
  • Lead Enterprise Architect
  • Business SME from each major domain
  • IT SME from each major domain
  • Operational & Infrastructure SME
  • Security & Risk Officer
  • Process Management
  • Other relevant stakeholders

For enterprise architecture to contribute, EA must address the organizational vision and goals

External Factors –› Layers of a Business Model
(Organization)
–› Architecture Supported Transformation
Industry Changes Business Strategy
Competition Value Streams
(Business Outcomes)
Regulatory Impacts Business Capability Maps
  • Security
Workforce Impacts Execution
  • Policies
  • Processes
  • People
  • Information
  • Applications
  • Technology

Info-Tech Insight

External forces can affect the organization as a whole; they need to be included as part of the holistic approach for enterprise architecture.

How does EA provide value?

Business and Technology Drivers – A set of statements created from business and technology needs. Gathered from information sources, it communicates improvements needed.

  • Vision, Aspirations, Long-Term Goals – Vision, aspirations, long term goals

    • EA Contributions – EA contributions that will alleviate obstructions. Removing the obstructions will allow EA to help satisfy business and technology needs.

      • Promise of Value – A statement that depicts a concrete benefit that the EA practice can provide for the organization in response to business and technology drivers.

Info-Tech Insight

Enterprise architecture needs to create and be part of a culture where decisions are made through collaboration while focusing on enterprise-wide efficiencies (e.g. reduced duplication, reusability, enterprise-wide cost minimization, overall security, comprehensive risk mitigation, and any other cross-cutting concerns) to optimize corporate business goals.

The EA function scope is influenced by the EA value proposition and previously developed EA fundamentals

Establish the EA function scope by using the EA value proposition and EA fundamentals that have already been developed. After defining the EA function scope, refer back to these statements to ensure it accurately reflects the EA value proposition and EA fundamentals.

EA value proposition

+

EA vision statement
EA mission statement
EA goals and objectives

—›
Influences

Organizational coverage

Architectural domains

Depth

Time horizon

—›
Defines
EA function scope

EA team characteristics

Create the optimal EA strategy by including personnel who understand a broad set of topics in the organization

The team assembled to create the EA strategy will be defined as the “EA strategy creation team” in this blueprint.

  • Someone who has been in the organization for a long time and has built strong relationships with key stakeholders. This individual can exert influence and become the EA strategy sponsor.
  • An individual who understands how the different technology components in the organization support its business operations.
  • Someone in the organization who can communicate IT concepts to business managers in a language the business understands.
  • An individual with a strategy background or perspective on the organization. This individual will understand where the organization is headed.
  • Any individuals who feel an acute pain as a result of poorly made investment decisions. They can be champions of EA strategy in their respective functions.

EA skills and competencies

Apart from business know-how, the EA team should have the following skills

  • Architectural thinking
  • Analytical
  • Trusted, credible
  • Can handle complexity
  • Can change perspectives
  • Can learn fast (business and technology)
  • Independent and steadfast
  • Not afraid to go against the stream
  • Able to understand problems of others with empathy
  • Able to estimate scaling on design decisions such as model patterns
  • Intrinsic capability to identify where relevant details are
  • Able to identify root causes quickly
  • Able to communicate complex issues clearly
  • Able to negotiate and come up with acceptable solutions
  • Can model well
  • Able to change perspectives (from business to implementation and operational perspectives).

Use of enterprise architecture methodologies

Balance EA methodologies with Agile approaches

Using an enterprise architecture methodology is a good starting point to achieving a common understanding of what that is. Often, organizations agree to "tailor" methodologies to their needs.

The use of lean/Agile approaches will increase efficiency beyond traditional methodologies.

Use of EA methodologies vs. Agile methods

When to use what?

  • Use an existing methodology to structure your thinking and establish a common vocabulary to communicate basic concepts, processes, and approaches.
  • Customize the methodology to your needs; make it as lean as possible.
  • Execute in an Agile way, but keep in mind the thoughtful checks recommended by your end-to-end methodology.
  • Clarify goals.
  • Have good measures and metrics in place.
  • Continuously monitor progress, fit for purpose, etc.
  • Highlight risks, roadblocks, etc.
  • Get support.
  • Communicate vision, goals, key decisions, etc.
  • Iterate.

Business strategy first, EA strategy second, and EA operating model third

Corporate Strategy
“Why does our enterprise exist in the market?”
EA Strategy
“What does EA need to be and do to support the enterprise’s ability to meet its goals? What is EA’s value proposition?”
Business & IT Operating Culture
“How does the organization’s culture and structure influence the EA operating model?”
EA Operating Model
How does EA need to operate on a daily basis to deliver the value proposition?”

High-level perspective

Creating an effective practice involves many moving parts.

A visual of the many moving parts in an effective practice; there are 6 smaller circles in a large circle, an input arrow labelled 'Environment', an output arrow labelled 'Results', and a thin arrow connecting 'Results' back to 'Environment'. Of the circles, 'Leadership' is in the center, connected to each of the others, while 'Culture', 'Strategy', 'Core Processes', 'Structure', and 'Systems' create a cycle. (Source: The Center for Organizational Design)

  • Environment. Influences that are external to the organization, such as customer perceptions, changing needs, and changes in technology, and the organization’s ability to adjust to them.
  • Strategy. The business strategy defines how the organization adds value and acts as the rudder to direct the organization. Organizational strategy defines the character of the organization, what it wants to be, its values, its vision, its mission, etc.
  • Core Process. The flow of work through the organization.
  • Structure. How people are organized around business processes. Includes reporting structures, boundaries, roles, and responsibilities. The structure should assist the organization with achieving its goals rather than hinder its performance.
  • Systems. Interrelated sets of tasks or activities that help organize and coordinate work.
  • Culture. The personality of the organization: its leadership style, attitudes, habits, and management practices. Culture measures how well philosophy is translated into practice.
  • Results. Measurement of how well the organization achieved its goals.
  • Leadership. Brings the organization together by providing vision and strategy; designing, monitoring, and nurturing the culture; and fostering agility.

The answer to the strategic planning entity dilemma is enterprise architecture

Enterprise architecture is a discipline that defines the structure and operation of an organization. The intent of enterprise architecture is to determine how an organization can most effectively achieve its current and future objectives.

Vision, goals, and aspirations as well internal and external pressures

Business current state

  • Existing capability
  • Existing capability
  • Existing capability
  • Existing capability
  • Existing capability
Enterprise Architecture

IT current state

  • IT asset management
  • Database services
  • Application development

Business target state

  • Existing capability
  • Existing capability
  • Existing capability
  • Existing capability
  • Existing capability
  • New capability

IT target state

  • IT asset management
  • Database services
  • Application development
  • Business analytics
Complex, overlapping, contradictory world of humans vs. logical binary world of IT
EA is a planning tool to help achieve the corporate business goals

EA spans across all the domains of architecture

Business architecture is the cornerstone that sets the foundation for all other architectural domains: security, data, application, and technology.

A flow-like diagram titled 'Enterprise Architecture' beginning with 'Digital Architecture' and 'Business Architecture', which feeds into 'Security Architecture', which feeds into both 'Data Architecture' and 'Application Architecture', which both feed into 'Technology Architecture: Infrastructure'.

“An enterprise architecture practice is both difficult and costly to set up. It is normally built around a process of peer review and involves the time and talent of the strategic technical leadership of an enterprise.” (The Open Group Architecture Framework, 2018)

Enterprise architecture deployment continuum

A diagram visualizing the Enterprise architecture deployment continuum with two continuums, 'Level of Embedding' and 'EA Value', assigning terms to EA deployments based on where they fall. On the left is an 'Ivory Tower' configuration: EA' is separated from the 'BU's but is still controlling them. Level of Embedding: 'Centralized', EA Value: 'Dictatorship'. In the center is a 'Balanced' configuration: 'EA' is spread across and connected to each 'BU'. Level of Embedding: 'Federated', EA Value: 'Democracy'. On the right is a 'Siloed' configuration: Each 'BU' has its own separate 'EA'. Level of Embedding: 'Decentralized', EA Value: 'Abdication of enterprise role'.

Info-Tech Insight

The primary question during the design of the EA operating model is how to integrate the EA function with the rest of the business.

If the EA practice functions on its own, you end up with ivory tower syndrome and a dictatorship.

If you totally embed the EA function within business units it will become siloed with no enterprise value.

Organizations need to balance consistency at the enterprise level with creativity from the grass roots.

Enterprise vs. Program/Portfolio/Domain

Enterprise vs. Program/Portfolio/Domain. Image depicts where Enterprise Scope overlaps Program/Portfolio Scope. Enterprise Scope includes Business Architecture. Program/Portfolio Scope includes Business Requirements, Business Process, and Solutions Architecture. Overlap between scope includes Technology Architecture, Data Architecture, and Applications Architecture.

Info-Tech Insight

Decisions at the enterprise level apply across multiple programs/portfolios/solutions and represent the guardrails set for all to play within.

Decide on the degree of centralization

Larger organizations with multiple domains/divisions or business units will need to decide which architecture functions will be centralized and which, if any, will be decentralized as they plan to scope their EA program. What are the core functions to be centralized for the EA to deliver the greatest benefits?

Typically, we see a need to have a centralized repository of reusable assets and standards across the organization, while other approaches/standards can operate locally.

Centralization

  • Allows for more strategic planning
  • Visibility into standards and assets across the organization promotes rationalization and cost savings
  • Ensures enterprise-wide assets are used
  • More strategic sourcing of vendors and resellers
  • Can centrally negotiate pricing for better deals
  • Easier to manage risk and prepare for audits
  • Greater coordination of resources
  • Derives benefits from enterprise decisions, e.g. integration…

Decentralization

  • May allow for more innovation
  • May be easier to demonstrate local compliance if the organization is geographically decentralized
  • May be easier to procure software if offices are in different countries
  • Deployment and installation of software on user devices may be easier

EA strategy

What is the role of enterprise architecture vis-à-vis business goals?

  • What needs to be done?
  • Who needs to be involved?
  • When?
  • Where?
  • Why?
  • How?

Top-down approach starting from the goals of the organization

    What the Business Sees...
  • Business Goals
    • Value Streams
        What the CxO Sees...
      • Capabilities
          What the App Managers See...
        • Processes
          • Applications
              What the Program Managers See...
            • Programs/Projects

Info-Tech Insight

Being able to answer the deceptively simple question “How am I doing?” requires traceability to and from the business goals to be achieved all the way to applications, to infrastructure, and ultimately, to the funded initiatives (portfolios, programs, projects, etc.).

Measure EA strategy effectiveness by tracking the benefits it provides to the corporate business goals

The success of the EA function spans across three main dimensions:

  1. The delivery of EA-enabled business outcomes that are most important to the enterprise.
  2. The alignment between the business and the technology from a planning perspective.
  3. Improvements in the corporate business goals due to EA contributions (standardization, rationalization, reuse, etc.).

Corporate Business Goals

  • Reduction in operating costs
  • Decreased regulatory compliance infractions
  • Increased revenue from existing channels
  • Increased revenue from new channels
  • Faster time to business value
  • Improved business agility
  • Reduction in enterprise risk exposure

EA Contributions

  • Alignment of IT investments to business strategy
  • Achievement of business results directly linked to IT involvement
  • Application and platform rationalization
  • Standards in place
  • Flexible architecture
  • Better integration
  • Higher organizational satisfaction with technology-enabled services and solutions

Measurements

  • Cost reductions based on application and platform rationalization
  • Time and cost reductions due to standardization
  • Time reduction for integration
  • Service reused
  • Stakeholder satisfaction with EA services
  • Increase in customer satisfaction
  • Rework minimized
  • Lower cost of integration
  • Risk reduction
  • Faster time to market
  • Better scalability, etc.

Info-Tech Insight

Organizations must create clear and smart KPIs (key performance indicators) across the board.

From corporate strategy to enterprise architecture

A model connecting 'Enterprise Architecture' with 'Corporate Strategy' through 'EA Services' and 'EA Strategy'.

Info-Tech Insight

In the absence of a corporate strategy, enterprise architecture is missing its North Star.

However, enterprise architects can partner with the business strategists to build the needed vision.

Traceability to and from business corporate business goals to EA contributions (sample)

A model connecting 'Enterprise Architecture' with 'Corporate Goals' through 'EA Contributions'.

Enterprise architecture journey

The enterprise architecture journey, from left to right: 'Business Goals' and 'EA Maturity Assessment', 'EA Strategy', 'Industry-Specific Capability Model' and 'Customized to the Organization's Needs', 'EA Operating Model' and 'EA Governance', 'Business Architecture' and 'EA Tooling', 'Data Architecture' and 'Application Architecture', 'Infrastructure Architecture'.

Agile architecture principles

Agile architecture principles:
  • Fast learning cycle
  • Explore alternatives
  • Create environment for decentralized ideation and innovation

According to the Scaled Agile Framework, three of the most applicable principles for the architectural professions refer to the following:

  1. "Fast learning cycle" refers to learning cycles that allow for quick reiterations as well as the opportunity to fail fast to learn fast.
  2. "Explore alternatives" refers to the exploration phase and also to the need to make tough decisions and balance competing demands.
  3. "Create environment for decentralized ideation and innovation" ensures that no one has a monopoly on innovation. Moreover, EA needs to invite ideas from various stakeholders (from the business to operations as well as implementers, etc.).

Architecture roles in lean enterprises

Typical architecture roles in modern/Agile lean enterprises

  • System Architect
  • Solution Architect
  • Enterprise Architect

Depth vs. strategy focus

Typical architect roles

A graph with different architect roles mapped onto it. Axes are 'Low Strategic Impact' to 'High Strategic Impact' and 'Breadth' to 'Depth'. 'Enterprise Architect' has the highest strategic impact and most breadth. 'Technical/System Architect' has the lowest strategic impact and most depth. 'Solution Architect' sits in the middle of both axes.

Architecture roles continued

The three architect roles from above and their impacts on the list of 'Common Domains' to the right. 'Enterprise Architect's impact is 'Across Value Streams', 'Solution Architect's impact is 'Across Systems', 'Technical/System Architect's impact is 'Single System'. Adapted from Scaled Agile.

Common Domains

Business Architecture

Information Architecture

Application Architecture

Technical Architecture

Integration Architecture

Security Architecture

Others

Info-Tech Insight

All architects are boots on the ground and play in the solutioning space. What differs is their decisions’ impact (the enterprise architect’s decisions affects all domains and solutions).

SAFe definitions of the Enterprise/Solution and System Architect roles can be found here.

The role of the Enterprise Architect is detailed here.

Collaboration models across the enterprise

A collaboration model with 'Enterprise Architecture' at the top consisting of a 'Chief Enterprise Architect', 'Enterprise Architects', and 'EA Concerns across solutions': 'Architect A', 'Architect B', and 'Architect C'. Each lettered Architect is connected to their respective 'Solution Architect (A-C)' which runs their respective 'Delivery Team (A-C)' with 'Other Team Members'.(Adapted from Disciplined Agile)

There are both formal and informal collaborations between enterprise architects and solution architects across the enterprise.

Info-Tech Insight

Enterprise architects should collaborate with solutions architects to create the best solutions at the enterprise level and to provide guidance across the board.

Architect roles in SAFe

According to Scale Agile Framework 5 for Lean Enterprises:

  • The system architect participates in the Essential SAFe
  • Solution architects and system architects participate in Large Solution
  • The enterprise architect participates in the Portfolio SAFe
  • Enterprise, solution, and system architects are all involved in Full SAFe

Please check the SAFe Scaled Agile site for detailed information on the approach.

Architect roles and their participation in Agile events (see likely events and a typical calendar)

Info-Tech Insight

A clear commitment for architects to achieve and support agility is needed. Architects should not be in an ivory tower; they should be hands on and engaged in all relevant Agile ceremonies, like the pre- and post-program increment (PI) planning, etc.

Architect syncs are also required to ensure the needed collaboration.

Architect participation in Agile ceremonies, according to SAFe:

Architecture runway (at scale)

Info-Tech Insight

Architecting for scale, modularity, and extensibility is key for the architecture to adapt to changing conditions and evolve.

Proactively address NFRs; architect for performance and security.

Continuously refine the solution intent.

For large solutions, longer foundational architectural runways are needed.

Having an intentional continuous improvement/continuous development (CI/CD) pipeline to continuously release, test, and monitor is key to evolving large and complex systems.

Parallel continuous exploration/integration/deployment

A cycle titled DevOps containing three smaller cycles labelled 'Continuous Explorations', 'Continuous Integration', and 'Continuous Deployment'.

Info-Tech Insight

Architects need to help make some fundamental decisions, e.g. help define the environment that best supports continuous innovation or exploration and continuous integration, deployment, and delivery.

Typical strategic enterprise architecture involvement

Enterprise Architect —DRIVES–› Enterprise Architecture Strategy

Enterprise Architecture Strategy
  • Application Strategy
  • Business Strategy
  • Data Strategy
  • Implementation Strategy
  • Infrastructure Strategy
  • Inter-domain Collaboration
  • Integration Strategy
  • Operations Strategy
  • Security Strategy
  • (Adapted from Scaled Agile)

The EA statement relative to agility

The enterprise architecture statement relative to agility specifies the architects’ responsibilities as well as the Agile protocols they will participate in. This statement will guide every architect’s participation in planning meetings, pre- and post-PI, various syncs, etc. Use simple and concise terminology; speak loudly and clearly.

Strong EA statement relative to agility has the following characteristics:

  • Describes what different architect roles do to achieve the vision of the organization
  • In an agile way
  • Compelling
  • Easy to grasp
  • Sharply focused
  • Specific
  • Concise

Sample EA statement relative to agility

  • Create strategies that provide guardrails for the organization, provide standards, reusable assets, accelerators, and other decisions at the enterprise level that support agility.
  • Participate in pre-PI and post-PI planning activities, architect syncs, etc.

A clear statement can include additional details surrounding the enterprise architect’s role relative to agility

Below is a sample of connecting keywords to form an enterprise architect role statement, relative to agility.

Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture in an agile way.

Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.

Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.

Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.

Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture and provide guidance and accelerators.

Target enterprise structure in an agile way – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:

  • Business capabilities and processes (business architecture)
  • Data, application, and technology assets that enable business capabilities and processes (technology architecture)
  • Architecture principles
  • Standards and reusable assets
  • Continuous exploration, integration, and deployment

Traditional vs. Agile approaches

Traditional Enterprise Architecture Next-Generation Enterprise Architecture
Scope: Technology focused Business transformation (scope includes both business and technology)
Bottom up Top down
Inside out Outside In
Point to point; difficult to change Expandable, extensible, evolvable
Control-based: Governance intensive; often over-centralized Guidance-based: Collaboration and partnership-driven based on accepted guardrails
Big up-front planning Incremental/dynamic planning; frequent changes
Functional siloes and isolated projects, programs, and portfolios Enterprise-driven outcome optimization (across value streams)

Info-Tech Insight

The role of the architecture in Lean (Agile) approaches is to set up the needed guardrails and ensure a safe environment where everyone can be effective and creative.

Design an Enterprise Architecture Strategy

Phase 2

Create the EA Value Proposition

Phase 1

  • 1.1 Explore a general EA strategy approach
  • 1.2 Introduce Agile EA architecture

Phase 2

  • 2.1 Define the business and technology drivers
  • 2.2 Define your value proposition

Phase 3

  • 3.1 Realize the importance of EA fundamentals
  • 3.2 Finalize the EA fundamentals

Phase 4

  • 4.1 Select relevant EA services
  • 4.2 Finalize the set of services and secure approval

This phase will walk you through the following activities:

  • Identify and prioritize EA stakeholders.
  • Create business and technology drivers from stakeholder information.
  • Identify business pains and technology drivers.
  • Define EA contributions to alleviate the pains.
  • Create promises of value to fully articulate the value proposition.

This phase involves the following participants:

  • CIO
  • IT Leaders
  • Business Leaders

Step 2.1

Define the Business and Technology Drivers

Activities
  • 2.1.1 Use a stakeholder power map to identify and prioritize EA stakeholders
  • 2.1.2 Conduct a PESTLE analysis
  • 2.1.3 Review strategic planning documents
  • 2.1.4 Conduct EA stakeholder interviews

This step will walk you through the following activities:

  • Learn the five-step process to create an EA value proposition.
  • Uncover business and technology needs from stakeholders.

This step involves the following participants:

  • CIO
  • IT Leaders
  • Business Leaders

Outcomes of this step

An understanding of your organization’s EA needs.

Create the Value Proposition

Step 2.1 Step 2.2

Value proposition is an important step in the creation of the EA strategy

Creating an EA value proposition should be the first step to realizing a healthy EA function. The EA value proposition demonstrates to organizational stakeholders the importance of EA in helping to realize their needs.

Five steps towards the successful articulation of EA value proposition:

  1. Identify and prioritize stakeholders. The EA function must know to whom to communicate the value proposition.
  2. Construct business and technology drivers. Drivers are derived from the needs of the business and IT. Needs come from the analysis of external factors, strategic documents, and interviewing stakeholders. Helping stakeholders and the organization realize their needs demonstrates the value of EA.
  3. Discover pains that prevent driver realization. There are always challenges that obstruct drivers of the organization. Find out what they are to get closer to showing the value of EA.
  4. Brainstorm EA contributions. Pains that obstruct drivers have now been identified. To demonstrate EA’s value, think about how EA can help to alleviate those pains. Create statements that show how EA’s contribution will be able to overcome the pain to show the value of EA.
  5. Derive promises of value. Complete the articulation of value for the EA value proposition by stating how realizing the business or technology will provide in terms of value for the organization. Speak with the stakeholders to discover the value that can be achieved.

Info-Tech Insight

EA can deliver many benefits to an organization. To increase the likelihood of success, each EA group needs to commit to delivering value to their organization based on the current operating environment and the desired direction of the enterprise. An EA value proposition will articulate the group’s promises of value to the enterprise.

The foundation of an optimal EA value proposition is laid by defining the right stakeholders

All stakeholders need to know how the EA function can help them. Provide the stakeholders with an understanding of the EA strategy’s impact on the business by involving them.

A stakeholder map can be a powerful tool to help identify and prioritize stakeholders. A stakeholder map is a visual sketch of how various stakeholders interact with your organization, with each other, and with external audience segments.

An example stakeholder map with the 'Key players' quadrant highlighted, it includes 'CEO', 'CIO', and the modified position of 'CFO' after being engaged.

“Stakeholder management is critical to the success of every project in every organization I have ever worked with. By engaging the right people in the right way in your project, you can make a big difference to its success…and to your career.” (Rachel Thompson, MindTools)

2.1.1 Use a stakeholder power map to identify and prioritize EA stakeholders

2 hours

Input: Expertise from the EA strategy creation team

Output: An identified and prioritized set of stakeholders for the EA function to target

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

  1. A stakeholder power map helps to visualize the importance of various stakeholders and their concerns so you can prioritize your time according to the most powerful and most impacted stakeholders.
  2. Evaluate each stakeholder in terms of power, Involvement, impact, and support.
    • Power: How much influence does the stakeholder have? Enough to drive the project forward or into the ground?
    • Involvement: How interested is the stakeholder? How involved is the stakeholder in the project already?
    • Impact: To what degree will the stakeholder be impacted? Will this significantly change how they do their job?
    • Support: Is the stakeholder a supporter of the project? Neutral? A resistor?
  3. Map each stakeholder to an area on the Power Map Template.
  4. Ask yourself if the power map looks accurate. Is there someone who has no involvement in EA strategy development but should?
  5. Some stakeholders may have influence over others. For example, a COO who highly values the opinion of the Director of Operations would be influenced by that director. Draw an arrow from one stakeholder to another to signify this relationship.

Download the Stakeholder Power Map Template for more detailed instructions on completing this activity.

Each stakeholder will have a set of needs that will influence the final EA value proposition

All stakeholders will have a set of needs they would like to address. Take those needs and translate them into business and technology drivers. Drivers help clearly articulate to stakeholders, and the EA function, the stakeholder needs to be addressed.

Business Driver

Business drivers are internal or external business conditions, changing business capabilities, and changing market trends that impact the way EA operates and provides value to the enterprise.

Examples:

Ensure corporate compliance with legislation pertaining to data and security (e.g. regulated oil fields).

Enable the automation and digitization of internal processes and services to business stakeholders.

Technology Driver

Technology drivers are internal or external technology conditions or factors that are not within the control of the EA group that impact the way that the EA group operates and provides value to the enterprise.

Examples:

Establish standards and policies for enabling the organization to take advantage of cloud and mobile technologies.

Reduce the frequency of shadow IT by lowering the propensity to make business–technology decisions in isolation.

(Source: The Strategic CFO, 2013)

Gather information from stakeholders to begin the process of distilling business and technology drivers

Review information sources, then analyze them to derive business and technology drivers. Information sources are not targeted towards EA stakeholders. Analyze the information sources to create drivers that are relevant to EA stakeholders.

Information Sources Drivers (Examples)

PESTLE Analysis

Strategy Documents

Stakeholder Interviews

SWOT Analysis

—›

Analysis

—›

Help the organization align technology investments with corporate strategy

Ensure corporate compliance with legislation.

Increase the organization’s speed to market.

Business and Technology Needs

By examining information sources, the EA team will come across a set of business and technology needs. Through analysis, these needs can be synthesized into drivers.

The PESTLE analysis will help you uncover external factors impacting the organization

PESTLE examines six perspectives for external factors that may impact business and technology needs. Below are prompting questions to facilitate a PESTLE analysis working session.

Political
  • Will a change in government (at any level) affect your organization?
  • Do inter-government or trade relations affect you?
  • Are there shareholder needs or demands that must be considered?
  • How are your costs changing (moving off-shore, fluctuations in markets, etc.)?
  • Do currency fluctuations have an effect on your business?
  • Can you attract and pay for top-quality talent (e.g. desirable location, reasonable cost of living, changes to insurance requirements)?
Economic
Social
  • What are the demographics of your customers and/or employees?
  • What are the attitudes of your customers and/or staff (e.g. do they require social media, collaboration, transparency of costs)?
  • What is the general lifecycle of an employee (i.e. is there high turnover)?
  • Is there a market of qualified staff?
  • Is your business seasonal?
  • Do you require constant technology upgrades (e.g. faster network, new hardware)?
  • What is the appetite for innovation within your industry/business?
  • Are there demands for increasing data storage, quality, BI, etc.?
  • Are you looking to cloud technologies?
  • What is the stance on bring your own device?
  • Are you required to do a significant amount of development work in-house?
Technological
Legal
  • Are there changes to trade laws?
  • Are there changes to regulatory requirements (i.e. data storage policies, privacy policies)?
  • Are there union factors that must be considered?
  • Is there a push towards being environmentally friendly?
  • Does the weather have any effect on your business (hurricanes, flooding, etc.)?
Environmental

2.1.2 Conduct a PESTLE analysis

2 hours

Input: Expertise from EA strategy creation team

Output: Identified set of business and technology needs from PESTLE

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

  1. Begin conducting the PESTLE analysis by breaking the participants into groups. Divide the six different perspectives amongst the groups.
  2. Ask each group to begin to derive business and technology needs from their assigned perspectives. Use some of the areas noted below along with the questions on the previous slide to derive business and technology needs.
    • Political: Examine taxes, environmental regulations, and zoning restrictions.
    • Economic: Examine interest rates, inflation rate, exchange rates, the financial and stock markets, and the job market.
    • Social: Examine gender, race, age, income, disabilities, educational attainment, employment status, and religion.
    • Technological: Examine servers, computers, networks, software, database technologies, wireless capabilities, and availability of Software as a Service.
    • Legal: Examine trade laws, labor laws, environmental laws, and privacy laws.
    • Environmental: Examine green initiatives, ethical issues, weather patterns, and pollution.
  3. Ask each group to take into account the following questions when deriving business and technology needs:
    • Will business components require any changes to address the factor?
    • Will information technology components changes be needed to address any factor?
  4. Have each team record its findings. Have each team present its list and have remaining teams give feedback and additional suggestions. Record any changes in this step.

Download the PESTLE Analysis Template to assist with completing this activity.

Strategic planning documents can provide information regarding the direction of the organization

Some organizations (and business units) create an authoritative strategy document. These documents contain corporate aspirations and outline initiatives, reorganizations, and shifts in strategy. From these documents, a set of business and technology needs can be generated.

Overt Statements

  • Corporate objectives and initiatives are often explicitly stated in these documents. Look for statements that begin with phrases such as “Our corporate objectives are…”
  • Remember that different organizations use different terminology; if you cannot find the word goal or objective then look for “pillar,” “imperative,” “theme,” etc.

Turn these statements to business and technology needs by:

Asking the following:
  • Is there a need from a business perspective to address these objectives, initiatives, and shifts in strategy?
  • Is there a need from a technology perspective to address these objectives, initiatives, and shifts in strategy?

Covert Statements

  • Some corporate objectives and initiatives will be mentioned in passing and will require clarification. For example: “As we continue to penetrate new markets, we will be diversifying our manufacturing geography to simplify distribution.”

2.1.3 Review strategic planning documents

2 hours

Input: Strategic documents in the organization

Output: Identified set of business and technology needs from documents

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin the identification process of business and technology needs from strategic documents with the following steps:

  1. Work with the EA strategy creation team to identify the strategic documents within the organization. Look for documents with any of the following content:
    • Corporate strategy document
    • Business unit strategy documents
    • Annual general reports
  2. Gather the strategic documents into one place and call a meeting with the EA strategy creation team to identify the business and technology needs in those documents.
  3. Pick one document and look through its contents. Look for future-looking words such as:
    • We will be…
    • We are planning to…
    • We will need…
  4. Consider those portions of the document with future-looking words and ask the following:
    • Will business components require any changes to address these objectives?
    • Will information technology components changes be needed to address these objectives?
  5. Record the business and technology needs identified in step 4. As well, record any questions you may have regarding the document contents for stakeholders to validate later.
  6. Move to the next document once complete. Complete steps 3-5 for the remaining strategy documents.

Stakeholder interviews will help you collect primary data and will shed light on stakeholder priorities and challenges

In this interview process, you will be asking EA stakeholders questions that uncover their business and technology needs. You will also be able to ask follow-up questions to get a better understanding of abstract or complex concepts from the strategy document review and PESTLE analysis.

EA Stakeholders:

  • Stakeholders may not think of their business and technology needs. But stakeholders will often explicitly state their objectives and initiatives.
  • Objectives often result in risks, opportunities, and annoyances:
    • Risks: Potential damage associated with pursuing an objective or initiative.
    • Opportunities: Potential gains that could be leveraged when capturing objectives and initiatives.
    • Annoyances: Roadblocks that could hinder the pursuit of objectives and initiatives.
  • Ask stakeholders questions on these areas to discern their business and technology needs.

Risks + Opportunities + Annoyances –› Business and Technology Needs

2.1.4 Conduct EA stakeholder interviews

4-8 hours

Input: Expertise from the EA stakeholders

Output: Business and technology needs for EA stakeholders

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team, Identified EA stakeholders

  1. Schedule an interview with each of the stakeholders that were identified as key stakeholders in the Stakeholder Power Map.
  2. Meet with the key EA stakeholders and start business and technology needs gathering. Schedule each identified key stakeholder for an interview.
  3. When a stakeholder arrives for their interview, ask the following questions and record the answers to help uncover needs. Be sure to record which stakeholder answered the question. Further, record any future stakeholders that agree.
    • What are the current strengths of your organization?
    • What are the current weaknesses of your organization?
    • What is the number 1 risk you need to prevent?
    • What is the number 1 opportunity you want to capitalize on?
    • What is the number 1 annoying pet peeve you want to remove?
    • How would you prioritize these risks, opportunities, and annoyances?
  4. Recorded answer example: “We can’t see what the other departments are doing; when we spend a lot of money to invest in something, we later find out the capability is already within the company.”
  5. After completing each interview, verify with each stakeholder that you have captured their business and technology needs. Continue the interview process until all identified key stakeholders have been interviewed.
  6. Capture all inputs into a SWOT (strengths, weaknesses, opportunities, and threats) format.

Step 2.2

Define Your Value Proposition

Activities
  • 2.2.1 Create a set of business and technology drivers from business and technology needs
  • 2.2.2 Identify the pains associated with the business and technology drivers
  • 2.2.3 Identify the EA contributions that can address the pains
  • 2.2.4 Create promises of value to shape the EA value proposition

This step will walk you through the following activities:

  • Use business and technology drivers to determine EA’s role in your organization.

This step involves the following participants:

  • CIO
  • IT Leaders
  • Business Leaders

Outcomes of this step

A value proposition document that ties the value of the EA function to stakeholder needs.

Create the EA Value Proposition

Step 2.1 Step 2.2

Synthesize the collected data into business and technology drivers

Two triangles labelled 'Business needs' and 'Technology needs' point to a cloud labelled 'Analysis', which connects to the driver attributes on the right via a dotted line.

There are several key attributes that a driver should have.

Driver Key Attributes
  • A succinct statement.
  • Begins with “action words” to communicate a call to action (e.g. Support, Help, Enable).
  • Written in a language understood by all parties involved.
  • Communicates a need for improvement or prevention.

“The greatest impact of enterprise architecture is the strategic impact. Put the mission and the needs of the organization first.” (Matthew Kern, Clear Government Solutions)

2.2.1 Create a set of business and technology drivers from business and technology needs

3 hours

Input: Expertise from EA strategy creation team

Output: A set of business and technology drivers

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team, EA stakeholders

Meet with the EA strategy creation team and follow the steps below to begin the process of synthesizing the business and technology needs into drivers.

  1. Lay out the documented business and technology needs your team gathered from PESTLE analysis, strategy document reviews, and stakeholder interviews.
  2. Assess the documented business and technology needs to see if there are common themes. Consolidate those similar business and technology needs by crafting one driver for them. For example:
    • PESTLE: Influx of competitors in the marketplace causing tighter margins.
    • Document review: Improve investment quality and their value to the organization.
    • Stakeholder interview: “We can’t see what the other departments are doing; when we spend a lot of money to invest in something, we later find out the capability is already within the company.”
    • Consolidated business driver example: Help the organization align investments with the corporate strategy and departmental priorities.
  3. As well, synthesize the business and technology needs that cannot be consolidated.
  4. Verify the completed list of drivers with stakeholders. This is to ensure you have fully captured their needs.

Download the EA Value Proposition Template to record your findings in this activity.

When addressing business and technology drivers, an organization can expect obstacles

A pain is an obstacle that business stakeholders will face when attempting to address business and technology drivers. Identify the pains associated with each driver so that EA’s contributions can be linked to resolving obstacles to address business needs.

Business and Technology Drivers

Pains

Created by assessing information sources. A sentence that states the nature of the pain and how the pain stops the organization from addressing the drivers.
Examples:
  • Business driver: Help the organization align investments with the corporate strategy and departmental priorities.
  • Technology driver: Improve the organization’s technology responsiveness and increase speed to market.
Examples:
  • Business driver pains: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
  • Technology driver pains: Ineffective application development requiring delays decreases the speed to market.

2.2.2 Identify the pains associated with the business and technology drivers

2 hours

Input: Expertise from EA strategy creation team and EA stakeholders

Output: An associated pain that obstructs each identified driver

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team, EA stakeholders

Call a meeting with the EA strategy creation team and any available stakeholders to identify the pains that obstruct addressing the business and technology drivers.

Take each driver and ask the questions below to the EA strategy creation team and to any EA stakeholders who are available. Record the answers to identify the pains when realizing the drivers.

  1. What are your challenges in performing the activity or process today?
  2. What other business activities/processes will be impacted/improved if we solve this?
  3. What compliance/regulatory/policy concerns do we need to consider in any solution?
  4. What are the steps in the process/activity?

Take the recorded answers and follow the steps below to create the pain statements:

  1. Answers to the questions above can be long, unfocused, or spoken in a casual manner. To turn the answer into pains, refine the recorded answers into a succinct sentence that captures its meaning.
    • Recorded answer example: “I feel like there needs to be a holistic view of the organization. If we had a tool to see all the capabilities across the business, then we can figure out what investments should be prioritized.”
    • Example of pain statement: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
  2. When the list of pains has been written out, verify with the stakeholders that you have fully captured their pains.

Download the EA Value Proposition Template to record your findings in this activity.

The identified pains can be alleviated by a set of EA contributions

Set the foundations for the value proposition by brainstorming the EA contributions that can alleviate the pains.

Business and technology drivers produce:

Pains

—›
EA contributions produce:

Value by alleviating pains

Pains

Obstructions to addressing business and technology drivers. Stakeholders will face these pains.

Examples
  • Business driver pains: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
EA contributions

Activities the EA function can perform to help alleviate the pains. Demonstrates the contributions the EA function can make to business value.

Examples:
  • Business driver EA contributions: Business capability mapping shows the business capabilities of the organization and the technology that supports those capabilities in the current and target state. This provides a view for the set of investments that are needed by the organization, which can then be prioritized.

Enterprise architecture functions can provide a diverse set of contributions to any organization – Sample

EA contribution category EA contribution details
Define business capabilities and processes As-is and target business capabilities and processes are documented and understood by both IT and the business.
Design information flows and services Information flows and services effectively support business capabilities and processes.
Analyze gaps and identify project opportunities Create informed project identification, scope definition, and project portfolio management.
Optimize technology assets Greater homogeneity and interoperability between tangible and intangible technology assets.
Create and maintain technology standards Decrease development, integration, and support efforts. Reduce complexity and improve interoperability.
Rationalize technology assets Tangible and intangible technology assets are rationalized to adequately and efficiently support information flows and services.

2.2.3 Identify the EA contributions that can address the pains

2 hours

Input: Expertise from EA strategy creation team

Output: EA contributions that addresses the pains that were identified

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Gather with the EA strategy creation team, take each pain, then ask and record the answers to the questions below to identify the EA contributions that would solve the pains:

  1. What activities can the EA practice conduct to overcome the pain?
  2. What are the core EA models that can help accurately define the problem and assist in finding appropriate resolutions?
  3. What are the general EA benefits that can be associated with solving this pain?

Answers to the questions above will generate a list of activities EA can do to help alleviate the pains. Use the following steps to complete this activity:

  1. Create a stronger tie between the EA contributions and pains by linking the EA contribution statement to the pain.
    • Example of pain statement: Lack of holistic view of business capabilities obstructs the organization from aligning investments with corporate strategy and departmental priorities.
    • Example of EA contributions statement: Business capability mapping shows the business capabilities of the organization and the technology that supports those capabilities in the current and target state. This provides a view for the set of investments that are needed by the organization, which can then be prioritized.
  2. Verify with the stakeholders that they understand the EA contributions have been written out and how those contributions address the pains.

Download the EA Value Proposition Template to record your findings in this activity.

EA promises of value articulate EA’s commitment to the organization

  • Business Goals and Technology Drivers
    A set of statements created from business and technology needs. Gathered from information sources, it communicates improvements needed.

    • Value Streams, Aspirations, Long-Term Goals
      Value streams, aspirations, long-term goals

      • EA Contributions
        EA contributions that will alleviate the obstructions. Removing the obstructions will allow EA to help satisfy business and technology needs.

        • Promise of Value
          A statement that depicts a concrete benefit the EA practice can provide for the organization in response to business and technology drivers.
          Communicate the statements in a language that stakeholders understand to complete the articulation of EA’s value proposition.

2.2.4 Create promises of value to shape the EA value proposition

2 hours

Input: Expertise from EA strategy creation team and EA stakeholders

Output: Promises of value for each business and technology driver

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team, EA stakeholders

Now that the EA contributions have been identified, identify the promises of value to articulate the value proposition.

Take each driver, then ask and record the answers to the questions below to identify the promises of value when realizing the drivers:

  1. What does amazing look like if we solve this perfectly?
  2. What other business activities/processes will be impacted/improved if we solve this?
  3. What measures of success/change should we use to prove value of the effort (KPIs/ROI)?

Take the recorded answers and follow the steps below to create the promises of value.

  1. Answers to the questions above can be long, unfocused, or spoken in a casual manner. To turn the answer into a promise of value, refine the recorded answer into a succinct sentence that captures its meaning.
    • Business driver example: Help the organization align investments with the corporate strategy and departmental priorities.
    • Recorded answer example: “If this would be solved perfectly, we would have a very easy time planning investments and investment planning hours can be spent doing other activities.”
    • Promises of value example: Increase the number of investments that have a direct tie to corporate strategy.
  2. When the promises of value have been written out, verify with the stakeholders that you have fully captured their ideas.

Download the EA Value Proposition Template to record your findings in this activity.

Design an Enterprise Architecture Strategy

Phase 3

Build the EA Fundamentals

Phase 1

  • 1.1 Explore a general EA strategy approach
  • 1.2 Introduce Agile EA architecture

Phase 2

  • 2.1 Define the business and technology drivers
  • 2.2 Define your value proposition

Phase 3

  • 3.1 Realize the importance of EA fundamentals
  • 3.2 Finalize the EA fundamentals

Phase 4

  • 4.1 Select relevant EA services
  • 4.2 Finalize the set of services and secure approval

This phase will walk you through the following activities:

  • Create an EA vision statement and an EA mission statement.
  • Create EA goals, define EA objectives, and link them to EA goals.
  • Define the EA function scope dimensions.
  • Create a set of EA principles for your organization.
  • Discuss current methodology.

This phase involves the following participants:

  • CIO
  • EA Team
  • IT Leaders
  • Business Leaders

Step 3.1

Realize the Importance of EA Fundamentals

Activities
  • 3.1.1 Create the EA vision statement
  • 3.1.2 Create the EA mission statement
  • 3.1.3 Create EA goals
  • 3.1.4 Define EA objectives and link them to EA goals
  • 3.1.5 Record the details of each EA objective

This step will walk you through the following activities:

  • Define and document the fundamentals that guide the EA function.

This step involves the following participants:

  • CIO
  • EA Team
  • IT Leaders
  • Business Leaders

Outcomes of this step

  • Vision and mission statements for the EA function.
  • A set of EA goals and a set of objectives to track progression toward those goals.
Build the EA Fundamentals
Step 3.1 Step 3.2

EA fundamentals guide the EA function

EA fundamentals include a vision statement, a mission statement, goals and objectives, and principles. They are a set of documented statements that guide the EA function. The fundamentals guide the EA function in terms of its strategy and decision making.

EA vision statement EA mission statement

EA fundamentals

EA goals and objectives EA principles

Info-Tech Insight

Treat the critical elements of the EA group the same way as you would a business. Create a directional foundation for EA and define the vision, mission, goals, principles, and scope necessary to deliver on the established value proposition.

The EA vision statement articulates the aspirations of the EA function

The enterprise architecture vision statement communicates a desired future state of the EA function. The statement is expressed in the present tense. It seeks to articulate the desired role of the EA function and how the EA function will be perceived.

Strong EA vision statements have the following characteristics:

  • Describe a desired future
  • Focus on ends, not means
  • Communicate promise
  • Concise, no unnecessary words
  • Compelling
  • Achievable
  • Inspirational
  • Memorable

Sample EA vision statements:

  • To be a trusted partner for both the business and IT, driving enterprise effectiveness, efficiency, and agility at [Company Name].
  • To be a trusted partner and advisor to both the business and IT, contributing to business-IT alignment and cost reduction at [Company Name].
  • To create distinctive value and accelerate [Company Name]’s transformation.

The EA mission statement articulates the purpose of the EA function

The enterprise architecture mission statement specifies the team’s purpose or “reason of being.” The mission should guide each day’s activities and decisions. The mission statements use simple and concise terminology, speak loudly and clearly, and generate enthusiasm for the organization.

Strong EA mission statements have the following characteristics:

  • Articulates EA function purpose and reason for existence
  • Describes what the EA function does to achieve its vision
  • Defines who the customers of the EA function are
  • Compelling
  • Easy to grasp
  • Sharply focused
  • Inspirational
  • Memorable
  • Concise

Sample EA mission statements:

  • Define target enterprise architecture for [Company Name], identify solution opportunities, inform IT investment management, and direct solution development, acquisition, and operation compliance.
  • Synergize with both the business and IT to define and help realize [Company Name]’s target enterprise architecture that enables the business strategy and optimizes IT assets, resources, and capabilities.

The EA vision and mission statements become relevant to EA stakeholders when linked to the promises of value

The process for constructing the enterprise architecture vision statement and enterprise architecture mission statement is articulated below.

Promises of value Derive keywords Construct draft statements Reference test criteria Finalize statements
Derive the a set of keywords from the promises of value to accurately capture their essence. Create the initial statement using the keywords. Check the initial statement against a set of test criteria to ensure their quality. Finalize the statement after referencing the initial statement against the test criteria.

Derive keywords from promises of value to begin the vision and mission statement creation process

Develop keywords by summarizing the promises of value that were derived from drivers into one word that will take on the essence of the promise. See examples below:

Business and technology drivers Promises of value Keywords
Help the organization align investments with the corporate strategy and departmental priorities. Increase the number of investments that have a direct tie to corporate strategy. Business
Support the rapid growth and development of the company through fiscal planning, project planning, and technology sustainability. Ensure budgets and projects are delivered on time with the assistance of technology. IT-Enabled
Reduce the duplication and work effort to build and deploy technology solutions across the entire organization. Aim to reduce the number of redundant applications in the organization to streamline processes and save costs. Catalyst
Improve the organization’s technology responsiveness and increase speed to market. Reduce the number of days required in the SDLC for all core business support projects. Value delivery

An inspirational vision statement is greater than the sum of the individual words

Ensure the sentence is cohesive and captures additional value outside of the keywords. The statement as a whole should be greater than the sum of the parts. Expand upon the meaning of the words, if necessary, to communicate the value. Below is an example of a finished vision statement.

Sample

Be a catalyst for IT-enabled business value delivery.

Catalyst – We will continuously interact with the business and IT to accelerate and improve results.

IT-enabled – We will ensure the optimal use of technology in enabling business capabilities to achieve business objectives.

Business – We will be perceived as a business-focused unit that understands [Company name]’s business priorities and required business capabilities.

Value delivery – EA’s value will be recognized by both business and IT stakeholders. We will track and market EA’s contribution to business value organization-wide.

A clear mission statement can include additional details surrounding the EA team’s desired and expected value

Likewise, below is a sample of connecting keywords together to form an EA mission statement:

Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture.

Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.

Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.

Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.

Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture.

Target enterprise structure – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:

  • Business capabilities and processes (business architecture)
  • Data, application, and technology assets that enable business capabilities and processes (technology architecture)
  • Architecture principles and standards

3.1.1 Create the EA vision statement

1 hour

Input: Identified promises of value, Vision statement test criteria

Output: EA function vision statement

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin the creation of the EA vision statement by following the steps below:

  1. Gather the EA strategy creation team and have the promises of value from the EA value proposition laid out.
  2. Select one promise of value and work with the team to identify one word that captures the essence of that promise of value.
  3. Continue to the next promise of value until all of the promises of value have a keyword identified.
  4. Have the identified set of keywords laid out and see if any of their meanings are similar and can be consolidated together. Consolidate similar meaning keywords.
  5. Create the initial draft of the EA vision statement by linking the keywords together.
  6. Check the initial draft of the vision statement against the test criteria below. Ask the team if the vision statement satisfies each of the test criteria.
    • Do you find this vision exciting?
    • Is the vision clear, compelling, and easy to grasp?
    • Does this vision somehow connect to the core purpose?
    • Will this vision be exciting to a broad base of people in the organization, not just those within the EA team?
  7. Make changes to the initial draft to satisfy the test criteria. Socialize the EA vision statement with EA stakeholders to make sure it captures their needs.

3.1.2 Create the EA mission statement

1 hour

Input: Identified promises of value, Mission statement test criteria

Output: EA function mission statement

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin the creation of the EA mission statement by following the steps below:

  1. Gather the EA strategy creation team and have the promises of value from the EA value proposition laid out.
  2. Select one promise of value and work with the team to identify one word that captures the essence of that promise of value.
  3. Continue to the next promise of value until all of the promises of value have a keyword identified.
  4. Have the identified set of keywords laid out, and see if any of their meanings are similar and can be consolidated together. Consolidate similar meaning keywords.
  5. Create the initial draft of the EA mission statement by linking the keywords together.
  6. Check the initial draft of the mission statement against the following test criteria below. Ask the team if the mission statement satisfies each of the test criteria.
    • Do you find this purpose personally inspiring?
    • Does the purpose help you to decide what activities to not pursue, to eliminate from consideration? Is this purpose authentic – something true to what the organization is all about – not merely words on paper that sound nice?
    • Would this purpose be greeted with enthusiasm rather than cynicism by a broad base of people in the organization?
  7. Make changes to the initial draft to satisfy the test criteria. Socialize the EA mission statement with EA stakeholders to make sure it captures their needs.

EA goals demonstrate the achievement of success of the EA function

Enterprise architecture goals define specific desired outcomes of an EA function. EA goals are important because they establish the milestones the EA function can strive toward to deliver their promises of value.

Inform EA goals by examining:

Promises of value

—›
EA goals produce:

Targets and milestones

Promises of value

Produce EA strategic outcomes that can be classified into four categories. The four categories are:

  • Business performance
  • IT performance
  • Customer value
  • Risk management
EA goals

Support the strategic outcomes. EA goals can be strategic or operational:

  • EA strategic goals support the strategic outcomes.
  • EA operational goals help measure the architecture capability quality and supporting processes.

3.1.3 Create EA goals

2 hours

Input: Identified promises of value

Output: EA goals

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin the creation of EA goals by following the steps below:

  1. Gather the EA strategy creation team and the identified promises of value from Phase 2, Create the EA Value Proposition.
  2. Open the EA Goals and Objectives Template and examine the list of default EA goals already within the template.
  3. Take the identified promises of value and discuss with the team if any of the EA goals in the template relate to the promises of value. Record the related EA goal and promise of value. See example below:
    • Promises of value example: Increase the number of investments that have a direct tie to corporate strategy.
    • Related EA goal example: Alignment of IT and business strategy.
  4. Repeat step 3 until all identified promises of value have been examined in relation to the EA goals in the template.
  5. If there are promises of value that are not related to an EA goal in the template, create EA goals to relate to those promises of value. Keep in mind that EA goals need to support the strategic outcomes produced by the promises of value. Record the EA goals in the template and document the related promises of value.

Download the EA Goals and Objectives Template to assist with completing this activity.

Starting with COBIT, select the appropriate objectives to track EA goals – Sample

Below are examples of EA goals and the objectives that track their performance:

IT performance-oriented goals Objectives
Alignment of IT and business strategy
  • Increase the percentage of enterprise strategic goals and requirements supported by IT strategic goals by X percent in the fiscal year.
  • Improve stakeholder satisfaction with planned function and services portfolio scope by X percent in the fiscal year.
  • Increase the percentage of IT value drivers mapped to business value drivers by X percent in the next fiscal year.
Increase in IT agility
  • Improve business executive satisfaction with IT’s responsiveness to new requirements by X percent in the fiscal year.
  • Increase the number of critical business processes supported by up-to-date infrastructure and applications in the next three years.
  • Lower the average time to turn strategic IT objectives into agreed-upon and approved initiatives.
Optimization of IT assets, resources, and capabilities
  • Increase the frequency of capability maturity and cost optimization assessments.
  • Improve the frequency of reporting for assessment result trends.
  • Raise the satisfaction levels of business and IT executives with IT-related costs and capabilities by X percent.

3.1.4 Define EA objectives and link them to EA goals

2 hours

Input: Defined EA goals

Output: EA objectives linked to EA goals

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin the process of defining EA objectives and linking them to EA goals using the following steps:

  1. Gather the EA strategy creation team and open the EA Goals and Objectives Template.
  2. Have the goals laid out, and refer to the objectives already in the EA Goals and Objectives Template. Examine if any of them will fit the goals your team has created.
  3. If some of the goals your team has created do not fit with the objectives in the template, begin the process of creating new objectives. Remember, EA objectives are SMART metrics that help track the progress toward the EA goals.
  4. Create an EA objective and check if it is SMART by asking some of the questions below:
    • Specific: Is the objective specific to the goal? Is the objective clear to anyone who has basic knowledge of the goal?
    • Measurable: Is it possible to figure out how far the team would be away from completing the objective?
    • Agreed Upon: Does everyone involved agree the objective is the correct way to measure progress?
    • Realistic: Can the objective be met within the availability of resources, knowledge, and time?
    • Time Based: Is there a time-bound component to the goal?
  5. Continue to create new objectives until each goal has an objective linked to it.

Download the EA Goals and Objectives Template to assist with completing this activity.

For each of the objectives, determine how they will be collected, reported, and implemented

Add details to the enterprise architecture objectives previously defined to increase their clarity to stakeholders.

EA objective detail category Description
Unit of measure
  • The unit in which the objective will be presented.
Calculation formula
  • The formula by which the objective will be calculated.
Objective baseline, status, and target
  • Baseline: The state of the objective at the start of measurement.
  • Status: The current state of the measurement.
  • Target: The target state the measurement should reach.
Data collection
  • Responsible: The individual responsible for collecting the data.
  • Source: Where the data originates.
  • Frequency: How often the data will be collected to calculate the objective.
Reporting
  • Target Audience: The people the objective will be presented to.
  • Method: The method used to present the data collected on the objective (e.g. report, presentation).
  • Frequency: How often the data will be presented to the target audience.

3.1.5 Record the details of each EA objective

2 hours

Input: Defined list of EA objectives

Output: Increased detail into each defined EA objective

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Record the details of each EA objective. Use the following steps below to assist with recording the details:

  1. Gather the EA strategy creation team, and open the EA Goals and Objectives Template.
  2. Select one objective that has been identified and discuss the formula for calculating the objective and in what units the objective will be recorded. Record the information in the “Calculation formula” and “Unit of measure” columns in the template once they have been agreed upon.
  3. Using the same objective, move to the “Data Collection” portion of the template. Discuss and record the following: the source of the data that generates the objective, the frequency of reporting on the objective, and the person responsible for reporting the objective.
  4. Move to the “Reporting” portion of the template. Discuss and record the target audience for the objective and the reporting frequency and method to those audiences.
  5. Examine the “Objective baseline,” “Objective status,” and “Objective target” columns. Record any measurement you may currently have in the “Objective baseline” column. Record what you would like the objective measurement to be in the “Objective target” column. Note: Keep track of the progression towards the target in the “Objective status” column in the future.
  6. Select the next objective and complete steps 2–5 for that measure. Continue this process until you have recorded details for all objectives.

Download the EA Goals and Objectives Template to assist with completing this activity.

Step 3.2

Finalize the EA Fundamentals

Activities
  • 3.2.1 Define the organizational coverage dimension of the EA function scope
  • 3.2.2 Define the architectural domains and depth dimension
  • 3.2.3 Define the time horizon dimension
  • 3.2.4 Create a set of EA principles for your organization
  • 3.2.5 Add the rationale and implications to the principles
  • 3.2.6 Operationalize the EA principles
  • 3.2.7 Discuss the need for classical methodology and/or a combination including Agile practices

This step will walk you through the following activities:

  • Define the EA function scope dimensions.
  • Create a set of EA principles.
  • Discuss the organization’s current methodology, if any, and whether it works for the business.

This step involves the following participants:

  • CIO
  • EA Team
  • IT Leaders
  • Business Leaders

Outcomes of this step

  • Defined scope of the EA function.
  • A set of EA principles for your organization.
  • A decision on traditional vs. Agile methodology or a blend of both.

Build the EA Fundamentals

Step 3.1 Step 3.2

A clear EA function scope defines the EA sandbox

The EA function scope constrains the promises of value the EA function will deliver on by taking into account factors across four dimensions. The EA function scope ensures that the EA function is not stretched beyond its current/planned means and capabilities when delivering the promised value. The four dimensions are illustrated below:

Organizational coverage
Determine the focus of the enterprise architecture effort in terms of specific business units, functions, departments, capabilities, or geographical areas.
Depth
Determine the appropriate level of detail to be captured, based on the intended use of the enterprise architecture and the contingent decisions to be made.

EA Scope

Architectural Domains
Determine the EA domains (business, data, application, infrastructure, security) that are appropriate to address stakeholder concerns and architecture requirements.
Time horizon
Determine the target-state architecture’s objective time period.

The EA function scope is influenced by the EA value proposition and previously developed EA fundamentals

Establish the EA function scope by using the EA value proposition and EA fundamentals that have been developed. After defining the EA function scope, refer back to these statements to ensure the EA function scope accurately reflects the EA value proposition and EA fundamentals.

EA value proposition

+

EA vision statement
EA mission statement
EA goals and objectives

—›
Influences

Organizational coverage

Architectural domains

Depth

Time horizon

—›
Defines
EA function scope

EA scope – Organizational Coverage

The organizational coverage dimension of EA scope determines the focus of enterprise architecture effort in the organization. Coverage can be determined by specific business units, functions, departments, capabilities, or geographic areas. Info-Tech has typically seen two types of coverage based on the size of the organization.

Small and medium-size enterprise

Indicators: Full-time employees dedicated to manage its data and IT infrastructure. Individuals are IT generalists and may have multiple roles.

Recommended coverage: Typically, for small and medium-size businesses, the organizational coverage of architecture work is the entire enterprise. (Source: The Open Group, 2018)

Large enterprise

Indicators: Dedicated full-time IT staff with expertise to manage specific applications or parts of the IT infrastructure.

Recommended coverage: For large enterprises, it is often necessary to develop a number of architectures focused on specific business segments and/or geographies. In this federated model, an overarching enterprise architecture should be established to ensure interoperability and conformance to overarching EA principles. (Source: DCIG, 2011)

EA objectives track the progression towards the target set by EA goals

Enterprise architecture objectives are specific metrics that help measure and monitor progress towards achieving an EA goal. Objectives are SMART.

EA goals —› EA objectives
  • EA strategic goals:
    • Business performance
    • IT performance
    • Customer value
    • Risk management
  • EA operational goals
  • Specific
  • Measurable
  • Agreed upon
  • Realistic
  • Time bound
(Source: Project Smart, 2014)

Download the EA Goals and Objectives Template to see examples between the relationship of EA goals to objectives.

Measure the EA strategy effectiveness by tracking the benefits it provides to the corporate business goals

The success of the EA function is influenced by the following:

  • The delivery of EA-enabled business outcomes that are most important to the enterprise.
  • The alignment between the business and IT from a planning perspective.
  • Improvements in the corporate business goals due to EA contributions (standardization, rationalization, reuse, etc.).
Corporate Business Goals Measurements
  • Reduction in operating costs
  • Decrease in regulatory compliance infractions
  • Increased revenue from existing channels
  • Increased revenue from new channels
  • Faster time to business value
  • Improved business agility
  • Reduction in enterprise risk exposure
  • Cost reductions based on application and platform rationalization
  • Standard-based solutions
  • Time reduction for integration
  • Service reused
  • Stakeholder satisfaction with EA services
  • Increase customer satisfaction
  • Rework minimized
  • Lower cost of integration
  • Risk reduction
  • Faster time to market
  • Better scalability, etc.

3.2.1 Define the organizational coverage dimension of the EA function scope

2 hours

Input: EA value proposition, Previously defined EA fundamentals

Output: Organizational coverage dimension of EA scope defined

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Define the organizational coverage of the EA function scope using the following steps below:

  1. Gather the EA strategy creation team. As well, gather the EA value proposition, the EA vision and mission statements, and the EA goals and objectives your team has already created.
  2. Ask the team to read each of the documents gathered in the previous step. This ensures the concepts are fresh in the team members’ minds when defining the EA function scope organizational coverage.
  3. Consider how much of the organization the EA function would need to cover. Refer to the gathered materials to assist with your decision. For example:
    • EA mission statement: Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture.
    • Implications on organizational coverage: If the purpose of the EA function is to help optimize, transform, and innovate with target-state architecture mapping, then the scope should cover the entire organization. Only by mapping the entire organization’s architecture can the EA function assist with optimizing, transforming, and innovating.
  4. Work with the EA strategy creation team to examine all the gathered materials and document the implications on organization coverage as shown in step 3.
  5. Discuss with the team and select the organizational coverage level that best fits the documented implications for all the gathered materials. Refer back to the gathered materials and make any changes necessary to ensure they support the selected organizational coverage.

EA scope – Architectural Domains

A complete enterprise architecture should address all five architectural domains. The five architectural domains are business, data, application, infrastructure, and security.

Enterprise Architecture
—› Data Architecture
Business Architecture —› Infrastructure Architecture
Security Architecture
—› Application Architecture

“The realities of resource and time constraints often mean there is not enough time, funding, or resources to build a top-down, all-inclusive architecture encompassing all four architecture domains. Build architecture domains with a specific purpose in mind.” (The Open Group, 2018)

Each architectural domain creates a different view of the organization

Below are the definitions of different domains of enterprise architecture (Info-Tech perspective; others can be identified as well, e.g. Integration Architecture).

Business Architecture

Business architecture is a means of demonstrating the business value of subsequent architecture work to key stakeholders and the return on investment to those stakeholders from supporting and participating in the subsequent work. Business architecture defines the business strategy, governance, organization, and key business processes.

Data Architecture

Describes the structure of an organization’s logical and physical data assets and data management resources.

Application Architecture

Provides a blueprint for the individual applications to be deployed, their interactions, and their relationships to the core business processes of the organization.

Infrastructure Architecture

Represents the sum of hardware, software, and telecommunications-related IT capability associated with a particular enterprise. It is concerned with the synergistic operations and management of the devices in the organization.

Security Architecture

Provides an unified security design that addresses the necessities and potential risks involved in a certain scenario or environment. It also specifies when and where to apply security controls.
(Sources: The Open Group, 2018; IT Architecture Journal, 2014; Technopedia, 2016)

EA scope – Depth

EA scope depth defines the architectural detail for each EA domain that the organization has selected to pursue. The level of depth is broken down into four levels. The level of depth the organization decides to pursue should be consistent across the domains.

Contextual
  • Helps define the organization scope, and examines external and internal requirements and their effect on the organization. For example, enterprise governance.
Conceptual
  • High-level representations of the organization or what the organization wants to be. For example, business strategy, IT strategy.
Logical
  • Models that define how to implement the representation in the conceptual stage. For example, identifying the business gaps from the current state to the target state defined by the business strategy.
Physical
  • The technology and physical tools used to implement the representation created in the logical stage. For example, business processes that need to be created to bridge the gaps identified and reach the target stage.
(Source: Zachman International, 2011) Business Architecture Data Architecture Application Architecture Infrastructure Architecture Security Architecture

Each architectural depth level contains a set of key artifacts

The graphic below depicts examples of the key artifacts that each domain of architecture would produce at each depth level.

Contextual Enterprise Governance
Conceptual Business strategy Business objects Use-case models Technology landscaping Security policy
Logical Business capabilities Data attribution Application integration Network/ hardware topology Security standards
Physical Business process Database design Application design Configuration management Security configuration
Business Architecture Data Architecture Application Architecture Infrastructure Architecture Security Architecture

3.2.2 Define the architectural domains and depth dimension of the EA function scope

2 hours

Input: EA value proposition, Previously defined EA fundamentals

Output: Architectural domain and depth dimensions of EA scope defined

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Define the EA function scope for your organization using the following steps below:

  1. Gather the EA strategy creation team. As well, gather the EA value proposition, the EA vision and mission statements, and the EA goals and objectives that your team has already created.
  2. Ask the team to read each of the documents gathered in the previous step. This ensures the concepts are fresh in the team members’ minds when defining the architectural domains and depth of the EA function scope.
  3. Consider the architectural domains and the depth those domains need to reach. Refer to the gathered materials to assist with your decision. For example:
    • Promise of value: Increase the number of IT investments with a direct tie to business strategy.
    • Implications on architectural domains: The EA function will need business architecture. Business architecture generates business capability mapping, which will anticipate what IT investments are needed for the future.
    • Implications on depth: Depth for business architecture needs to reach a logical level to encompass business capabilities.
  4. Work with the EA strategy creation team to examine all the gathered materials and document the implications on architectural domains and depth as shown in step 3.
  5. Discuss with the team and select the architectural domains and the depth for each domain that best fits the documented implication. Refer back to the gathered materials and make any changes necessary to ensure they support the selected architectural domains and depth.

EA scope – Time Horizon

The EA scope time horizon dictates how long to plan for the architecture.

It is important that the EA team’s work has an appropriate planning horizon while avoiding two extremes:

  1. A planning horizon that is too short focuses on immediate operational goals and strategic quick wins, missing the “big picture,” and fails to support the achievement of strategic long-term enterprise goals.
  2. A planning horizon that is too long is at a higher risk of becoming irrelevant.

Target the same strategic planning horizon as your business. Additionally, consider the following recommendations:

Planning Horizon: 1 year 2-3 years 5 years
Recommended under the following conditions:
  • Corporate strategy is not stable and frequently changes direction (typical for small and some mid-sized companies).
  • There will be a major update of the corporate strategy in one year.
  • The company will be acquired by or merged with another company in one year.
  • The business' strategic plan spans the next two to three years, and corporate strategy is moderately stable within this time frame (typical for mid-sized and some large companies).
  • The business' strategic plan spans the next five years and corporate strategy is very stable (typical for large companies).

3.2.3 Define the time horizon dimension of the EA function scope

2 hours

Input: EA value proposition, Previously defined EA fundamentals

Output: Time horizon dimension of EA scope defined

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Define the EA function scope for your organization using the following steps below:

  1. Gather the EA strategy creation team. As well, gather the EA value proposition, the EA vision and mission statements, and the EA goals and objectives your team has already created.
  2. Ask the team to read each of the documents gathered in the previous step. This ensures the concepts are fresh in the team members’ minds when crafting the EA function scope.
  3. Consider the time horizons of the EA function scope. Refer to the gathered materials to assist with your decision. For example:
    • EA Objective: Increase the percentage of enterprise strategic goals and requirements supported by IT strategic goals by 30% in the next 3 years.
    • Implications on time horizon: Because it will take 3 years to measure the success of these EA objectives, the time horizon may need to be 3 years.
  4. Work with the EA strategy creation team to examine all the gathered materials and document the implications on time horizon as shown in step 3.
  5. Discuss with the team and select the time horizon that best fits the documented implication. Refer back to the gathered materials and make any changes necessary to ensure they support the selected architectural time horizon.

EA principles capture the EA value proposition essence and provide guidance for the decisions that impact architecture

EA principles are shared, long-lasting beliefs that guide the use of IT in constructing, transforming, and operating the enterprise by informing and restricting target-state enterprise architecture design, IT investment portfolio management, solution development, and procurement decisions.

EA value proposition Influences
—›
EA Principles Guide and inform
—›
Decisions on the Use of IT Direct and control
‹—
Specific Domain Policies
‹———————

What decisions should be made?
————— ————— —————
How should decisions be made?
————— ————— —————————›
Who has the accountability and authority to make decisions?

EA principles must be carefully constructed to make sure they are adhered to and relevant

Info-Tech has identified a set of characteristics that EA principles should possess. Having these characteristics ensures the EA principles are relevant and followed in the organization.

Approach focused EA principles are focused on the approach, i.e. how the enterprise is built, transformed, and operated, as apposed to what needs to be built, which is defined by both functional and non-functional requirements.
Business relevant Create EA principles specific to the organization. Tie EA principles to the organization’s priorities and strategic aspirations.
Long lasting Build EA principles that will withstand the test of time.
Prescriptive Inform and direct decision making with EA principles that are actionable. Avoid truisms, general statements, and observations.
Verifiable If compliance can’t be verified, the principle is less likely to be followed.
Easily digestible EA principles must be clearly understood by everyone in IT and by business stakeholders. EA principles aren’t a secret manuscript of the EA team. EA principles should be succinct; wordy principles are hard to understand and remember.
Followed Successful EA principles represent a collection of beliefs shared among enterprise stakeholders. EA principles must be continuously “preached” to all stakeholders to achieve and maintain buy-in.

In organizations where formal policy enforcement works well, EA principles should be enforced through appropriate governance processes.

Review ten universal EA principles to determine if your organization wishes to adopt them

1. Enterprise value focus We aim to provide maximum long-term benefits to the enterprise as a whole while optimizing total costs of ownership and risks.
2. Fit for purpose We maintain capability levels and create solutions that are fit for purpose without over-engineering them.
3. Simplicity We choose the simplest solutions and aim to reduce operational complexity of the enterprise.
4. Reuse › buy › build We maximize reuse of existing assets. If we can’t reuse, we procure externally. As a last resort, we build custom solutions.
5. Managed data We handle data creation, modification, and use enterprise-wide in compliance with our data governance policy.
6. Controlled technical diversity We control the variety of technology platforms we use.
7. Managed security We manage security enterprise-wide in compliance with our security governance policy.
8. Compliance to laws and regulations We operate in compliance with all applicable laws and regulations.
9. Innovation We seek innovative ways to use technology for business advantage.
10. Customer centricity We deliver best experiences to our customers with our services and products.

3.2.4 Create a set of EA principles for your organization

2 hours

Input: Info-Tech’s ten universal EA principles, Identified promises of value

Output: A defined set of EA principles for your organization

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Create a set of EA principles for your organization using the steps below:

  1. Gather the EA strategy creation team, download the EA Principles Template – EA Strategy, and have the identified promises of value opened.
  2. Select one universal principle and relate it to the promises of value by discussing with the EA strategy creation team. If there is a relation, record “Yes” in the template on the slide “Select the applicability of 10 universally accepted EA principles.” See example below:
    • Universal principle: Enterprise value focus – We aim to provide maximum long-term benefits to the enterprise as a whole while optimizing total costs of ownership and risks.
    • Related promise of value example: Increase the number of investments that have a direct tie with corporate strategy.
  3. Continue the process in step 2 until all ten universal EA principles have been examined. If there is a universal principle that is unrelated to a promise of value, discuss with the team whether the principle still needs to be included. If the principle is not included, record “No” in the template on the slide “Select the applicability of 10 universally accepted EA principles.”
  4. If there are any promises of value that are not captured by the universally accepted EA principles, the team may choose to create new principles. Create the new principles in the format below and record them in the template.
    • Name: The name of the principle, in a few words.
    • Statement: A sentence that expands on the “Name” section and explains what the principle achieves.

Download the EA Principles Template – EA Strategy to document this step.

Organizational stakeholders are more likely to follow EA principles when a rationale and an implication are provided

After defining the set of EA principles, ensure they are all expanded upon with a rationale and implications. The rationale and implications ensure principles are more likely to be followed because they communicate why the principles are important and how they are to be used.

Name
  • The name of the EA principle, in a few words.
Statement
  • A sentence that expands on the “Name” section and explains what the principle achieves.
Rationale
  • Describes the business benefits and reasoning for establishing the principle.
  • Explicitly links the principle to business/IT vision, mission, priorities, goals, or strategic aspirations (strategic themes).
Implications
  • Describe when and how the principle is to be applied.
  • Communicate this section with “must” sentences.
  • Refer to domain-specific policies that provide detailed, domain-specific direction on how to apply the principle.

3.2.5 Add the rationale and implications to the principles that have been created

2 hours

Input: Identified set of EA principles

Output: EA principles that have rationale and implications

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Add the rationale and implication of each EA principle that your organization has selected using the following steps:

  1. Gather the EA strategy creation team and open the EA Principles Template – EA Strategy.
  2. Examine the EA Principles Template – EA Strategy. Look for the detailed descriptions of all the applicable EA universal principles, and discuss with the team whether the pre-populated rationale and implications need to be changed.
  3. Make sure all the rationale and implication sections of the applicable universal EA principles have been examined. Record the changes on the slide devoted to each principle in the template.
  4. Examine any new principles created outside of the universal EA principles. Create the rationale and implication sections for each of those principles. Use the slide “Review the rationale and implications for the applicable universal principles” in the EA Principles Template – EA Strategy to assist with this step.

Download the EA Principles Template – EA Strategy to document this step.

3.2.6 Operationalize the EA principles to ensure they are used when decisions are being made

1-2 hours

Input: Defined set of EA principles

Output: EA principles are successfully operationalized

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin to operationalize the EA principles by reviewing the proposed principles with business and technology leadership to secure their approval.

  1. Publish the list of principles, their rationale, and their implications.
  2. Include the principles in any existing policies that guide decision making for the use of technology within the business.
  3. Provide existing governance bodies with the authority to enforce adherence to principles, and communicate the waiver process.
  4. Ensure that project-level teams are aware of the principles and have at least one champion guiding the decisions of the team.

Review a use case for the utilization of EA principles – Sample

After operationalizing the EA principles for your organization, the organization can now use those principles to guide and inform its IT investment decisions. Below is an example of a scenario where EA principles were used to guide and inform an IT investment decision.

Organization wants to provision an application but it needs to decide how to do so, and it considers the relevant EA principles:

  • Reuse › buy › build
  • Managed security
  • Innovation

The organization has decided to go with a specialized vendor, even though it normally prefers to reuse existing components. The vendor has experience in this domain, understands the data security implications, and can help the organization mitigate risk. Lastly, the vendor is known for providing new solutions on a regular basis and is a market leader, making it more likely to provide the organization with innovative solutions.

An oil and gas company created EA fundamentals to guide the EA function

CASE STUDY

Industry: Oil & Gas
Source: Info-Tech

Challenge

As an enterprise architecture function starting from ground zero, the organization did not have the EA fundamentals in place to guide the EA function. Further, the organization also did not possess an EA function scope to define the boundaries of the EA function.

Due to the lack of EA scope, the EA function did not know which part of the organization to provide contributions toward. A lack of EA fundamentals caused confusion regarding the future direction of the EA function.

Solution

Info-Tech worked with the EA team to define the different components of the EA fundamentals. This included EA vision and mission statements, EA goals and objectives, and EA principles.

Additionally, Info-Tech worked with the EA team to define the EA function scope.

These EA strategy components were created by examining the needs of the business. The components were aligned with the identified needs of the EA stakeholders.

Results

The defined EA function scope helped set out the responsibilities of the enterprise architecture function to the organization.

The EA vision and mission statements and EA goals and objectives were used to guide the direction of the EA function. These fundamentals helped the EA function improve its maturity and deliver on its promises.

The EA principles were used in IT review boards to guide the decisions on IT investments in the organization.

3.2.7 Discuss the need for a classical methodology and/or a combination including Agility practices

1 hour

Input: Existing methodologies

Output: Decisions about need of agility, ceremonies, and protocols to be used

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Add the rationale and implication of adopting an Agile methodology and/or a combination with a traditional methodology.

  1. Is there an EA methodology adopted by the organization? Is there a classical one, or is it purely Agile?
  2. What would need to happen to address the business goals of the organization (e.g. is there a need to be more agile?)? Do you need to have more decisions centralized (e.g. to adopt certain standards, security controls)?
  3. Where on the decentralization continuum does your organization need to be?
  4. What role would Enterprise Architects have (would they need to be part of existing ceremonies? Would they need to blend traditional and agile processes?)?
  5. If a customized methodology is required, identify this as an item to be included as part of the EA roadmap (can be run as a Agile Enterprise Operating Model workshop).

Design an Enterprise Architecture Strategy

Phase 4

Design the EA Services

Phase 1

  • 1.1 Explore a general EA strategy approach
  • 1.2 Introduce Agile EA architecture

Phase 2

  • 2.1 Define the business and technology drivers
  • 2.2 Define your value proposition

Phase 3

  • 3.1 Realize the importance of EA fundamentals
  • 3.2 Finalize the EA fundamentals

Phase 4

  • 4.1 Select relevant EA services
  • 4.2 Finalize the set of services and secure approval

This phase will walk you through the following activities:

  • Select relevant EA services
  • Finalize the set of services and secure approval

This phase involves the following participants:

  • CIO
  • EA Team
  • IT Leaders
  • Business Leaders

Step 4.1

Select Relevant EA Services

Activities
  • 4.1.1 Select the EA services relevant to your organization
  • 4.1.2 Identify if your organization needs additional services outside of the recommended list
  • 4.1.3 Complete all of the service catalog fields for each service to show the organization how each can be consumed

This step will walk you through the following activities:

  • Communicate a definition of EA services.
  • Link services to the previously identified EA contributions.

This step involves the following participants:

  • CIO
  • EA Team
  • IT Leaders
  • Business Leaders

Outcomes of this step

  • A defined set of services the EA function will provide.
  • An EA service catalog that demonstrates to the organization how each provided service can be accessed and consumed.

Design the EA Services

Step 3.1 Step 3.2

The definition of EA services will allow the group to communicate how they can add value to EA stakeholders

Enterprise architecture services are a set of activities the enterprise architecture function provides for the organization. EA services are important because the services themselves provide a set of benefits for the organization.

Enterprise Architecture Services

  • A means of delivering value to the business by facilitating outcomes service consumers want to achieve.
  • EA services are defined from the business perspective using business language.
  • EA services are designed to enable required business activities.

Viewing the EA function from a service perspective resolves the following pains:

  • Business users don’t know how EA can assist them.
  • Business users don’t know how to request access to a service with multiple sources of information available.
  • EA has no way of managing expectations for their users, which tend to inflate.
  • EA does not have a holistic view of all the services they need to provide.

Link EA services to the previously identified EA contributions

Previously identified EA contributions can be linked to EA services, which helps the EA function identify a set of EA services that are important to business stakeholders. Further, linking the EA contributions to EA services can define for the EA function the services they need to provide.

Demonstrate EA service value by linking them to EA contributions

  1. EA stakeholders generate drivers
  2. Drivers have pains that obstruct them
  3. Pains are alleviated by EA contributions
  4. EA contributions help define the EA services needed

    • EA Contributions
      Example EA contribution: Business capability mapping shows the business capabilities of the organization and the technology that supports those capabilities in the current and target state. This provides a view for the set of investments that are needed by the organization, which can then be prioritized.

      • EA Services
        Example EA service: Target-state business capability mapping

4.1.1 Select the EA services relevant to your organization

2 hours

Input: Previously identified EA contributions from the EA value proposition

Output: A set of EA services selected for the organization from Info-Tech’s defined set of EA services

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Begin the selection of EA services relevant to your organization by following the steps below:

  1. Gather the EA strategy creation team, and the list of identified EA contributions that the team formulated during Phase 2.
  2. Open the EA Service Planning Tool, select one sub-service, and read its definition.
  3. Based on the definition of the sub-service, refer back to the identified list of EA contributions and check if there is an identified EA contribution that matches the service.
    • If the EA service definitions matches one of the identified EA contributions, then that EA service is relevant to the organization. If there is no match, then the EA service may not be relevant to the organization.
  4. Highlight the sub-service if it is relevant. Add a checkmark beside the EA contribution if it is addressed by a sub-service.
  5. Select the next sub-service and repeat steps 2-4. Continue down the list of sub-services in the EA Service Planning Tool until all sub-services have been examined.

Download the EA Service Planning Tool to assist with this activity.

4.1.2 Identify if your organization needs additional services outside of the recommended list

2 hours

Input: Expertise from the EA strategy creation team, Previously defined EA contributions

Output: A defined set of EA services outside the list Info-Tech has recommended

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Identify if services outside of the recommended list in the EA Service Planning Tool are relevant to your organization by using the steps below:

  1. Gather the EA strategy creation team and the list of EA contributions with checkmarks for contributions addressed by EA services.
  2. Take the list of unaddressed EA contributions and select one EA contribution in the list. Assess whether an EA service is required to address the EA contribution. Ask the group the following:
    • Can the EA practice provide the service now?
    • Does providing this EA service line up with the previously defined EA function scope and EA fundamentals?
  3. Decide if a service needs to be provided for that contribution. If yes, give the service a name and a definition.
  4. Then, decide if the service fits into one of the service categories in the EA Service Planning Tool. If there is no fit, create another service category. Define the new service category as well.
  5. Continue to the next unaddressed EA contribution and repeat steps 2-4. Repeat this process until all unaddressed EA contributions have been assessed.

Download the EA Service Planning Tool to assist with this activity.

Create the EA service catalog to demonstrate to the organization how each service can be accessed and used

The EA service catalog is an important communicator to the business. It shifts the technology-oriented view of EA to services that show direct benefit to the business. It is a tool that communicates and provides clarity to the business about the EA services that are available and how those services can assist them.

Define the services to show value Define the service catalog to show how to use those services
Already defined
  • EA service categories
  • The services needed by the EA stakeholders in each EA service category
Need to define
  • Should EA deliver this service?
  • Service triggers
  • Service provider
  • Service requestor

Info-Tech Insight

The EA group must provide the organization with a list of services it will provide to demonstrate value. This will help the team manage expectations and the workload while giving organizational stakeholders a clear understanding of how to engage EA and what lies outside of EA’s involvement.

4.1.3 Complete all the service catalog fields for each service to show the organization how each can be consumed

4 hours

Input: Expertise from the EA strategy creation team

Output: Service details for each EA service in your organization

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Complete the details for each relevant EA service in the EA Service Planning Tool by using the following steps:

  1. Gather the EA strategy creation team, and open the EA Service Planning Tool.
  2. Select one of the services you have defined as relevant and begin the process of defining the service. Define the following fields:
    • Should EA deliver this service? Should the EA team provide this service? (Yes/No)
    • Service trigger: What trigger will signal the need for the service?
    • Service provider: Who in the EA team will provide the service?
    • Service requestor: Who outside of the EA team has requested this service?
  3. Have the EA strategy creation team discuss and define each of the fields for the service above. Record the decisions in the corresponding columns of the EA Service Planning Tool.
  4. Select the next required EA service, and repeat steps 2 and 3. Repeat the process until all required EA services have their details defined.

Download the EA Service Planning Tool to assist with this activity.

Step 4.2

Finalize the Set of Services and Secure Approval

Activities
  • 4.2.1 Secure approval for your organization’s EA strategy
  • 4.2.2 Map the EA contributions to business goals
  • 4.2.3 Quantify the EA effectiveness
  • 4.2.4 Determine the role of the architect in the Agile ceremonies of the organization

This step will walk you through the following activities:

  • Present the EA strategy to stakeholders.
  • Determine service details for each EA service in your organization.

This step involves the following participants:

  • CIO
  • EA Team
  • IT Leaders
  • Business Leaders

Outcomes of this step

  • Secured approval for your organization’s EA strategy.
  • Measure effectiveness of EA contributions.

Design the EA Services

Step 4.1 Step 4.2

Present the EA strategy to stakeholders to secure approval of the finalized EA strategy

For the EA strategy to be successfully executed, it must be approved by the EA stakeholders. Securing their approval will increase the likelihood of success in the execution of the EA operating model.

Outputs that make up the EA strategy —› Present outputs to EA strategy stakeholders
  • Business and technology drivers
  • EA function value proposition

  • EA vision statement
  • EA mission statement
  • EA goals and objectives
  • EA scope
  • EA principles

  • EA function services
  • Identified and prioritized EA stakeholders.








  • The checkmark symbol represents the outputs this blueprint assists with creating.

4.2.1 Secure approval of your organization’s EA strategy

1 hour

Input: Completed EA Function Strategy Template, Expertise from EA strategy creation team

Output: Approval of the EA strategy

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team, Key EA stakeholders

Use the following steps to assist with securing approval for your organization’s EA strategy:

  1. Call a meeting between the EA strategy creation team and the identified key EA stakeholders. Key stakeholders were defined in activity 2.1.1.
  2. Open the completed EA Function Strategy Template. Use it to help you discuss the merits of the EA strategy with the key stakeholders.
  3. Discuss with the stakeholders any concerns and modifications they wish to make to the strategy. If detailed questions are asked, refer to the other templates created as a part of this blueprint. Record those concerns and address them at a later time.
  4. After presenting the EA strategy, ask the stakeholders for approval. If stakeholders do not approve, refer back to the concerns documented in step 3 and inquire if addressing the concerns will result in approval.
  5. If applicable, address stakeholder concerns with the EA strategy.
  6. Once EA strategy has been approved, publish the EA strategy to ensure there is a mutual understanding of what the EA function will provide to the organization. Move on to Info-Tech’s Define an EA Operating Model blueprint to begin executing upon the EA strategy.

Use the EA Function Strategy Template to assist with this activity.

4.2.2 Map the EA contributions to the business goals

3 hours

Input: Expertise from EA strategy creation team

Output: Service details for each EA service in your organization

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Map EA contributions/services to the goals of the organization.

  1. Start from the business goals of the organization.
  2. Determine Business and IT drivers.
  3. Identify EA contributions that help achieve the business goals.

Download the EA Service Planning Tool to assist with this activity.

Trace EA drivers to business goals (sample)

A model connecting 'Enterprise Architecture' with 'Corporate Goals' through 'EA Contributions'.

4.2.3 Quantify the EA effectiveness

1 hour

Input: Expertise from EA strategy creation team

Output: Defined KPIs (SMART)

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Use SMART key performance indicators (KPIs) to measure EA contributions vis-à-vis business goals.

Measure the EA strategy effectiveness by tracking the benefits it provides to the corporate business goals

The success of the EA function spans across three main dimensions:

  • The delivery of EA-enabled business outcomes that are most important to the enterprise.
  • The alignment between the business and IT from a planning perspective.
  • Improvements in the corporate business goals due to EA contributions (standardization, rationalization, reuse, etc.).
Corporate Business GoalsEA ContributionsMeasurements
  • Reduction in operating costs
  • Decrease in regulatory compliance infractions
  • Increased revenue from existing channels
  • Increased revenue from new channels
  • Faster time to business value
  • Improved business agility
  • Reduction in enterprise risk exposure
  • Alignment of IT investments to business strategy
  • Achievement of business results directly linked to IT involvement
  • Application and platform rationalization
  • Standards in place
  • Flexible architecture
  • Better integration
  • Higher organizational satisfaction with technology-enabled services and solutions
  • Cost reductions based on application and platform rationalization
  • Standard based solutions
  • Time reduction for integration
  • Service reused
  • Stakeholder satisfaction with EA services
  • Increase customer satisfaction
  • Rework minimized
  • Lower cost of integration
  • Risk reduction
  • Faster time to market
  • Better scalability, etc.

The oil and gas company began the EA strategy creation by crafting an EA value proposition

CASE STUDY

Industry: Oil & Gas
Source: Info-Tech

Challenge

The oil and gas corporation faced a great challenge in communicating the role of enterprise architecture to the organization. Although it has the mandate from the CIO to create the EA function, there was no function in existence. Thus, few people in the organization understood EA.

Because of this lack of understanding, the EA function was often undermined. The EA function was seen as an order taker that provided some services to the organization.

Solution

First, Info-Tech worked with the enterprise architecture team to define the EA stakeholders in the organization.

Second, Info-Tech interviewed those stakeholders to identify their needs. The needs were analyzed and pains that would obstruct addressing those needs were identified.

Lastly, Info-Tech worked with the team to identify common EA contributions that would solve those pains.

Results

Through this process, Info-Tech helped the team at the oil and gas company create a document that could communicate the value of EA. Specifically, the document could articulate the issues obstructing each stakeholder from achieving their needs and how enterprise architecture could solve them.

With this value proposition, EA was able to demonstrate value to important stakeholders and set itself up for success in its future endeavors.

The oil and gas company defined EA services to provide and communicate value to the organization

CASE STUDY

Industry: Oil & Gas
Source: Info-Tech

Challenge

As a brand new enterprise architecture function, the EA function at the oil and gas corporation did not have a set of defined EA services. Because of this lack of EA services, the organization did not know what contributions EA could provide.

Further, without the definition of EA services, the EA function did not set out explicit expectations to the business. This caused expectations from the business to be different from those of the EA function, resulting in friction.

Solution

Info-Tech worked with the EA function at the oil and gas corporation to define a set of EA services the function could provide.

The Info-Tech team, along with the organization, assessed the business and technology needs of the stakeholder. Those needs acted as the basis for the EA function to create their initial services.

Additionally, Info-Tech worked with the team to define the service details (e.g. service benefits, service requestor, service provider) to communicate how to provide services to the business.

Results

The defined EA services led the EA function to communicate what it could provide for the business. As well, the defined services clarified the level of expectation for the business.

The EA team was able to successfully service the business on future projects, adding value through their expertise and knowledge of the organization’s systems. Because of the demonstrated value, EA has been given greater responsibility throughout the organization.

4.2.4 Determine the role of the architect in the Agile ceremonies of the organization

1 hour

Input: Expertise from EA strategy creation team

Output: Participation in Agile Pre- and Post-PI, Architect Syncs, etc.

Materials: Note-taking materials, Whiteboard or flip chart, markers

Participants: EA strategy creation team

Document the involvement of the enterprise architect in your organization’s Agile ceremonies.

  1. Document the Agile ceremonial used in the organization (based on SAFe or other Agile approaches).
  2. Determine ceremonies the System Architect will participate in.
  3. Determine ceremonies the Solution Architect will participate in
  4. Determine ceremonies the Enterprise Architect will participate in.
  5. Determine Architect Syncs, etc.

Note: Roles and responsibilities can be further defined as part of the Agile Enterprise Operating Model.

The EA role relative to agility

The enterprise architecture role relative to agility specifies the architecture roles as well as the agile protocols they will participate in.
This statement will guide every architect’s participation in planning meetings, pre- and post-PI, syncs, etc. Use simple and concise terminology; speak loudly and clearly.

A strong EA role statement relative to agility has the following characteristics:

  • Describes what different architect roles do to achieve the vision of the organization
  • In an agile way
  • Compelling
  • Easy to grasp
  • Sharply focused
  • Specific
  • Concise

Sample EA mission relative to agility

  • Create strategies that provide guardrails for the organization, provide standards, reusable assets, accelerators, and other decisions at the enterprise level that support agility.
  • Participate in pre-PI and post-PI planning activities, architect syncs, etc.

A clear statement can include additional details surrounding the Enterprise Architect role relative to agility

Likewise, below is a sample of connecting keywords together to form an enterprise architect role statement, relative to agility.

Optimize, transform, and innovate by defining and implementing the [Company]’s target enterprise architecture in an agile way.

Optimize – We collaborate with the business to analyze and optimize business capabilities and business processes to enable the agile and efficient attainment of [Company name] business objectives.

Transform – We support IT-enabled business transformation programs by building and maintaining a shared vision of the future-state enterprise and consistently communicating it to stakeholders.

Innovate – We identify and develop new and creative opportunities for IT to enable the business. We communicate the art of the possible to the business.

Defining and implementing – We engage with project teams early and guide solution design and selection to ensure alignment to the target-state enterprise architecture and provide guidance as well as accelerators.

Target enterprise structure in an agile way – We analyze business needs and priorities and assess the current state of the enterprise. We build and maintain the target enterprise architecture blueprints that define:

  • Business capabilities and processes (business architecture)
  • Data, application, and technology assets that enable business capabilities and processes (technology architecture)
  • Architecture principles
  • Standards and reusable assets
  • Continuous exploration, integration, and deployment

Move to the enterprise architecture operating model blueprint to execute your EA strategy

Once approved, move on to Info-Tech’s Define an EA Operating Model blueprint to begin executing on the EA strategy.

Enterprise architecture strategy

This blueprint focuses on setting up an enterprise architecture function, with the goal of maximizing the likelihood of EA success. The blueprint puts into place the components that will align the EA function with the needs of the stakeholders, guide the decision making of the EA function, and define the services EA can provide to the organization.

Agile enterprise architecture operating model

An EA operating model helps you design and organize the EA function, ensuring adherence to architectural standards and delivery of EA services. This blueprint acts on the EA strategy by creating methods to engage, govern, and develop architecture as a part of the larger organization.

Research contributors and experts

Photo of Milena Litoiu, Senior Director Research and Advisory, Enterprise Architecture Milena Litoiu
Senior Director Research and Advisory, Enterprise Architecture
  • Milena Litoiu is a Principal/Senior Manager of Enterprise Architecture. She is Master Certified with The Open Group and she sits on global architecture certification boards.
  • Other certifications include SABSA, CRISC, and Scaled Agile Framework. She started as a certified IT Architect at IBM and has over 25 years experience in this field.
  • Milena teaches enterprise architecture at the University of Toronto and led the development of the Enterprise Architecture Certificate (a course on EA fundamentals, one on EA development and Governance, and one on Trends going forward).
  • She has a Masters in Engineering, an executive MBA, and extensive experience in enterprise architecture as well as methodologies and tools.
Photo of Lan Nguyen, IT Executive, Mentor, Managing Partner at CIOs Beyond Borders Group Lan Nguyen
IT Executive, Mentor, Managing Partner at CIOs Beyond Borders Group
  • Lan Nguyen has a wealth of experience driving the EA strategy and the digital transformation success at the City of Toronto.
  • Lan is a university lecturer on topics like strategic leadership in the digital enterprise.
  • Lan is a Managing Partner at CIOs Beyond Borders Group.
  • Lan specializes in Partnership Development; Governance; Strategic Planning, Business Development; Government Relations; Business Relationship Management; Leadership Development; Organizational Agility and Change Management; Talent Management; Managed Services; Digital Transformation; Strategic Management of Enterprise IT; Shared Services; Service Quality Improvement, Portfolio Management; Community Development; and Social Enterprise.


Photo of Dirk Coetsee, Director Research and Advisory, Enterprise Architecture, Data & Analytics Dirk Coetsee
Director Research and Advisory, Enterprise Architecture, Data & Analytics
  • Dirk Coetsee is a Research & Advisory Director in the Data & Analytics practice. Dirk has over 25 years of experience in data management and architecture within a wide range of industries, especially Financial Services, Manufacturing, and Retail.
  • Dirk spearheaded data architecture at several organizations and was involved in enterprise data architecture, data governance, and data quality and analytics. He architected many operational data stores of ranging complexity and transaction volumes and was part of major enterprise data warehouse initiatives. Lately, he was part of projects that implemented big data, enterprise service bus, and micro services architectures. Dirk has an in-depth knowledge of industry models within the financial and retail spaces.
  • Dirk holds a BSc (Hons) in Operational Research and an MBA with specialization in Financial Services from the University of Pretoria, South Africa.
Photo of Andy Neill, AVP, Enterprise Architecture, Data and Analytics Andy Neill
AVP, Enterprise Architecture, Data and Analytics
  • Andy is AVP Data and Analytics and Chief Enterprise Architect at Info-Tech Research Group. Previous roles include leading the data architecture practice for Loblaw Companies Ltd, Shoppers Drug Mart and 360 Insights in Canada as well as leading architecture practices at Siemens consultancy, BBC, NHS, Ordnance Survey, and Houses of Parliament and Commons in the UK.
  • His responsibilities at Info-Tech include leading the data and analytics and enterprise architecture research practices and guiding the future of research and client engagement in that space.
  • Andy is the Product Owner for the Technical Counselor seat offering at Info-Tech, which gives world-class holistic support to our senior technical members.
  • He is also a instructor and content creator for the University of Toronto in the field of Enterprise Architecture.


Photo of Wayne Filin-Matthews, Chief Enterprise Architect, ICMG Winner of Global Chief Enterprise Architect of the Year 2019 Wayne Filin-Matthews
Chief Enterprise Architect, ICMG Winner of Global Chief Enterprise Architect of the Year 2019
  • Wayne is currently the EA Discipline Lead/Chief Enterprise Architect – Global Digital Transformation Office, COE at Dell Technologies.
  • He is a distinguished Motivator & Tech Lead as well as an influencer.
  • Wayne has led multiple Enterprise Architecture practices at the global level and has valuable contributions in this space managing and growing Enterprise Architecture and CTO practices across strategy, execution, and adoption parts of the IT lifecycle.
Photo of Graham Smith, Experienced lead Enterprise Architect and Independent Consultant Graham Smith
Experienced lead Enterprise Architect and Independent Consultant
  • Graham is an experienced lead enterprise architect specializing in digital and data transformation, with over 33 years of experience, spanning financial markets, media, information, insurance, and telecommunications sectors. Graham has successfully established and led large teams across India, China, Australia, Americas, Japan, and the UK.
  • He is currently working as an independent consultant in digital and data-led transformation and his work spans established businesses and start-ups alike.

Thanks also go to all experts who contributed to previous versions of this document:

  • Zachary Curry, Director, Enterprise Architecture and Innovation, FMC Technologies
  • Pam Doucette, Director of Enterprise Architecture, Tufts Health Plan
  • Joe Evers, Consulting Principal, JcEvers Consulting Corp
  • Cameron Fairbairn, Enterprise Architect, Agriculture Financial Services Corporation (AFSC)
  • Michael Fulton, Chief Digital Officer & Senior IT Strategy & Architecture Consultant at CC and C Solutions
  • Tom Graves, Principal Consultant, Tetradian Consulting
  • (JB) Brahmaiah Jarugumilli, Consultant, Federal Aviation Administration – Enterprise Services Center
  • Huw Morgan, IT Research Executive, Enterprise Architect
  • Serge Parisien, Manager, Enterprise Architecture, Canada Mortgage & Housing Corporation

Additional interviews were conducted but are not listed due to privacy and confidentiality requirements.

Bibliography

“Agile Manifesto for Software Development,” Ward Cunningham, 2001. Accessed July 2021.

“ArchiMate 3.1 Specification.” The Open Group, n.d. Accessed July 2021.

“Are Your IT Strategy and Business Strategy Aligned?” 5Q Partners, 8 Jan. 2015. Accessed Oct. 2016.

Bowen, Fillmore. “How agile companies create and sustain high ROI.” IBM. Accessed Oct. 2016.

Burns, Peter, et al. Building Value through Enterprise Architecture: A Global Study. Booz & Co. 2009. Web. Nov. 2016.

“Demonstrating the Value of Enterprise Architecture in Delivering Business Capabilities.” Cisco, 2008. Web. Oct. 2016.

“Disciplined Agile.” Disciplined Agile Consortium, n.d. Web.

Fowler, Martin. “Building Effective software.” MartinFowler.com. Accessed July 2021.

Fowler, Martin. “Agile Software Guide.” MartinFowler.com, 1 Aug. 2019.

Accessed July 2021.

Haughey, Duncan. “SMART Goals.” Project Smart, 2014. Accessed July 2021.

Kern, Matthew. “20 Enterprise Architecture Practices.” LinkedIn, 3 March 2016. Accessed Nov. 2016.

Lahanas, Stephen. “Infrastructure Architecture, Defined.” IT Architecture Journal, Sept. 2014. Accessed July 2021.

Lean IX website, Accessed July 2021.

Litoiu, Milena. Course material from Information Technology 2690: Foundations of Enterprise Architecture, 2021, University of Toronto.

Mocker, M., J.W. Ross, and C.M. Beath. “How Companies Use Digital Technologies to Enhance Customer Findings.” MIT CISR Working Paper No. 434, Feb. 2019. Qtd in Mayor, Tracy. “MIT expert recaps 30-plus years of enterprise architecture.” MIT Sloan, 10 Aug. 2020. Web.

“Open Agile ArchitectureTM.” The Open Group, 2020. Accessed July 2021.

“Organizational Design Framework – The Transformation Model.” The Center for Organizational Design, n.d. Accessed 1 Aug. 2020.

Ross, Jeanne W. et al. Enterprise Architecture as Strategy: Creating a Foundation for Business Execution. Harvard Business School Press, 2006.

Rouse, Margaret. “Enterprise Architecture (EA).” SearchCIO, June 2007. Accessed Nov. 2016.

“SAFe 5 for Lean Enterprises.” Scaled Agile Framework, Scaled Agile, Inc. Accessed 2021.

“Security Architecture.” Technopedia, updated 20 Dec. 2016. Accessed July 2021.

“Software Engineering Institute.” Carnegie Mellon University, n.d. Web.

“TOGAF 9.1.” The Open Group, 2011. Accessed Oct. 2016.

“TOGAF 9.2.” The Open Group, 2018. Accessed July 2021.

Thompson, Rachel. “Stakeholder Analysis: Winning Support for Your Projects.” MindTools, n.d. Accessed July 2021.

Wendt, Jerome M. “Redefining ‘SMB’, ‘SME’ and ‘Large Enterprise.’” DCIG, 25 Mar. 2011. Accessed July 2021.

Wilkinson, Jim. “Business Drivers.” The Strategic CFO, 23 July 2013. Accessed July 2021.

Zachman, John. “Conceptual, Logical, Physical: It is Simple.” Zachman International, 2011. Accessed July 2021.

Create a Game Plan to Implement Cloud Backup the Right Way

  • Buy Link or Shortcode: {j2store}469|cart{/j2store}
  • member rating overall impact: 7.0/10 Overall Impact
  • member rating average dollars saved: $2,000 Average $ Saved
  • member rating average days saved: 5 Average Days Saved
  • Parent Category Name: Storage & Backup Optimization
  • Parent Category Link: /storage-and-backup-optimization
  • Cloud adoption is frequently driven by hype rather than careful consideration of the best-fit solution.
  • IT is frequently rushed into cloud adoption without appropriate planning.
  • Organizations frequently lack appropriate strategies to deal with cloud-specific backup challenges.
  • Insufficient planning for cloud backup can exacerbate problems rather than solving them, leading to poor estimates of the cost and effort involved, budget overruns, and failure to meet requirements.

Our Advice

Critical Insight

  • The cloud isn’t a magic bullet, but it tends to deliver the most value to organizations with specific use cases – frequently smaller organizations who are looking to avoid the cost of building or upgrading a data center.
  • Cloud backup does not necessarily reduce backup costs so much as it moves them around. Cloud backup distributes costs over a longer term. Organizations need to compare the difference in CAPEX and OPEX to determine if making the move makes financial sense.
  • The cloud can deliver a great deal of value for organizations who are looking to reduce the operational effort demanded by an existing tape library for second- or third-tier backups.
  • Data security risks in some cases may be overstated, depending on what on-premises security is available. However, targeting backup to the cloud introduces other risks that need to be considered before implementation is given the green light.

Impact and Result

  • Understand if cloud backup is the right solution for actual organizational needs.
  • Make an informed decision about targeting backup to the cloud by considering the big picture TCO and effort level involved in adoption.
  • Have a ready strategy to mitigate the most common challenges with cloud adoption projects.
  • Develop a roadmap that lays out the required step-by-step to implement cloud backup.

Create a Game Plan to Implement Cloud Backup the Right Way Research & Tools

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Understand the benefits and risks of targeting backups to the cloud

Build a plan to mitigate the risks associated with backing data up in the cloud.

  • Storyboard: Create a Game Plan to Implement Cloud Backup the Right Way

2. Determine if the cloud can meet the organization's data requirements

Assess if the cloud is a good fit for your organization’s backup data.

  • Cloud Backup Implementation Game Plan Tool

3. Mitigate the Challenges of Backing Up to the Cloud

Build a cloud challenge contingency plan.

4. Build a Cloud Backup Implementation Roadmap

Perform a gap analysis to determine cloud backup implementation initiatives.

Infographic

Workshop: Create a Game Plan to Implement Cloud Backup the Right Way

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Evaluate the business case for targeting backup at the cloud

The Purpose

Understand how cloud backup will affect backup and recovery processes

Determine backup and recovery objectives

Assess the value proposition of cloud backup

Key Benefits Achieved

A high-level understanding of the benefits of moving to cloud backup

A best-fit analysis of cloud backup in comparison to organizational needs

Activities

1.1 Document stakeholder goals for cloud backup

1.2 Document present backup processes

1.3 Document ideal backup processes

1.4 Review typical benefits of cloud backup

Outputs

Documented stakeholder goals

Current backup process diagrams

Ideal backup process diagram

2 Identify candidate data sets and assess opportunities and readiness

The Purpose

Identify candidate data sets for cloud-based backup

Determine RPOs and RTOs for candidate data sets

Identify potential value specific to each data set for targeting backup at the cloud

Evaluate organizational readiness for targeting backup at the cloud

Key Benefits Achieved

Documented recovery objectives

Recommendations for cloud backup based on actual organizational needs and readiness

Activities

2.1 Document candidate data sets

2.2 Determine recovery point and recovery time objectives for candidate data sets

2.3 Identify potential value of cloud-based backup for candidate data sets

2.4 Discuss the risk and value of cloud-based backup versus an on-premises solution

2.5 Evaluate organizational readiness for cloud backup

2.6 Identify data sets to move to the cloud

Outputs

Validated list of candidate data sets

Specific RPOs and RTOs for core data sets

An assessment of the value of cloud backup for data sets

A tool-based recommendation for moving backups to the cloud

3 Mitigate the challenges of backing up to the cloud

The Purpose

Understand different cloud provider models and their specific risks

Identification of how cloud backup will affect IT infrastructure and personnel

Strategize ways to mitigate the most common challenges of implementing cloud backup

Understand the client/vendor relationship in cloud backup

Understand the affect of cloud backup on data security

Key Benefits Achieved

Verified best-fit cloud provider model for organizational needs

Verified strategy for meeting the most common challenges for cloud-based backup

A strong understanding of how cloud backup will change IT

Strategies for approaching vendors to ensure a strong footing in negotiations and clear expectations for the client/vendor relationship

Activities

3.1 Discuss the impact of cloud backup on infrastructure and IT environment

3.2 Create a cloud backup risk contingency plan

3.3 Document compliance and security regulations

3.4 Identify client and vendor responsibilities for cloud backup

3.5 Discuss and document the impact of cloud backup on IT roles and responsibilities

3.6 Compile a list of implementation intiatives

3.7 Evaluate the financial case for cloud backup

Outputs

Cloud risk assessment

Documented contingency strategies for probabe risks

Negotiation strategies for dealing with vendors

A committed go/no-go decision on the value of cloud backup weighted against the effort of implementation

4 Build a cloud backup implementation roadmap

The Purpose

Create a road map for implementing cloud backup

Key Benefits Achieved

Determine any remaining gaps between the present state and the ideal state for cloud backup

Understand the steps and time frame for implementing cloud backup

Allocate roles and responsibilities for the implementation intitiative

A validated implementation road map

Activities

4.1 Perform a gap analysis to generate a list of implementation intiatives

4.2 Prioritize cloud backup initiatives

4.3 Assess risks and dependencies for critical implementation initiatives

4.4 Assign ownership over implementation tasks

4.5 Determine road map time frame and structure

4.6 Populate the roadmap with cloud backup initiatives

Outputs

A validated gap analysis

A prioritized list of cloud backup initiatives

Documented dependencies and risks associated with implementation tasks

A roadmap for targeting backups at the cloud

Effectively Recognize IT Employees

  • Buy Link or Shortcode: {j2store}547|cart{/j2store}
  • member rating overall impact: 8.0/10 Overall Impact
  • member rating average dollars saved: $100 Average $ Saved
  • member rating average days saved: 5 Average Days Saved
  • Parent Category Name: Engage
  • Parent Category Link: /engage
  • Even when organizations do have recognition programs, employees want more recognition than they currently receive.
  • In a recent study, McLean & Company found that 69% of IT employees surveyed felt they were not adequately praised and rewarded for superior work.
  • In a lot of cases, the issue with recognition programs isn’t that IT departments haven’t thought about the importance but rather that they haven’t focused on proper execution.

Our Advice

Critical Insight

  • You’re busy – don’t make your recognition program more complicated than it needs to be. Focus on day-to-day ideas and actively embed recognition into your IT team’s culture.
  • Recognition is impactful independent of rewards (i.e. items with a monetary value), but rewarding employees without proper recognition can be counterproductive. Put recognition first and use rewards as a way to amplify its effectiveness.

Impact and Result

  • Info-Tech tools and guidance will help you develop a successful and sustainable recognition program aligned to strategic goals and values.
  • By focusing on three key elements – customization, alignment, and transparency – you can improve your recognition culture within four weeks, increasing employee engagement and productivity, improving relationships, and reducing turnover.

Effectively Recognize IT Employees Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should implement an IT employee recognition program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

  • Effectively Recognize IT Employees – Executive Brief
  • Effectively Recognize IT Employees – Phases 1-3

1. Assess the current recognition landscape

Understand the current perceptions around recognition practices in the organization and determine the behaviors that your program will seek to recognize.

  • Effectively Recognize IT Employees – Phase 1: Assess the Current Recognition Landscape
  • IT Employee Recognition Survey Questions

2. Design the recognition program

Determine the structure and processes to enable effective recognition in your IT organization.

  • Effectively Recognize IT Employees – Phase 2: Design the Recognition Program
  • Employee Recognition Program Guide
  • Employee Recognition Ideas Catalog
  • Employee Recognition Nomination Form

3. Implement the recognition program

Rapidly build and roll out a recognition action and sustainment plan, including training managers to reinforce behavior with recognition.

  • Effectively Recognize IT Employees – Phase 3: Implement the Recognition Program
  • Recognition Action and Communication Plan
  • Manager Training: Reinforce Behavior With Recognition
[infographic]

Rationalize Your Collaboration Tools

  • Buy Link or Shortcode: {j2store}51|cart{/j2store}
  • member rating overall impact: 7.3/10 Overall Impact
  • member rating average dollars saved: 10 Average Days Saved
  • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
  • Parent Category Name: End-User Computing Applications
  • Parent Category Link: /end-user-computing-applications
  • Organizations collaboration toolsets are increasingly disordered and overburdened. Not only do organizations waste money by purchasing tools that overlap with their current toolset, but also employees’ productivity is destroyed by having to spend time switching between multiple tools.
  • Shadow IT is easier than ever. Without suitable onboarding and agreed-upon practices, employees will seek out their own solutions for collaboration. No transparency of what tools are being used means that information shared through shadow IT cannot be coordinated, monitored, or regulated effectively.

Our Advice

Critical Insight

  • Best-of-breed approaches create more confusion than productivity. Collaboration toolsets should be as streamlined as possible.
  • Employee-led initiatives to implement new toolsets are more successful. Focus on what is a suitable fit for employees’ needs.
  • Strategizing toolsets enhances security. File transfers and communication through unmonitored, unapproved tools increases phishing and hacking risks.

Impact and Result

  • Categorize your current collaboration toolset, identifying genuine overlaps and gaps in your collaboration capabilities.
  • Work through our best-practice recommendations to decide which redundant overlapping tools should be phased out.
  • Build business requirements to fill toolset gaps and create an adoption plan for onboarding new tools.
  • Create a collaboration strategy that documents collaboration capabilities, rationalizes them, and states which capability to use when.

Rationalize Your Collaboration Tools Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out how to create a collaboration strategy that will improve employee efficiency and save the organization time and money.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Evaluate current toolset

Identify and categorize current collaboration toolset usage to recognize unnecessary overlaps and legitimate gaps.

  • Rationalize Your Collaboration Tools – Phase 1: Evaluate Current Toolset
  • Identifying and Categorizing Shadow Collaboration Tools Survey
  • Overlaps and Gaps in Current Collaboration Toolset Template

2. Strategize toolset overlaps

Evaluate overlaps to determine which redundant tools should be phased out and explore best practices for how to do so.

  • Rationalize Your Collaboration Tools – Phase 2: Strategize Toolset Overlaps
  • Phase-Out Plan Gantt Chart Template
  • Phase-Out Plan Marketing Materials

3. Fill toolset gaps

Fill your collaboration toolset gaps with best-fit tools, build business requirements for those tools, and create an adoption plan for onboarding.

  • Rationalize Your Collaboration Tools – Phase 3: Fill Toolset Gaps
  • Adoption Plan Gantt Chart Template
  • Adoption Plan Marketing Materials
  • Collaboration Tools Business Requirements Document Template
  • Collaboration Platform Evaluation Tool
[infographic]

Workshop: Rationalize Your Collaboration Tools

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Categorize the Toolset

The Purpose

Create a collaboration vision.

Acknowledge the current state of the collaboration toolset.

Key Benefits Achieved

A clear framework to structure the collaboration strategy

Activities

1.1 Set the vision for the Collaboration Strategy.

1.2 Identify your collaboration tools with use cases.

1.3 Learn what collaboration tools are used and why, including shadow IT.

1.4 Begin categorizing the toolset.

Outputs

Beginnings of the Collaboration Strategy

At least five archetypical use cases, detailing the collaboration capabilities required for these cases

Use cases updated with shadow IT currently used within the organization

Overlaps and Gaps in Current Capabilities Toolset Template

2 Strategize Overlaps

The Purpose

Identify redundant overlapping tools and develop a phase-out plan.

Key Benefits Achieved

Communication and phase-out plans for redundant tools, streamlining the collaboration toolset.

Activities

2.1 Identify legitimate overlaps and gaps.

2.2 Explore business and user strategies for identifying redundant tools.

2.3 Create a Gantt chart and communication plan and outline post-phase-out strategies.

Outputs

Overlaps and Gaps in Current Capabilities Toolset Template

A shortlist of redundant overlapping tools to be phased out

Phase-out plan

3 Build Business Requirements

The Purpose

Gather business requirements for finding best-fit tools to fill toolset gaps.

Key Benefits Achieved

A business requirements document

Activities

3.1 Use SoftwareReviews and the Collaboration Platform Evaluation Tool to shortlist best-fit collaboration tool.

3.2 Build SMART objectives and goals cascade.

3.3 Walk through the Collaboration Tools Business Requirements Document Template.

Outputs

A shortlist of collaboration tools

A list of SMART goals and a goals cascade

Completed Business Requirements Document

4 Create an Adoption Plan

The Purpose

Create an adoption plan for successfully onboarding new collaboration tools.

Key Benefits Achieved

An adoption plan

Activities

4.1 Fill out the Adoption Plan Gantt Chart Template.

4.2 Create the communication plan.

4.3 Explore best practices to socialize the new tools.

Outputs

Completed Gantt chart

Adoption plan marketing materials

Long-term strategy for engaging employees with onboarded tools

Combine Security Risk Management Components Into One Program

  • Buy Link or Shortcode: {j2store}376|cart{/j2store}
  • member rating overall impact: 9.1/10 Overall Impact
  • member rating average dollars saved: $37,798 Average $ Saved
  • member rating average days saved: 32 Average Days Saved
  • Parent Category Name: Governance, Risk & Compliance
  • Parent Category Link: /governance-risk-compliance
  • Companies are aware of the need to discuss and assess risk, but many struggle to do so in a systematic and repeatable way.
  • Rarely are security risks analyzed in a consistent manner, let alone in a systematic and repeatable method to determine project risk as well as overall organizational risk exposure.

Our Advice

Critical Insight

  • The best security programs are built upon defensible risk management. With an appropriate risk management program in place, you can ensure that security decisions are made strategically instead of based on frameworks and gut feelings. This will optimize any security planning and budgeting.
  • All risks can be quantified. Security, compliance, legal, or other risks can be quantified using our methodology.

Impact and Result

  • Develop a security risk management program to create a standardized methodology for assessing and managing the risk that information systems face.
  • Build a risk governance structure that makes it clear how security risks can be escalated within the organization and who makes the final decision on certain risks.
  • Use Info-Tech’s risk assessment methodology to quantifiably evaluate the threat severity for any new or existing project or initiative.
  • Tie together all aspects of your risk management program, including your information security risk tolerance level, threat and risk assessments, and mitigation effectiveness models.

Combine Security Risk Management Components Into One Program Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should develop and implement a security risk management program, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Establish the risk environment

Lay down the foundations for security risk management, including roles and responsibilities and a defined risk tolerance level.

  • Combine Security Risk Management Components Into One Program – Phase 1: Establish the Risk Environment
  • Security Risk Governance Responsibilities and RACI Template
  • Risk Tolerance Determination Tool
  • Risk Weighting Determination Tool

2. Conduct threat and risk assessments

Define frequency and impact rankings then assess the risk of your project.

  • Combine Security Risk Management Components Into One Program – Phase 2: Conduct Threat and Risk Assessments
  • Threat and Risk Assessment Process Template
  • Threat and Risk Assessment Tool

3. Build the security risk register

Catalog an inventory of individual risks to create an overall risk profile.

  • Combine Security Risk Management Components Into One Program – Phase 3: Build the Security Risk Register
  • Security Risk Register Tool

4. Communicate the risk management program

Communicate the risk-based conclusions and leverage these in security decision making.

  • Combine Security Risk Management Components Into One Program – Phase 4: Communicate the Risk Management Program
  • Security Risk Management Presentation Template
  • Security Risk Management Summary Template
[infographic]

Workshop: Combine Security Risk Management Components Into One Program

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Establish the Risk Environment

The Purpose

Build the foundation needed for a security risk management program.

Define roles and responsibilities of the risk executive.

Define an information security risk tolerance level.

Key Benefits Achieved

Clearly defined roles and responsibilities.

Defined risk tolerance level.

Activities

1.1 Define the security executive function RACI chart.

1.2 Assess business context for security risk management.

1.3 Standardize risk terminology assumptions.

1.4 Conduct preliminary evaluation of risk scenarios to determine your risk tolerance level.

1.5 Decide on a custom risk factor weighting.

1.6 Finalize the risk tolerance level.

1.7 Begin threat and risk assessment.

Outputs

Defined risk executive functions

Risk governance RACI chart

Defined quantified risk tolerance and risk factor weightings

2 Conduct Threat and Risk Assessments

The Purpose

Determine when and how to conduct threat and risk assessments (TRAs).

Complete one or two TRAs, as time permits during the workshop.

Key Benefits Achieved

Developed process for how to conduct threat and risk assessments.

Deep risk analysis for one or two IT projects/initiatives.

Activities

2.1 Determine when to initiate a risk assessment.

2.2 Review appropriate data classification scheme.

2.3 Identify system elements and perform data discovery.

2.4 Map data types to the elements.

2.5 Identify STRIDE threats and assess risk factors.

2.6 Determine risk actions taking place and assign countermeasures.

2.7 Calculate mitigated risk severity based on actions.

2.8 If necessary, revisit risk tolerance.

2.9 Document threat and risk assessment methodology.

Outputs

Define scope of system elements and data within assessment

Mapping of data to different system elements

Threat identification and associated risk severity

Defined risk actions to take place in threat and risk assessment process

3 Continue to Conduct Threat and Risk Assessments

The Purpose

Complete one or two TRAs, as time permits during the workshop.

Key Benefits Achieved

Deep risk analysis for one or two IT projects/initiatives, as time permits.

Activities

3.1 Continue threat and risk assessment activities.

3.2 As time permits, one to two threat and risk assessment activities will be performed as part of the workshop.

3.3 Review risk assessment results and compare to risk tolerance level.

Outputs

One to two threat and risk assessment activities performed

Validation of the risk tolerance level

4 Establish a Risk Register and Communicate Risk

The Purpose

Collect, analyze, and aggregate all individual risks into the security risk register.

Plan for the future of risk management.

Key Benefits Achieved

Established risk register to provide overview of the organizational aggregate risk profile.

Ability to communicate risk to other stakeholders as needed.

Activities

4.1 Begin building a risk register.

4.2 Identify individual risks and threats that exist in the organization.

4.3 Decide risk responses, depending on the risk level as it relates to the risk tolerance.

4.4 If necessary, revisit risk tolerance.

4.5 Identify which stakeholders sign off on each risk.

4.6 Plan for the future of risk management.

4.7 Determine how to present risk to senior management.

Outputs

Risk register, with an inventory of risks and a macro view of the organization’s risk

Defined risk-based initiatives to complete

Plan for securing and managing the risk register

Improve Security Governance With a Security Steering Committee

  • Buy Link or Shortcode: {j2store}373|cart{/j2store}
  • member rating overall impact: 9.5/10 Overall Impact
  • member rating average dollars saved: $10,000 Average $ Saved
  • member rating average days saved: 20 Average Days Saved
  • Parent Category Name: Governance, Risk & Compliance
  • Parent Category Link: /governance-risk-compliance
  • Security is still seen as an IT problem rather than a business risk, resulting in security governance being relegated to the existing IT steering committee.
  • Security is also often positioned in the organization where they are not privy to the details of the organization’s overall strategy. Security leaders struggle to get the full enterprise picture.

Our Advice

Critical Insight

  • Work to separate the Information Security Steering Committee (ISSC) from the IT Steering Committee (ITSC). Security transcends the boundaries of IT and needs an independent, eclectic approach to make strategic decisions.
  • Be the lawyer, not the cop. Ground your communications in business terminology to facilitate a solution that makes sense to the entire organization.
  • Develop and stick to the agenda. Continued engagement from business stakeholders requires sticking to a strategic level-focused agenda. Dilution of purpose will lead to dilution in attendance.

Impact and Result

  • Define a clear scope of purpose and responsibilities for the ISSC to gain buy-in and consensus for security governance receiving independent agenda time from the broader IT organization.
  • Model the information flows necessary to provide the steering committee with the intelligence to make strategic decisions for the enterprise.
  • Determine membership and responsibilities that shift with the evolving security landscape to ensure participation reflects interested parties and that money being spent on security mitigates risk across the enterprise.
  • Create clear presentation material and strategically oriented meeting agendas to drive continued participation from business stakeholders and executive management.

Improve Security Governance With a Security Steering Committee Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out how to improve your security governance with a security steering committee, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Define committee purpose and responsibilities

Identify the purpose of your committee, determine the capabilities of the committee, and define roles and responsibilities.

  • Improve Security Governance With a Security Steering Committee – Phase 1: Define Committee Purpose and Responsibilities
  • Information Security Steering Committee Charter

2. Determine information flows, membership & accountabilities

Determine how information will flow and the process behind that.

  • Improve Security Governance With a Security Steering Committee – Phase 2: Determine Information Flows, Membership & Accountabilities

3. Operate the Information Security Steering Committee

Define your meeting agendas and the procedures to support those meetings. Hold your kick-off meeting. Identify metrics to measure the committee’s success.

  • Improve Security Governance With a Security Steering Committee – Phase 3: Operate the Information Security Steering Committee
  • Security Metrics Summary Document
  • Information Security Steering Committee Stakeholder Presentation
[infographic]

Further reading

Improve Security Governance With a Security Steering Committee

Build an inclusive committee to enable holistic strategic decision making.

ANALYST PERSPECTIVE

"Having your security organization’s steering committee subsumed under the IT steering committee is an anachronistic framework for today’s security challenges. Conflicts in perspective and interest prevent holistic solutions from being reached while the two permanently share a center stage.

At the end of the day, security is about existential risks to the business, not just information technology risk. This focus requires its own set of business considerations, information requirements, and delegated authorities. Without an objective and independent security governance body, organizations are doomed to miss the enterprise-wide nature of their security problems."

– Daniel Black, Research Manager, Security Practice, Info-Tech Research Group

Our understanding of the problem

This Research Is Designed For:

  • CIOs
  • CISOs
  • IT/Security Leaders

This Research Will Help You:

  • Develop an effective information security steering committee (ISSC) that ensures the right people are involved in critical decision making.
  • Ensure that business and IT strategic direction are incorporated into security decisions.

This Research Will Also Assist:

  • Information Security Steering Committee (ISSC) members

This Research Will Help Them:

  • Formalize roles and responsibilities.
  • Define effective security metrics.
  • Develop a communication plan to engage executive management in the organization’s security planning.

Executive summary

Situation

  • Successful information security governance requires a venue to address security concerns with participation from across the entire business.
  • Without access to requisite details of the organization – where we are going, what we are trying to do, how the business expects to use its technology – security can not govern its strategic direction.

Complication

  • Security is still seen as an IT problem rather than a business risk, resulting in security governance being relegated to the existing IT steering committee.
  • Security is also often positioned in the organization where they are not privy to the details of the organization’s overall strategy. Security leaders struggle to get the full enterprise picture.

Resolution

  • Define a clear scope of purpose and responsibilities for the Information Security Steering Committee to gain buy-in and consensus for security governance receiving independent agenda time from the broader IT organization.
  • Model the information flows necessary to provide the steering committee with the intelligence to make strategic decisions for the enterprise.
  • Determine membership and responsibilities that shift with the evolving security landscape to ensure participation reflects interested parties and that money being spent on security mitigates risk across the enterprise.
  • Create security metrics that are aligned with committee members’ operational goals to incentivize participation.
  • Create clear presentation material and strategically oriented meeting agendas to drive continued participation from business stakeholders and executive management.

Info-Tech Insight

  1. Work to separate the ISSC from the IT Steering Committee (ITSC). Security transcends the boundaries of IT and needs an independent, eclectic approach to make strategic decisions.
  2. Be the lawyer, not the cop. Ground your communications in business terminology to facilitate a solution that make sense to the entire organization.
  3. Develop and stick to the agenda. Continued engagement from business stakeholders requires sticking to a strategic level-focused agenda. Dilution of purpose will lead to dilution in attendance.

Empower your security team to act strategically with an ISSC

Establishing an Information Security Steering Committee (ISSC)

Even though security is a vital consideration of any IT governance program, information security has increasingly become an important component of the business, moving beyond the boundaries of just the IT department.

This requires security to have its own form of steering, beyond the existing IT Steering Committee, that ensures continual alignment of the organization’s security strategy with both IT and business strategy.

An ISSC should have three primary objectives:

  • Direct Strategic Planning The ISSC formalizes organizational commitments to strategic planning, bringing visibility to key issues and facilitating the integration of security controls that align with IT and business strategy.
  • Institute Clear Accountability The ISSC facilitates the involvement and commitment of executive management through clearly defined roles and accountabilities for security decisions, ensuring consistency in participation as the organization’s strategies evolve.
  • Optimize Security Resourcing The ISSC maximizes security by monitoring the implementation of the security strategic plan, making recommendations on prioritization of effort, and securing necessary resources through the planning and budgeting processes, as necessary.

What does the typical ISSC do?

Ensuring proper governance over your security program is a complex task that requires ongoing care and feeding from executive management to succeed.

Your ISSC should aim to provide the following core governance functions for your security program:

  1. Define Clarity of Intent and Direction How does the organization’s security strategy support the attainment of the business and IT strategies? The ISSC should clearly define and communicate strategic linkage and provide direction for aligning security initiatives with desired outcomes.
  2. Establish Clear Lines of Authority Security programs contain many important elements that need to be coordinated. There needs to be clear and unambiguous authority, accountability, and responsibility defined for each element so lines of reporting/escalation are clear and conflicting objectives can be mediated.
  3. Provide Unbiased Oversight The ISSC should vet the organization’s systematic monitoring processes to make certain there is adherence to defined risk tolerance levels and ensure that monitoring is appropriately independent from the personnel responsible for implementing and managing the security program.
  4. Optimize Security Value Delivery Optimized value delivery occurs when strategic objectives for security are achieved and the organization’s acceptable risk posture is attained at the lowest possible cost. This requires constant attention to ensure controls are commensurate with any changes in risk level or appetite.

Formalize the most important governance functions for your organization

Creation of an ISSC is deemed the most important governance and oversight practice that a CISO can implement, based on polling of IT security leaders analyzing the evolving role of the CISO.

Relatedly, other key governance practices reported – status updates, upstream communications, and executive-level sponsorship – are within the scope of what organizations traditionally formalize when establishing their ISSC.

Vertical bar chart highlighting the most important governance functions according to respondents. The y axis is labelled 'Percentage of Respondents' with the values 0%-60%, and the x axis is labelled 'Governance and Oversight Practices'. Bars are organized from highest percentage to lowest with 'Creation of cross-functional committee to oversee security strategy' at 56%, 'Regularly scheduled reporting on the state of security to stakeholders' at 55%, 'Upstream communication channel from security leadership to CEO' at 46%, and 'Creation of program charter approved by executive-level sponsor' at 37%. Source: Ponemon Institute, 2017; N=184 organizations; 660 respondents.

Despite the clear benefits of an ISSC, organizations are still falling short

83% of organizations have not established formal steering committees to evaluate the business impact and risks associated with security decisions. (Source: 2017 State of Cybersecurity Metrics Report)

70% of organizations have delegated cybersecurity oversight to other existing committees, providing security limited agenda time. (Source: PwC 2017 Annual Corporate Director Survey)

"This is a group of risk managers an institution would bring together to deal with a response anyway. Having them in place to do preventive discussions and formulate policy to mitigate the liability sets and understand compliance obligations is just powerful." (Kirk Bailey, CISO, University of Washington)

Prevent the missteps that make 9 out of 10 steering committees unsuccessful

Why Do Steering Committees Fail?

  1. A lack of appetite for a steering committee from business partners. An effective ISSC requires participation from core members of the organization’s leadership team. The challenge is that most business partners don’t understand the benefits of an ISSC and the responsibilities aren’t tailored to participants’ needs or interests. It’s the CISO’s (or senior IT/security leader’s) responsibility to make this case to stakeholders and right-size the committee responsibilities and membership.
  2. ISSC committees are given inappropriate responsibilities. The steering committee is fundamentally about decision making; it’s not a working committee. Security leadership typically struggles with clarifying these responsibilities on two fronts: either the responsibilities are too vague and there is no clear way to execute on them within a meeting or responsibilities are too tactical and require knowledge that participants do not have. Responsibilities should determine who is on the ISSC, not the other way around.
  3. Lack of process around execution. An ISSC is only valuable if members are able to successfully execute on its mandate. Without well-defined processes it becomes nearly impossible for the ISSC to be actionable. As a result, participants lack the information they need to make critical decisions, agendas are unmet, and meetings are seen as a waste of time.

Use these icons to help direct you as you navigate this research

Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

A small monochrome icon of a wrench and screwdriver creating an X.

This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.

A small monochrome icon depicting a person in front of a blank slide.

This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

Guided Implementation

Workshop

Consulting

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks used throughout all four options

Improve Security Governance With a Security Steering Committee – project overview

1. Define Committee Purpose and Responsibilities

2. Determine Information Flows, Membership & Accountabilities

3. Operate the Information Security Steering Committee

Supporting Tool icon

Best-Practice Toolkit

1.1 Tailor Info-Tech’s Information Security Steering Committee Charter Template to define terms of reference for the ISSC

1.2 Conduct a SWOT analysis of your information security governance capabilities

1.3 Identify the responsibilities and duties of the ISSC

1.4 Draft the committee purpose statement of your ISSC

2.1 Define your SIPOC model for each of the ISSC responsibilities

2.2 Identify committee participants and responsibility cadence

2.3 Define ISSC participant RACI for each of the responsibilities

3.1 Define the ISSC meeting agendas and procedures

3.2 Define which metrics you will report to the ISSC

3.3 Hold a kick-off meeting with your ISSC members to explain the process, responsibilities, and goals

3.4 Tailor the Information Security Steering Committee Stakeholder Presentation template

3.5 Present the information to the security leadership team

3.6 Schedule your first meeting of the ISSC

Guided Implementations

  • Identify the responsibilities and duties of the ISSC.
  • Draft the committee purpose of the ISSC.
  • Determine SIPOC modeling of information flows.
  • Determine accountabilities and responsibilities.
  • Set operational standards.
  • Determine effectiveness metrics.
  • Steering committee best practices.
Associated Activity icon

Onsite Workshop

This blueprint can be combined with other content for onsite engagements, but is not a standalone workshop.
Phase 1 Outcome:
  • Determine the purpose and responsibilities of your information security steering committee.
Phase 2 Outcome:
  • Determine membership, accountabilities, and information flows to enable operational excellence.
Phase 3 Outcome:
  • Define agendas and standard procedures to operate your committee.
  • Design an impactful stakeholder presentation.

Improve Security Governance With a Security Steering Committee

PHASE 1

Define Committee Purpose and Responsibilities

Phase 1: Define Committee Purpose and Responsibilities

ACTIVITIES:

  • 1.1 Tailor Info-Tech’s Information Security Steering Committee Charter Template to define terms of reference for the ISSC
  • 1.2 Conduct a SWOT analysis of your information security governance capabilities
  • 1.3 Identify the responsibilities and duties of the ISSC
  • 1.4 Draft the committee purpose statement for your ISSC

OUTCOMES:

  • Conduct an analysis of your current information security governance capabilities and identify opportunities and weaknesses.
  • Define a clear scope of purpose and responsibilities for your ISSC.
  • Begin to customize your ISSC charter.

Info-Tech Insight

Balance vision with direction. Purpose and responsibilities should be defined so that they encompass your mission and objectives to the enterprise in clear terms, but provide enough detail that you can translate the charter into operational plans for the security team.

Tailor Info-Tech’s Information Security Steering Committee Charter Template to define terms of reference for the ISSC

Supporting Tool icon 1.1

A charter is the organizational mandate that outlines the purpose, scope, and authority of the ISSC. Without a charter, the steering committee’s value, scope, and success criteria are unclear to participants, resulting in unrealistic stakeholder expectations and poor organizational acceptance.

Start by reviewing Info-Tech’s template. Throughout the next two sections we will help you to tailor its contents.

  • Committee Purpose: The rationale, benefits of, and overall function of the committee.
  • Organization and Membership: Who is on the committee and how is participation measured against organizational need.
  • Responsibilities and Duties: What tasks/decisions the accountable committee is making.
  • RACI: Who is accountable, responsible, consulted, and informed regarding each responsibility.
  • Committee Procedures and Agendas: Includes how the committee will be organized and how the committee will interact and communicate with interested parties.
Sample of the Info-Tech deliverable 'Information Security Steering Committee Charter Template'.

Download the Information Security Steering Committee Charter to customize your organization’s charter

Conduct a SWOT analysis of your information security governance capabilities

Associated Activity icon 1.2

INPUT: Survey outcomes, Governance overview handouts

OUTPUT: SWOT analysis, Top identified challenges and opportunities

  1. Hold a meeting with your IT leadership team to conduct a SWOT analysis on your current information security governance capabilities.
  2. In small groups, or individually, have each group complete a SWOT analysis for one of the governance areas. For each consider:
    • Strengths: What is currently working well in this area?
    • Weaknesses: What could you improve? What are some of the challenges you’re experiencing?
    • Opportunities: What are some organizational trends that you can leverage? Consider whether your strengths or weaknesses could create opportunities.
    • Threats: What are some key obstacles across people, process, and technology?
  3. Have each team or individual rotate until each person has contributed to each SWOT. Add comments from the stakeholder survey to the SWOT.
  4. As a group, rank the inputs from each group and highlight the top five challenges and the top five opportunities you see for improvement.

Identify the responsibilities and duties of the ISSC

Associated Activity icon 1.3

INPUT: SWOT analysis, Survey reports

OUTPUT: Defined ISSC responsibilities

  1. With your security leadership team, review the typical responsibilities of the ISSC on the following slides (also included in the templated text of the charter linked below).
  2. Print off the following two slides, and in small teams or individually, identify which responsibilities the ISSC should have in your organization, brainstorm any additional responsibilities, and document reasoning.
  3. Have each team present to the larger group, track the similarities and differences between each of the groups, and come to consensus on the list of categories and responsibilities.
  4. Complete a sanity check: review your SWOT analysis. Do the responsibilities you’ve identified resolve the critical challenges or weaknesses?
  5. As a group, consider the responsibilities and whether you can reasonably implement those in one year or if there are any that will need to wait until year two of the committee.

Add or modify responsibilities in Info-Tech’s Information Security Steering Committee Charter.

Typical ISSC responsibilities and duties

Use the following list of responsibilities to customize the list of responsibilities your ISSC may take on. These should link directly to the Responsibilities and Duties section of your ISSC charter.

Strategic Oversight

  • Provide oversight and ensure alignment between information security strategy and company objectives.
  • Assess the adequacy of resources and funding to sustain and advance successful security programs and practices for identifying, assessing, and mitigating cybersecurity risks across all business functions.
  • Review controls to prevent, detect, and respond to cyber-attacks or information or data breaches involving company electronic information, intellectual property, data, or connected devices.
  • Review the company’s cyberinsurance policies to ensure appropriate coverage.
  • Provide recommendations, based on security best practices, for significant technology investments.

Policy Governance

  • Review company policies pertaining to information security and cyberthreats, taking into account the potential for external threats, internal threats, and threats arising from transactions with trusted third parties and vendors.
  • Review privacy and information security policies and standards and the ramifications of updates to policies and standards.
  • Establish standards and procedures for escalating significant security incidents to the ISSC, board, other steering committees, government agencies, and law enforcement, as appropriate.

Typical ISSC responsibilities and duties (continued)

Use the following list of responsibilities to customize the list of responsibilities your ISSC may take on. These should link directly to the Responsibilities and Duties section of your ISSC charter.

Risk Governance

  • Review and approve the company’s information risk governance structure and key risk management processes and capabilities.
  • Assess the company’s high-risk information assets and coordinate planning to address information privacy and security needs.
  • Provide input to executive management regarding the enterprise’s information risk appetite and tolerance.
  • Review the company’s cyber-response preparedness, incident response plans, and disaster recovery capabilities as applicable to the organization’s information security strategy.
  • Promote an open discussion regarding information risk and integrate information risk management into the enterprise’s objectives.

Monitoring & Reporting

  • Receive periodic reports and coordinate with management on the metrics used to measure, monitor, and manage cyber and IT risks posed to the company and to review periodic reports on selected risk topics as the Committee deems appropriate.
  • Review reports provided by the IT organization regarding the status of and plans for the security of the company’s data stored on internal resources and with third-party providers.
  • Monitor and evaluate the quality and effectiveness of the company’s technology security, capabilities for disaster recovery, data protection, cyberthreat detection and cyber incident response, and management of technology-related compliance risks.

Review the organization’s security strategy to solidify understanding of the ISSC’s purpose

The ISSC should consistently evolve to reflect the strategic purpose of the security program. If you completed Info-Tech’s Security Strategy methodology, review the results to inform the scope of your committee. If you have not completed Info-Tech’s methodology, determining these details should be achieved through iterative stakeholder consultations.

Strategy Components

ISSC Considerations

Security Pressure Analysis

Review the ten security domains and your organization’s pressure levels to review the requisite maturity level of your security program. Consider how this may impact the focus of your ISSC.

Security Drivers/Obligations

Review how your security program supports the attainment of the organization’s business objectives. By what means should the ISSC support these objectives? This should inform the rationale, benefits, and overall function of the committee.

Security Strategy Scope and Boundaries

Consider the scope and boundaries of your security program to reflect on what the program is responsible for securing. Is this reflected adequately in the language of the committee’s purpose? Should components be added or redacted?

Draft the committee purpose statement of your ISSC

Associated Activity icon 1.4

INPUT: SWOT Analysis, Security Strategy

OUTPUT: ISSC Committee Purpose

  1. In a meeting with your IT leadership team – and considering the organization’s security strategy, defined responsibilities, and opportunities and threats identified – review the example goal statement in the Information Security Steering Committee Charter, and identify whether any of these statements apply to your organization. Select the statements that apply and collaboratively make any changes needed.
  2. Define unique goal statements by considering the following questions:
    • What three things would you realistically list for the ISSC to achieve?
    • If you were to accomplish three things in the next year, what would those be?
  3. With those goal statements in mind, consider the overall purpose of the committee. The purpose statement should be a reflection of what the committee does, why, and the goals.
  4. Have each individual review the example purpose statement and draft what they think a good purpose statement would be.
  5. Present each statement, and work together to determine a best-of-breed statement.

Alter the Committee Purpose section in the Information Security Steering Committee Charter.

Audit the Project Portfolio

  • Buy Link or Shortcode: {j2store}442|cart{/j2store}
  • member rating overall impact: N/A
  • member rating average dollars saved: N/A
  • member rating average days saved: N/A
  • Parent Category Name: Portfolio Management
  • Parent Category Link: /portfolio-management
  • As a CIO you know you should audit your portfolio, but you don’t know where to start.
  • There is a lack of portfolio and project visibility.
  • Projects are out of scope, over budget, and over schedule.

Our Advice

Critical Insight

  • Organizations establish processes and assume people are following them.
  • There is a dilution of practices from external influences and rapid turnover rates.
  • Many organizations build their processes around existing frameworks. These frameworks are great resources but they’re often missing context and clear links to tools, templates, and fiduciary duty.

Impact and Result

  • The best way to get insight into your current state is to get an objective set of observations of your processes.
  • Use Info-Tech’s framework to audit your portfolios and projects:
    • Triage at a high level to assess the need for an audit by using the Audit Standard Triage Tool to assess your current state and the importance of conducting a deeper audit.
    • Complete Info-Tech’s Project Portfolio Audit Tool:
      • Validate the inputs.
      • Analyze the data.
      • Review the findings and create your action plan.

Audit the Project Portfolio Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should audit the project portfolio, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Assess readiness

Understand your current state and determine the need for a deeper audit.

  • Audit the Project Portfolio – Phase 1: Assess Readiness
  • Info-Tech Audit Standard for Project Portfolio Management
  • Audit Glossary of Terms
  • Audit Standard Triage Tool

2. Perform project portfolio audit

Audit your selected projects and portfolios. Understand the gaps in portfolio practices.

  • Audit the Project Portfolio – Phase 2: Perform Project Portfolio Audit
  • Project Portfolio Audit Tool

3. Establish a plan

Document the steps you are going to take to address any issues that were uncovered in phase 2.

  • Audit the Project Portfolio – Phase 3: Establish a Plan
  • PPM Audit Timeline Template
[infographic]

Workshop: Audit the Project Portfolio

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Portfolio Audit

The Purpose

An audit of your portfolio management practices.

Key Benefits Achieved

Analysis of audit results.

Activities

1.1 Info-Tech’s Audit Standard/Engagement Context

1.2 Portfolio Audit

1.3 Input Validation

1.4 Portfolio Audit Analysis

1.5 Start/Stop/Continue

Outputs

Audit Standard and Audit Glossary of Terms

Portfolio and Project Audit Tool

Start/Stop/Continue

2 Project Audit

The Purpose

An audit of your project management practices.

Key Benefits Achieved

Analysis of audit results.

Activities

2.1 Project Audit

2.2 Input Validation

2.3 Project Audit Analysis

2.4 Start/Stop/Continue

Outputs

Portfolio and Project Audit Tool

Start/Stop/Continue

3 Action Plan

The Purpose

Create a plan to start addressing any vulnerabilities.

Key Benefits Achieved

A plan to move forward.

Activities

3.1 Action Plan

3.2 Key Takeaways

Outputs

Audit Timeline Template

Redesign Your IT Organizational Structure

  • Buy Link or Shortcode: {j2store}275|cart{/j2store}
  • member rating overall impact: 9.2/10 Overall Impact
  • member rating average dollars saved: $71,830 Average $ Saved
  • member rating average days saved: 25 Average Days Saved
  • Parent Category Name: Organizational Design
  • Parent Category Link: /organizational-design

Most organizations go through an organizational redesign to:

  • Better align to the strategic objectives of the organization.
  • Increase the effectiveness of IT as a function.
  • Provide employees with clarity in their roles and responsibilities.
  • Support new capabilities.
  • Better align IT capabilities to suit the vision.
  • Ensure the IT organization can support transformation initiatives.

Our Advice

Critical Insight

  • Organizational redesign is only as successful as the process leaders engage in. It shapes a story framed in a strong foundation of need and a method to successfully implement and adopt the new structure.
  • Benchmarking your organizational redesign to other organizations will not work. Other organizations have different strategies, drivers, and context. It’s important to focus on your organization, not someone else's.
  • You could have the best IT employees in the world, but if they aren’t structured well your organization will still fail in reaching its vision.

Impact and Result

  • We are often unsuccessful in organizational redesign because we lack an understanding of why this initiative is required or fail to recognize that it is a change initiative.
  • Successful organizational design requires a clear understanding of why it is needed and what will be achieved by operating in a new structure.
  • Additionally, understanding the impact of the change initiative can lead to greater adoption by core stakeholders.

Redesign Your IT Organizational Structure Research & Tools

Besides the small introduction, subscribers and consulting clients within this management domain have access to:

1. Redesign Your IT Organizational Structure Deck – A defined method of redesigning your IT structure that is founded by clear drivers and consistently considering change management practices.

The purpose of this storyboard is to provide a four-phased approach to organizational redesign.

  • Redesign Your IT Organizational Structure – Phases 1-4

2. Communication Deck – A method to communicate the new organizational structure to critical stakeholders to gain buy-in and define the need.

Use this templated Communication Deck to ensure impacted stakeholders have a clear understanding of why the new organizational structure is needed and what that structure will look like.

  • Organizational Design Communications Deck

3. Redesign Your IT Organizational Structure Executive Summary Template – A template to secure executive leadership buy-in and financial support for the new organizational structure to be implemented.

This template provides IT leaders with an opportunity to present their case for a change in organizational structure and roles to secure the funding and buy-in required to operate in the new structure.

  • Redesign Your IT Organizational Structure Executive Summary

4. Redesign Your IT Organizational Structure Workbook – A method to document decisions made and rationale to support working through each phase of the process.

This Workbook allows IT and business leadership to work through the steps required to complete the organizational redesign process and document key rationale for those decisions.

  • Redesign Your IT Organizational Structure Workbook

5. Redesign Your IT Organizational Structure Operating Models and Capability Definitions – A tool that can be used to provide clarity on the different types of operating models that exist as well as the process definitions of each capability.

Refer to this tool when working through the redesign process to better understand the operating model sketches and the capability definitions. Each capability has been tied back to core frameworks that exist within the information and technology space.

  • Redesign Your IT Organizational Structure Operating Models and Capability Definitions

Infographic

Workshop: Redesign Your IT Organizational Structure

Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

1 Establish the Organizational Design Foundation

The Purpose

Lay the foundation for your organizational redesign by establishing a set of organizational design principles that will guide the redesign process.

Key Benefits Achieved

Clearly articulate why this organizational redesign is needed and the implications the strategies and context will have on your structure.

Activities

1.1 Define the org design drivers.

1.2 Document and define the implications of the business context.

1.3 Align the structure to support the strategy.

1.4 Establish guidelines to direct the organizational design process.

Outputs

Clear definition of the need to redesign the organizational structure

Understanding of the business context implications on the organizational structure creation.

Strategic impact of strategies on organizational design.

Customized Design Principles to rationalize and guide the organizational design process.

2 Create the Operating Model Sketch

The Purpose

Select and customize an operating model sketch that will accurately reflect the future state your organization is striving towards. Consider how capabilities will be sourced, gaps in delivery, and alignment.

Key Benefits Achieved

A customized operating model sketch that informs what capabilities will make up your IT organization and how those capabilities will align to deliver value to your organization.

Activities

2.1 Augmented list of IT capabilities.

2.2 Capability gap analysis

2.3 Identified capabilities for outsourcing.

2.4 Select a base operating model sketch.

2.5 Customize the IT operating model sketch.

Outputs

Customized list of IT processes that make up your organization.

Analysis of which capabilities require dedicated focus in order to meet goals.

Definition of why capabilities will be outsourced and the method of outsourcing used to deliver the most value.

Customized IT operating model reflecting sourcing, centralization, and intended delivery of value.

3 Formalize the Organizational Structure

The Purpose

Translate the operating model sketch into a formal structure with defined functional teams, roles, reporting structure, and responsibilities.

Key Benefits Achieved

A detailed organizational chart reflecting team structures, reporting structures, and role responsibilities.

Activities

3.1 Categorize your IT capabilities within your defined functional work units.

3.2 Create a mandate statement for each work unit.

3.3 Define roles inside the work units and assign accountability and responsibility.

3.4 Finalize your organizational structure.

Outputs

Capabilities Organized Into Functional Groups

Functional Work Unit Mandates

Organizational Chart

4 Plan for the Implementation & Change

The Purpose

Ensure the successful implementation of the new organizational structure by strategically communicating and involving stakeholders.

Key Benefits Achieved

A clear plan of action on how to transition to the new structure, communicate the new organizational structure, and measure the effectiveness of the new structure.

Activities

4.1 Identify and mitigate key org design risks.

4.2 Define the transition plan.

4.3 Create the change communication message.

4.4 Create a standard set of FAQs.

4.5 Align sustainment metrics back to core drivers.

Outputs

Risk Mitigation Plan

Change Communication Message

Standard FAQs

Implementation and sustainment metrics.

Further reading

Redesign Your IT Organizational Structure

Designing an IT structure that will enable your strategic vision is not about an org chart – it’s about how you work.

EXECUTIVE BRIEF

Analyst Perspective

Structure enables strategy.

The image contains a picture of Allison Straker.

Allison Straker

Research Director,

Organizational Transformation

The image contains a picture of Brittany Lutes.

Brittany Lutes

Senior Research Analyst,

Organizational Transformation

An organizational structure is much more than a chart with titles and names. It defines the way that the organization operates on a day-to-day basis to enable the successful delivery of the organization’s information and technology objectives. Moreover, organizational design sees beyond the people that might be performing a specific role. People and role titles will and often do change frequently. Those are the dynamic elements of organizational design that allow your organization to scale and meet specific objectives at defined points of time. Capabilities, on the other hand, are focused and related to specific IT processes.

Redesigning an IT organizational structure can be a small or large change transformation for your organization. Create a structure that is equally mindful of the opportunities and the constraints that might exist and ensure it will drive the organization towards its vision with a successful implementation. If everyone understands why the IT organization needs to be structured that way, they are more likely to support and adopt the behaviors required to operate in the new structure.

Executive Summary

Your Challenge

Your organization needs to reorganize itself because:

  • The current IT structure does not align to the strategic objectives of the organization.
  • There are inefficiencies in how the IT function is currently operating.
  • IT employees are unclear about their role and responsibilities, leading to inconsistencies.
  • New capabilities or a change in how the capabilities are organized is required to support the transformation.

Common Obstacles

Many organizations struggle when it comes redesigning their IT organizational structure because they:

  • Jump right into creating the new organizational chart.
  • Do not include the members of the IT leadership team in the changes.
  • Do not include the business in the changes.
  • Consider the context in which the change will take place and how to enable successful adoption.

Info-Tech’s Approach

Successful IT organization redesign includes:

  • Understanding the drivers, context, and strategies that will inform the structure.
  • Remaining objective by focusing on capabilities over people or roles.
  • Identifying gaps in delivery, sourcing strategies, customers, and degrees of centralization.
  • Remembering that organizational design is a change initiative and will require buy-in.

Info-Tech Insight

A successful redesign requires a strong foundation and a plan to ensure successful adoption. Without these, the organizational chart has little meaning or value.

Your challenge

This research is designed to help organizations who are looking to:

  • Redesign the IT structure to align to the strategic objectives of the enterprise.
  • Increase the effectiveness in how the IT function is operating in the organization.
  • Provide clarity to employees around their roles and responsibilities.
  • Ensure there is an ability to support new IT capabilities and/or align capabilities to better support the direction of the organization.
  • Align the IT organization to support a business transformation such as becoming digitally enabled or engaging in M&A activities.

Organizational design is a challenge for many IT and digital executives

69% of digital executives surveyed indicated challenges related to structure, team silos, business-IT alignment, and required roles when executing on a digital strategy.

Source: MIT Sloan, 2020

Common obstacles

These barriers make IT organizational redesign difficult to address for many organizations:

  • Confuse organizational design and organizational charts as the same thing.
  • Start with the organizational chart, not taking into consideration the foundational elements that will make that chart successful.
  • Fail to treat organizational redesign as a change management initiative and follow through with the change.
  • Exclude impacted or influential IT leaders and/or business stakeholders from the redesign process.
  • Leverage an operating model because it is trending.

To overcome these barriers:

  • Understand the context in which the changes will take place.
  • Communicate the changes to those impacted to enable successful adoption and implementation of a new organizational structure.
  • Understand that organizational design is for more than just HR leaders now; IT executives should be driving this change.

Succeed in Organizational Redesign

75% The percentage of change efforts that fail.

Source: TLNT, 2019

55% The percentage of practitioners who identify how information flows between work units as a challenge for their organization.

Source: Journal of Organizational Design, 2019

Organizational design defined

If your IT strategy is your map, your IT organizational design represents the optimal path to get there.

IT organizational design refers to the process of aligning the organization’s structure, processes, metrics, and talent to the organization’s strategic plan to drive efficiency and effectiveness.

Why is the right IT organizational design so critical to success?

Adaptability is at the core of staying competitive today

Structure is not just an organizational chart

Organizational design is a never-ending process

Digital technology and information transparency are driving organizations to reorganize around customer responsiveness. To remain relevant and competitive, your organizational design must be forward looking and ready to adapt to rapid pivots in technology or customer demand.

The design of your organization dictates how roles function. If not aligned to the strategic direction, the structure will act as a bungee cord and pull the organization back toward its old strategic direction (ResearchGate.net, 2014). Structure supports strategy, but strategy also follows structure.

Organization design is not a one-time project but a continuous, dynamic process of organizational self-learning and continuous improvement. Landing on the right operating model will provide a solid foundation to build upon as the organization adapts to new challenges and opportunities.

Understand the organizational differences

Organizational Design

Organizational design the process in which you intentionally align the organizational structure to the strategy. It considers the way in which the organization should operate and purposely aligns to the enterprise vision. This process often considers centralization, sourcing, span of control, specialization, authority, and how those all impact or are impacted by the strategic goals.

Operating Model

Operating models provide an architectural blueprint of how IT capabilities are organized to deliver value. The placement of the capabilities can alter the culture, delivery of the strategic vision, governance model, team focus, role responsibility, and more. Operating model sketches should be foundational to the organizational design process, providing consistency through org chart changes.

Organizational Structure

The organizational structure is the chosen way of aligning the core processes to deliver. This can be strategic, or it can be ad hoc. We recommend you take a strategic approach unless ad hoc aligns to your culture and delivery method. A good organizational structure will include: “someone with authority to make the decisions, a division of labor and a set of rules by which the organization operates” (Bizfluent, 2019).

Organizational Chart

The capstone of this change initiative is an easy-to-read chart that visualizes the roles and reporting structure. Most organizations use this to depict where individuals fit into the organization and if there are vacancies. While this should be informed by the structure it does not necessarily depict workflows that will take place. Moreover, this is the output of the organizational design process.

Sources: Bizfluent, 2019; Strategy & Business, 2015; SHRM, 2021

The Technology Value Trinity

The image contains a diagram of the Technology Value Trinity as described in the text below.

All three elements of the Technology Value Trinity work in harmony to delivery business value and achieve strategic needs. As one changes, the others need to change as well.

How do these three elements relate?

  • Digital and IT strategy tells you what you need to achieve to be successful.
  • Operating model and organizational design align resources to deliver on your strategy and priorities. This is done by strategically structuring IT capabilities in a way that enables the organizations vision and considers the context in which the structure will operate.
  • I&T governance is the confirmation of IT’s goals and strategy, which ensures the alignment of IT and business strategy and is the mechanism by which you continuously prioritize work to ensure that what is delivered is in line with the strategy.

Too often strategy, organizational design, and governance are considered separate practices – strategies are defined without teams and resources to support. Structure must follow strategy.

Info-Tech’s approach to organizational design

Like a story, a strategy without a structure to deliver on it is simply words on paper.

Books begin by setting the foundation of the story.

Introduce your story by:

  • Defining the need(s) that are driving this initiative forward.
  • Introducing the business context in which the organizational redesign must take place.
  • Outlining what’s needed in the redesign to support the organization in reaching its strategic IT goals.

The plot cannot thicken without the foundation. Your organizational structure and chart should not exist without one either.

The steps to establish your organizational chart - with functional teams, reporting structure, roles, and responsibilities defined – cannot occur without a clear definition of goals, need, and context. An organizational chart alone won’t provide the insight required to obtain buy-in or realize the necessary changes.

Conclude your story through change management and communication.

Good stories don’t end without referencing what happened before. Use the literary technique of foreshadowing – your change management must be embedded throughout the organizational redesign process. This will increase the likelihood that the organizational structure can be communicated, implemented, and reinforced by stakeholders.

Info-Tech uses a capability-based approach to help you design your organizational structure

Once your IT strategy is defined, it is critical to identify the capabilities that are required to deliver on those strategic initiatives. Each initiative will require a combination of these capabilities that are only supported through the appropriate organization of roles, skills, and team structures.

The image contains a diagram of the various services and blueprints that Info-Tech has to offer.

Embed change management into organizational design

Change management practices are needed from the onset to ensure the implementation of an organizational structure.

For each phase of this blueprint, its important to consider change management. These are the points when you need to communicate the structure changes:

  • Phase 1: Begin to socialize the idea of new organizational structure with executive leadership and explain how it might be impactful to the context of the organization. For example, a new control, governance model, or sourcing approach could be considered.
  • Phase 2: The chosen operating model will influence your relationships with the business and can create/eliminate silos. Ensure IT and business leaders have insight into these possible changes and a willingness to move forward.
  • Phase 3: The new organizational structure could create or eliminate teams, reduce or increase role responsibilities, and create different reporting structures than before. It’s time to communicate these changes with those most impacted and be able to highlight the positive outcomes of the various changes.
  • Phase 4: Should consider the change management practices holistically. This includes the type of change and length of time to reach the end state, communication, addressing active resistors, acquiring the right skills, and measuring the success of the new structure and its adoption.

Info-Tech Insight

Do not undertake an organizational redesign initiative if you will not engage in change management practices that are required to ensure its successful adoption.

Measure the value of the IT organizational redesign

Given that the organizational redesign is intended to align with the overall vision and objectives of the business, many of the metrics that support its success will be tied to the business. Adapt the key performance indicators (KPIs) that the business is using to track its success and demonstrate how IT can enable the business and improve its ability to reach those targets.

Strategic Resources

The percentage of resources dedicated to strategic priorities and initiatives supported by IT operating model. While operational resources are necessary, ensuring people are allocating time to strategic initiatives as well will drive the business towards its goal state. Leverage Info-Tech’s IT Staffing Assessment diagnostic to benchmark your IT resource allocation.

Business Satisfaction

Assess the improvement in business satisfaction overall with IT year over year to ensure the new structure continues to drive satisfaction across all business functions. Leverage Info-Tech’s CIO Business Vision diagnostic to see how your IT organization is perceived.

Role Clarity

The degree of clarity that IT employees have around their role and its core responsibilities can lead to employee engagement and retention. Consider measuring this core job driver by leveraging Info-Tech’s Employee Engagement Program.

Customer & User Satisfaction

Measure customer satisfaction with technology-enabled business services or products and improvements in technology-enabled client acquisition or retention processes. Assess the percentage of users satisfied with the quality of IT service delivery and leverage Info-Tech’s End-User Satisfaction Survey to determine improvements.

Info-Tech’s methodology for Redesigning Your IT Organization

Phase

1. Establish the Organizational Design Foundation

2. Create the Operating Model Sketch

3. Formalize the Organizational Structure

4. Plan for Implementation and Change

Phase Outcomes

Lay the foundation for your organizational redesign by establishing a set of organizational design principles that will guide the redesign process.

Select and customize an operating model sketch that will accurately reflect the future state your organization is striving towards. Consider how capabilities will be sourced, gaps in delivery, and alignment.

Translate the operating model sketch into a formal structure with defined functional teams, roles, reporting structure, and responsibilities.

Ensure the successful implementation of the new organizational structure by strategically communicating and involving stakeholders.

Insight summary

Overarching insight

Organizational redesign processes focus on defining the ways in which you want to operate and deliver on your strategy – something an organizational chart will never be able to convey.

Phase 1 insight

Focus on your organization, not someone else's’. Benchmarking your organizational redesign to other organizations will not work. Other organizations have different strategies, drivers, and context.

Phase 2 insight

An operating model sketch that is customized to your organization’s specific situation and objectives will significantly increase the chances of creating a purposeful organizational structure.

Phase 3 insight

If you follow the steps outlined in the first three phases, creating your new organizational chart should be one of the fastest activities.

Phase 4 insight

Throughout the creation of a new organizational design structure, it is critical to involve the individuals and teams that will be impacted.

Tactical insight

You could have the best IT employees in the world, but if they aren’t structured well your organization will still fail in reaching its vision.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:


Communication Deck

Communicate the changes to other key stakeholders such as peers, managers, and staff.

Workbook

As you work through each of the activities, use this workbook as a place to document decisions and rationale.

Reference Deck

Definitions for every capability, base operating model sketches, and sample organizational charts aligned to those operating models.

Job Descriptions

Key deliverable:

Executive Presentation

Leverage this presentation deck to gain executive buy-in for your new organizational structure.

Blueprint benefits

IT Benefits

  • Create an organizational structure that aligns to the strategic goals of IT and the business.
  • Provide IT employees with clarity on their roles and responsibilities to ensure the successful delivery of IT capabilities.
  • Highlight and sufficiently staff IT capabilities that are critical to the organization.
  • Define a sourcing strategy for IT capabilities.
  • Increase employee morale and empowerment.

Business Benefits

  • IT can carry out the organization’s strategic mission and vision of all technical and digital initiatives.
  • Business has clarity on who and where to direct concerns or questions.
  • Reduce the likelihood of turnover costs as IT employees understand their roles and its importance.
  • Create a method to communicate how the organizational structure aligns with the strategic initiatives of IT.
  • Increase ability to innovate the organization.

Executive Brief Case Study

IT design needs to support organizational and business objectives, not just IT needs.

INDUSTRY: Government

SOURCE: Analyst Interviews and Working Sessions

Situation

IT was tasked with providing equality to the different business functions through the delivery of shared IT services. The government created a new IT organizational structure with a focus on two areas in particular: strategic and operational support capabilities.

Challenge

When creating the new IT structure, an understanding of the complex and differing needs of the business functions was not reflected in the shared services model.

Outcome

As a result, the new organizational structure for IT did not ensure adequate meeting of business needs. Only the operational support structure was successfully adopted by the organization as it aligned to the individual business objectives. The strategic capabilities aspect was not aligned to how the various business lines viewed themselves and their objectives, causing some partners to feel neglected.

Info-Tech offers various levels of support to best suit your needs.

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization. A typical GI is 8 to 12 calls over the course of 4 to 6 months.

Phase 1

Call #1: Define the process, understand the need, and create a plan of action.

Phase 2

Call #2: Define org. design drivers and business context.

Call #3: Understand strategic influences and create customized design principles.

Call #4: Customize, analyze gaps, and define sourcing strategy for IT capabilities.

Call #5: Select and customize the IT operating model sketch.

Phase 3

Call #6: Establish functional work units and their mandates.

Call #7: Translate the functional organizational chart to an operational organizational chart with defined roles.

Phase 4

Call #8: Consider risks and mitigation tactics associated with the new structure and select a transition plan.

Call #9: Create your change message, FAQs, and metrics to support the implementation plan.

Workshop Overview

Contact your account representative for more information.

workshops@infotech.com 1-888-670-8889

Day 1

Day 2

Day 3

Day 4

Day 5

Establish the Organizational Redesign Foundation

Create the Operating Model Sketch

Formalize the Organizational Structure

Plan for Implementation and Change

Next Steps and
Wrap-Up (offsite)

Activities

1.1 Define the org. design drivers.

1.2 Document and define the implications of the business context.

1.3 Align the structure to support the strategy.

1.4 Establish guidelines to direct the organizational design process.

2.1 Augment list of IT capabilities.

2.2 Analyze capability gaps.

2.3 Identify capabilities for outsourcing.

2.4 Select a base operating model sketch.

2.5 Customize the IT operating model sketch.

3.1 Categorize your IT capabilities within your defined functional work units.

3.2 Create a mandate statement for each work unit.

3.3 Define roles inside the work units and assign accountability and responsibility.

3.4 Finalize your organizational structure.

4.1 Identify and mitigate key org. design risks.

4.2 Define the transition plan.

4.3 Create the change communication message.

4.4 Create a standard set of FAQs.

4.5 Align sustainment metrics back to core drivers.

5.1 Complete in-progress deliverables from previous four days.

5.2 Set up review time for workshop deliverables and to discuss next steps.

Deliverables

  1. Foundational components to the organizational design
  2. Customized design principles
  1. Heat mapped IT capabilities
  2. Defined outsourcing strategy
  3. Customized operating model
  1. Capabilities organized into functional groups
  2. Functional work unit mandates
  3. Organizational chart
  1. Risk mitigation plan
  2. Change communication message
  3. Standard FAQs
  4. Implementation and sustainment metrics
  1. Completed organizational design communications deck

This blueprint is part one of a three-phase approach to organizational transformation

PART 1: DESIGN

PART 2: STRUCTURE

PART 3: IMPLEMENT

IT Organizational Architecture

Organizational Sketch

Organizational Structure

Organizational Chart

Transition Strategy

Implement Structure

1. Define the organizational design drivers, business context, and strategic alignment.

2. Create customized design principles.

3. Develop and customize a strategically aligned operating model sketch.

4. Define the future-state work units.

5. Create future-state work unit mandates.

6. Define roles by work unit.

7. Turn roles into jobs with clear capability accountabilities and responsibilities.

8. Define reporting relationships between jobs.

9. Assess options and select go-forward organizational sketch.

11. Validate organizational sketch.

12. Analyze workforce utilization.

13. Define competency framework.

14. Identify competencies required for jobs.

15. Determine number of positions per job

16. Conduct competency assessment.

17. Assign staff to jobs.

18. Build a workforce and staffing plan.

19. Form an OD implementation team.

20. Develop change vision.

21. Build communication presentation.

22. Identify and plan change projects.

23. Develop organizational transition plan.

24. Train managers to lead through change.

25. Define and implement stakeholder engagement plan.

26. Develop individual transition plans.

27. Implement transition plans.

Risk Management: Create, implement, and monitor risk management plan.

HR Management: Develop job descriptions, conduct job evaluation, and develop compensation packages.

Monitor and Sustain Stakeholder Engagement

Phase 1

Establish the Organizational Redesign Foundation

This phase will walk you through the following activities:

1.1 Define the organizational redesign driver(s)

1.2 Create design principles based on the business context

1.3a (Optional Exercise) Identify the capabilities from your value stream

1.3b Identify the capabilities required to deliver on your strategies

1.4 Finalize your list of design principles

This phase involves the following participants:

  • CIO
  • IT Leadership
  • Business Leadership

Embed change management into the organizational design process

Articulate the Why

Changes are most successful when leaders clearly articulate the reason for the change – the rationale for the organizational redesign of the IT function. Providing both staff and executive leaders with an understanding for this change is imperative to its success. Despite the potential benefits to a redesign, they can be disruptive. If you are unable to answer the reason why, a redesign might not be the right initiative for your organization.

Employees who understand the rationale behind decisions made by executive leaders are 3.6 times more likely to be engaged.

McLean & Company Engagement Survey Database, 2021; N=123,188

Info-Tech Insight

Successful adoption of the new organizational design requires change management from the beginning. Start considering how you will convey the need for organizational change within your IT organization.

The foundation of your organizational design brings together drivers, context, and strategic implications

All aspects of your IT organization’s structure should be designed with the business’ context and strategic direction in mind.

Use the following set of slides to extract the key components of your drivers, business context, and strategic direction to land on a future structure that aligns with the larger strategic direction.

REDESIGN DRIVERS

Driver(s) can originate from within the IT organization or externally. Ensuring the driver(s) are easy to understand and articulate will increase the successful adoption of the new organizational structure.

BUSINESS CONTEXT

Defines the interactions that occur throughout the organization and between the organization and external stakeholders. The context provides insight into the environment by both defining the purpose of the organization and the values that frame how it operates.

STRATEGY IMPLICATIONS

The IT strategy should be aligned to the overall business strategy, providing insight into the types of capabilities required to deliver on key IT initiatives.

Understand IT’s desired maturity level, alignment with business expectations, and capabilities of IT

Where are we today?

Determine the current overall maturity level of the IT organization.

Where do we want to be as an organization?

Use the inputs from Info-Tech’s diagnostic data to determine where the organization should be after its reorganization.

How can you leverage these results?

The result of these diagnostics will inform the design principles that you’ll create in this phase.

Leverage Info-Tech’s diagnostics to provide an understanding of critical areas your redesign can support:

CIO Business Vision Diagnostic

Management & Governance Diagnostic

IT Staffing Diagnostic

The image contains a picture of Info-Tech's maturity ladder.

Consider the organizational design drivers

Consider organizational redesign if …

Effectiveness is a concern:

  • Insufficient resources to meet demand
  • Misalignment to IT (and business) strategies
  • Lack of clarity around role responsibility or accountability
  • IT functions operating in silos

New capabilities are needed:

  • Organization is taking on new capabilities (digital, transformation, M&A)
  • Limited innovation
  • Gaps in the capabilities/services of IT
  • Other external environmental influences or changes in strategic direction

Lack of business understanding

  • Misalignment between business and IT or how the organization does business
  • Unhappy customers (internal or external)

Workforce challenges

  • Frequent turnover or inability to attract new skills
  • Low morale or employee empowerment

These are not good enough reasons …

  • New IT leader looking to make a change for the sake of change or looking to make their legacy known
  • To work with specific/hand-picked leaders over others
  • To “shake things up” to see what happens
  • To force the organization to see IT differently

Info-Tech Insight

Avoid change for change’s sake. Restructuring could completely miss the root cause of the problem and merely create a series of new ones.

1.1 Define the organizational redesign driver(s)

1-2 hours

  1. As a group, brainstorm a list of current pain points or inhibitors in the current organizational structure, along with a set of opportunities that can be realized during your restructuring. Group these pain points and opportunities into themes.
  2. Leverage the pain points and opportunities to help further define why this initiative is something you’re driving towards. Consider how you would justify this initiative to different stakeholders in the organization.
  3. Questions to consider:
    1. Who is asking for this initiative?
    2. What are the primary benefits this is intended to produce?
    3. What are you optimizing for?
    4. What are we capable of achieving as an IT organization?
    5. Are the drivers coming from inside or outside the IT organization?
  4. Once you’ve determined the drivers for redesigning the IT organization, prioritize those drivers to ensure there is clarity when communicating why this is something you are focusing time and effort on.

Input

Output

  • Knowledge of the current organization
  • Pain point and opportunity themes
  • Defined drivers of the initiative

Materials

Participants
  • Whiteboard/flip charts (physical or electronic)
  • CIO
  • IT Leadership
  • Business Leadership

Record the results in the Organizational Design Communications Deck

Frame the organizational design within the context of the business

Workforce Considerations:

  • How does your organization view its people resources? Does it have the capacity to increase the number of resources?
  • Do you currently have sufficient staff to meet the demands of the organization? Are you able to outsource resources when demand requires it?
  • Are the members of your IT organization unionized?
  • Is your workforce distributed? Do time zones impact how your team can collaborate?

Business Context Consideration

IT Org. Design Implication

Culture:

Culture, "the way we do things here,” has huge implications for executing strategy, driving engagement, and providing a guiding force that ensures organizations can work together toward common goals.

  • What is the culture of your organization? Is it cooperative, traditional, competitive, or innovative? (See appendix for details.)
  • Is this the target culture or a stepping-stone to the ideal culture?
  • How do the attitudes and behaviors of senior leaders in the organization reinforce this culture?

Consider whether your organization’s culture can accept the operating model and organizational structure changes that make sense on paper.

Certain cultures may lean toward particular operating models. For example, the demand-develop-service operating model may be supported by a cooperative culture. A traditional organization may lean towards the plan-build-run operating model.

Ensure you have considered your current culture and added exercises to support it.

If more capacity is required to accomplish the goals of the organization, you’ll want to prepare the leaders and explain the need in your design principles (to reflect training, upskilling, or outsourcing). Unionized environments require additional consideration. They may necessitate less structural changes, and so your principles will need to reflect other alternatives (hiring additional resources, creative options) to support organizational needs. Hybrid or fully remote workforces may impact how your organization interacts.

Business context considerations

Business Context Consideration

IT Org. Design Implication

Control & Governance:

It is important to consider how your organization is governed, how decisions are made, and who has authority to make decisions.

Strategy tells what you do, governance validates you’re doing the right things, and structure is how you execute on what’s been approved.

  • How do decisions get considered and approved in your organization? Are there specific influences that impact the priorities of the organization?
  • Are those in the organization willing to release decision-making authority around specific IT components?
  • Should the organization take on greater accountability for specific IT components?

Organizations that require more controls may lean toward more centralized governance. Organizations that are looking to better enable and empower their divisions (products, groups, regions, etc.) may look to embed governance in these parts of the organization.

For enterprise organizations, consider where IT has authority to make decisions (at the global, local, or system level). Appropriate governance needs to be built into the appropriate levels.

Business context considerations

Business Context Consideration

IT Org. Design Implication

Financial Constraints:

Follow the money: You may need to align your IT organization according to the funding model.

  • Do partners come to IT with their budgets, or does IT have a central pool that they use to fund initiatives from all partners?
  • Are you able to request finances to support key initiatives/roles prioritized by the organization?
  • How is funding aligned: technology, data, digital, etc.? Is your organization business-line funded? Pooled?
  • Are there special products or digital transformation initiatives with resources outside IT? Product ownership funding?
  • How are regulatory changes funded?
  • Do you have the flexibility to adjust your budget throughout the fiscal year?
  • Are chargebacks in place? Are certain services charged back to business units

Determine if you can move forward with a new model or if you can adjust your existing one to suit the financial constraints.

If you have no say over your funding, pre-work may be required to build a business case to change your funding model before you look at your organizational structure – without this, you might have to rule out centralized and focus on hybrid/centralized. If you don’t control the budget (funding comes from your partners), it will be difficult to move to a more centralized model.

A federated business organization may require additional IT governance to help prioritize across the different areas.

Budgets for digital transformation might come from specific areas of the business, so resources may need to be aligned to support that. You’ll have to consider how you will work with those areas. This may also impact the roles that are going to exist within your IT organization – product owners or division owners might have more say.

Business context considerations

Business Context Consideration

IT Org. Design Implication

Business Perspective of IT:

How the business perceives IT and how IT perceives itself are sometimes not aligned. Make sure the business’ goals for IT are well understood.

  • Are your business partners satisfied if IT is an order taker? Do they agree with the need for IT to become a business partner? Is IT expected to innovate and transform the organization?
  • Is what the business needs from IT the same as what IT is providing currently?

Business Organization Structure and Growth:

  • How is the overall organization structured: Centralized/decentralized? Functionally aligned? Divided by regions?
  • In what areas does the organization prioritize investments?
  • Is the organization located across a diverse geography?
  • How big is the organization?
  • How is the organization growing and changing – by mergers and acquisitions?

If IT needs to become more of a business partner, you’ll want to define what that means to your organization and focus on the capabilities to enable this. Educating your partners might also be required if you’re not aligned.

For many organizations, this will include stakeholder management, innovation, and product/project management. If IT and its business partners are satisfied with an order-taker relationship, be prepared for the consequences of that.

A global organization will require different IT needs than a single location. Specifically, site reliability engineering (SRE) or IT support services might be deployed in each region. Organizations growing through mergers and acquisitions can be structured differently depending on what the organization needs from the transaction. A more centralized organization may be appropriate if the driver is reuse for a more holistic approach, or the organization may need a more decentralized organization if the acquisitions need to be handled uniquely.

Business context considerations

Business Context Consideration

IT Org. Design Implication

Sourcing Strategy:

  • What are the drivers for sourcing? Staff augmentation, best practices, time zone support, or another reason?
  • What is your strategy for sourcing?
  • Does IT do all of your technology work, or are parts being done by business or other units?
  • Are we willing/able to outsource, and will that place us into non-compliance (regulations)?
  • Do you have vendor management capabilities in areas that you might outsource?
  • How cloud-driven is your organization?
  • Do you have global operations?

Change Tolerance:

  • What’s your organization’s tolerance to make changes around organizational design?
  • What's the appetite and threshold for risk?

Your sourcing strategy affects your organizational structure, including what capabilities you group together. Since managing outsourced capabilities also includes the need for vendor management, you’ll need to ensure there aren’t too many capabilities required per leader. Look closely at what can be achieved through your operating model if IT is done through other groups. Even though these groups may not be in scope of your organization changes, you need to ensure your IT team works with them effectively.

If your organization is going to push back if there are big structural changes, consider whether the changes are truly necessary. It may be preferred to take baby steps – use an incremental versus big-bang approach.

A need for incremental change might mean not making a major operating model change.

Business context considerations

Business Context Consideration

IT Org Design. Implication

Stakeholder Engagement & Focus:

Identify who your customers and stakeholders are; clarify their needs and engagement model.

  • Who is the customer for IT products and services?
  • Is your customer internal? External? Both?
  • How much of a priority is customer focus for your organization?
  • How will IT interact with customers, end users, and partners? What is the engagement model desired?

Business Vision, Services, and Products:

Articulate what your organization was built to do.

  • What does the organization create or provide?
  • Are these products and services changing?
  • What are the most critical capabilities to your organization?
  • What makes your organization a success? What are critical success factors of the organization and how are they measuring this to determine success?

For a customer or user focus, ensure capabilities related to understanding needs (stakeholder, UX, etc.) are prioritized. Hybrid, decentralized, or demand-develop-service models often have more of a focus on customer needs.

Outsourcing the service desk might be a consideration if there’s a high demand for the service. A differentiation between these users might mean there’s a different demand for services.

Think broadly in terms of your organizational vision, not just the tactical (widget creation). You might need to choose an operating model that supports vision.

Do you need to align your organization with your value stream? Do you need to decentralize specific capabilities to enable prioritization of the key capabilities?

1.2 Create design principles based on the business context

1-3 hours

  1. Discuss the business context in which the IT organizational redesign will be taking place. Consider the following standard components of the business context; include other relevant components specific to your organization:
  • Culture
  • Workforce Considerations
  • Control and Governance
  • Financial Constraints
  • Business Perspective of IT
  • Business Organization Structure and Growth
  • Sourcing Strategy
  • Change Tolerance
  • Stakeholder Engagement and Focus
  • Business Vision, Services, and Products
  • Different stakeholders can have different perspectives on these questions. Be sure to consider a holistic approach and engage these individuals.
  • Capture your findings and use them to create initial design principles.
  • Input

    Output

    • Business context
    • Design principles reflecting how the business context influences the organizational redesign for IT

    Materials

    Participants

    • Whiteboard/flip charts (physical or electronic)
    • List of Context Questions
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Communications Deck

    How your IT organization is structured needs to reflect what it must be built to do

    Structure follows strategy – the way you design will impact what your organization can produce.

    Designing your IT organization requires an assessment of what it needs to be built to do:

    • What are the most critical capabilities that you need to deliver, and what does success look like in those different areas?
    • What are the most important things that you deliver overall in your organization?

    The IT organization must reflect your business needs:

    • Understand your value stream and/or your prioritized business goals.
    • Understand the impact of your strategies – these can include your overall digital strategy and/or your IT strategy

    1.3a (Optional Exercise) Identify the capabilities from your value stream

    1 hour

    1. Identify your organization’s value stream – what your overall organization needs to do from supplier to consumer to provide value. Leverage Info-Tech’s industry reference architectures if you haven’t identified your value stream, or use the Document Your Business Architecture blueprint to create yours.
    2. For each item in your value stream, list capabilities that are critical to your organizational strategy and IT needs to further invest in to enable growth.
    3. Also, list those that need further support, e.g. those that lead to long wait times, rework time, re-tooling, down-time, unnecessary processes, unvaluable processes.*
    4. Capture the IT capabilities required to enable your business in your draft principles.
    The image contains a screenshot of the above activity: Sampling Manufacturing Business Capabilities.
    Source: Six Sigma Study Guide, 2014
    Input Output
    • Organization’s value stream
    • List of IT capabilities required to support the IT strategy
    Materials Participants
    • Whiteboard/flip charts (physical or electronic)
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Communications Deck

    Your strategy will help you decide on your structure

    Ensure that you have a clear view of the goals and initiatives that are needed in your organization. Your IT, digital, business, and/or other strategies will surface the IT capabilities your organization needs to develop. Identify the goals of your organization and the initiatives that are required to deliver on them. What capabilities are required to enable these? These capabilities will need to be reflected in your design principles.

    Sample initiatives and capabilities from an organization’s strategies

    The image contains a screenshot of sample initiatives and capabilities from an organization's strategies.

    1.3b Identify the capabilities required to deliver on your strategies

    1 hour

    1. For each IT goal, there may be one or more initiatives that your organization will need to complete in order to be successful.
    2. Document those goals and infinitives. For each initiative, consider which core IT capabilities will be required to deliver on that goal. There might be one IT capability or there might be several.
    3. Identify which capabilities are being repeated across the different initiatives. Consider whether you are currently investing in those capabilities in your current organizational structure.
    4. Highlight the capabilities that require IT investment in your design principles.
    InputOutput
    • IT goals
    • IT initiatives
    • IT, digital, and business strategies
    • List of IT capabilities required to support the IT strategy
    MaterialsParticipants
    • Whiteboard/flip charts (physical or electronic)
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Communications Deck

    Create your organizational design principles

    Your organizational design principles should define a set of loose rules that can be used to design your organizational structure to the specific needs of the work that needs to be done. These rules will guide you through the selection of the appropriate operating model that will meet your business needs. There are multiple ways you can hypothetically organize yourself to meet these needs, and the design principles will point you in the direction of which solution is the most appropriate as well as explain to your stakeholders the rationale behind organizing in a specific way. This foundational step is critical: one of the key reasons for organizational design failure is a lack of requisite time spent on the front-end understanding what is the best fit.

    The image contains an example of organizing design principles as described above.

    1.4 Finalize your list of design principles

    1-3 hours

    1. As a group, review the key outputs from your data collection exercises and their implications.
    2. Consider each of the previous exercises – where does your organization stand from a maturity perspective, what is driving the redesign, what is the business context, and what are the key IT capabilities requiring support. Identify how each will have an implication on your organizational redesign. Leverage this conversation to generate design principles.
    3. Vote on a finalized list of eight to ten design principles that will guide the selection of your operating model. Have everyone leave the meeting with these design principles so they can review them in more detail with their work units or functional areas and elicit any necessary feedback.
    4. Reconvene the group that was originally gathered to create the list of design principles and make any final amendments to the list as necessary. Use this opportunity to define exactly what each design principle means in the context of your organization so everyone has the same understanding of what this means moving forward.
    InputOutput
    • Organizational redesign drivers
    • Business context
    • IT strategy capabilities
    • Organizational design principles to help inform the selection of the right operating model sketch
    MaterialsParticipants
    • Whiteboard/flip charts (physical or electronic)
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Communications Deck

    Example design principles

    Your eight to ten design principles will be those that are most relevant to YOUR organization. Below are samples that other organizations have created, but yours will not be the same.

    Design Principle

    Description

    Decision making

    We will centralize decision making around the prioritization of projects to ensure that the initiatives driving the most value for the organization as a whole are executed.

    Fit for purpose

    We will build and maintain fit-for-purpose solutions based on business units’ unique needs.

    Reduction of duplication

    We will reduce role and application duplication through centralized management of assets and clearly differentiated roles that allow individuals to focus within key capability areas.

    Managed security

    We will manage security enterprise-wide and implement compliance and security governance policies.

    Reuse > buy > build

    We will maximize reuse of existing assets by developing a centralized application portfolio management function and approach.

    Managed data

    We will create a specialized data office to provide data initiatives with the focus they need to enable our strategy.

    Design Principle

    Description

    Controlled technical diversity

    We will control the variety of technology platforms we use to allow for increased operability and reduction of costs.

    Innovation

    R&D and innovation are critical – we will build an innovation team into our structure to help us meet our digital agenda.

    Resourcing

    We will separate our project and maintenance activities to ensure each are given the dedicated support they need for success and to reduce the firefighting mentality.

    Customer centricity

    The new structure will be directly aligned with customer needs – we will have dedicated roles around relationship management, requirements, and strategic roadmapping for business units.

    Interoperability

    We will strengthen our enterprise architecture practices to best prepare for future mergers and acquisitions.

    Cloud services

    We will move toward hosted versus on-premises infrastructure solutions, retrain our data center team in cloud best practices, and build roles around effective vendor management, cloud provisioning, and architecture.

    Phase 2

    Create the Operating Model Sketch

    This phase will walk you through the following activities:

    2.1 Augment the capability list

    2.2 Heatmap capabilities to determine gaps in service

    2.3 Identify the target state of sourcing for your IT capabilities

    2.4 Review and select a base operating model sketch

    2.5 Customize the selected overlay to reflect the desired future state

    This phase involves the following participants:

    • CIO
    • IT Leadership

    Embed change management into the organizational design process

    Gain Buy-In

    Obtain desire from stakeholders to move forward with organizational redesign initiative by involving them in the process to gain interest. This will provide the stakeholders with assurance that their concerns are being heard and will help them to understand the benefits that can be anticipated from the new organizational structure.

    “You’re more likely to get buy-in if you have good reason for the proposed changes – and the key is to emphasize the benefits of an organizational redesign.”

    Source: Lucid Chart

    Info-Tech Insight

    Just because people are aware does not mean they agree. Help different stakeholders understand how the change in the organizational structure is a benefit by specifically stating the benefit to them.

    Info-Tech uses capabilities in your organizational design

    We differentiate between capabilities and competencies.

    Capabilities

    • Capabilities are focused on the entire system that would be in place to satisfy a particular need. This includes the people who are competent to complete a specific task and also the technology, processes, and resources to deliver.
    • Capabilities work in a systematic way to deliver on specific need(s).
    • A functional area is often made up of one or more capabilities that support its ability to deliver on that function.
    • Focusing on capabilities rather then the individuals in organizational redesign enables a more objective and holistic view of what your organization is striving toward.

    Competencies

    • Competencies on the other hand are specific to an individual. It determines if the individual poses the skills or ability to perform.
    • Competencies are rooted in the term competent, which looks to understand if you are proficient enough to complete the specific task at hand.
    • Source: The People Development Magazine, 2020

    Use our IT capabilities to establish your IT organization design

    The image contains a diagram of the various services and blueprints that Info-Tech has to offer.

    2.1 Augment the capability list

    1-3 hours

    1. Using the capability list on the previous slide, go through each of the IT capabilities and remove any capabilities for which your IT organization is not responsible and/or accountable. Refer to the Operating Model and Capability Definition List for descriptions of each of the IT capabilities.
    2. Augment the language of specific capabilities that you feel are not directly reflective of what is being done within your organizational context or that you feel need to be changed to reflect more specifically how work is being done in your organization.
    • For example, some organizations may refer to their service desk capability as help desk or regional support. Use a descriptive term that most accurately reflects the terminology used inside the organization today.
  • Add any core capabilities from your organization that are missing from the provided IT capability list.
    • For example, organizations that leverage DevOps capabilities for their product development may desire to designate this in their operating model.
  • Document the rationale for decisions made for future reference.
  • Input Output
    • Baseline list of IT capabilities
    • IT capabilities required to support IT strategy
    • Customized list of IT capabilities
    Materials Participants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership

    Record the results in the Organizational Design Workbook

    Gaps in delivery

    Identify areas that require greater focus and attention.

    Assess the gaps between where you currently are and where you need to be. Evaluate how critical and how effective your capabilities are:

    • Criticality = Importance
      • Try to focus on those which are highly critical to the organization.
      • These may be capabilities that have been identified in your strategies as areas to focus on.
    • Effectiveness = Performance
      • Identify those where the process or system is broken or ineffective, preventing the team from delivering on the capability.
      • Effectiveness could take into consideration how scalable, adaptable, or sustainable each capability is.
      • Focus on the capabilities that are low or medium in effectiveness but highly critical. Addressing the delivery of these capabilities will lead to the most positive outcomes in your organization.

    Remember to identify what allows the highly effective capabilities to perform at the capacity they are. Leverage this when increasing effectiveness elsewhere.

    High Gap

    There is little to no effectiveness (high gap) and the capability is highly important to your organization.

    Medium Gap

    Current ability is medium in effectiveness (medium gap) and there might be some priority for that capability in your organization.

    Low Gap

    Current ability is highly effective (low gap) and the capability is not necessarily a priority for your organization.

    2.2 Heatmap capabilities to determine gaps in delivery

    1-3 hours

    1. At this point, you should have identified what capabilities you need to have to deliver on your organization's goals and initiatives.
    2. Convene a group of the key stakeholders involved in the IT organizational design initiative.
    3. Review your IT capabilities and color each capability border according to the effectiveness and criticality of that capability, creating a heat map.
    • Green indicates current ability is highly effective (low gap) and the capability is not necessarily a priority for your organization.
    • Yellow indicates current ability is medium in effectiveness (medium gap) and there might be some priority for that capability in your organization.
    • Red indicates that there is little to no effectiveness (high gap) and the capability is highly important to your organization.
    Input Output
    • Selected capabilities from activity 2.1
    • Gap analysis in delivery of capabilities currently
    Materials Participants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership

    Record the results in the Organizational Design Workbook

    Don’t forget the why: why are you considering outsourcing?

    There are a few different “types” of outsourcing:

    1. Competitive Advantage – Working with a third-party organization for the knowledge, insights, and best practices they can bring to your organization.
    2. Managed Service– The third party manages a capability or function for your organization.
    3. Staff Augmentation – Your organization brings in contractors and third-party organizations to fill specific skills gaps.

    Weigh which sourcing model(s) will best align with the needed capabilities to deliver effectively

    Insourcing

    Staff Augmentation

    Managed Service

    Competitive Advantage

    Description

    The organization maintains full responsibility for the management and delivery of the IT capability or service.

    Vendor provides specialized skills and enables the IT capability or service together with the organization to meet demand.

    Vendor completely manages the delivery of value for the IT capability, product or service.

    Vendor has unique skills, insights, and best practices that can be taught to staff to enable insourced capability and competency.

    Benefits

    • Retains in-house control over proprietary knowledge and assets that provide competitive or operational advantage.
    • Gains efficiency due to integration into the organization’s processes.
    • Provision of unique skills.
    • Addresses variation in demand for resources.
    • Labor cost savings.
    • Improves use of internal resources.
    • Improves effectiveness due to narrow specialization.
    • Labor cost savings.
    • Gain insights into aspects that could provide your organization with advantages over competitors.
    • Long-term labor cost savings.
    • Short-term outsourcing required.
    • Increase in-house competencies.

    Drawbacks

    • Quality of services/capabilities might not be as high due to lack of specialization.
    • No labor cost savings.
    • Potentially inefficient distribution of labor for the delivery of services/capabilities.
    • Potential conflicts in management or delivery of IT services and capabilities.
    • Negative impact on staff morale.
    • Limited control over services/capabilities.
    • Limited integration into organization’s processes.
    • Short-term labor expenses.
    • Requires a culture of continuous learning and improvement.

    Your strategy for outsourcing will vary with capability and capacity

    The image contains a diagram to show the Develop Vendor Management Capabilities, as described in the text below.

    Capability

    Capacity

    Outsourcing Model

    Low

    Low

    Your solutions may be with you for a long time, so it doesn’t matter whether it is a strategic decision to outsource development or if you are not able to attract the talent required to deliver in your market. Look for a studio, agency, or development shop that has a proven reputation for long-term partnership with its clients.

    Low

    High

    Your team has capacity but needs to develop new skills to be successful. Look for a studio, agency, or development shop that has a track record of developing its customers and delivering solutions.

    High

    Low

    Your organization knows what it is doing but is strapped for people. Look at “body shops” and recruiting agencies that will support short-term development contracts that can be converted to full-time staff or even a wholesale development shop acquisition.

    High

    High

    You have capability and capacity for delivering on your everyday demands but need to rise to the challenge of a significant, short-term rise in demand on a critical initiative. Look for a major system integrator or development shop with the specific expertise in the appropriate technology.

    Use these criteria to inform your right sourcing strategy

    Sourcing Criteria

    Description

    Determine whether you’ll outsource using these criteria

    1. Critical or commodity

    Determine whether the component to be sourced is critical to your organization or if it is a commodity. Commodity components, which are either not strategic in nature or related to planning functions, are likely candidates for outsourcing. Will you need to own the intellectual property created by the third party? Are you ok if they reuse that for their other clients?

    2. Readiness to outsource

    Identify how easy it would be to outsource a particular IT component. Consider factors such as knowledge transfer, workforce reassignment or reduction, and level of integration with other components.

    Vendor management readiness – ensuring that you have sufficient capabilities to manage vendors – should also be considered here.

    3. In-house capabilities

    Determine if you have the capability to deliver the IT solutions in-house. This will help you establish how easy it would be to insource an IT component.

    4. Ability to attract resources (internal vs. outsourced)

    Determine if the capability is one that is easily sourced with full-time, internal staff or if it is a specialty skill that is best left for a third-party to source.

    Determine your sourcing model using these criteria

    5. Cost

    Consider the total cost (investment and ongoing costs) of the delivery of the IT component for each of the potential sourcing models for a component.

    6. Quality

    Define the potential impact on the quality of the IT component being sourced by the possible sourcing models.

    7. Compliance

    Determine whether the sourcing model would fit with regulations in your industry. For example, a healthcare provider would only go for a cloud option if that provider is HIPAA compliant.

    8. Security

    Identify the extent to which each sourcing option would leave your organization open to security threats.

    9. Flexibility

    Determine the extent to which the sourcing model will allow your organization to scale up or down as demand changes.

    2.3 Identify capabilities that could be outsourced

    1-3 hours

    1. For each of the capabilities that will be in your future-state operating model, determine if it could be outsourced. Review the sourcing criteria available on the previous slide to help inform which sourcing strategy you will use for each capability.
    2. When looking to outsource or co-source capabilities, consider why that capability would be outsourced:
    • Competitive Advantage – Work with a third-party organization for the knowledge, insights, and best practices they can bring to your organization.
    • Managed Service – The third party manages a capability or function for your organization.
    • Staff Augmentation – Your organization brings in contractors and third-party organizations to fill specific skills gaps.
  • Place an asterisk (*) around the capabilities that will be leveraging one of the three previous sourcing options.
  • InputOutput
    • Customized IT capabilities
    • Sourcing strategy for each IT capability
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership

    Record the results in the Organizational Design Workbook

    What is an operating model?

    Leverage a cohesive operating model throughout the organizational design process.

    An IT operating model sketch is a visual representation of the way your IT organization needs to be designed and the capabilities it requires to deliver on the business mission, strategic objectives, and technological ambitions. It ensures consistency of all elements in the organizational structure through a clear and coherent blueprint.

    The visual should be the optimization and alignment of the IT organization’s structure to deliver the capabilities required to achieve business goals. Additionally, it should clearly show the flow of work so that key stakeholders can understand where inputs flow in and outputs flow out of the IT organization. Investing time in the front end getting the operating model right is critical. This will give you a framework to rationalize future organizational changes, allowing you to be more iterative and your model to change as the business changes.

    The image contains an example of an operating model as described in the text above.

    Info-Tech Insight

    Every structure decision you make should be based on an identified need, not on a trend.Build your IT organization to enable the priorities of the organization.

    Each IT operating model is characterized by a variety of advantages and disadvantages

    Centralized

    Hybrid

    Decentralized

    Advantages
    • Maximum flexibility to allocate IT resources across business units.
    • Low-cost delivery model and greatest economies of scale.
    • Control and consistency offers opportunity for technological rationalization and standardization and volume purchasing at the highest degree.
    • Centralizes processes and services that require consistency across the organization.
    • Decentralizes processes and services that need to be responsive to local market conditions.
    • Eliminates duplication and redundancy by allowing effective use of common resources (e.g. shared services, standardization).
    • Goals are aligned to the distinct business units or functions.
    • Greater flexibility and more timely delivery of services.
    • Development resources are highly knowledgeable about business-unit-specific applications.
    • Business unit has greatest control over IT resources and can set and change priorities as needed.

    Disadvantages

    • Less able to respond quickly to local requirements with flexibility.
    • IT can be resistant to change and unwilling to address the unique needs of end users.
    • Business units can be frustrated by perception of lack of control over resources.
    • Development of special business knowledge can be limited.
    • Requires the most disciplined governance structure and the unwavering commitment of the business; therefore, it can be the most difficult to maintain.
    • Requires new processes as pooled resources must be staffed to approved projects.
    • Redundancies, conflicts, and incompatible technologies can result from business units having differentiated services and applications – increasing cost.
    • Ability to share IT resources is low due to lack of common approaches.
    • Lack of integration limits the communication of data between businesses and reduces common reporting.

    Decentralization can take many forms – define what it means to your organization

    Decentralization can take a number of different forms depending on the products the organization supports and how the organization is geographically distributed. Use the following set of explanations to understand the different types of decentralization possible and when they may make sense for supporting your organizational objectives.

    Line of Business

    Decentralization by lines of business (LoB) aligns decision making with business operating units based on related functions or value streams. Localized priorities focus the decision making from the CIO or IT leadership team. This form of decentralization is beneficial in settings where each line of business has a unique set of products or services that require specific expertise or flexible resourcing staffing between the teams.

    Product Line

    Decentralization by product line organizes your team into operationally aligned product families to improve delivery throughput, quality, and resource flexibility within the family. By adopting this approach, you create stable product teams with the right balance between flexibility and resource sharing. This reinforces value delivery and alignment to enterprise goals within the product lines.

    Geographical

    Geographical decentralization reflects a shift from centralized to regional influences. When teams are in different locations, they can experience a number of roadblocks to effective communication (e.g. time zones, regulatory differences in different countries) that may necessitate separating those groups in the organizational structure, so they have the autonomy needed to make critical decisions.

    Functional

    Functional decentralization allows the IT organization to be separated by specialty areas. Organizations structured by functional specialization can often be organized into shared service teams or centers of excellence whereby people are grouped based on their technical, domain, or functional area within IT (Applications, Data, Infrastructure, Security, etc.). This allows people to develop specialized knowledge and skills but can also reinforce silos between teams.

    2.4 Review and select a base operating model sketch

    1 hour

    1. Review the set of base operating model sketches available on the following slides.
    2. For each operating model sketch, there are benefits and risks to be considered. Make an informed selection by understanding the risks that your organization might be taking on by adopting that particular operating model.
    3. If at any point in the selection process the group is unsure about which operating model will be the right fit, refer back to your design principles established in activity 1.4. These should guide you in the selection of the right operating model and eliminate those which will not serve the organization.
    InputOutput
    • Organizational design principles
    • Customized list of IT capabilities
    • Operating model sketch examples
    • Selected operating model sketch
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership

    Record the results in the Organizational Design Workbook

    Centralized Operating Model #1: Plan-Build-Run

    I want to…

    • Establish a formalized governance process that takes direction from the organization on which initiatives should be prioritized by IT.
    • Ensure there is a clear separation between teams that are involved in strategic planning, building solutions, and delivering operational support.
    • Be able to plan long term by understanding the initiatives that are coming down the pipeline and aligning to an infrequent budgeting plan.

    BENEFITS

    • Effective at implementing long-term plans efficiently; separates maintenance and projects to allow each to have the appropriate focus.
    • More oversight over financials; better suited for fixed budgets.
    • Works across centralized technology domains to better align with the business’ strategic objectives – allows for a top-down approach to decision making.
    • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
    • Well-suited for a project-driven environment that employs waterfall or a hybrid project management methodology that is less iterative.

    RISKS

    • Creates artificial silos between the build (developers) and run (operations staff) teams, as both teams focus on their own responsibilities and often fail to see the bigger picture.
    • Miss opportunities to deliver value to the organization or innovate due to an inability to support unpredictable/shifting project demands as decision making is centralized in the plan function.
    • The portfolio of initiatives being pursued is often determined before requirements analysis takes place, meaning the initiative might be solving the wrong need or problem.
    • Depends on strong hand-off processes to be defined and strong knowledge transfer from build to run functions in order to be successful.
    The image contains an example of a Centralized Operating Model: Plan-Build-Run.

    Centralized Operating Model #2: Demand-Develop-Service

    I want to…

    • Listen to the business to understand new initiatives or service enhancements being requested.
    • Enable development and operations to work together to seamlessly deliver in a DevOps culture.
    • Govern and confirm that initiatives being requested by the business are still aligned to IT’s overarching strategy and roadmap before prioritizing those initiatives.

    BENEFITS

    • Aligns well with an end-to-end services model; constant attention to customer demand and service supply.
    • Centralizes service operations under one functional area to serve shared needs across lines of business.
    • Allows for economies of scale and expertise pooling to improve IT’s efficiency.
    • Elevates sourcing and vendor management as its own strategic function; lends well to managed service and digital initiatives.
    • Development and operations housed together; lends well to DevOps-related initiatives and reduces the silos between these two core groups.

    RISKS

    • IT prioritizes the initiatives it thinks are a priority to the business based on how well it establishes good stakeholder relations and communications.
    • Depends on good governance to prevent enhancements and demands from being prioritized without approval from those with accountability and authority.
    • This model thrives in a DevOps culture but does not mean it ensures your organization is a “DevOps” organization. Be sure you're encouraging the right behaviors and attitudes.

    The image contains an example of a Centralized Operating Model: Demand, Develop, Service.

    Hybrid Operating Model #1: LOB/Functional Aligned

    I want to…

    • Better understand the various needs of the organization to align IT priorities and ensure the right services can be delivered.
    • Keep all IT decisions centralized to ensure they align with the overarching strategy and roadmap that IT has set.
    • Organize your shared services in a strategic manner that enables delivery of those services in a way that fits the culture of the organization and the desired method of operating.

    BENEFITS

    • Best of both worlds of centralization and decentralization; attempts to channel benefits from both centralized and decentralized models.
    • Embeds key IT functions that require business knowledge within functional areas, allowing for critical feedback and the ability to understand those business needs.
    • Places IT in a position to not just be “order takers” but to be more involved with the different business units and promote the value of IT.
    • Achieves economies of scale where necessary through the delivery of shared services that can be requested by the function.
    • Shared services can be organized to deliver in the best way that suits the organization.

    RISKS

    • Different business units may bypass governance to get their specific needs met by functions – to alleviate this, IT must have strong governance and prioritize amongst demand.
    • Decentralized role can be viewed as an order taker by the business if not properly embedded and matured.
    • No guaranteed synergy and integration across functions; requires strong communication, collaboration, and steering.
    • Cannot meet every business unit’s needs – can cause tension from varying effectiveness of the IT functions.

    The image contains an example of a Hybrid Operating Model: LOB/Functional Aligned.

    Hybrid Model #2: Product-Aligned Operating Model

    I want to…

    • Align my IT organization into core products (services) that IT provides to the organization and establish a relationship with those in the organization that have alignment to that product.
    • Have roles dedicated to the lifecycle of their product and ensure the product can continuously deliver value to the organization.
    • Maintain centralized set of standards as it applies to overall IT strategy, security, and architecture to ensure consistency across products and reduce silos.

    BENEFITS

    • Focus is on the full lifecycle of a product – takes a strategic view of how technology enables the organization.
    • Promotes centralized backlog around a specific value creator, rather than a traditional project focus that is more transactional.
    • Dedicated teams around the product family ensure you have all of the resources required to deliver on your product roadmap.
    • Reduces barriers between IT and business stakeholders; focuses on technology as a key strategic enabler.
    • Delivery is largely done through frequent releases that can deliver value.

    RISKS

    • If there is little or no business involvement, it could prevent IT from truly understanding business demand and prioritizing the wrong work.
    • A lack of formal governance can create silos between the IT products, causing duplication of efforts, missed opportunities for collaboration, and redundancies in application or vendor contracts.
    • Members of each product can interpret the definition of standards (e.g. architecture, security) differently.

    The image contains an example of the Hybrid Operating Model: Product-Aligned Operating Model.

    Hybrid Operating Model #3: Service-Aligned Operating Model

    I want to…

    • Decentralize the IT organization by the various IT services it offers to the organization while remaining centralized with IT strategy, governance, security and operational services.
    • Ensure IT services are defined and people resources are aligned to deliver on those services.
    • Enable each of IT’s services to have the autonomy to understand the business needs and be able to manage the operational and new project initiatives with a dedicated service owner or business relationship manager.

    BENEFITS

    • Strong enabler of agility as each service has the autonomy to make decisions around operational work versus project work based on their understanding of the business demand.
    • Individuals in similar roles that are decentralized across services are given coaching to provide common direction.
    • Allows teams to efficiently scale with service demand.
    • This is a structurally baseline DevOps model. Each group will have services built within that have their own dedicated teams that will handle the full gambit of responsibilities, from new features to enhancements and maintenance.

    RISKS

    • Service owners require a method to collaborate to avoid duplication of efforts or projects that conflict with the efforts of other IT services.
    • May result in excessive cost through role redundancies across different services, as each will focus on components like integration, stakeholder management, project management, and user experiences.
    • Silos cause a high degree of specialization, making it more difficult for team members to imagine moving to another defined service group, limiting potential career advancement opportunities.
    • The level of complex knowledge required by shared services (e.g. help desk) is often beyond what they can provide, causing them to rely on and escalate to defined service groups more than with other operating models.

    The image contains an example of the Hybrid Operating Model: Service-Aligned Operating Model.

    Decentralized Model: Division Decentralization (LoB, Geography, Function, Product)

    I want to…

    • Decentralize the IT organization to enable greater autonomy within specific groups that have differing customer demands and levels of support.
    • Maintain a standard level of service that can be provided by IT for all divisions.
    • Ensure each division has access to critical data and reports that supports informed decision making.

    BENEFITS

    • Organization around functions allows for diversity in approach in how areas are run to best serve a specific business unit’s needs.
    • Each functional line exists largely independently, with full capacity and control to deliver service at the committed SLAs.
    • Highly responsive to shifting needs and demands with direct connection to customers and all stages of the solution development lifecycle.
    • Accelerates decision making by delegating authority lower into the function.
    • Promotes a flatter organization with less hierarchy and more direct communication with the CIO.

    RISKS

    • Requires risk and security to be centralized and have oversight of each division to prevent the decisions of one division from negatively impacting other divisions or the enterprise.
    • Less synergy and integration across what different lines of business are doing can result in redundancies and unnecessary complexity.
    • Higher overall cost to the IT group due to role and technology duplication across different divisions.
    • It will be difficult to centralize aspects of IT in the future, as divisions adopt to a culture of IT autonomy.

    The image contains an example of the Decentralized Model: Division Decentralization.

    Enterprise Model: Multi-Modal

    I want to…

    • Have an organizational structure that leverages several different operating models based on the needs and requirements of the different divisions.
    • Provide autonomy and authority to the different divisions so they can make informed and necessary changes as they see fit without seeking approval from a centralized IT group.
    • Support the different initiatives the enterprise is focused on delivering and ensure the right model is adopted based on those initiatives.

    BENEFITS

    • Allows for the organization to work in ways that best support individual areas; for example, areas that support legacy systems can be supported through traditional operating models while areas that support digital transformations may be supported through more flexible operating models.
    • Enables a specialization of knowledge related to each division.

    RISKS

    • Inconsistency across the organization can lead to confusion on how the organization should operate.
    • Parts of the organization that work in more traditional operating models may feel limited in career growth and innovation.
    • Cross-division initiatives may require greater oversight and a method to enable operations between the different focus areas.

    The image contains an example of the Enterprise Model: Multi-Modal.

    Create enabling teams that bridge your divisions

    The following bridges might be necessary to augment your divisions:

    • Specialized augmentation: There might not be a sufficient number of resources to support each division. These teams will be leveraged across the divisions; this means that the capabilities needed for each division will exist in this bridge team, rather than in the division.
    • Centers of Excellence: Capabilities that exist within divisions can benefit from shared knowledge across the enterprise. Your organization might set up centers of excellence to support best practices in capabilities organization wide. These are Forums in the unfix model, or communities of practice and support capability development rather than deliveries of each division.
    • Facilitation teams might be required to support divisions through coaching. This might include Agile or other coaches who can help teams adopt practices and embed learnings.
    • Holistic teams provide an enterprise view as they work with various divisions. This can include capabilities like user experience, which can benefit from the holistic perspective rather than a siloed one. People with these capabilities augment the divisions on an as-needed basis.
    The image contains a diagram to demonstrate the use of bridges on divisions.

    2.5 Customize the selected sketch to reflect the desired future state

    1-3 hours

    1. Using the baseline operating model sketch, walk through each of the IT capabilities. Based on the outputs from activity 2.1:
      1. Remove any capabilities for which your IT organization is not responsible and/or accountable.
      2. Augment the language of specific capabilities that you feel are not directly reflective of what is being done within your organizational context or that you feel need to be changed to reflect more specifically how work is being done in your organization.
      3. Add any core capabilities from your organization that are missing from the provided IT capability list.
    2. Move capabilities to the right places in the operating model to reflect how each of the core IT processes should interact with one another.
    3. Add bridges as needed to support the divisions in your organization. Identify which capabilities will sit in these bridges and define how they will enable the operating model sketch to deliver.
    InputOutput
    • Selected base operating model sketch
    • Customized list of IT capabilities
    • Understanding of outsourcing and gaps
    • Customized operating model sketch
    MaterialsParticipants
    • Whiteboard/flip charts
    • Operating model sketch examples
    • CIO
    • IT Leadership

    Record the results in the Organizational Design Workbook

    Document the final operating model sketch in the Communications Deck

    Phase 3

    Formalize the Organizational Structure

    This phase will walk you through the following activities:

    3.1 Create work units

    3.2 Create work unit mandates

    3.3 Define roles inside the work units

    3.4 Finalize the organizational chart

    3.5 Identify and mitigate key risks

    This phase involves the following participants:

    • CIO
    • IT Leadership
    • Business Leadership

    Embed change management into the organizational design process

    Enable adoption of the new structure.

    You don’t have to make the change in one big bang. You can adopt alternative transition plans such as increments or pilots. This allows people to see the benefits of why you are undergoing the change, allows the change message to be repeated and applied to the individuals impacted, and provides people with time to understand their role in making the new organizational structure successful.

    “Transformational change can be invigorating for some employees but also highly disruptive and stressful for others.”

    Source: OpenStax, 2019

    Info-Tech Insight

    Without considering the individual impact of the new organizational structure on each of your employees, the change will undoubtedly fail in meeting its intended goals and your organization will likely fall back into old structured habits.

    Use a top-down approach to build your target-state IT organizational sketch

    The organizational sketch is the outline of the organization that encompasses the work units and depicts the relationships among them. It’s important that you create the structure that’s right for your organization, not one that simply fits with your current staff’s skills and knowledge. This is why Info-Tech encourages you to use your operating model as a mode of guidance for structuring your future-state organizational sketch.

    The organizational sketch is made up of unique work units. Work units are the foundational building blocks on which you will define the work that IT needs to get done. The number of work units you require and their names will not match your operating model one to one. Certain functional areas will need to be broken down into smaller work units to ensure appropriate leadership and span of control.

    Use your customized operating model to build your work units

    WHAT ARE WORK UNITS?

    A work unit is a functional group or division that has a discrete set of processes or capabilities that it is responsible for, which don’t overlap with any others. Your customized list of IT capabilities will form the building blocks of your work units. Step one in the process of building your structure is grouping IT capabilities together that are similar or that need to be done in concert in the case of more complex work products. The second step is to iterate on these work units based on the organizational design principles from Phase 1 to ensure that the future-state structure is aligned with enablement of the organization’s objectives.

    Work Unit Examples

    Here is a list of example work units you can use to brainstorm what your organization’s could look like. Some of these overlap in functionality but should provide a strong starting point and hint at some potential alternatives to your current way of organizing.

    • Office of the CIO
    • Strategy and Architecture
    • Architecture and Design
    • Business Relationship Management
    • Projection and Portfolio Management
    • Solution Development
    • Solution Delivery
    • DevOps
    • Infrastructure and Operations
    • Enterprise Information Security
    • Security, Risk & Compliance
    • Data and Analytics

    Example of work units

    The image contains an example of work units.

    3.1 Create functional work units

    1-3 hours

    1. Using a whiteboard or large tabletop, list each capability from your operating model on a sticky note and recreate your operating model. Use one color for centralized activities and a second color for decentralized activities.
    2. With the group of key IT stakeholders, review the operating model and any important definitions and rationale for decisions made.
    3. Starting with your centralized capabilities, review each in turn and begin to form logical groups of compatible capabilities. Review the decentralized capabilities and repeat the process, writing additional sticky notes for capabilities that will be repeated in decentralized units.
    4. Note: Not all capabilities need to be grouped. If you believe that a capability has a high enough priority, has a lot of work, or is significantly divergent from others put this capability by itself.
    5. Define a working title for each new work unit, and discuss the pros and cons of the model. Ensure the work units still align with the operating model and make any changes to the operating model needed.
    6. Review your design principles and ensure that they are aligned with your new work units.
    InputOutput
    • Organizational business objectives
    • Customized operating model
    • Defined work units
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    Group formation

    Understand the impact of the functional groups you create.

    A group consists of two or more individuals who are working toward a common goal. Group formation is how those individuals are organized to deliver on that common goal. It should take into consideration the levels of hierarchy in your structure, the level of focus you give to processes, and where power is dispersed within your organizational design.

    Importance: Balance highly important capabilities with lower priority capabilities

    Specialization: The scope of each role will be influenced by specialized knowledge and a dedicated leader

    Effectiveness: Group capabilities that increase their efficacy

    Span of Control: Identify the right number of employees reporting to a single leader

    Choose the degree of specialization required

    Be mindful of the number of hats you’re placing on any one role.

    • Specialization exists when individuals in an organization are dedicated to performing specific tasks associated with a common goal and requiring a particular skill set. Aligning the competencies required to carry out the specific tasks based on the degree of complexity associated with those tasks ensures the right people and number of people can be assigned.
    • When people are organized by their specialties, it reduces the likelihood of task switching, reduces the time spent training or cross-training, and increases the focus employees can provide to their dedicated area of specialty.
    • There are disadvantages associated with aligning teams by their specialization, such as becoming bored and seeing the tasks they are performing as monotonous. Specialization doesn’t come without its problems. Monitor employee motivation

    Info-Tech Insight

    Smaller organizations will require less specialization simply out of necessity. To function and deliver on critical processes, some people might be asked to wear several hats.

    Avoid overloading the cognitive capacity of employees

    Cognitive load refers to the number of responsibilities that one can successfully take on.

    • When employees are assigned an appropriate number of responsibilities this leads to:
      • Engaged employees
      • Less task switching
      • Increased effectiveness on assigned responsibilities
      • Reduced bottlenecks
    • While this cognitive load can differ from employee to employee, when assigning role responsibilities, ensure each role isn’t being overburdened and spreading their focus thin.
    • Moreover, capable does not equal successful. Just because someone has the capability to take on more responsibilities doesn’t mean they will be successful.
    • Leverage the cognitive load being placed on your team to help create boundaries between teams and demonstrate clear role expectations.
    Source: IT Revolution, 2021

    Info-Tech Insight

    When you say you are looking for a team that is a “jack of all trades,” you are likely exceeding appropriate cognitive loads for your staff and losing productivity to task switching.

    Factors to consider for span of control

    Too many and too few direct reports have negative impacts on the organization.

    Complexity: More complex work should have fewer direct reports. This often means the leader will need to provide lots of support, even engaging in the work directly at times.

    Demand: Dynamic shifts in demand require more managerial involvement and therefore should have a smaller span of control. Especially if this demand is to support a 24/7 operation.

    Competency Level: Skilled employees should require less hands-on assistance and will be in a better position to support the business as a member of a larger team than those who are new to the role.

    Purpose: Strategic leaders are less involved in the day-to-day operations of their teams, while operational leaders tend to provide hands-on support, specifically when short-staffed.

    Group formation will influence communication structure

    Pick your poison…

    It’s important to understand the impacts that team design has on your services and products. The solutions that a team is capable of producing is highly dependent on how teams are structured. For example, Conway’s Law tells us that small distributed software delivery teams are more likely to produce modular service architecture, where large collocated teams are better able to create monolithic architecture. This doesn’t just apply to software delivery but also other products and services that IT creates. Note that small distributed teams are not the only way to produce quality products as they can create their own silos.

    Sources: Forbes, 2017

    Create mandates for each of your identified work units

    WHAT ARE WORK UNIT MANDATES?

    The work unit mandate should provide a quick overview of the work unit and be clear enough that any reader can understand why the work unit exists, what it does, and what it is accountable for.

    Each work unit will have a unique mandate. Each mandate should be distinguishable enough from your other work units to make it clear why the work is grouped in this specific way, rather than an alternative option. The mandate will vary by organization based on the agreed upon work units, design archetype, and priorities.

    Don’t just adopt an example mandate from another organization or continue use of the organization’s pre-existing mandate – take the time to ensure it accurately depicts what that group is doing so that its value-added activities are clear to the larger organization.

    Examples of Work Unit Mandates

    The Office of the CIO will be a strategic enabler of the IT organization, driving IT organizational performance through improved IT management and governance. A central priority of the Office of the CIO is to ensure that IT is able to respond to evolving environments and challenges through strategic foresight and a centralized view of what is best for the organization.

    The Project Management Office will provide standardized and effective project management practices across the IT landscape, including an identified project management methodology, tools and resources, project prioritization, and all steps from project initiation through to evaluation, as well as education and development for project managers across IT.

    The Solutions Development Group will be responsible for the high-quality development and delivery of new solutions and improvements and the production of customized business reports. Through this function, IT will have improved agility to respond to new initiatives and will be able to deliver high-quality services and insights in a consistent manner.

    3.2 Create work unit mandates

    1-3 hours

    1. Break into teams of three to four people and assign an equal number of work units to each team.
    2. Have each team create a set of statements that describe the overall purpose of that working group. Each mandate statement should:
    • Be clear enough that any reader can understand.
    • Explain why the work unit exists, what it does, and what it is accountable for.
    • Be distinguishable enough from your other work units to make it clear why the work is grouped in this specific way, rather than an alternative option.
  • Have each group present their work unit mandates and make changes wherever necessary.
  • InputOutput
    • Work units
    • Work unit mandates
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    Identify the key roles and responsibilities for the target IT organization

    Now that you have identified the main units of work in the target IT organization, it is time to identify the roles that will perform that work. At the end of this step, the key roles will be identified, the purpose statement will be built, and accountability and responsibility for roles will be clearly defined. Make sure that accountability for each task is assigned to one role only. If there are challenges with a role, change the role to address them (e.g. split roles or shift responsibilities).

    The image contains an example of two work units: Enterprise Architecture and PMO. It then lists the roles of the two work units.

    Info-Tech Insight

    Do not bias your role design by focusing on your existing staff’s competencies. If you begin to focus on your existing team members, you run the risk of artificially narrowing the scope of work or skewing the responsibilities of individuals based on the way it is, rather than the way it should be.

    3.3 Define roles inside the work units

    1-3 hours

    1. Select a work unit from the organizational sketch.
    2. Describe the most senior role in that work unit by asking, “what would the leader of this group be accountable or responsible for?” Define this role and move the capabilities they will be accountable for under that leader. Repeat this activity for the capabilities this leader would be responsible for.
    3. Continue to define each role that will be required in that work unit to deliver or provide oversight related to those capabilities.
    4. Continue until key roles are identified and the capabilities each role will be accountable or responsible for are clarified.
    5. Remember, only one role can have accountability for each capability but several can have responsibility.
    6. For each role, use the list of capabilities that the position will be accountable, responsible, or accountable and responsible for to create a job description. Leverage your own internal job descriptions or visit our Job Descriptions page.
    InputOutput
    • Work units
    • Work unit mandates
    • Responsibilities
    • Accountabilities
    • Roles with clarified responsibilities and accountabilities
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    Delivery model for product or solution development

    Can add additional complexity or clarity

    • Certain organizational structures will require a specific type of resourcing model to meet expectations and deliver on the development or sustainment of core products and solutions.
    • There are four common methods that we see in IT organizations:
      • Functional Roles: Completed work is handed off from functional team to functional team sequentially as outlined in the organization’s SDLC.
      • Shared Service & Resource Pools (Matrix): Resources are pulled whenever the work requires specific skills or pushed to areas where product demand is high.
      • Product or System: Work is directly sent to the teams who are directly managing the product or directly supporting the requestor.
      • Skills & Competencies: Work is directly sent to the teams who have the IT and business skills and competencies to complete the work.
    • Each of these will lead to a difference in how the functional team is skilled. They could have a great understanding of their customer, the product, the solution, or their service.

    Info-Tech Insight

    Despite popular belief, there is no such thing as the Spotify model, and organizations that structured themselves based on the original Spotify drawing might be missing out on key opportunities to obtain productivity from employees.

    Sources: Indeed, 2020; Agility Scales

    There can be different patterns to structure and resource your product delivery teams

    The primary goal of any product delivery team is to improve the delivery of value for customers and the business based on your product definition and each product’s demand. Each organization will have different priorities and constraints, so your team structure may take on a combination of patterns or may take on one pattern and then transform into another.

    Delivery Team Structure Patterns

    How Are Resources and Work Allocated?

    Functional Roles

    Teams are divided by functional responsibilities (e.g. developers, testers, business analysts, operations, help desk) and arranged according to their placement in the software development lifecycle (SDLC).

    Completed work is handed off from team to team sequentially as outlined in the organization’s SDLC.

    Shared Service and Resource Pools

    Teams are created by pulling the necessary resources from pools (e.g. developers, testers, business analysts, operations, help desk).

    Resources are pulled whenever the work requires specific skills or pushed to areas where product demand is high.

    Product or System

    Teams are dedicated to the development, support, and management of specific products or systems.

    Work is directly sent to the teams who are directly managing the product or directly supporting the requester.

    Skills and Competencies

    Teams are grouped based on skills and competencies related to technology (e.g. Java, mobile, web) or familiarity with business capabilities (e.g. HR, Finance).

    Work is directly sent to the teams who have the IT and business skills and competencies to complete the work.

    Delivery teams will be structured according to resource and development needs

    Functional Roles

    Shared Service and Resource Pools

    Product or System

    Skills and Competencies

    When your people are specialists versus having cross-functional skills

    Leveraged when specialists such as Security or Operations will not have full-time work on the product

    When you have people with cross-functional skills who can self-organize around a product’s needs

    When you have a significant investment in a specific technology stack

    The image contains a diagram of functional roles.The image contains a diagram of shared service and resource pools.The image contains a diagram of product or system.The image contains a diagram of skills and competencies.

    For more information about delivering in a product operating model, refer to our Deliver Digital Products at Scale blueprint.

    3.4 Finalize the organizational chart

    1-3 hours

    1. Import each of your work units and the target-state roles that were identified for each.
    2. In the place of the name of each work unit in your organizational sketch, replace the work unit name with the prospective role name for the leader of that group.
    3. Under each of the leadership roles, import the names of team members that were part of each respective work unit.
    4. Validate the final structure as a group to ensure each of the work units includes all the necessary roles and responsibilities and that there is clear delineation of accountabilities between the work units.

    Input

    Output

    • Work units
    • Work unit mandates
    • Roles with accountabilities and responsibilities
    • Finalized organizational chart

    Materials

    Participants

    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook & Executive Communications Deck

    Proactively consider and mitigate redesign risks

    Every organizational structure will include certain risks that should have been considered and accepted when choosing the base operating model sketch. Now that the final organizational structure has been created, consider if those risks were mitigated by the final organizational structure that was created. For those risks that weren’t mitigated, have a tactic to control risks that remain present.

    3.5 Identify and mitigate key risks

    1-3 hours

    1. For each of the operating model sketch options, there are specific risks that should have been considered when selecting that model.
    2. Take those risks and transfer them into the correct slide of the Organizational Design Workbook.
    3. Consider if there are additional risks that need to be considered with the new organizational structure based on the customizations made.
    4. For each risk, rank the severity of that risk on a scale of low, medium, or high.
    5. Determine one or more mitigation tactic(s) for each of the risks identified. This tactic should reduce the likelihood or impact of the risk event happening.
    InputOutput
    • Final organizational structure
    • Operating model sketch benefits and risks
    • Redesign risk mitigation plan
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    Phase 4

    Plan for Implementation & Change

    This phase will walk you through the following activities:

    4.1 Select a transition plan

    4.2 Establish the change communication messages

    4.3 Be consistent with a standard set of FAQs

    4.4 Define org. redesign resistors

    4.5 Create a sustainment plan

    This phase involves the following participants:

    • CIO
    • IT Leadership
    • Business Leadership
    • HR Business Partners

    All changes require change management

    Change management is:

    Managing a change that requires replanning and reorganizing and that causes people to feel like they have lost control over aspects of their jobs.

    – Padar et al., 2017
    People Process Technology

    Embedding change management into organizational design

    PREPARE A

    Awareness: Establish the need for organizational redesign and ensure this is communicated well.

    This blueprint is mostly focused on the prepare and transition components.

    D

    Desire: Ensure the new structure is something people are seeking and will lead to individual benefits for all.

    TRANSITION K

    Knowledge: Provide stakeholders with the tools and resources to function in their new roles and reporting structure.

    A

    Ability: Support employees through the implementation and into new roles or teams.

    FUTURE R

    Reinforcement: Emphasize and reward positive behaviors and attitudes related to the new organizational structure.

    Implementing the new organizational structure

    Implementing the organizational structure can be the most difficult part of the process.

    • To succeed in the process, consider creating an implementation plan that adequately considers these five components.
    • Each of these are critical to supporting the final organizational structure that was established during the redesign process.

    Implementation Plan

    Transition Plan: Identify the appropriate approach to making the transition, and ensure the transition plan works within the context of the business.

    Communication Strategy: Create a method to ensure consistent, clear, and concise information can be provided to all relevant stakeholders.

    Plan to Address Resistance: Given that not everyone will be happy to move forward with the new organizational changes, ensure you have a method to hear feedback and demonstrate concerns have been heard.

    Employee Development Plan: Provide employees with tools, resources, and the ability to demonstrate these new competencies as they adjust to their new roles.

    Monitor and Sustain the Change: Establish metrics that inform if the implementation of the new organizational structure was successful and reinforce positive behaviors.

    Define the type of change the organizational structure will be

    As a result, your organization must adopt OCM practices to better support the acceptance and longevity of the changes being pursued.

    Incremental Change

    Transformational Change

    Organizational change management is highly recommended and beneficial for projects that require people to:

    • Adopt new tools and workflows.
    • Learn new skills.
    • Comply with new policies and procedures.
    • Stop using old tools and workflows.

    Organizational change management is required for projects that require people to:

    • Move into different roles, reporting structures, and career paths.
    • Embrace new responsibilities, goals, reward systems, and values.
    • Grow out of old habits, ideas, and behaviors.
    • Lose stature in the organization.

    Info-Tech Insight

    How you transition to the new organizational structure can be heavily influenced by HR. This is the time to be including them and leveraging their expertise to support the transition “how.”

    Transition Plan Options

    Description

    Pros

    Cons

    Example

    Big Bang Change

    Change that needs to happen immediately – “ripping the bandage off.”

    • It puts an immediate stop to the current way of operating.
    • Occurs quickly.
    • More risky.
    • People may not buy into the change immediately.
    • May not receive the training needed to adjust to the change.

    A tsunami in Japan stopped all imports and exports. Auto manufacturers were unable to get parts shipped and had to immediately find an alternative supplier.

    Incremental Change

    The change can be rolled out slower, in phases.

    • Can ensure that people are bought in along the way through the change process, allowing time to adjust and align with the change.
    • There is time to ensure training takes place.
    • It can be a timely process.
    • If the change is dragged on for too long (over several years) the environment may change and the rationale and desired outcome for the change may no longer be relevant.

    A change in technology, such as HRIS, might be rolled out one application at a time to ensure that people have time to learn and adjust to the new system.

    Pilot Change

    The change is rolled out for only a select group, to test and determine if it is suitable to roll out to all impacted stakeholders.

    • Able to test the success of the change initiative and the implementation process.
    • Able to make corrections before rolling it out wider, to aid a smooth change.
    • Use the pilot group as an example of successful change.
    • Able to gain buy-in and create change champions from the pilot group who have experienced it and see the benefits.
    • Able to prevent an inappropriate change from impacting the entire organization.
    • Lengthy process.
    • Takes time to ensure the change has been fully worked through.

    A retail store is implementing a new incentive plan to increase product sales. They will pilot the new incentive plan at select stores, before rolling it out broadly.

    4.1 Select a transition plan approach

    1-3 hours

    1. List each of the changes required to move from your current structure to the new structure. Consider:
      1. Changes in reporting structure
      2. Hiring new members
      3. Eliminating positions
      4. Developing key competencies for staff
    2. Once you’ve defined all the changes required, consider the three different transition plan approaches: big bang, incremental, and pilot. Each of the transition plan approaches will have drawbacks and benefits. Use the list of changes to inform the best approach.
    3. If you are proceeding with the incremental or the pilot, determine the order in which you will proceed with the changes or the groups that will pilot the new structure first.
    InputOutput
    • Customized operating model sketch
    • New org. chart
    • Current org. chart
    • List of changes to move from current to future state
    • Transition plan to support changes
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • HR Business Partners

    Record the results in the Organizational Design Workbook

    Make a plan to effectively manage and communicate the change

    Success of your new organizational structure hinges on adequate preparation and effective communication.

    The top challenge facing organizations in completing the organizational redesign is their organizational culture and acceptance of change. Effective planning for the implementation and communication throughout the change is pivotal. Make sure you understand how the change will impact staff and create tailored plans for communication.

    65% of managers believe the organizational change is effective when provided with frequent and clear communication.

    Source: SHRM, 2021

    Communicate reasons for organizational structure changes and how they will be implemented

    Leaders of successful change spend considerable time developing a powerful change message, i.e. a compelling narrative that articulates the desired end state, and that makes the change concrete and meaningful to staff.

    The organizational change message should:

    • Explain why the change is needed.
    • Summarize what will stay the same.
    • Highlight what will be left behind.
    • Emphasize what is being changed.
    • Explain how change will be implemented.
    • Address how change will affect various roles in the organization.
    • Discuss the staff’s role in making the change successful.

    Five elements of communicating change

    • What is the change?
    • Why are we doing it?
    • How are we going to go about it?
    • How long will it take us to do it?
    • What will the role be for each department and individual?
    Source: Cornelius & Associates, 2010

    4.2 Establish the change communication messages

    2 hours

    1. The purpose of this activity is to establish a change communication message you can leverage when talking to stakeholders about the new organizational structure.
    2. Review the questions in the Organizational Design Workbook.
    3. Establish a clear message around the expected changes that will have to take place to help realize the new organizational structure.
    InputOutput
    • Customized operating model sketch
    • New org. chart
    • Current org. chart
    • List of changes
    • Transition plan
    • Change communication message for new organizational structure
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    Apply the following communication principles to make your IT organization redesign changes relevant to stakeholders

    Be Clear

    • Say what you mean and mean what you say.
    • Choice of language is important: “Do you think this is a good idea? I think we could really benefit from your insights and experience here.” Or do you mean: “I think we should do this. I need you to do this to make it happen.”
    • Don’t use jargon.

    Be Consistent

    • The core message must be consistent regardless of audience, channel, or medium.
    • Test your communication with your team or colleagues to obtain feedback before delivering to a broader audience.
    • A lack of consistency can be interpreted as an attempt at deception. This can hurt credibility and trust.

    Be Concise

    • Keep communication short and to the point so key messages are not lost in the noise.
    • There is a risk of diluting your key message if you include too many other details.

    Be Relevant

    • Talk about what matters to the stakeholder.
    • Talk about what matters to the initiative.
    • Tailor the details of the message to each stakeholder’s specific concerns.
    • IT thinks in processes but stakeholders only care about results: talk in terms of results.
    • IT wants to be understood but this does not matter to stakeholders. Think: “what’s in it for them?”
    • Communicate truthfully; do not make false promises or hide bad news.

    Frequently asked questions (FAQs) provide a chance to anticipate concerns and address them

    As a starting point for building an IT organizational design implementation, look at implementing an FAQ that will address the following:

    • The what, who, when, why, and where
    • The transition process
    • What discussions should be held with clients in business units
    • HR-centric questions

    Questions to consider answering:

    • What is the objective of the IT organization?
    • What are the primary changes to the IT organization?
    • What does the new organizational structure look like?
    • What are the benefits to our IT staff and to our business partners?
    • How will the IT management team share new information with me?
    • What is my role during the transition?
    • What impact is there to my reporting relationship within my department?
    • What are the key dates I should know about?

    4.3 Be consistent with a standard set of FAQs

    1 hour

    1. Beyond the completed communications plans, brainstorm a list of answers to the key “whats” of your organizational design initiative:
    • What is the objective of the IT organization?
    • What are the primary changes to the IT organization?
    • What does the new organizational structure look like?
    • What are the benefits to our IT staff and to our business partners?
  • Think about any key questions that may rise around the transition:
    • How will the IT management team share new information with me?
    • What is my role during the transition?
    • What impact is there to my reporting relationship within my department?
    • What are the key dates I should know about?
  • Determine the best means of socializing this information. If you have an internal wiki or knowledge-sharing platform, this would be a useful place to host the information.
  • InputOutput
    • Driver(s) for the new organizational structure
    • List of changes to move from current to future state
    • Change communication message
    • FAQs to provide to staff about the organizational design changes
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    The change reaction model

    The image contains a picture of the change reaction model. The model includes a double arrow pointing in both directions of left and right. On top of the arrow are 4 circles spread out on the arrow. They are labelled: Active Resistance, Detachment, Questioning, Acceptance.

    (Adapted from Cynthia Wittig)

    Info-Tech Insight

    People resist changes for many reasons. When it comes to organizational redesign changes, some of the most common reasons people resist change include a lack of understanding, a lack of involvement in the process, and fear.

    Include employees in the employee development planning process

    Prioritize

    Assess employee to determine competency levels and interests.

    Draft

    Employee drafts development goals; manager reviews.

    Select

    Manager helps with selection of development activities.

    Check In

    Manager provides ongoing check-ins, coaching, and feedback.

    Consider core and supplementary components that will sustain the new organizational structure

    Supplementary sustainment components:

    • Tools & Resources
    • Structure
    • Skills
    • Work Environment
    • Tasks
    • Disincentives

    Core sustainment components:

    • Empowerment
    • Measurement
    • Leadership
    • Communication
    • Incentives

    Sustainment Plan

    Sustain the change by following through with stakeholders, gathering feedback, and ensuring that the change rationale and impacts are clearly understood. Failure to so increases the potential that the change initiative will fail or be a painful experience and cost the organization in terms of loss of productivity or increase in turnover rates.

    Support sustainment with clear measurements

    • Measurement is one of the most important components of monitoring and sustaining the new organizational structure as it provides insight into where the change is succeeding and where further support should be added.
    • There should be two different types of measurements:
    1. Standard Change Management Metrics
    2. Organizational Redesign Metrics
  • When gathering data around metrics, consider other forms of measurement (qualitative) that can provide insights on opportunities to enhance the success of the organizational redesign change.
    1. Every measurement should be rooted to a goal. Many of the goals related to organizational design will be founded in the driver of this change initiative
    2. Once the goals have been defined, create one or more measurements that determines if the goal was successful.
    3. Use specific key performance indicators (KPIs) that contain a metric that is being measured and the frequency of that measurement.

    Info-Tech Insight

    Obtaining qualitative feedback from employees, customers, and business partners can provide insight into where the new organizational structure is operating optimally versus where there are further adjustments that could be made to support the change.

    4.4 Consider sustainment metrics

    1 hour

    1. Establish metrics that bring the entire process together and that will ensure the new organizational design is a success.
    2. Go back to your driver(s) for the organizational redesign. Use these drivers to help inform a particular measurement that can be used to determine if the new organizational design will be successful. Each measurement should be related to the positive benefits of the organization, an individual, or the change itself.
    3. Once you have a list of measurements, use these to determine the specific KPI that can be qualified through a metric. Often you are looking for an increase or decrease of a particular measurement by a dollar or percentage within a set time frame.
    4. Use the example metrics in the workbook and update them to reflect your organization’s drivers.
    InputOutput
    • Driver(s) for the new organizational structure
    • List of changes to move from current to future state
    • Change communication message
    • Sustainment metrics
    MaterialsParticipants
    • Whiteboard/Flip Charts
    • CIO
    • IT Leadership
    • Business Leadership

    Record the results in the Organizational Design Workbook

    Related Info-Tech Research

    Build a Strategic IT Workforce Plan

    • Continue into the second phase of the organizational redesign process by defining the required workforce to deliver.
    • Leveraging trends, data, and feedback from your employees, define the competencies needed to deliver on the defined roles.

    Implement a New IT Organizational Structure

    • Organizational design implementations can be highly disruptive for IT staff and business partners.
    • Without a structured approach, IT leaders may experience high turnover, decreased productivity, and resistance to the change.

    Define the Role of Project Management in Agile and Product-Centric Delivery

    • There are many voices with different opinions on the role of project management. This causes confusion and unnecessary churn.
    • Project management and product management naturally align to different time horizons. Harmonizing their viewpoints can take significant work.

    Research Contributors and Experts

    The image contains a picture of Jardena London.

    Jardena London

    Transformation Catalyst, Rosetta Technology Group

    The image contains a picture of Jodie Goulden.

    Jodie Goulden

    Consultant | Founder, OrgDesign Works

    The image contains a picture of Shan Pretheshan.

    Shan Pretheshan

    Director, SUPA-IT Consulting

    The image contains a picture of Chris Briley.

    Chris Briley

    CIO, Manning & Napier

    The image contains a picture of Dean Meyer.

    Dean Meyer

    President N. Dean Meyer and Associates Inc.

    The image contains a picture of Jimmy Williams.

    Jimmy Williams

    CIO, Chocktaw Nation of Oklahoma

    Info-Tech Research Group

    Cole Cioran, Managing Partner

    Dana Daher, Research Director

    Hans Eckman, Principal Research Director

    Ugbad Farah, Research Director

    Ari Glaizel, Practice Lead

    Valence Howden, Principal Research Director

    Youssef Kamar, Senior Manager, Consulting

    Carlene McCubbin, Practice Lead

    Baird Miller, Executive Counsellor

    Josh Mori, Research Director

    Rajesh Parab, Research Director

    Gary Rietz, Executive Counsellor

    Bibliography

    “A Cheat Sheet for HR Professionals: The Organizational Development Process.” AIHR, 2021. Web.

    Acharya, Ashwin, Roni Lieber, Lissa Seem, and Tom Welchman. “How to identify the right ‘spans of control’ for your organization.” McKinsey, 21 December 2017. Web.

    Anand. N., and Jean-Louis Barsoux. “What everyone gets wrong about change management. Harvard Business Review, December 2017. Web.

    Atiken, Chris. “Operating model design-first principles.” From Here On, 24 August 2018. Web.

    “Avoid common digital transformation challenges: Address your IT Operating Model Now.” Sofigate, 5 May 2020. Web.

    Baumann, Oliver, and Brian Wu. “The many dimensions of research on designing flat firms.” Journal of Organizational Design, no. 3, vol. 4. 09 May 2022.Web.

    Bertha, Michael. “Cross the project to product chasm.” CIO, 1 May 2020. Web.

    Blenko, Marcia, and James Root. “Design Principles for a Robust Operating Model.” Bain & Company, 8 April 2015. Web.

    Blenko, Marcia, Leslie Mackrell, and Kevin Rosenberg. “Operating models: How non-profits get from strategy to results.” The Bridge Span Group, 15 August 2019. Web.

    Boulton, Clint. “PVH finds perfect fit in hybrid IT operating model amid pandemic.” CIO, 19 July 2021. Web.

    Boulton, Clint. “Why digital disruption leaves no room for bimodal IT.” CIO, 11 May 2017. Web.

    Bright, David, et al. “Chapter 10: Organizational Structure & Change.” Principles of Management, OpenStax, Rice University, 20 March 2019. Book.

    Campbell, Andrew. “Design Principles: How to manage them.” Ashridge Operating Models. 1 January 2022. Web.

    D., Maria. “3 Types of IT Outsourcing Models and How to Choose Between Them.” Cleveroad, 29 April 2022. Web.

    Devaney, Eric. “9 Types of Organizational Structure Every Company Should Consider.” HubSpot, 11 February 2022. Web.

    Devaney, Erik. “The six building blocks of organizational structure.” Hubspot, 3 June 2020. Web.

    Eisenman, M., S. Paruchuri, and P. Puranam. “The design of emergence in organizations.” Journal of Organization Design, vol. 9, 2020. Web.

    Forbes Business Development Council. “15 Clear Signs It’s Time to Restructure the Business.” Forbes, 10 February 2020. Web.

    Freed, Joseph. “Why Cognitive Load Could Be The Most Important Employee Experience Metric In The Next 10 Years.” Forbes, 30 June 2020. Web.

    Galibraith, Jay. “The Star Model.” JayGalbraith.com, n.d. Web.

    Girod, Stéphane, and Samina Karim. “Restructure or reconfigure?” Harvard Business Review, April 2017. Web.

    Goldman, Sharon. “The need for a new IT Operating Model: Why now?” CIO, 27 August 2019. Web.

    Halapeth, Milind. “New age IT Operating Model: Creating harmony between the old and the new.” Wirpo, n.d. Web.

    Harvey, Michelle. “Why a common operating model is efficient for business productivity.” CMC, 10 May 2020. Web.

    Helfand, Heidi. “Dynamic Reteaming.” O’Reilly Media, 7 July 2020. Book.

    JHeller, Martha. “How Microsoft CIO Jim DuBois changed the IT Operating Model.” CIO, 2 February 2016. Web.

    Heller, Martha. “How Stryker IT Shifted to a global operating model.” CIO, 19 May 2021. Web.

    Heller, Michelle. “Inside blue Shields of California’s IT operating model overhaul.” CIO, 24 February 2021. Web.

    Hessing, Ted. “Value Stream Mapping.” Six Sigma Study Guide, 11 April 2014. Web.

    Huber, George, P. “What is Organization Design.” Organizational Design Community, n.d. Web.

    Indeed Editorial Team. “5 Advantages and Disadvantages of the Matrix Organizational Structure.” Indeed, 23 November 2020. Web.

    Indeed Editorial Team. “How to plan an effective organization restructure.” Indeed, 10 June 2021. Web.

    “Insourcing vs Outsourcing vs Co-Sourcing.” YML Group, n.d. Web.

    “Investing in more strategic roles.” CAPS Research, 3 February 2022. Web.

    Jain, Gagan. “Product IT Operating Model: The next-gen model for a digital work.” DevOps, 22 July 2019. Web.

    Kane, Gerald, D. Plamer, and Anh Phillips. “Accelerating Digital Innovation Inside and Out.” Deloitte Insights, 4 June 2019. Web.

    Krush, Alesia. “IT companies with ‘flat’ structures: utopia or innovative approach?” Object Style, 18 October 2018. Web.

    Law, Michael. “Adaptive Design: Increasing Customer Value in Your Organisation.” Business Agility Institute, 5 October 2020. Web.

    LucidContent Team. “How to get buy-in for changes to your organizational structure.” Lucid Chart, n.d. Web.

    Matthews, Paul. “Do you know the difference between competence and capability?” The People Development Magazine, 25 September 2020. Web.

    Meyer, Dean N. “Analysis: Common symptoms of organizational structure problems.” NDMA, n.d. Web.

    Meyer, N. Dean. “Principle-based Organizational Structure.” NDMA Publishing, 2020. Web.

    Morales Pedraza, Jorge. Answer to posting, “What is the relationship between structure and strategy?” ResearchGate.net, 5 March 2014. Web.

    Nanjad, Len. “Five non-negotiables for effective organization design change.” MNP, 01 October 2021. Web.

    Neilson, Gary, Jaime Estupiñán, and Bhushan Sethi. “10 Principles of Organizational Design.” Strategy & Business, 23 March 2015. Web.

    Nicastro, Dom. “Understanding the Foundational Concepts of Organizational Design.” Reworked, 24 September 2020. Web.

    Obwegeser, Nikolaus, Tomoko Yokoi, Michael Wade, and Tom Voskes. “7 Key Principles to Govern Digital Initiatives.” MIT Sloan, 1 April 2020. Web.

    “Operating Models and Tools.” Business Technology Standard, 23 February 2021. Web.

    “Organizational Design Agility: Journey to a combined community.” ODF-BAI How Space, Organizational Design Forum, 2022. Web.

    “Organizational Design: Understanding and getting started.” Ingentis, 20 January 2021. Web.

    Padar, Katalin, et al. “Bringing project and change management roles into sync.” Journal of Change Management, 2017. Web.

    Partridge, Chris. “Evolve your Operating Model- It will drive everything.” CIO, 30 July 2021. Web.

    Pijnacker, Lieke. “HR Analytics: role clarity impacts performance.” Effectory, 25 September 2019. Web.

    Pressgrove, Jed. “Centralized vs. Federated: Breaking down IT Structures.” Government Technology, March 2020. Web.

    Sherman, Fraser. “Differences between Organizational Structure and Design.” Bizfluent, 20 September 2019. Web.

    Skelton, Matthew, and Manual Pais. “Team Cognitive Load.” IT Revolution, 19 January 2021. Web.

    Skelton, Matthew, and Manual Pais. Team Topologies. IT Revolution Press, 19 September 2019. Book

    Spencer, Janet, and Michael Watkins. “Why organizational change fails.” TLNT, 26 November 2019. Web.

    Storbakken, Mandy. “The Cloud Operating Model.” VMware, 27 January 2020. Web.

    "The Qualities of Leadership: Leading Change.” Cornelius & Associates, 2010. Web.

    “Understanding Organizational Structures.” SHRM, 31 August 2021. Web.

    "unfix Pattern: Base.” AgilityScales, n.d. Web.

    Walker, Alex. “Half-Life: Alyx helped change Valve’s Approach to Development.” Kotaku, 10 July 2020. Web.

    "Why Change Management.” Prosci, n.d. Web.

    Wittig, Cynthia. “Employees' Reactions to Organizational Change.” OD Practioner, vol. 44, no. 2, 2012. Web.

    Woods, Dan. “How Platforms are neutralizing Conway’s Law.” Forbes, 15 August 2017. Web.

    Worren, Nicolay, Jeroen van Bree, and William Zybach. “Organization Design Challenges. Results from a practitioner survey.” Journal of Organizational Design, vol. 8, 25 July 2019. Web.

    Appendix

    IT Culture Framework

    This framework leverages McLean & Company’s adaptation of Quinn and Rohrbaugh’s Competing Values Approach.

    The image contains a diagram of the IT Culture Framework. The framework is divided into four sections: Competitive, Innovative, Traditional, and Cooperative, each with their own list of descriptors.

    Satisfy Customer Requirements for Information Security

    • Buy Link or Shortcode: {j2store}259|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: $247 Average $ Saved
    • member rating average days saved: 3 Average Days Saved
    • Parent Category Name: Governance, Risk & Compliance
    • Parent Category Link: /governance-risk-compliance
    • Your customers and potential customers are increasingly demanding assurance that you will meet their information security requirements.
    • Responding to these assurance demands requires ever more effort from the security team, which distracts them from their primary mission of protecting the organization.
    • Every customer seems to have their own custom security questionnaire they want you to complete, increasing the effort you have to expend to respond to them.

    Our Advice

    Critical Insight

    • Your security program can be a differentiator and help win and retain customers.
    • Value rank your customers to right-size the level of effort your security team dedicates to responding to questionnaires.
    • SOC 2 or ISO 27001 certification can be an important part of your security marketing, but only if you make the right business case.

    Impact and Result

    • CISOs need to develop a marketing strategy for their information security program.
    • Ensure that your security team dedicates the appropriate amount of effort to sales by value ranking your potential customers and aligning efforts to value.
    • Develop a business case for SOC 2 or ISO 27001 to determine if certification makes sense for your organization, and to gain support from key stakeholders.

    Satisfy Customer Requirements for Information Security Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should proactively satisfy customer requirements for information security, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Manage customer expectations for information security

    Identify your customers’ expectations for security and privacy, value rank your customers to right-size your efforts, and learn how to impress them with your information security program.

    • Satisfy Customer Requirements for Information Security – Phase 1: Manage Customer Expectations for Information Security

    2. Select a certification path

    Decide whether to obtain SOC 2 or ISO 27001 certification, and build a business case for certification.

    • Satisfy Customer Requirements for Information Security – Phase 2: Select a Certification Path
    • Security Certification Selection Tool
    • Security Certification Business Case Tool

    3. Obtain and maintain certification

    Develop your certification scope, prepare for the audit, and learn how to maintain your certification over time.

    • Satisfy Customer Requirements for Information Security – Phase 3: Obtain and Maintain Certification
    [infographic]

    Establish an Effective IT Steering Committee

    • Buy Link or Shortcode: {j2store}191|cart{/j2store}
    • member rating overall impact: 9.6/10 Overall Impact
    • member rating average dollars saved: $44,821 Average $ Saved
    • member rating average days saved: 11 Average Days Saved
    • Parent Category Name: IT Governance, Risk & Compliance
    • Parent Category Link: /it-governance-risk-and-compliance
    • Unfortunately, when CIOs implement IT steering committees, they often lack the appropriate structure and processes to be effective.
    • Due to the high profile of the IT steering committee membership, CIOs need to get this right – or their reputation is at risk.

    Our Advice

    Critical Insight

    • 88% of IT steering committees fail. The organizations that succeed have clearly defined responsibilities that are based on business needs.
    • Without a documented process your committee can’t execute on its responsibilities. Clearly define the flow of information to make your committee actionable.
    • Limit your headaches by holding your IT steering committee accountable for defining project prioritization criteria.

    Impact and Result

    Leverage Info-Tech’s process and deliverables to see dramatic improvements in your business satisfaction through an effective IT steering committee. This blueprint will provide three core customizable deliverables that you can use to launch or optimize your IT steering committee:

    • IT Steering Committee Charter: Use this template in combination with this blueprint to form a highly tailored committee.
    • IT Steering Committee Stakeholder Presentation: Build understanding around the goals and purpose of the IT steering committee, and generate support from your leadership team.
    • IT Steering Committee Project Prioritization Tool: Engage your IT steering committee participants in defining project prioritization criteria. Track project prioritization and assess your portfolio.

    Establish an Effective IT Steering Committee Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should establish an IT steering committee, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Build the steering committee charter

    Build your IT steering committee charter using results from the stakeholder survey.

    • Establish an Effective IT Steering Committee – Phase 1: Build the Steering Committee Charter
    • IT Steering Committee Stakeholder Survey
    • IT Steering Committee Charter

    2. Define IT steering commitee processes

    Define your high level steering committee processes using SIPOC, and select your steering committee metrics.

    • Establish an Effective IT Steering Committee – Phase 2: Define ITSC Processes

    3. Build the stakeholder presentation

    Customize Info-Tech’s stakeholder presentation template to gain buy-in from your key IT steering committee stakeholders.

    • Establish an Effective IT Steering Committee – Phase 3: Build the Stakeholder Presentation
    • IT Steering Committee Stakeholder Presentation

    4. Define the prioritization criteria

    Build the new project intake and prioritization process for your new IT steering committee.

    • Establish an Effective IT Steering Committee – Phase 4: Define the Prioritization Criteria
    • IT Steering Committee Project Prioritization Tool
    • IT Project Intake Form
    [infographic]

    Workshop: Establish an Effective IT Steering Committee

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Build the IT Steering Committee

    The Purpose

    Lay the foundation for your IT steering committee (ITSC) by surveying your stakeholders and identifying the opportunities and threats to implementing your ITSC.

    Key Benefits Achieved

     An understanding of the business environment affecting your future ITSC and identification of strategies for engaging with stakeholders

    Activities

    1.1 Launch stakeholder survey for business leaders.

    1.2 Analyze results with an Info-Tech advisor.

    1.3 Identify opportunities and threats to successful IT steering committee implementation.

    1.4 Develop the fit-for-purpose approach.

    Outputs

    Report on business leader governance priorities and awareness

    Refined workshop agenda

    2 Define the ITSC Goals

    The Purpose

    Define the goals and roles of your IT steering committee.

    Plan the responsibilities of your future committee members.

    Key Benefits Achieved

     Groundwork for completing the steering committee charter

    Activities

    2.1 Review the role of the IT steering committee.

    2.2 Identify IT steering committee goals and objectives.

    2.3 Conduct a SWOT analysis on the five governance areas

    2.4 Define the key responsibilities of the ITSC.

    2.5 Define ITSC participation.

    Outputs

    IT steering committee key responsibilities and participants identified

    IT steering committee priorities identified

    3 Define the ITSC Charter

    The Purpose

    Document the information required to create an effective ITSC Charter.

    Create the procedures required for your IT steering committee.

    Key Benefits Achieved

    Clearly defined roles and responsibilities for your steering committee

    Completed IT Steering Committee Charter document

    Activities

    3.1 Build IT steering committee participant RACI.

    3.2 Define your responsibility cadence and agendas.

    3.3 Develop IT steering committee procedures.

    3.4 Define your IT steering committee purpose statement and goals.

    Outputs

    IT steering committee charter: procedures, agenda, and RACI

    Defined purpose statement and goals

    4 Define the ITSC Process

    The Purpose

    Define and test your IT steering committee processes.

    Get buy-in from your key stakeholders through your stakeholder presentation.

    Key Benefits Achieved

    Stakeholder understanding of the purpose and procedures of IT steering committee membership

    Activities

    4.1 Define your high-level IT steering committee processes.

    4.2 Conduct scenario testing on key processes, establish ITSC metrics.

    4.3 Build your ITSC stakeholder presentation.

    4.4 Manage potential objections.

    Outputs

    IT steering committee SIPOC maps

    Refined stakeholder presentation

    5 Define Project Prioritization Criteria

    The Purpose

    Key Benefits Achieved

    Activities

    5.1 Create prioritization criteria

    5.2 Customize the project prioritization tool

    5.3 Pilot test the tool

    5.4 Define action plan and next steps

    Outputs

    IT Steering Committee Project Prioritization Tool

    Action plan

    Further reading

    Establish an Effective IT Steering Committee

    Have the right people making the right decisions to drive IT success.

    Our understanding of the problem

    This Research Is Designed For:

    • CIOs
    • IT Leaders

    This Research Will Also Assist:

    • Business Partners

    This Research Will Help You:

    • Structure an IT steering committee with the appropriate membership and responsibilities
    • Define appropriate cadence around business involvement in IT decision making
    • Define your IT steering committee processes, metrics, and timelines
    • Obtain buy-in for IT steering committee participations
    • Define the project prioritization criteria

    This Research Will Help Them:

    • Understand the importance of IT governance and their role
    • Identify and build the investment prioritization criteria

    Executive Summary

    Situation

    • An effective IT steering committee (ITSC) is one of the top predictors of value generated by IT, yet only 11% of CIOs believe their committees are effective.
    • An effective steering committee ensures that the right people are involved in critical decision making to drive organizational value.

    Complication

    • Unfortunately, when CIOs do implement IT steering committees, they often lack the appropriate structure and processes to be effective.
    • Due to the high profile of the IT steering committee membership, CIOs need to get this right – or their reputation is at risk.

    Resolution

    Leverage Info-Tech’s process and deliverables to see dramatic improvements in your business satisfaction through an effective IT steering committee. This blueprint will provide three core customizable deliverables that you can use to launch or optimize your IT steering committee. These include:

    1. IT Steering Committee Charter: Customizable charter complete with example purpose, goals, responsibilities, procedures, RACI, and processes. Use this template in combination with this blueprint to get a highly tailored committee.
    2. IT Stakeholder Presentation: Use our customizable presentation guide to build understanding around the goals and purpose of the IT steering committee and generate support from your leadership team.
    3. IT Steering Committee Project Prioritization Tool: Engage your IT steering committee participants in defining the project prioritization criteria. Use our template to track project prioritization and assess your portfolio.

    Info-Tech Insight

    1. 88% of IT steering committees fail. The organizations that succeed have clearly defined responsibilities that are based on business needs.
    2. Without a documented process your committee can’t execute on its responsibilities. Clearly define the flow of information to make your committee actionable.
    3. Limit your headaches by holding your IT steering committee accountable for defining project prioritization criteria.

    IT Steering Committee

    Effective IT governance critical in driving business satisfaction with IT. Yet 88% of CIOs believe that their governance structure and processes are not effective. The IT steering committee (ITSC) is the heart of the governance body and brings together critical organizational stakeholders to enable effective decision making (Info-Tech Research Group Webinar Survey).

    IT STEERING COMMITTEES HAVE 3 PRIMARY OBJECTIVES – TO IMPROVE:

    1. Alignment: IT steering committees drive IT and business strategy alignment by having business partners jointly accountable for the prioritization and selection of projects and investments within the context of IT capacity.
    2. Accountability: The ITSC facilitates the involvement and commitment of executive management through clearly defined roles and accountabilities for IT decisions in five critical areas: investments, projects, risk, services, and data.
    3. Value Generation: The ITSC is responsible for the ongoing evaluation of IT value and performance of IT services. The committee should define these standards and approve remediation plans when there is non-achievement.

    "Everyone needs good IT, but no one wants to talk about it. Most CFOs would rather spend time with their in-laws than in an IT steering-committee meeting. But companies with good governance consistently outperform companies with bad. Which group do you want to be in?"

    – Martha Heller, President, Heller Search Associates

    An effective IT steering committee improves IT and business alignment and increases support for IT across the organization

    CEOs’ PERCEPTION OF IT AND BUSINESS ALIGNMENT

    67% of CIOs/CEOs are misaligned on the target role for IT.

    47% of CEOs believe that business goals are going unsupported by IT.

    64% of CEOs believe that improvement is required around IT’s understanding of business goals.

    28% of business leaders are supporters of their IT departments.

    A well devised IT steering committee ensures that core business partners are involved in critical decision making and that decisions are based on business goals – not who shouts the loudest. Leading to faster decision-making time, and better-quality decisions and outcomes.

    Source: Info-Tech CIO/CEO Alignment data

    Despite the benefits, 9 out of 10 steering committees are unsuccessful

    WHY DO IT STEERING COMMITTEES FAIL?

    1. A lack of appetite for an IT steering committee from business partners
    2. An effective ITSC requires participation from core members of the organization’s leadership team. The challenge is that most business partners don’t understand the benefits of an ITSC and the responsibilities aren’t tailored to participants’ needs or interests. It’s the CIOs responsibility to make this case to stakeholders and right-size the committee responsibilities and membership.
    3. IT steering committees are given inappropriate responsibilities
    4. The IT steering committee is fundamentally about decision making; it’s not a working committee. CIOs struggle with clarifying these responsibilities on two fronts: either the responsibilities are too vague and there is no clear way to execute on them within a meeting, or responsibilities are too tactical and require knowledge that participants do not have. Responsibilities should determine who is on the ITSC, not the other way around.
    5. Lack of process around execution
    6. An ITSC is only valuable if members are able to successfully execute on the responsibilities. Without well defined processes it becomes nearly impossible for the ITSC to be actionable. As a result, participants lack the information they need to make critical decisions, agendas are unmet, and meetings are seen as a waste of time.

    GOVERNANCE and ITSC and IT Management

    Organizations often blur the line between governance and management, resulting in the business having say over the wrong things. Understand the differences and make sure both groups understand their role.

    The ITSC is the most senior body within the IT governance structure, involving key business executives and focusing on critical strategic decisions impacting the whole organization.

    Within a holistic governance structure, organizations may have additional committees that evaluate, direct, and monitor key decisions at a more tactical level and report into the ITSC.

    These committees require specialized knowledge and are implemented to meet specific organizational needs. Those operational committees may spark a tactical task force to act on specific needs.

    IT management is responsible for executing on, running, and monitoring strategic activities as determined by IT governance.

    RELATIONSHIP BETWEEN STRATEGIC, TACTICAL, AND OPERATIONAL GROUPS

    Strategic IT Steering Committee
    Tactical

    Project Governance Service Governance

    Risk Governance Information Governance

    IT Management
    Operational Risk Task Force

    This blueprint focuses exclusively on building the IT steering committee. For more information on IT governance see Info-Tech’s blueprint Tailor an IT Governance Plan to Fit Organizational Needs.

    1. Governance of the IT Portfolio & Investments: ensures that funding and resources are systematically allocated to the priority projects that deliver value
    2. Governance of Projects: ensures that IT projects deliver the expected value, and that the PM methodology is measured and effective.
    3. Governance of Risks: ensures the organization’s ability to assess and deliver IT projects and services with acceptable risk.
    4. Governance of Services: ensures that IT delivers the required services at the acceptable performance levels.
    5. Governance of Information and Data: ensures the appropriate classification and retention of data based on business need.

    If these symptoms resonate with you, it might be time to invest in building an IT steering committee

    SIGNS YOU MAY NEED TO BUILD AN IT STEERING COMMITTEE

    As CIO I find that there is a lack of alignment between business and IT strategies.
    I’ve noticed that projects are thrown over the fence by stakeholders and IT is expected to comply.
    I’ve noticed that IT projects are not meeting target project metrics.
    I’ve struggled with a lack of accountability for decision making, especially by the business.
    I’ve noticed that the business does not understand the full cost of initiatives and projects.
    I don’t have the authority to say “no” when business requests come our way.
    We lack a standardized approach for prioritizing projects.
    IT has a bad reputation within the organization, and I need a way to improve relationships.
    Business partners are unaware of how decisions are made around IT risks.
    Business partners don’t understand the full scope of IT responsibilities.
    There are no SLAs in place and no way to measure stakeholder satisfaction with IT.

    Info-Tech’s approach to implementing an IT steering committee

    Info-Tech’s IT steering committee development blueprint will provide you with the required tools, templates, and deliverables to implement a right-sized committee that’s effective the first time.

    • Measure your business partner level of awareness and interest in the five IT governance areas, and target specific responsibilities for your steering committee based on need.
    • Customize Info-Tech’s IT Steering Committee Charter Template to define and document the steering committee purpose, responsibilities, participation, and cadence.
    • Build critical steering committee processes to enable information to flow into and out of the committee to ensure that the committee is able to execute on responsibilities.
    • Customize Info-Tech’s IT Steering Committee Stakeholder Presentation template to make your first meeting a breeze, providing stakeholders with the information they need, with less than two hours of preparation time.
    • Leverage our workshop guide and prioritization tools to facilitate a meeting with IT steering committee members to define the prioritization criteria for projects and investments and roll out a streamlined process.

    Info-Tech’s Four-Phase Process

    Key Deliverables:
    1 2 3 4
    Build the Steering Committee Charter Define ITSC Processes Build the Stakeholder Presentation Define the Prioritization Criteria
    • IT Steering Committee Stakeholder Survey
    • IT Steering Committee Charter
      • Purpose
      • Responsibilities
      • RACI
      • Procedures
    • IT Steering Committee SIPOC (Suppliers, Inputs, Process, Outputs, Customers)
    • Defined process frequency
    • Defined governance metrics
    • IT Steering Committee Stakeholder Presentation template
      • Introduction
      • Survey outcomes
      • Responsibilities
      • Next steps
      • ITSC goals
    • IT project prioritization facilitation guide
    • IT Steering Committee Project Prioritization Tool
    • Project Intake Form

    Leverage both COBIT and Info-Tech-defined metrics to evaluate the success of your program or project

    COBIT METRICS Alignment
    • Percent of enterprise strategic goals and requirements supported by strategic goals.
    • Level of stakeholder satisfaction with scope of the planned portfolio of programs and services.
    Accountability
    • Percent of executive management roles with clearly defined accountabilities for IT decisions.
    • Rate of execution of executive IT-related decisions.
    Value Generation
    • Level of stakeholder satisfaction and perceived value.
    • Number of business disruptions due to IT service incidents.
    INFO-TECH METRICS Survey Metrics:
    • Percent of business leaders who believe they understand how decisions are made in the five governance areas.
    • Percentage of business leaders who believe decision making involved the right people.
    Value of Customizable Deliverables:
    • Estimated time to build IT steering committee charter independently X cost of employee
    • Estimated time to build and generate customer stakeholder survey and generate reports X cost of employee
    • # of project interruptions due to new or unplanned projects

    CASE STUDY

    Industry: Consumer Goods

    Source: Interview

    Situation

    A newly hired CIO at a large consumer goods company inherited an IT department with low maturity from her predecessor. Satisfaction with IT was very low across all business units, and IT faced a lot of capacity constraints. The business saw IT as a bottleneck or red tape in terms of getting their projects approved and completed.

    The previous CIO had established a steering committee for a short time, but it had a poorly established charter that did not involve all of the business units. Also the role and responsibilities of the steering committee were not clearly defined. This led the committee to be bogged down in politics.

    Due to the previous issues, the business was wary of being involved in a new steering committee. In order to establish a new steering committee, the new CIO needed to navigate the bad reputation of the previous CIO.

    Solution

    The CIO established a new steering committee engaging senior members of each business unit. The roles of the committee members were clearly established in the new steering committee charter and business stakeholders were informed of the changes through presentations.

    The importance of the committee was demonstrated through the new intake and prioritization process for projects. Business stakeholders were impressed with the new process and its transparency and IT was no longer seen as a bottleneck.

    Results

    • Satisfaction with IT increased by 12% after establishing the committee and IT was no longer seen as red tape for completing projects
    • IT received approval to hire two more staff members to increase capacity
    • IT was able to augment service levels, allowing them to reinvest in innovative projects
    • Project prioritization process was streamlined

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Establish an Effective IT Steering Committee

    Build the Steering Committee Charter Define ITSC Processes Build the Stakeholder Presentation Define the Prioritization Criteria
    Best-Practice Toolkit

    1.1 Survey Your Steering Committee Stakeholders

    1.2 Build Your ITSC Charter

    2.1 Build a SIPOC

    2.2 Define Your ITSC Process

    3.1 Customize the Stakeholder Presentation

    4.1 Establish your Prioritization Criteria

    4.2 Customize the Project Prioritization Tool

    4.3 Pilot Test Your New Prioritization Criteria

    Guided Implementations
    • Launch your stakeholder survey
    • Analyze the results of the survey
    • Build your new ITSC charter
    • Review your completed charter
    • Build and review your SIPOC
    • Review your high-level steering committee processes
    • Customize the presentation
    • Build a script for the presentation
    • Practice the presentation
    • Review and select prioritization criteria
    • Review the Project Prioritization Tool
    • Review the results of the tool pilot test
    Onsite Workshop

    Module 1:

    Build a New ITSC Charter

    Module 2:

    Design Steering Committee Processes

    Module 3:

    Present the New Steering Committee to Stakeholders

    Module 4:

    Establish Project Prioritization Criteria

    Phase 1 Results:
    • Customized ITSC charter

    Phase 2 Results:

    • Completed SIPOC and steering committee processes
    Phase 3 Results:
    • Customized presentation deck and script
    Phase 4 Results:
    • Customized project prioritization tool

    Workshop overview

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4 Workshop Day 5
    Activities

    Build the IT Steering Committee

    1.1 Launch stakeholder survey for business leaders

    1.2 Analyze results with an Info-Tech Advisor

    1.3 Identify opportunities and threats to successful IT steering committee implementation.

    1.4 Develop the fit-for-purpose approach

    Define the ITSC Goals

    2.1 Review the role of the IT steering committee

    2.2 Identify IT steering committee goals and objectives

    2.3 Conduct a SWOT analysis on the five governance areas

    2.4 Define the key responsibilities of the ITSC 2.5 Define ITSC participation

    Define the ITSC Charter

    3.1 Build IT steering committee participant RACI

    3.2 Define your responsibility cadence and agendas

    3.3 Develop IT steering committee procedures

    3.4 Define your IT steering committee purpose statement and goals

    Define the ITSC Process

    4.1 Define your high-level IT steering committee processes

    4.2 Conduct scenario testing on key processes, establish ITSC metrics

    4.3 Build your ITSC stakeholder presentation

    4.4 Manage potential objections

    Define Project Prioritization Criteria

    5.1 Create prioritization criteria

    5.2 Customize the Project Prioritization Tool

    5.3 Pilot test the tool

    5.4 Define action plan and next steps

    Deliverables
    1. Report on business leader governance priorities and awareness
    2. Refined workshop agenda
    1. IT steering committee priorities identified
    2. IT steering committee key responsibilities and participants identified
    1. IT steering committee charter: procedures, agenda, and RACI
    2. Defined purpose statement and goals
    1. IT steering committee SIPOC maps
    2. Refined stakeholder presentation
    1. Project Prioritization Tool
    2. Action plan

    Phase 1

    Build the IT Steering Committee Charter

    Phase 1 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 1: Formalize the Security Policy Program

    Proposed Time to Completion: 1-2 weeks

    Select Your ITSC Members

    Start with an analyst kick-off call:

    • Launch your stakeholder survey

    Then complete these activities…

    • Tailor the survey questions
    • Identify participants and tailor email templates

    With these tools & templates:

    • ITSC Stakeholder Survey
    • ITSC Charter Template

    Review Stakeholder Survey Results

    Review findings with analyst:

    • Review the results of the Stakeholder Survey

    Then complete these activities…

    • Customize the ITSC Charter Template

    With these tools & templates:

    • ITSC Charter Template

    Finalize the ITSC Charter

    Finalize phase deliverable:

    • Review the finalized ITSC charter with an Info-Tech analyst

    Then complete these activities…

    • Finalize any changes to the ITSC Charter
    • Present it to ITSC Members

    With these tools & templates:

    • ITSC Charter Template

    Build the IT Steering Committee Charter

    This step will walk you through the following activities:

    • Launch and analyze the stakeholder survey
    • Define your ITSC goals and purpose statement
    • Determine ITSC responsibilities and participants
    • Determine ITSC procedures

    This step involves the following participants:

    • CIO
    • IT Steering Committee
    • IT Leadership Team
    • PMO

    Key Insight:

    Be exclusive with your IT steering committee membership. Determine committee participation based on committee responsibilities. Select only those who are key decision makers for the activities the committee is responsible for and, wherever possible, keep membership to 5-8 people.

    Tailor Info-Tech’s IT Steering Committee Charter Template to define terms of reference for the ITSC

    1.1

    A charter is the organizational mandate that outlines the purpose, scope, and authority of the ITSC. Without a charter, the steering committee’s value, scope, and success criteria are unclear to participants, resulting in unrealistic stakeholder expectations and poor organizational acceptance.

    Start by reviewing Info-Tech’s template. Throughout this section we will help you to tailor its contents.

    Committee Purpose: The rationale, benefits of, and overall function of the committee.

    Responsibilities: What tasks/decisions the accountable committee is making.

    Participation: Who is on the committee

    RACI: Who is accountable, responsible, consulted, and informed regarding each responsibility.

    Committee Procedures and Agendas: Includes how the committee will be organized and how the committee will interact and communicate with business units.

    A screenshot of Info-Tech's <em data-verified=IT Steering Committee Charter Template.">

    IT Steering Committee Charter

    Take a data-driven approach to build your IT steering committee based on business priorities

    1.2

    Leverage Info-Tech’s IT Steering Committee Stakeholder Surveyand reports to quickly identify business priorities and level of understanding of how decisions are made around the five governance areas.

    Use these insights to drive the IT steering committee responsibilities, participation, and communication strategy.

    The Stakeholder Survey consists of 17 questions on:

    • Priority governance areas
    • Desired level of involvement in decision making in the five governance areas
    • Knowledge of how decisions are made
    • Five open-ended questions on improvement opportunities

    To simplify your data collection and reporting, Info-Tech can launch a web-based survey, compile the report data and assist in the data interpretation through one of our guided implementations.

    Also included is a Word document with recommended questions, if you prefer to manage the survey logistics internally.

    A screenshot of Info-Tech's first page of the <em data-verified=IT Steering Committee Stakeholder Survey "> A screenshot of Info-Tech's survey.

    Leverage governance reports to define responsibilities and participants, and in your presentation to stakeholders

    1.3

    A screenshot is displayed. It advises that 72% of stakeholders do <strong data-verified= understand how decisions around IT services are made (quality, availability, etc.). Two graphs are included in the screenshot. One of the bar graphs shows the satisfaction with the quality of decisions and transparency around IT services. The other bar graph displays IT decisions around service delivery and quality that involve the right people.">

    OVERALL PRIORITIES

    You get:

    • A clear breakdown of stakeholders’ level of understanding on how IT decisions are made in the five governance areas
    • Stakeholder perceptions on the level of IT and business involvement in decision making
    • Identification of priority areas

    So you can:

    • Get an overall pulse check for understanding
    • Make the case for changes in decision-making accountability
    • Identify which areas the IT steering committee should focus on
    A screenshot is displayed. It advises that 80% of stakeholders do <strong data-verified=not understand how decisions around IT investments or project and service resourcing are made. Two bar graphs are displayed. One of the bar graphs shows the satisfaction with the quality of decisions made around IT investments. The other graph display IT decisions around spending priorities involving the right people.">

    GOVERNANCE AREA REPORTS

    You get:

    • Satisfaction score for decision quality in each governance area
    • Breakdown of decision-making accountability effectiveness
    • Identified level of understanding around decision making
    • Open-ended comments

    So you can:

    • Identify the highest priority areas to change.
    • To validate changes in decision-making accountability
    • To understand business perspectives on decision making.

    Conduct a SWOT analysis of the five governance areas

    1.4

    1. Hold a meeting with your IT leadership team to conduct a SWOT analysis on each of the five governance areas. Start by printing off the following five slides to provide participants with examples of the role of governance and the symptoms of poor governance in each area.
    2. In groups of 1-2 people, have each group complete a SWOT analysis for one of the governance areas. For each consider:
    • Strengths: What is currently working well in this area?
    • Weaknesses: What could you improve? What are some of the challenges you’re experiencing?
    • Opportunities: What are some organizational trends that you can leverage? Consider whether your strengths or weaknesses that could create opportunities?
    • Threats: What are some key obstacles across people, process, and technology?
  • Have each team or individual rotate until each person has contributed to each SWOT. Add comments from the stakeholder survey to the SWOT.
  • As a group rank each of the five areas in terms of importance for a phase one IT steering committee implementation, and highlight the top 10 challenges, and the top 10 opportunities you see for improvement.
  • Document the top 10 lists for use in the stakeholder presentation.
  • INPUT

    • Survey outcomes
    • Governance overview handouts

    OUTPUT

    • SWOT analysis
    • Ranked 5 areas
    • Top 10 challenges and opportunities identified.

    Materials

    • Governance handouts
    • Flip chart paper, pens

    Participants

    • IT leadership team

    Governance of RISK

    Governance of risk establishes the risk framework, establishes policies and standards, and monitors risks.

    Governance of risk ensures that IT is mitigating all relevant risks associated with IT investments, projects, and services.

    GOVERNANCE ROLES:

    1. Defines responsibility and accountability for IT risk identification and mitigation.
    2. Ensures the consideration of all elements of IT risk, including value, change, availability, security, project, and recovery
    3. Enables senior management to make better IT decisions based on the evaluation of the risks involved
    4. Facilitates the identification and analysis of IT risk and ensures the organization’s informed response to that risk.

    Symptoms of poor governance of risk

    • Opportunities for value creation are missed by not considering or assessing IT risk, or by completely avoiding all risk.
    • No formal risk management process or accountabilities exist.
    • There is no business continuity strategy.
    • Frequent security breaches occur.
    • System downtime occurs due to failed IT changes.

    Governance of PPM

    Governance of the IT portfolio achieves optimum ROI through prioritization, funding, and resourcing.

    PPM practices create value if they maximize the throughput of high-value IT projects at the lowest possible cost. They destroy value when they foster needlessly sophisticated and costly processes.

    GOVERNANCE ROLES:

    1. Ensures that the projects that deliver greater business value get a higher priority.
    2. Provides adequate funding for the priority projects and ensures adequate resourcing and funding balanced across the entire portfolio of projects.
    3. Makes the business and IT jointly accountable for setting project priorities.
    4. Evaluate, direct, and monitor IT value metrics and endorse the IT strategy and monitor progress.

    Symptoms of poor governance of PPM/investments

    • The IT investment mix is determined solely by Finance and IT.
    • It is difficult to get important projects approved.
    • Projects are started then halted, and resources are moved to other projects.
    • Senior management has no idea what projects are in the backlog.
    • Projects are approved without a valid business case.

    Governance of PROJECTS

    Governance of projects improves the quality and speed of decision making for project issues.

    Don’t confuse project governance and management. Governance makes the decisions regarding allocation of funding and resources and reviews the overall project portfolio metrics and process methodology.

    Management ensures the project deliverables are completed within the constraints of time, budget, scope, and quality.

    GOVERNANCE ROLES:

    1. Monitors and evaluates the project management process and critical project methodology metrics.
    2. Ensures review and mitigation of project issue and that management is aware of projects in crisis.
    3. Ensures that projects beginning to show characteristics of failure cannot proceed until issues are resolved.
    4. Endorses the project risk criteria, and monitors major risks to project completion.
    5. Approves the launch and execution of projects.

    Symptoms of poor governance of projects

    • Projects frequently fail or get cancelled.
    • Project risks and issues are not identified or addressed.
    • There is no formal project management process.
    • There is no senior stakeholder responsible for making project decisions.
    • There is no formal project reporting.

    Governance of SERVICES

    Governance of services ensures delivery of a highly reliable set of IT services.

    Effective governance of services enables the business to achieve the organization’s goals and strategies through the provision of reliable and cost-effective services.

    GOVERNANCE ROLES:

    1. Ensures the satisfactory performance of those services critical to achieving business objectives.
    2. Monitors and directs changes in service levels.
    3. Ensures operational and performance objectives for IT services are met.
    4. Approves policy and standards on the service portfolio.

    Symptoms of poor governance of service

    • There is a misalignment of business needs and expectations with IT capability.
    • No metrics are reported for IT services.
    • The business is unaware of the IT services available to them.
    • There is no accountability for service level performance.
    • There is no continuous improvement plan for IT services.
    • IT services or systems are frequently unavailable.
    • Business satisfaction with IT scores are low.

    Governance of INFORMATION

    Governance of information ensures the proper handling of data and information.

    Effective governance of information ensures the appropriate classification, retention, confidentiality, integrity, and availability of data in line with the needs of the business.

    GOVERNANCE ROLES:

    1. Ensures the information lifecycle owner and process are defined and endorse by business leadership.
    2. Ensures the controlled access to a comprehensive information management system.
    3. Ensures knowledge, information, and data are gathered, analyzed, stored, shared, used, and maintained.
    4. Ensures that external regulations are identified and met.

    Symptoms of poor governance of information

    • There is a lack of clarity around data ownership, and data quality standards.
    • There is insufficient understanding of what knowledge, information, and data are needed by the organization.
    • There is too much effort spent on knowledge capture as opposed to knowledge transfer and re-use.
    • There is too much focus on storing and sharing knowledge and information that is not up to date or relevant.
    • Personnel see information management as interfering with their work.

    Identify the responsibilities of the IT steering committee

    1.5

    1. With your IT leadership team, review the typical responsibilities of the IT steering committee on the following slide.
    2. Print off the following slide, and in your teams of 1-2 have each group identify which responsibilities they believe the IT steering committee should have, brainstorm any additional responsibilities, and document their reasoning.
    3. Note: The bolded responsibilities are the ones that are most common to IT steering committees, and greyed out responsibilities are typical of a larger governance structure. Depending on their level of importance to your organization, you may choose to include the responsibility.

    4. Have each team present to the larger group, track the similarities and differences between each of the groups, and come to consensus on the list of responsibilities.
    5. Complete a sanity check – review your swot analysis and survey results. Do the responsibilities you’ve identified resolve the critical challenges or weaknesses?
    6. As a group, consider the responsibilities and consider whether you can reasonably implement those in one year, or if there are any that will need to wait until year two of the IT steering committee.
    7. Modify the list of responsibilities in Info-Tech’s IT Steering Committee Charter by deleting the responsibilities you do not need and adding any that you identified in the process.

    INPUT

    • SWOT analysis
    • Survey reports

    OUTPUT

    • Defined ITSC responsibilities documented in the ITSC Charter

    Materials

    • Responsibilities handout
    • Voting dots

    Participants

    • IT leadership team

    Typical IT steering committee and governance responsibilities

    The bolded responsibilities are those that are most common to IT steering committees, and responsibilities listed in grey are typical of a larger governance structure.

    INVESTMENTS / PPM

    • Establish the target investment mix
    • Evaluate and select programs/projects to fund
    • Monitor IT value metrics
    • Endorse the IT budget
    • Monitor and report on program/project outcomes
    • Direct the governance optimization
    • Endorse the IT strategy

    PROJECTS

    • Monitor project management metrics
    • Approve launch of projects
    • Review major obstacles to project completion
    • Monitor a standard approach to project management
    • Monitor and direct project risk
    • Monitor requirements gathering process effectiveness
    • Review feasibility studies and formulate alternative solutions for high risk/high investment projects

    SERVICE

    • Monitor stakeholder satisfaction with services
    • Monitor service metrics
    • Approve plans for new or changed service requirements
    • Monitor and direct changes in service levels
    • Endorse the enterprise architecture
    • Approve policy and standards on the service portfolio
    • Monitor performance and capacity

    RISK

    • Monitor risk management metrics
    • Review the prioritized list of risks
    • Monitor changes in external regulations
    • Maintain risk profiles
    • Approve the risk management emergency action process
    • Maintain a mitigation plan to minimize risk impact and likelihood
    • Evaluate risk management
    • Direct risk management

    INFORMATION / DATA

    • Define information lifecycle process ownership
    • Monitor information lifecycle metrics
    • Define and monitor information risk
    • Approve classification categories of information
    • Approve information lifecycle process
    • Set policies on retirement of information

    Determine committee membership based on the committee’s responsibilities

    • One of the biggest benefits to an IT steering committee is it involves key leadership from the various lines of business across the organization.
    • However, in most cases, more people get involved than is required, and all the committee ends up accomplishing is a lot of theorizing. Participants should be selected based on the identified responsibilities of the IT steering committee.
    • If the responsibilities don’t match the participants, this will negatively impact committee effectiveness as leaders become disengaged in the process and don’t feel like it applies to them or accomplishes the desired goals. Once participants begin dissenting, it’s significantly more difficult to get results.
    • Be careful! When you have more than one individual in a specific role, select only the people whose attendance is absolutely critical. Don’t let your governance collapse under committee overload!

    LIKELY PARTICIPANT EXAMPLES:

    MUNICIPALITY

    • City Manager
    • CIO/IT Leader
    • CCO
    • CFO
    • Division Heads

    EDUCATION

    • Provost
    • Vice Provost
    • VP Academic
    • VP Research
    • VP Public Affairs
    • VP Operations
    • VP Development
    • Etc.

    HEALTHCARE

    • President/CEO
    • CAO
    • EVP/ EDOs
    • VPs
    • CIO
    • CMO

    PRIVATE ORGANIZATIONS

    • CEO
    • CFO
    • COO
    • VP Marketing
    • VP Sales
    • VP HR
    • VP Product Development
    • VP Engineering
    • Etc.

    Identify committee participants and responsibility cadence

    1.6

    1. In a meeting with your IT leadership team, review the list of committee responsibilities and document them on a whiteboard.
    2. For each responsibility, identify the individuals whom you would want to be either responsible or accountable for that decision.
    3. Repeat this until you’ve completed the exercise for each responsibility.
    4. Group the responsibilities with the same participants and highlight groupings with less than four participants. Consider the responsibility and determine whether you need to change the wording to make it more applicable or if you should remove the responsibility.
    5. Review the grouping, the responsibilities within them, and their participants, and assess how frequently you would like to meet about them – annually, quarterly, or monthly. (Note: suggested frequency can be found in the IT Steering Committee Charter.)
    6. Subdivide the responsibilities for the groupings to determine your annual, quarterly, and monthly meeting schedule.
    7. Validate that one steering committee is all that is needed, or divide the responsibilities into multiple committees.
    8. Document the committee participants in the IT Steering Committee Charter and remove any unneeded responsibilities identified in the previous exercise.

    INPUT

    • List of responsibilities

    OUTPUT

    • ITSC participants list
    • Meeting schedule

    Materials

    • Whiteboard
    • Markers

    Participants

    • IT leadership team

    Committees can only be effective if they have clear and documented authority

    It is not enough to participate in committee meetings; there needs to be a clear understanding of who is accountable, responsible, consulted, and informed about matters brought to the attention of the committee.

    Each committee responsibility should have one person who is accountable, and at least one person who is responsible. This is the best way to ensure that committee work gets done.

    An authority matrix is often used within organizations to indicate roles and responsibilities in relation to processes and activities. Using the RACI model as an example, there is only one person accountable for an activity, although several people may be responsible for executing parts of the activity. In this model, accountable means end-to-end accountability for the process.

    RESPONSIBLE: The one responsible for getting the job done.

    ACCOUNTABLE: Only one person can be accountable for each task.

    CONSULTED: Involvement through input of knowledge and information.

    INFORMED: Receiving information about process execution and quality.

    A chart is depicted to show an example of the authority matrix using the RACI model.

    Define IT steering committee participant RACI for each of the responsibilities

    1.7

    1. Use the table provided in the IT Steering Committee Charter and edit he list of responsibilities to reflect the chosen responsibilities of your ITSC.
    2. Along the top of the chart list the participant names, and in the right hand column of the table document the agreed upon timing from the previous exercise.
    3. For each of the responsibilities identify whether participants are Responsible, Accountable, Consulted, or Informed by denoting an R, A, C, I, or N/A in the table. Use N/A if this is a responsibility that the participant has no involvement in.
    4. Review your finalized RACI chart. If there are participants who are only consulted or informed about the majority of responsibilities, consider removing them from the IT steering committee. You only want the decision makers on the committee.

    INPUT

    • Responsibilities
    • Participants

    OUTPUT

    • RACI documented in the ITSC Charter

    Materials

    • ITSC RACI template
    • Projector

    Participants

    • IT leadership

    Building the agenda may seem trivial, but it is key for running effective meetings

    49% of people consider unfocused meetings as the biggest workplace time waster.*

    63% of the time meetings do not have prepared agendas.*

    80% Reduction of time spent in meetings by following a detailed agenda and starting on time.*

    *(Source: http://visual.ly/fail-plan-plan-fail).

    EFFECTIVE MEETING AGENDAS:

    1. Have clearly defined meeting objectives.
    2. Effectively time-boxed based on priority items.
    3. Defined at least two weeks prior to the meetings.
    4. Evaluated regularly – are not static.
    5. Leave time at the end for new business, thus minimizing interruptions.

    BUILDING A CONSENT AGENDA

    A consent agenda is a tool to free up time at meetings by combining previously discussed or simple items into a single item. Items that can be added to the consent agenda are those that are routine, noncontroversial, or provided for information’s sake only. It is expected that participants read this information and, if it is not pulled out, that they are in agreement with the details.

    Members have the option to pull items out of the consent agenda for discussion if they have questions. Otherwise these are given no time on the agenda.

    Define the IT steering committee meeting agendas and procedures

    1.8

    Agendas

    1. Review the listed responsibilities, participants, and timing as identified in a previous exercise.
    2. Annual meeting: Identify if all of the responsibilities will be included in the annual meeting agenda (likely all governance responsibilities).
    3. Quarterly Meeting Agenda: Remove the meeting responsibilities from the annual meeting agenda that are not required and create a list of responsibilities for the quarterly meetings.
    4. Monthly Meeting Agenda: Remove all responsibilities from the list that are only annual or quarterly and compile a list of monthly meeting responsibilities.
    5. Review each responsibility, and estimate the amount of time each task will take within the meeting. We recommend giving yourself at least an extra 10-20% more time for each agenda item for your first meeting. It’s better to have more time than to run out.
    6. Complete the Agenda Template in the IT Steering Committee Charter.

    Procedures:

    1. Review the list of IT steering committee procedures, and replace the grey text with the information appropriate for your organization.

    INPUT

    • Responsibility cadence

    OUTPUT

    • ITSC annual, quarterly, monthly meeting agendas & procedures

    Materials

    • ITSC Charter

    Participants

    • IT leadership team

    Draft your IT steering committee purpose statement and goals

    1.9

    1. In a meeting with your IT leadership team – and considering the defined responsibilities, participants, and opportunities and threats identified – review the example goal statement in the IT Steering Committee Charter, and first identify whether any of these statements apply to your organization. Select the statements that apply and collaboratively make any changes needed.
    2. Define unique goal statements by considering the following questions:
      1. What three things would you realistically list for the ITSC to achieve.
      2. If you were to accomplish three things in the next year, what would those be?
    3. Document those goals in the IT Steering Committee Charter.
    4. With those goal statements in mind, consider the overall purpose of the committee. The purpose statement should be a reflection of what the committee does, why it does it, and the goals.
    5. Have each individual review the example purpose statement, and draft what they think a good purpose statement would be.
    6. Present each statement, and work together to determine a best of breed statement.
    7. Document this in the IT Steering Committee Charter.

    INPUT

    • Responsibilities, participants, top 10 lists of challenges and opportunities.

    OUTPUT

    • ITSC goals and purpose statement

    Materials

    • ITSC Charter

    Participants

    • IT leadership team

    CASE STUDY

    "Clearly defined Committee Charter allows CIO to escape the bad reputation of previous committee."

    Industry: Consumer Goods

    Source: Interview

    CHALLENGE

    The new CIO at a large consumer goods company had difficulty generating interest in creating a new IT steering committee. The previous CIO had created a steering committee that was poorly organized and did not involve all of the pertinent members. This led to a committee focused on politics that would often devolve into gossip. Also, many members were dissatisfied with the irregular meetings that would often go over their allotted time.

    In order to create a new committee, the new CIO needed to dispel the misgivings of the business leadership.

    SOLUTION

    The new CIO decided to build the new steering committee from the ground up in a systematic way.

    She collected information from relevant stakeholders about what they know/how they feel about IT and used this information to build a detailed charter.

    Using this info she outlined the new steering committee charter and included in it the:

    1. Purpose
    2. Responsibilities
    3. RACI Chart
    4. Procedures

    OUTCOME

    The new steering committee included all the key members of business units, and each member was clear on their roles in the meetings. Meetings were streamlined and effective. The adjustments in the charter and the improvement in meeting quality played a role in improving the satisfaction scores of business leaders with IT by 21%.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    1.1

    A screenshot of activity 1.1 is displayed. 1.1 is about surveying your ITSC stakeholders.

    Survey your ITSC stakeholders

    Prior to the workshop, Info-Tech’s advisors will work with you to launch the IT Steering Committee Stakeholder Survey to understand business priorities and level of understanding of how decisions are made. Using this data, we will create the IT steering committee responsibilities, participation, and communication strategy.

    1.7

    A screenshot of activity 1.7 is displayed. 1.7 is about defining a participant RACI for each of the responsibilities.

    Define a participant RACI for each of the responsibilities

    The analyst will facilitate several exercises to help you and your stakeholders create an authority matrix. The output will be defined responsibilities and authorities for members.

    Phase 2

    Build the IT Steering Committee Process

    Phase 2 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 2: Define your ITSC Processes
    Proposed Time to Completion: 2 weeks

    Review SIPOCs and Process Creation

    Start with an analyst kick-off call:

    • Review the purpose of the SIPOC and how to build one

    Then complete these activities…

    • Build a draft SIPOC for your organization

    With these tools & templates:

    Phase 2 of the Establish an Effective IT Steering Committee blueprint

    Finalize the SIPOC

    Review Draft SIPOC:

    • Review and make changes to the SIPOC
    • Discuss potential metrics

    Then complete these activities…

    • Test survey link
    • Info-Tech launches survey

    With these tools & templates:

    Phase 2 of the Establish an Effective IT Steering Committee blueprint

    Finalize Metrics

    Finalize phase deliverable:

    • Finalize metrics

    Then complete these activities…

    • Establish ITSC metric triggers

    With these tools & templates:

    Phase 2 of the Establish an Effective IT Steering Committee blueprint

    Build the IT Steering Committee Process

    This step will walk you through the following activities:

    • Define high-level steering committee processes using SIPOC
    • Select steering committee metrics

    This step involves the following participants:

    • CIO
    • IT Steering Committee
    • IT Leadership Team
    • PMO

    Key Insight:

    Building high-level IT steering committee processes brings your committee to life. Having a clear process will ensure that you have the right information from the right sources so that committees can operate and deliver the appropriate output to the customers who need it.

    Build your high-level IT steering committee processes to enable committee functionality

    The IT steering committee is only valuable if members are able to successfully execute on responsibilities.

    One of the most common mistakes organizations make is that they build their committee charters and launch into their first meeting. Without defined inputs and outputs, a committee does not have the needed information to be able to effectively execute on responsibilities and is unable to meet its stated goals.

    The arrows in this picture represent the flow of information between the IT steering committee, other committees, and IT management.

    Building high-level processes will define how that information flows within and between committees and will enable more rapid decision making. Participants will have the information they need to be confident in their decisions.

    Strategic IT Steering Committee
    Tactical

    Project Governance Service Governance

    Risk Governance Information Governance

    IT Management
    Operational Risk Task Force

    Define the high-level process for each of the IT steering committee responsibilities

    Info-Tech recommends using SIPOC as a way of defining how the IT steering committee will operate.

    Derived from the core methodologies of Six Sigma process management, SIPOC – a model of Suppliers, Inputs, Processes, Outputs, Customers – is one of several tools that organizations can use to build high level processes. SIPOC is especially effective when determining process scope and boundaries and to gain consensus on a process.

    By doing so you’ll ensure that:

    1. Information and documentation required to complete each responsibility is identified.
    2. That the results of committee meetings are distributed to those customers who need the information.
    3. Inputs and outputs are identified and that there is defined accountability for providing these.

    Remember: Your IT steering committee is not a working committee. Enable effective decision making by ensuring participants have the necessary information and appropriate recommendations from key stakeholders to make decisions.

    Supplier Input
    Who provides the inputs to the governance responsibility. The documented information, data, or policy required to effectively respond to the responsibility.
    Process
    In this case this represents the IT steering committee responsibility defined in terms of the activity the ITSC is performing.
    Output Customer
    The outcome of the meeting: can be approval, rejection, recommendation, request for additional information, endorsement, etc. Receiver of the outputs from the committee responsibility.

    Define your SIPOC model for each of the IT steering committee responsibilities

    2.1

    1. In a meeting with your IT leadership, draw the SIPOC model on a whiteboard or flip-chart paper. Either review the examples on the following slides or start from scratch.
    2. If you are adjusting the following slides, consider the templates you already have which would be appropriate inputs and make adjustments as needed.

    For atypical responsibilities:

    1. Start with the governance responsibility and identify what specifically it is that the IT steering committee is doing with regards to that responsibility. Write that in the center of the model.
    2. As a group, consider what information or documentation would be required by the participants to effectively execute on the responsibility.
    3. Identify which individual will supply each piece of documentation. This person will be accountable for this moving forward.
    4. Outputs: Once the committee has met about the responsibility, what information or documentation will be produced. List all of those documents.
    5. Identify the individuals who need to receive the outputs of the information.
    6. Repeat this for all of the responsibilities.
    7. Once complete, document the SIPOC models in the IT Steering Committee Charter.

    INPUT

    • List of responsibilities
    • Example SIPOCs

    OUTPUT

    • SIPOC model for all responsibilities.

    Materials

    • Whiteboard
    • Markers
    • ITSC Charter

    Participants

    • IT leadership team

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Establish the target investment mix
    Supplier Input
    CIO
    • Target investment mix and rationale
    Process
    Responsibility: The IT steering committee shall review and approve the target investment mix.
    Output Customer
    • Approval of target investment mix
    • Rejection of target investment mix
    • Request for additional information
    • CFO
    • CIO
    • IT leadership
    SIPOC: Endorse the IT budget
    Supplier Input
    CIO
    • Recommendations

    See Info-Tech’s blueprint IT Budget Presentation

    Process

    Responsibility: Review the proposed IT budget as defined by the CIO and CFO.

    Output Customer
    • Signed endorsement of the IT budget
    • Request for additional information
    • Recommendation for changes to the IT budget.
    • CFO
    • CIO
    • IT leadership

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Monitor IT value metrics
    Supplier Input
    CIO
    • IT value dashboard
    • Key metric takeaways
    • Recommendations
    CIO Business Vision
    Process

    Responsibility: Review recommendations and either accept or reject recommendations. Refine go-forward metrics.

    Output Customer
    • Launch corrective task force
    • Accept recommendations
    • Define target metrics
    • CEO
    • CFO
    • Business executives
    • CIO
    • IT leadership
    SIPOC: Evaluate and select programs/projects to fund
    Supplier Input
    PMO
    • Recommended project list
    • Project intake documents
    • Prioritization criteria
    • Capacity metrics
    • IT budget

    See Info-Tech’s blueprint

    Grow Your Own PPM Solution
    Process

    Responsibility: The ITSC will approve the list of projects to fund based on defined prioritization criteria – in line with capacity and IT budget.

    It is also responsible for identifying the prioritization criteria in line with organizational priorities.

    Output Customer
    • Approved project list
    • Request for additional information
    • Recommendation for increased resources
    • PMO
    • CIO
    • Project sponsors

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Endorse the IT strategy
    Supplier Input
    CIO
    • IT strategy presentation

    See Info-Tech’s blueprint

    IT Strategy and Roadmap
    Process

    Responsibility: Review, understand, and endorse the IT strategy.

    Output Customer
    • Signed endorsement of the IT strategy
    • Recommendations for adjustments
    • CEO
    • CFO
    • Business executives
    • IT leadership
    SIPOC: Monitor project management metrics
    Supplier Input
    PMO
    • Project metrics report with recommendations
    Process

    Responsibility: Review recommendations around PM metrics and define target metrics. Endorse current effectiveness levels or determine corrective action.

    Output Customer
    • Accept project metrics performance
    • Accept recommendations
    • Launch corrective task force
    • Define target metrics
    • PMO
    • Business executives
    • IT leadership

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Approve launch of planned and unplanned project
    Supplier Input
    CIO
    • Project list and recommendations
    • Resourcing report
    • Project intake document

    See Info-Tech’s Blueprint:

    Grow Your Own PPM Solution
    Process

    Responsibility: Review the list of projects and approve the launch or reprioritization of projects.

    Output Customer
    • Approved launch of projects
    • Recommendations for changes to project list
    • CFO
    • CIO
    • IT leadership
    SIPOC: Monitor stakeholder satisfaction with services and other service metrics
    Supplier Input
    Service Manager
    • Service metrics report with recommendations
    Info-Tech End User Satisfaction Report
    Process

    Responsibility: Review recommendations around service metrics and define target metrics. Endorse current effectiveness levels or determine corrective action.

    Output Customer
    • Accept service level performance
    • Accept recommendations
    • Launch corrective task force
    • Define target metrics
    • Service manager
    • Business executives
    • IT leadership

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Approve plans for new or changed service requirements
    Supplier Input
    Service Manager
    • Service change request
    • Project request and change plan
    Process

    Responsibility: Review IT recommendations, approve changes, and communicate those to staff.

    Output Customer
    • Approved service changes
    • Rejected service changes
    • Service manager
    • Organizational staff
    SIPOC: Monitor risk management metrics
    Supplier Input
    CIO
    • Risk metrics report with recommendations
    Process

    Responsibility: Review recommendations around risk metrics and define target metrics. Endorse current effectiveness levels or determine corrective action.

    Output Customer
    • Accept risk register and mitigation strategy
    • Launch corrective task force to address risks
    • Risk manager
    • Business executives
    • IT leadership

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Review the prioritized list of risks
    Supplier Input
    Risk Manager
    • Risk register
    • Mitigation strategies
    See Info-Tech’s risk management research to build a holistic risk strategy.
    Process

    Responsibility: Accept the risk registrar and define any additional action required.

    Output Customer
    • Accept risk register and mitigation strategy
    • Launch corrective task force to address risks
    • Risk manager
    • IT leadership
    • CRO
    SIPOC: Define information lifecycle process ownership
    Supplier Input
    CIO
    • List of risk owner options with recommendations
    See Info-Tech’s related blueprint: Information Lifecycle Management
    Process

    Responsibility: Define responsibility and accountability for information lifecycle ownership.

    Output Customer
    • Defined information lifecycle owner
    • Organization wide.

    SIPOC examples for typical ITSC responsibilities

    SIPOC: Monitor information lifecycle metrics
    Supplier Input
    Information lifecycle owner
    • Information metrics report with recommendations
    Process

    Responsibility: Review recommendations around information management metrics and define target metrics. Endorse current effectiveness levels or determine corrective action.

    Output Customer
    • Accept information management performance
    • Accept recommendations
    • Launch corrective task force to address challenges
    • Define target metrics
    • IT leadership

    Define which metrics you will report to the IT steering committee

    2.2

    1. Consider your IT steering committee goals and the five IT governance areas.
    2. For each governance area, identify which metrics you are currently tracking and determine whether these metrics are valuable to IT, to the business, or both. For metrics that are valuable to business stakeholders determine whether you have an identified target metric.

    New Metrics:

    1. For each of the five IT governance areas review your SWOT analysis and document your key opportunities and weaknesses.
    2. For each, brainstorm hypotheses around why the opportunity was weak or was a success. For each hypothesis identify if there are any clear ways to measure and test the hypothesis.
    3. Review the list of metrics and select 5-7 metrics to track for each prioritized governance area.

    INPUT

    • List of responsibilities
    • Example SIPOCs

    OUTPUT

    • SIPOC model for all responsibilities

    Materials

    • Whiteboard
    • Markers

    Participants

    • IT leadership team

    IT steering committee metric triggers to consider

    RISK

    • Risk profile % increase
    • # of actionable risks outstanding
    • # of issues arising not identified prior
    • # of security breaches

    SERVICE

    • Number of business disruptions due to IT service incidents
    • Number of service requests by department
    • Number of service requests that are actually projects
    • Causes of tickets overall and by department
    • Percentage of duration attributed to waiting for client response

    PROJECTS

    • Projects completed within budget
    • Percentage of projects delivered on time
    • Project completion rate
    • IT completed assigned portion to scope
    • Project status and trend dashboard

    INFORMATION / DATA

    • % of data properly classified
    • # of incidents locating data
    • # of report requests by complexity
    • # of open data sets

    PPM /INVESTMENTS

    • CIO Business Vision (an Info-Tech diagnostic survey that helps align IT strategy with business goals)
    • Level of stakeholder satisfaction and perceived value
    • Percentage of ON vs. OFF cycle projects by area/silo
    • Realized benefit to business units based on investment mix
    • Percent of enterprise strategic goals and requirements supported by strategic goals
    • Target vs. actual budget
    • Reasons for off-cycle projects causing delays to planned projects

    CASE STUDY

    Industry: Consumer Goods

    Source: Interview

    "IT steering committee’s reputation greatly improved by clearly defining its process."

    CHALLENGE

    One of the major failings of the previous steering committee was its poorly drafted procedures. Members of the committee were unclear on the overall process and the meeting schedule was not well established.

    This led to low attendance at the meetings and ineffective meetings overall. Since the meeting procedures weren’t well understood, some members of the leadership team took advantage of this to get their projects pushed through.

    SOLUTION

    The first step the new CIO took was to clearly outline the meeting procedures in her new steering committee charter. The meeting agenda, meeting goals, length of time, and outcomes were outlined, and the stakeholders signed off on their participation.

    She also gave the participants a SIPOC, which helped members who were unfamiliar with the process a high-level overview. It also reacquainted previous members with the process and outlined changes to the previous, out-of-date processes.

    OUTCOME

    The participation rate in the committee meetings improved from the previous rate of approximately 40% to 90%. The committee members were much more satisfied with the new process and felt like their contributions were appreciated more than before.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    An image of an Info-Tech analyst is depicted.

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    2.1

    A screenshot of activity 2.1 is depicted. Activity 2.1 is about defining a SIPOC for each of the ITSC responsibilities.

    Define a SIPOC for each of the ITSC responsibilities

    Create SIPOCs for each of the governance responsibilities with the help of an Info-Tech advisor.

    2.2

    A screenshot of activity 2.2 is depicted. Activity 2.2 is about establishing the reporting metrics for the ITSC.

    Establish the reporting metrics for the ITSC

    The analyst will facilitate several exercises to help you and your stakeholders define the reporting metrics for the ITSC.

    Phase 3

    Build the Stakeholder Presentation

    Phase 3 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 3: Build the Stakeholder Presentation
    Proposed Time to Completion: 1 week

    Customize the Presentation

    Start with an analyst kick-off call:

    • Review the IT Steering Committee Stakeholder Presentation with an analyst

    Then complete these activities…

    • Schedule the first meeting and invite the ITSC members
    • Customize the presentation template

    With these tools & templates:

    IT Steering Committee Stakeholder Presentation


    Review and Practice the Presentation

    Review findings with analyst:

    • Review the changes made to the template
    • Practice the presentation and create a script

    Then complete these activities…

    • Hold the ITSC meeting

    With these tools & templates:

    • IT Steering Committee Stakeholder Presentation
    Review the First ITSC Meeting

    Finalize phase deliverable:

    • Review the outcomes of the first ITSC meeting and plan out the next steps

    Then complete these activities…

    • Review the discussion and plan next steps

    With these tools & templates:

    Establish an Effective IT Steering Committee blueprint

    Build the Stakeholder Presentation

    This step will walk you through the following activities:

    • Organizing the first ITSC meeting
    • Customizing an ITSC stakeholder presentation
    • Determine ITSC responsibilities and participants
    • Determine ITSC procedures

    This step involves the following participants:

    • CIO
    • IT Steering Committee
    • IT Leadership Team
    • PMO

    Key Insight:

    Stakeholder engagement will be critical to your ITSC success, don't just focus on what is changing. Ensure stakeholders know why you are engaging them and how it will help them in their role.

    Hold a kick-off meeting with your IT steering committee members to explain the process, responsibilities, and goals

    3.1

    Don’t take on too much in your first IT steering committee meeting. Many participants may not have participated in an IT steering committee before, or some may have had poor experiences in the past.

    Use this meeting to explain the role of the IT steering committee and why you are implementing one, and help participants to understand their role in the process.

    Quickly customize Info-Tech’s IT Steering Committee Stakeholder Presentation template to explain the goals and benefits of the IT steering committee, and use your own data to make the case for governance.

    At the end of the meeting, ask committee members to sign the committee charter to signify their agreement to participate in the IT steering committee.

    A screenshot of IT Steering Committee: Meeting 1 is depicted. A screenshot of the IT Steering Committee Challenges and Opportunities for the organization.

    Tailor the IT Steering Committee Stakeholder Presentation template: slides 1-5

    3.2 Estimated Time: 10 minutes

    Review the IT Steering Committee Stakeholder Presentation template. This document should be presented at the first IT steering committee meeting by the assigned Committee Chair.

    Customization Options

    Overall: Decide if you would like to change the presentation template. You can change the color scheme easily by copying the slides in the presentation deck and pasting them into your company’s standard template. Once you’ve pasted them in, scan through the slides and make any additional changes needed to formatting.

    Slide 2-3: Review the text on each of the slides and see if any wording should be changed to better suite your organization.

    Slide 4: Review your list of the top 10 challenges and opportunities as defined in section 2 of this blueprint. Document those in the appropriate sections. (Note: be careful that the language is business-facing; challenges and opportunities should be professionally worded.)

    Slide 5: Review the language on slide 5 to make any necessary changes to suite your organization. Changes here should be minimal.

    INPUT

    • Top 10 list
    • Survey report
    • ITSC Charter

    OUTPUT

    • Ready-to-present presentation for defined stakeholders

    Materials

    • IT Steering Committee Stakeholder Presentation

    Participants

    • IT Steering Committee Chair/CIO

    Tailor the IT Steering Committee Stakeholder Presentation template: slides 6-10

    3.2 Estimated Time: 10 minutes

    Customization Options

    Slide 6: The goal of this slide is to document and share the names of the participants on the IT steering committee. Document the names in the right-hand side based on your IT Steering Committee Charter.

    Slides 7-9:

    • Review the agenda items as listed in your IT Steering Committee Charter. Document the annual, quarterly, and monthly meeting responsibilities on the left-hand side of slides 7-9.
    • Meeting Participants: For each slide, list the members who are required for that meeting.
    • Document the key required reading materials as identified in the SIPOC charts under “inputs.”
    • Document the key meeting outcomes as identified in the SIPOC chart under “outputs.”

    Slide 10: Review and understand the rollout timeline. Make any changes needed to the timeline.

    INPUT

    • Top 10 list
    • Survey report
    • ITSC Charter

    OUTPUT

    • Ready-to-present presentation for defined stakeholders

    Materials

    • IT Steering Committee Stakeholder Presentation

    Participants

    • IT Steering Committee Chair/CIO

    Present the information to the IT leadership team to increase your comfort with the material

    3.3 Estimated Time: 1-2 hours

    1. Once you have finished customizing the IT Steering Committee Stakeholder Presentation, practice presenting the material by meeting with your IT leadership team. This will help you become more comfortable with the dialog and anticipate any questions that might arise.
    2. The ITSC chair will present the meeting deck, and all parties should discuss what they think went well and opportunities for improvement.
    3. Each business relationship manager should document the needed changes in preparation for their first meeting.

    INPUT

    • IT Steering Committee Stakeholder Presentation - Meeting 1

    Participants

    • IT leadership team

    Schedule your first meeting of the IT steering committee

    3.4

    By this point, you should have customized the meeting presentation deck and be ready to meet with your IT steering committee participants.

    The meeting should be one hour in duration and completed in person.

    Before holding the meeting, identify who you think is going to be most supportive and who will be least. Consider meeting with those individuals independently prior to the group meeting to elicit support or minimize negative impacts on the meeting.

    Customize this calendar invite script to invite business partners to participate in the meeting.

    Hello [Name],

    As you may have heard, we recently went through an exercise to develop an IT steering committee. I’d like to take some time to discuss the results of this work with you, and discuss ways in which we can work together in the future to better enable corporate goals.

    The goals of the meeting are:

    1. Discuss the benefits of an IT steering committee
    2. Review the results of the organizational survey
    3. Introduce you to our new IT steering committee

    I look forward to starting this discussion with you and working with you more closely in the future.

    Warm regards,

    CASE STUDY

    Industry:Consumer Goods

    Source: Interview

    "CIO gains buy-in from the company by presenting the new committee to its stakeholders."

    CHALLENGE

    Communication was one of the biggest steering committee challenges that the new CIO inherited.

    Members were resistant to joining/rejoining the committee because of its previous failures. When the new CIO was building the steering committee, she surveyed the members on their knowledge of IT as well as what they felt their role in the committee entailed.

    She found that member understanding was lacking and that their knowledge surrounding their roles was very inconsistent.

    SOLUTION

    The CIO dedicated their first steering committee meeting to presenting the results of that survey to align member knowledge.

    She outlined the new charter and discussed the roles of each member, the goals of the committee, and the overarching process.

    OUTCOME

    Members of the new committee were now aligned in terms of the steering committee’s goals. Taking time to thoroughly outline the procedures during the first meeting led to much higher member engagement. It also built accountability within the committee since all members were present and all members had the same level of knowledge surrounding the roles of the ITSC.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    3.1

    A screenshot of Activity 3.1 is depicted. Activity 3.1 is about creating a presentation for ITSC stakeholders to be presented at the first ITSC meeting.

    Create a presentation for ITSC stakeholders to be presented at the first ITSC meeting

    Work with an Info-Tech advisor to customize our IT Steering Committee Stakeholder Presentation template. Use this presentation to gain stakeholder buy-in by making the case for an ITSC.

    Phase 4

    Define the Prioritization Criteria

    Phase 4 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation : Define the Prioritization Criteria
    Proposed Time to Completion: 4 weeks

    Discuss Prioritization Criteria

    Start with an analyst kick-off call:

    • Review sample project prioritization criteria and discuss criteria unique to your organization

    Then complete these activities...

    • Select the criteria that would be most effective for your organization
    • Input these into the tool

    With these tools & templates:

    IT Steering Committee Project Prioritization Tool

    Customize the IT Steering Committee Project Prioritization Tool

    Review findings with analyst:

    • Review changes made to the tool
    • Finalize criteria weighting

    Then complete these activities…

    • Pilot test the tool using projects from the previous year

    With these tools & templates:

    IT Steering Committee Project Prioritization Tool

    Review Results of the Pilot Test

    Finalize phase deliverable:

    • Review the results of the pilot test
    • Make changes to the tool

    Then complete these activities…

    • Input your current project portfolio into the prioritization tool

    With these tools & templates:

    IT Steering Committee Project Prioritization Tool

    Define the Project Prioritization Criteria

    This step will walk you through the following activities:

    • Selecting the appropriate project prioritization criteria for your organization
    • Developing weightings for the prioritization criteria
    • Filling in Info-Tech’s IT Steering Committee Project Prioritization Tool

    This step involves the following participants:

    • CIO
    • IT Steering Committee
    • IT Leadership Team
    • PMO

    Key Insight:

    The steering committee sets and agrees to principles that guide prioritization decisions. The agreed upon principles will affect business unit expectations and justify the deferral of requests that are low priority. In some cases, we have seen the number of requests drop substantially because business units are reluctant to propose initiatives that do not fit high prioritization criteria.

    Understand the role of the IT steering committee in project prioritization

    One of the key roles of the IT steering committee is to review and prioritize the portfolio of IT projects.

    What is the prioritization based on? Info-Tech recommends selecting four broad criteria with two dimensions under each to evaluate the value of the projects. The criteria are aligned with how the project generates value for the organization and the execution of the project.

    What is the role of the steering committee in prioritizing projects? The steering committee is responsible for reviewing project criteria scores and making decisions about where projects rank on the priority list. Planning, resourcing, and project management are the responsibility of the PMO or the project owner.

    Info-Tech’s Sample Criteria

    Value

    Strategic Alignment: How much a project supports the strategic goals of the organization.

    Customer Satisfaction: The impact of the project on customers and how visible a project will be with customers.

    Operational Alignment: Whether the project will address operational issues or compliance.

    Execution

    Financial: Predicted ROI and cost containment strategies.

    Risk: Involved with not completing projects and strategies to mitigate it.

    Feasibility: How easy the project is to complete and whether staffing resources exist.

    Use Info-Tech’s IT Steering Committee Project Prioritization Tool to catalog and prioritize your project portfolio

    4.1

    • Use Info-Tech’s IT Steering Committee Project Prioritization Tool in conjunction with the following activities to catalog and prioritize all of the current IT projects in your portfolio.
    • Assign weightings to your selected criteria to prioritize projects based on objective scores assigned during the intake process and adjust these weightings on an annual basis to align with changing organizational priorities and goals.
    • Use this tool at steering committee meetings to streamline the prioritization process and create alignment with the PMO and project managers.
    • Monitor ongoing project status and build a communication channel between the PMO and project managers and the IT steering committee.
    • Adjusting the titles in the Settings tab will automatically adjust the titles in the Project Data tab.
    • Note: To customize titles in the document you must unprotect the content under the View tab. Be sure to change the content back to protected after making the changes.
    A screenshot of Info-Tech's IT Steering Committee Project Prioritization Tool is depicted. The first page of the tool is shown. A screenshot of Info-Tech's IT Steering Committee Project Prioritization Tool is depicted. The page depicted is on the Intake and Prioritization Tool Settings.

    Establish project prioritization criteria and build the matrix

    4.2 Estimated Time: 1 hour

    1. During the second steering committee meeting, discuss the criteria you will be basing your project prioritization scoring on.
    2. Review Info-Tech’s prioritization criteria matrix, located in the Prioritization Criteria List tab of the IT Steering Committee Project Prioritization Tool, to gain ideas for what criteria would best suit your organization.
    3. Write these main criteria on the whiteboard and brainstorm criteria that are more specific for your organization; include these on the list as well.
    4. Discuss the criteria. Eliminate criteria that won’t contribute strongly to the prioritization process and vote on the remaining. Select four main criteria from the list.
    5. After selecting the four main criteria, write these on the whiteboard and brainstorm the dimensions that fall under the criteria. These should be more specific/measurable aspects of the criteria. These will be the statements that values are assigned to for prioritizing projects so they should be clear. Use the Prioritization Criteria List in the tool to help generate ideas.
    6. After creating the dimensions, determine what the scoring statements will be. These are the statements that will be used to determine the score out of 10 that the different dimensions will receive.
    7. Adjust the Settings and Project Data tabs in the IT Steering Committee Project Prioritization Tool to reflect your selections.
    8. Edit Info-Tech’s IT Project Intake Form or the intake form that you currently use to contain these criteria and scoring parameters.

    INPUT

    • Group input
    • IT Steering Committee Project Prioritization Tool

    OUTPUT

    • Project prioritization criteria to be used for current and future projects

    Materials

    • Whiteboard and markers

    Participants

    • IT steering committee
    • CIO
    • IT leadership

    Adjust prioritization criteria weightings to reflect organizational needs

    4.3 Estimated Time: 1 hour

    1. In the second steering committee meeting, after deciding what the project prioritization criteria will be, you need to determine how much weight (the importance) each criteria will receive.
    2. Use the four agreed upon criteria with two dimensions each, determined in the previous activity.
    3. Perform a $100 test to assign proportions to each of the criteria dimensions.
      1. Divide the committee into pairs.
      2. Tell each pair that they have $100 divide among the 4 major criteria based on how important they feel the criteria is.
      3. After dividing the initial $100, ask them to divide the amount they allocated to each criteria into the two sub-dimensions.
      4. Next, ask them to present their reasoning for the allocations to the rest of the committee.
      5. Discuss the weighting allotments and vote on the best one (or combination).
      6. Input the weightings in the Settings tab of the IT Steering Committee Project Prioritization Tool and document the discussion.
    4. After customizing the chart establish the owner of the document. This person should be a member of the PMO or the most suitable IT leader if a PMO doesn’t exist.
    5. Only perform this adjustment annually or if a major strategic change happens within the organization.

    INPUT

    • Group discussion

    OUTPUT

    • Agreed upon criteria weighting
    • Complete prioritization tool

    Materials

    • IT Steering Committee Project Prioritization Tool
    • Whiteboard and sticky notes

    Participants

    • IT steering committee
    • IT leadership

    Document the prioritization criteria weightings in Info-Tech’s IT Steering Committee Project Prioritization Tool.

    Configure the prioritization tool to align your portfolio with business strategy

    4.4 Estimated Time: 60 minutes

    Download Info-Tech’s Project Intake and Prioritization Tool.

    A screenshot of Info-Tech's Project Intake and Prioritization Tool.

    Rank: Project ranking will dynamically update relative to your portfolio capacity (established in Settings tab) and the Size, Scoring Progress, Remove from Ranking, and Overall Score columns. The projects in green represent top priorities based on these inputs, while yellow projects warrant additional consideration should capacity permit.

    Scoring Progress: You will be able to determine some items on the scorecard earlier in the scoring progress (such as strategic and operational alignment). As you fill in scoring columns on the Project Data tab, the Scoring Progress column will dynamically update to track progress.

    The Overall Score will update automatically as you complete the scoring columns (refer to Activity 4.2).

    Days in Backlog: This column will help with backlog management, automatically tracking the number of days since an item was added to the list based on day added and current date.

    Validate your new prioritization criteria using previous projects

    4.5 Estimated Time: 2 hours

    1. After deciding on the prioritization criteria, you need to test their validity.
    2. Look at the portfolio of projects that were completed in the previous year.
    3. Go through each project and score it according to the criteria that were determined in the previous exercise.
    4. Enter the scores and appropriate weighting (according to goals/strategy of the previous year) into the IT Steering Committee Project Prioritization Tool.
    5. Look at the prioritization given to the projects in reference to how they were previously prioritized.
    6. Adjust the criteria and weighting to either align the new prioritization criteria with previous criteria or to align with desired outcomes.
    7. After scoring the old projects, pilot test the tool with upcoming projects.

    INPUT

    • Information on previous year’s projects
    • Group discussion

    OUTPUT

    • Pilot tested project prioritization criteria

    Materials

    • IT Steering Committee Project Prioritization Tool

    Participants

    • IT steering committee
    • IT leadership
    • PMO

    Pilot the scorecard to validate criteria and weightings

    4.6 Estimated Time: 60 minutes

    1. Pilot your criteria and weightings in the IT Steering Committee Project Prioritization Tool using project data from one or two projects currently going through approval process.
    2. For most projects, you will be able to determine strategic and operational alignment early in the scoring process, while the feasibility and financial requirements will come later during business case development. Score each column as you can. The tool will automatically track your progress in the Scoring Progress column on the Project Data tab.

    Projects that are scored but not prioritized will populate the portfolio backlog. Items in the backlog will need to be rescored periodically, as circumstances can change, impacting scores. Factors necessitating rescoring can include:

    • Assumptions in business case have changed.
    • Organizational change – e.g. a new CEO or a change in strategic objectives.
    • Major emergencies or disruptions – e.g. a security breach.

    Score projects using the Project Data tab in Info-Tech’s IT Steering Committee Project Prioritization Tool

    A screenshot of Info-Tech's <em data-verified=IT Steering Committee Project Prioritization Tool is depicted. The Data Tab is shown.">

    Use Info-Tech’s IT Project Intake Form to streamline the project prioritization and approval process

    4.7

    • Use Info-Tech’s IT Project Intake Form template to streamline the project intake and prioritization process.
    • Customize the chart on page 2 to include the prioritization criteria that were selected during this phase of the blueprint.
    • Including the prioritization criteria at the project intake phase will free up a lot of time for the steering committee. It will be their job to verify that the criteria scores are accurate.
    A screenshot of Info-Tech's IT Project Intake Form is depicted.

    After prioritizing and selecting your projects, determine how they will be resourced

    Consult these Info-Tech blueprints on project portfolio management to create effective portfolio project management resourcing processes.

    A Screenshot of Info-Tech's Create Project Management Success Blueprint is depicted. Create Project Management Success A Screenshot of Info-Tech's Develop a Project Portfolio Management Strategy Blueprint is depicted. Develop a Project Portfolio Management Strategy

    CASE STUDY

    Industry: Consumer Goods

    Source: Interview

    "Clear project intake and prioritization criteria allow for the new committee to make objective priority decisions."

    CHALLENGE

    One of the biggest problems that the previous steering committee at the company had was that their project intake and prioritization process was not consistent. Projects were being prioritized based on politics and managers taking advantage of the system.

    The procedure was not formalized so there were no objective criteria on which to weigh the value of proposed projects. In addition to poor meeting attendance, this led to the overall process being very inconsistent.

    SOLUTION

    The new CIO, with consultation from the newly formed committee, drafted a set of criteria that focused on the value and execution of their project portfolio. These criteria were included on their intake forms to streamline the rating process.

    All of the project scores are now reviewed by the steering committee, and they are able to facilitate the prioritization process more easily.

    The objective criteria process also helped to prevent managers from taking advantage of the prioritization process to push self-serving projects through.

    OUTCOME

    This was seen as a contributor to the increase in satisfaction scores for IT, which improved by 12% overall.

    The new streamlined process helped to reduce capacity constraints on IT, and it alerted the company to the need for more IT employees to help reduce these constraints further. The IT department was given permission to hire two new additional staff members.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    4.1

    A screenshot of activity 4.1 is depicted. Activity 4.1 was about defining your prioritization criteria and customize our <em data-verified=IT Steering Committee Project Prioritization Tool.">

    Define your prioritization criteria and customize our IT Steering Committee Project Prioritization Tool

    With the help of Info-Tech advisors, create criteria for determining a project’s priority. Customize the tool to reflect the criteria and their weighting. Run pilot tests of the tool to verify the criteria and enter your current project portfolio.

    Research contributors and experts

    • Andy Lomasky, Manager, Technology & Management Consulting, McGladrey LLP
    • Angie Embree, CIO, Best Friends Animal Society
    • Corinne Bell, CTO and Director of IT Services, Landmark College
    • John Hanskenecht, Director of Technology, University of Detroit Jesuit High School and Academy
    • Lori Baker, CIO, Village of Northbrook
    • Lynne Allard, IT Supervisor, Nipissing Parry Sound Catholic School Board
    • Norman Allen, Senior IT Manager, Baker Tilly
    • Paul Martinello, VP, IT Services, Cambridge and North Dumfries Hydro Inc.
    • Renee Martinez, IT Director/CIO, City of Santa Fe
    • Sam Wong, Director, IT, Seneca College
    • Suzanne Barnes, Director, Information Systems, Pathfinder International
    • Walt Joyce, CTO, Peoples Bank

    Appendices

    GOVERNANCE & ITSC & IT Management

    Organizations often blur the line between governance and management, resulting in the business having say over the wrong things. Understand the differences and make sure both groups understand their role.

    The ITSC is the most senior body within the IT governance structure, involving key business executives and focusing on critical strategic decisions impacting the whole organization.

    Within a holistic governance structure, organizations may have additional committees that evaluate, direct, and monitor key decisions at a more tactical level and report into the ITSC.

    These committees require specialized knowledge and are implemented to meet specific organizational needs. Those operational committees may spark a tactical task force to act on specific needs.

    IT management is responsible for executing on, running, and monitoring strategic activities as determined by IT governance.

    Strategic IT Steering Committee
    Tactical

    Project Governance Service Governance

    Risk Governance Information Governance

    IT Management
    Operational Risk Task Force

    This blueprint focuses exclusively on building the IT Steering committee. For more information on IT governance see Info-Tech’s related blueprint: Tailor an IT Governance Plan to Fit Organizational Needs.

    IT steering committees play an important role in IT governance

    By bucketing responsibilities into these areas, you’ll be able to account for most key IT decisions and help the business to understand their role in governance, fostering ownership and joint accountability.

    The five governance areas are:

    Governance of the IT Portfolio and Investments: Ensures that funding and resources are systematically allocated to the priority projects that deliver value.

    Governance of Projects: Ensures that IT projects deliver the expected value, and that the PM methodology is measured and effective.

    Governance of Risks: Ensures the organization’s ability to assess and deliver IT projects and services with acceptable risk.

    Governance of Services: Ensures that IT delivers the required services at the acceptable performance levels.

    Governance of Information and Data: Ensures the appropriate classification and retention of data based on business need.

    A survey of stakeholders identified a need for increased stakeholder involvement and transparency in decision making

    A bar graph is depicted. The title is: I understand how decisions are made in the following areas. The areas include risk, services, projects, portfolio, and information. A circle graph is depicted. The title is: Do IT decisions involve the right people?

    Overall, survey respondents indicated a lack of understanding about how decisions are made around risk, services, projects, and investments, and that business involvement in decision making was too minimal.

    Satisfaction with decision quality around investments and PPM are uneven and largely not well understood

    72% of stakeholders do not understand how decisions around IT services are made (quality, availability, etc.).

    A bar graph is depicted. The title is: How satisfied are you with the quality of decisions and transparency around IT services? A bar graph is depicted. Title of the graph: IT decisions around service delivery and quality involve the right people?

    Overall, services were ranked #1 in importance of the 5 areas

    62% of stakeholders do not understand how decisions around IT services are made (quality, availability, etc.).

    A bar graph is depicted. The title is: How satisfied are you with the quality of decisions and transparency around IT services? A bar graph is depicted. Title of the graph: IT decisions around service delivery and quality involve the right people?

    Projects ranked as one of the areas with which participants are most satisfied with the quality of decisions

    70% of stakeholders do not understand how decisions around projects selection, success, and changes are made.

    A bar graph is depicted. The title is: How satisfied are you with the quality of decisions and transparency around IT services? A bar graph is depicted. The title is: IT decisions around project changes, delays, and metrics involve the right people?

    Stakeholders are largely unaware of how decisions around risk are made and believe business participation needs to increase

    78% of stakeholders do not understand how decisions around risk are made

    A bar graph is depicted. The title is: How satisfied are you with the quality of decisions made around risk? A bar graph is depicted. The title is: IT decisions around acceptable risk involve the right people?

    The majority of stakeholders believe that they are aware of how decisions around information are made

    67% of stakeholders believe they do understand how decisions around information (data) retention and classification are made.

    A bar graph is depicted. The title is: How satisfied are you with the quality of decisions around information governance? A bar graph is depicted. The title is: IT decisions around information retention and classification involve the right people?

    Establish an Analytics Operating Model

    • Buy Link or Shortcode: {j2store}339|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: $8,449 Average $ Saved
    • member rating average days saved: 6 Average Days Saved
    • Parent Category Name: Data Management
    • Parent Category Link: /data-management
    • Organizations are struggling to understand what's involved in the analytics developer lifecycle to generate reusable insights faster.
    • Discover what it takes to become a citizen analytics developer. Identify the proper way to enable self-serve analytics.
    • Self-serve business intelligence/analytics is misunderstood and confusing to the business, especially with regards to the roles and responsibilities of IT and the business.
    • End users are dissatisfied due to a lack of access to the data and the absence of a single source of truth.

    Our Advice

    Critical Insight

    Organizations that take data seriously should:

    • Decouple processes in which data is separated from business processes and elevate the visibility of the organization's data assets.
    • Leverage a secure platform where data can be easily exchanged for insights generation.
    • Create density for analytics where resources are mobilized around analytics ideas to generate value.

    Analytics is a journey, not a destination. This journey can eventually result in some level of sophisticated AI/machine learning in your organization. Every organization needs to mobilize its resources and enhance its analytics capabilities to quickly and incrementally add value to data products and services. However, most organizations fail to mobilize their resources in this way.

    Impact and Result

    • Firms become more agile when they realize efficiencies in their analytics operating models and can quickly implement reusable analytics.
    • IT becomes more flexible and efficient in understanding the business' data needs and eliminates redundant processes.
    • Trust in data-driven decision making goes up with collaboration, engagement, and transparency.
    • There is a clear path to continuous improvement in analytics.

    Establish an Analytics Operating Model Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief that outlines Info-Tech’s methodology for assessing the business' analytics needs and aligning your data governance, capabilities, and organizational structure to deliver analytics faster.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define your analytics needs

    This phase helps you understand your organization's data landscape and current analytics environment so you gain a deeper understanding of your future analytics needs.

    • Establish an Analytics Operating Model – Phase 1: Define Your Analytics Needs

    2. Establish an analytics operating model

    This phase introduces you to data operating model frameworks and provides a step-by-step guide on how to capture the right analytics operating model for your organization.

    • Establish an Analytics Operating Model – Phase 2: Establish an Analytics Operating Model
    • Analytics Operating Model Building Tool

    3. Implement your operating model

    This phase helps you implement your chosen analytics operating model, as well as establish an engagement model and communications plan.

    • Establish an Analytics Operating Model – Phase 3: Implement Your Analytics Operating Model
    [infographic]

    Workshop: Establish an Analytics Operating Model

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Define Your Analytics Needs

    The Purpose

    Achieve a clear understanding and case for data analytics.

    Key Benefits Achieved

    A successful analytics operating model starts with a good understanding of your analytical needs.

    Activities

    1.1 Review the business context.

    1.2 Understand your analytics needs.

    1.3 Draft analytics ideas and use cases.

    1.4 Capture minimum viable analytics.

    Outputs

    Documentation of analytics products and services

    2 Perform an Analytics Capability Assessment

    The Purpose

    Achieve a clear understanding of your organization's analytics capability and mapping across organizational functions.

    Key Benefits Achieved

    Understand your organization's data landscape and current analytics environment to gain a deeper understanding of your future analytics needs.

    Activities

    2.1 Capture your analytics capabilities.

    2.2 Map capabilities to a hub-and-spoke model.

    2.3 Document operating model results.

    Outputs

    Capability assessment results

    3 Establish an Analytics Operating Model

    The Purpose

    Capture the right analytics operating model for your organization.

    Key Benefits Achieved

    Explore data operating model frameworks.

    Capture the right analytics operating model for your organization using a step-by-step guide.

    Activities

    3.1 Discuss your operating model results.

    3.2 Review your organizational structure’s pros and cons.

    3.3 Map resources to target structure.

    3.4 Brainstorm initiatives to develop your analytics capabilities.

    Outputs

    Target operating model

    4 Implement Your Analytics Operating Model

    The Purpose

    Formalize your analytics organizational structure and prepare to implement your chosen analytics operating model.

    Key Benefits Achieved

    Implement your chosen analytics operating model.

    Establish an engagement model and communications plan.

    Activities

    4.1 Document your target organizational structure and RACI.

    4.2 Establish an analytics engagement model.

    4.3 Develop an analytics communications plan.

    Outputs

    Reporting and analytics responsibility matrix (RACI)

    Analytics engagement model

    Analytics communications plan

    Analytics organizational chart

    Start Making Data-Driven People Decisions

    • Buy Link or Shortcode: {j2store}427|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Leadership Development Programs
    • Parent Category Link: /leadership-development-programs
    • Ninety-one percent of IT leaders believe that analytics is important for talent management but 59% use no workforce analytics at all, although those who use analytics are much more effective than those who don't.
    • The higher the level of analytics used, the higher the level of effectiveness of the department as a whole.

    Our Advice

    Critical Insight

    • You don't need advanced metrics and analytics to see a return on people data. Begin by getting a strong foundation in place and showing the ROI on a pilot project.
    • Complex analyses will never make up for inadequate data quality. Spend the time up front to audit and improve data quality if necessary, no matter which stage of analytics proficiency you are at.
    • Ensure you collect and analyze only data that is essential to your decision making. More is not better, and excess data can detract from the overall impact of analytics.

    Impact and Result

    • Build a small-scale foundational pilot, which will allow you to demonstrate feasibility, refine your costs estimate, and show the ROI on people analytics for your budgeting meeting.
    • Drive organizational change incrementally by identifying and communicating with the stakeholders for your people analytics pilot.
    • Choose basic analytics suitable for organizations of all sizes and understand the building blocks of data quality to support more further analytics down the line.

    Start Making Data-Driven People Decisions Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should strategically apply people analytics to your IT talent management.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define the problem and apply the checklist

    From choosing the right data for the right problem to evaluating your progress toward data-driven people decisions, follow these steps to build your foundation to people analytics.

    • Start Making Data-Driven People Decisions – Phase 1: Define the Problem and Apply the Checklist
    • People Analytics Strategy Template
    • Talent Metrics Library
    [infographic]

    Why learn from Tymans Group?

    The TY classes contain in-depth learning material based on over 30 years of experience in IT Operations and Resilience.

    You receive the techniques, tips, tricks, and "professional secrets" you need to succeed in your resilience journey.

    Why would I share "secrets?"

    Because over time, you will find that "secrets" are just manifested experiences.

    What do I mean by that? Gordon Ramsay, who was born in 1966 like me, decided to focus on his culinary education at age 19. According to his Wikipedia page, that was a complete accident. (His Wikipedia page is a hoot to read, by the way.) And he has nothing to prove anymore. His experience in his field speaks for itself.

    I kept studying in my original direction for just one year longer, but by 21, I founded my first company in Belgium in 1987, in the publishing industry. This was extended by IT experiences in various sectors, like international publishing and hospitality, culminating in IT for high-velocity international financial markets and insurance.

    See, "secrets" are a great way to get you to sign up for some "guru" program that will "tell all!" Don't fall for it, especially if the person is too young to have significant experience.

    There are no "secrets." There is only experience and 'wisdom." And that last one only comes with age.

    If I were in my 20s, 30s, or 40s, there is no chance I would share my core experiences with anyone who could become my competitor. At that moment, I'm building my own credibility and my own career. I like helping people, but not to the extent that it will hurt my prospects. 

    And that is my second lesson: be always honest about your intentions. Yes, always. 

    At the current point in my career, "hurting my prospects" is less important. Yes, I still need to make a living, and in another post, I will explain more about that. Here, I feel it is important to share my knowledge and experience with the next people who will take my place in the day-to-day operations of medium and large corporations. And that is worth something. Hence, "sharing my secrets."

    Gert

    Why learn about resilience from us?

    This is a great opportunity to learn from my 30+ years of resilience experience. TY's Gert experienced 9/11 in New York, and he was part of the Lehman Disaster Recovery team that brought the company back within one (one!) week of the terrorist attack.

    He also went through the London Bombings of 2005 and the 2008 financial crisis, which required fast incident responses, the Covid 2020 issues, and all that entailed. Not to mention that Gert was part of the Tokyo office disaster response team as early as 1998, ensuring that Salomon was protected from earthquakes and floods in Japan.

    Gert was part of the solution (for his clients) to several further global events, like the admittedly technical log4J event in 2021, the 2024 Crowdstrike event, and many other local IT incidents, to ensure that clients could continue using the services they needed at that time.

    Beyond the large corporate world, we helped several small local businesses improve their IT resilience with better cloud storage and security solutions. 

    These solutions and ways of thinking work for any business, large or small.

    The TY team

    Explore our resilience solutions.

    Explore the Secrets of Oracle Cloud Licensing

    • Buy Link or Shortcode: {j2store}142|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: 5 Average Days Saved
    • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
    • Parent Category Name: Licensing
    • Parent Category Link: /licensing
    • Organizations are considering moving workloads to the cloud; however, they often struggle to understand Oracle's licensing and services models.
    • Complexity of licensing and high price tags can make the renewal process an overwhelming experience.
    • Oracle’s SaaS applications are the most mature, but Oracle’s on-premises E-Business Suite still has functionality gaps in comparison to Oracle’s cloud apps.

    Our Advice

    Critical Insight

    • Understand the Oracle agenda. Oracle has established a unique approach to their cloud offerings – they want all of your workloads on the Red Stack.
    • Communicate effectively. Be aware that Oracle will reach out to members at your organization at various levels. Having your executives on the same page is critical to successfully managing Oracle.
    • Negotiate hard. Oracle needs the deal more than the customer. Oracle's top leaders are heavily incentivized to drive massive cloud adoption and increase Oracle's share price. Use this to your advantage.

    Impact and Result

    • Conducting business with Oracle is not typical compared to other vendors. To emerge successfully from a commercial transaction with Oracle, customers must learn the “Oracle way” of conducting business, which includes a best-in-class sales structure, highly unique contracts, and license use policies coupled with a hyper-aggressive compliance function.
    • Leverage cloud spend to retire support on shelf-ware licenses, or gain virtualization rights for an on-premises environment.
    • Map out the process of how to negotiate from a position of strength, examining terms and conditions, discount percentages, and agreement pitfalls.
    • Carefully review key clauses in the Oracle Cloud Services Agreement to avoid additional spend and compliance risks.

    Explore the Secrets of Oracle Cloud Licensing Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should explore the secrets of Oracle Cloud licensing, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Evaluate licensing requirements

    Review current licensing options and models to determine which cloud products will most appropriately fit the organization's environment.

    • Oracle Cloud Services Agreement Terms and Conditions Evaluation Tool
    [infographic]

    Develop a Master Data Management Practice and Platform

    • Buy Link or Shortcode: {j2store}401|cart{/j2store}
    • member rating overall impact: 9.3/10 Overall Impact
    • member rating average dollars saved: $27,416 Average $ Saved
    • member rating average days saved: 15 Average Days Saved
    • Parent Category Name: Data Management
    • Parent Category Link: /data-management
    • The volume of enterprise data is growing rapidly and comes from a wide variety of internal and external data sources (e.g. ERP, CRM). When data is located in different systems and applications, coupled with degradation and proliferation, this can lead to inaccurate, inconsistent, and redundant data being shared across departments within an organization.
    • Data kept in separate soiled sources can result in poor stakeholder decision making and inefficient business processes. Some common master data problems include:
      • The lack of a clean customer list results in poor customer service.
      • Hindering good analytics and business predictions, such as incorrect supply chain decisions when having duplicate product and vendor data between plants.
      • Creating cross-group consolidated reports from inconsistent local data that require too much manual effort and resources.

    Our Advice

    Critical Insight

    • Everybody has master data (e.g. customer, product) but not master data problems (e.g. duplicate customers and products). MDM is complex in practice and requires investments in data governance, data architecture, and data strategy. Identifying business outcomes based on quality master data is essential before you pull the trigger on an MDM solution.

    Impact and Result

    This blueprint can help you:

    • Build a list of business-aligned data initiatives and capabilities that address master data problem and realize business strategic objectives.
    • Design a master data management practice based on the required business and data process.
    • Design a master data management platform based on MDM implementation style and prioritized technical capabilities.

    Develop a Master Data Management Practice and Platform Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Develop a Master Data Management Practice and Platform Deck – A clear blueprint that provides a step-by-step approach to aid in the development of your MDM practice and platform.

    This blueprint will help you achieve a single view of your most important data assets by following our two-phase methodology:

  • Build a vision for MDM
  • Build an MDM practice and platform
    • Develop a Master Data Management Practice and Platform – Phases 1-2

    2. Master Data Management Readiness Assessment Tool – A tool to help you make the decision to stop the MDM project now or to continue the path to MDM.

    This tool will help you determine if your organization has a master data problem and if an MDM project should be undertaken.

    • Master Data Management Readiness Assessment Tool

    3. Master Data Management Business Needs Assessment Tool – A tool to help you identify and document the various data sources in the organization and determine which data should be classified as master data.

    The tool will help you identify the sources of data within the business unit and use the typical properties of master data to determine which data should be classified as master data.

    • Master Data Management Business Needs Assessment Tool

    4. Master Data Management Business Case Presentation Template – A template to communicate MDM basics, benefits, and approaches to obtain business buy-in for the MDM project.

    The template will help you communicate your organization's specific pains surrounding poor management of master data and identify and communicate the benefits of effective MDM. Communicate Info-Tech's approach for creating an effective MDM practice and platform.

    • Master Data Management Business Case Presentation Template

    5. Master Data Management Project Charter Template – A template to centralize the critical information regarding to objectives, staffing, timeline, and expected outcome of the project.

    The project charter will help you document the project sponsor of the project. Identify purpose, goals, and objectives. Identify the project risks. Build a cross-functional project team and assign responsibilities. Define project team expectations and meeting frequency. Develop a timeline for the project with key milestones. Identify metrics for tracking success. Receive approval for the project.

    • Master Data Management Project Charter Template

    6. Master Data Management Architecture Design Template – An architecture design template to effectively document the movement of data aligned with the business process across the organization.

    This template will assist you:

  • Document the current state and achieve a common understanding of the business process and movement of data across the company.
  • Identify the source of master data and what other systems will contribute to the MDM system.
  • Document the target architectural state of the organization.
    • Master Data Management Architecture Design Template

    7. Master Data Management Practice Pattern Template – Pre-built practice patterns to effectively define the key services and outputs that must be delivered by establishing core capabilities, accountabilities, roles, and governance for the practice.

    The master data management practice pattern describes the core capabilities, accountabilities, processes, essential roles, and the elements that provide oversight or governance of the practice, all of which are required to deliver on high value services and deliverables or output for the organization.

    • Master Data Management Practice Pattern Template

    8. Master Data Management Platform Template – A pre-built platform template to illustrate the organization’s data environment with MDM and the value MDM brings to the organization.

    This template will assist you:

  • Establish an understanding of where MDM fits in an organization’s overall data environment.
  • Determine the technical capabilities that is required based on organization’s data needs for your MDM implementation.
    • Master Data Management Platform Template

    Infographic

    Workshop: Develop a Master Data Management Practice and Platform

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Develop a Vision for the MDM Project

    The Purpose

    Identification of MDM and why it is important.

    Differentiate between reference data and master data.

    Discuss and understand the key challenges and pains felt by the business and IT with respect to master data, and identify the opportunities MDM can provide to the business.

    Key Benefits Achieved

    Identification of what is and is not master data.

    Understand the value of MDM and how it can help the organization better monetize its data.

    Knowledge of how master data can benefit both IT and the business.

    Activities

    1.1 Establish business context for master data management.

    1.2 Assess the value, benefits, challenges, and opportunities associated with MDM.

    1.3 Develop the vision, purpose, and scope of master data management for the business.

    1.4 Identify MDM enablers.

    1.5 Interview business stakeholders.

    Outputs

    High-level data requirements

    Identification of business priorities

    Project vision and scope

    2 Document the Current State

    The Purpose

    Recognize business drivers for MDM.

    Determine where master data lives and how this data moves within the organization.

    Key Benefits Achieved

    Streamline business process, map the movement of data, and achieve a common understanding across the company.

    Identify the source of master data and what other systems will contribute to the MDM system.

    Activities

    2.1 Evaluate the risks and value of critical data.

    2.2 Map and understand the flow of data within the business.

    2.3 Identify master data sources and users.

    2.4 Document the current architectural state of the organization.

    Outputs

    Data flow diagram with identified master data sources and users

    Business data glossary

    Documented current data state.

    3 Document the Target State

    The Purpose

    Document the target data state of the organization surrounding MDM.

    Identify key initiatives and metrics.

    Key Benefits Achieved

    Recognition of four MDM implementation styles.

    Identification of key initiatives and success metrics.

    Activities

    3.1 Document the target architectural state of the organization.

    3.2 Develop alignment of initiatives to strategies.

    3.3 Consolidate master data management initiatives and strategies.

    3.4 Develop a project timeline and define key success measures.

    Outputs

    Documented target state surrounding MDM.

    Data and master data management alignment and strategies

    4 Develop an MDM Practice and Platform

    The Purpose

    Get a clear picture of what the organization wants to get out of MDM.

    Identify master data management capabilities, accountabilities, process, roles, and governance.

    Key Benefits Achieved

    Prioritized master data management capabilities, accountabilities, process, roles, and governance.

    Activities

    4.1 Identify master data management capabilities, roles, process, and governance.

    4.2 Build a master data management practice and platform.

    Outputs

    Master Data Management Practice and Platform

    Further reading

    Develop a Master Data Management Practice and Platform

    Are you sure you have a master data problem?

    Analyst Perspective

    The most crucial and shared data assets inside the firm must serve as the foundation for the data maturing process. This is commonly linked to your master data (such as customers, products, employees, and locations). Every organization has master data, but not every organization has a master data problem.

    Don't waste time or resources before determining the source of your master data problem. Master data issues are rooted in the business practices of your organization (such as mergers and acquisitions and federated multi-geographic operations). To address this issue, you will require a master data management (MDM) solution and the necessary architecture, governance, and support from very senior champions to ensure the long-term success of your MDM initiative. Approaching MDM with a clear blueprint that provides a step-by-step approach will aid in the development of your MDM practice and platform.

    Ruyi Sun

    Ruyi Sun
    Research Specialist
    Data & Analytics Practice
    Info-Tech Research Group

    Rajesh Parab

    Rajesh Parab
    Research Director
    Data & Analytics Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Common Obstacles

    Info-Tech’s Approach

    Your organization is experiencing data challenges, including:

    • Too much data volume, variety, and velocity, from more and more sources.
    • Duplicate and disorganized data across multiple systems and applications.
    • Master data is pervasive throughout the business and is often created and captured in highly disparate sources that often are not easily shared across business units and applications.

    MDM is useful in situations such as a business undergoing a merger or acquisition, where a unique set of master data needs to be created to act as a single source of truth. However, having a unified view of the definitions and systems of record for the most critical data in your organization can be difficult to achieve. An organization might experience some pain points:

    • Failure to identify master data problem and organization’s data needs.
    • Conflicting viewpoints and definitions of data assets across business units.
    • Recognize common business operating models or strategies with master data problems.
    • Identify the organization’s problem and needs out of its master data and align to strategic business needs.
    • Define the architecture, governance, and support.
    • Create a practice and platform for the organization’s MDM program.

    Info-Tech Insight

    Everybody has master data (e.g. customer, product) but not a master data problem (e.g. duplicate customers and products). MDM is complex in practice and requires investments in data governance, data architecture, and data strategy. Identifying business outcomes based on quality master data is essential before you pull the trigger on an MDM solution.

    What is master data and master data management?

    • Master data domains include the most important data assets of an organization. For this data to be used across an enterprise in consistent and value-added ways, the data must be properly managed. Some common master data entities include customer, product, and employees.
    • Master data management (MDM) is the control over master data values to enable consistent, shared, contextual use across systems, of the most accurate, timely, and relevant version of truth about essential business entities (DAMA DMBOK).
    • The fundamental objective of MDM is to enable the business to see one view of critical data elements across the organization.
    • MDM systems will detect and declare relationships between data, resolve duplicate records, and make data available to the people, processes, and applications that need it. The end goal of an MDM implementation is to make sure your investment in MDM technology delivers the promised business results. By supplementing the technology with rules, guidelines, and standards around enterprise data you will ensure data continues to be synchronized across data sources on an ongoing basis.

    The image contains a screenshot of Info-Tech's Data Management Framework.

    Info-Tech’s Data Management Framework Adapted from DAMA-DMBOK and Advanced Knowledge Innovations Global Solutions. See Create a Data Management Roadmap blueprint for more information.

    Why manage master data?

    Master data drives practical insights that arise from key aspects of the business.

    Customer Intimacy

    Innovation Leadership

    Risk Management

    Operational Excellence

    Improve marketing and the customer experience by using the right data from the system of record to analyze complete customer views of transactions, sentiments, and interactions.

    Gain insights on your products, services, usage trends, industry directions, and competitor results, and use these data artifacts to support decisions on innovations, new products, services, and pricing.

    Maintain more transparent and accurate records and ensure that appropriate rules are followed to support audit, compliance, regulatory, and legal requirements. Monitor data usage to avoid fraud.

    Make sure the right solution is delivered rapidly and consistently to the right parties for the right price and cost structure. Automate processes by using the right data to drive process improvements.

    85% of customers expect consistent interactions across departments (Salesforce, 2022).

    Top-decile economic performers are 20% more likely to have a common source of data that serves as the single source of truth across the organization compared to their peers (McKinsey & Company, 2021).

    Only 6% of board members believe they are effective in managing risk (McKinsey & Company, 2018).

    32% of sales and marketing teams consider data inconsistency across platforms as their biggest challenge (Dun & Bradstreet, 2022).

    Your Challenge

    Modern organizations have unprecedented data challenges.

    • The volume of enterprise data is growing rapidly and comes from a wide variety of internal and external data sources (e.g. ERP, CRM). When data is located in different systems and applications, coupled with degradation and proliferation, this can lead to inaccurate, inconsistent, and redundant data being shared across departments within an organization.
    • For example, customer information may not be identical in the customer service system, shipping system, and marketing management platform because of manual errors or different name usage (e.g. GE or General Electric) when input by different business units.
    • Data kept in separate soiled sources can also result in poor stakeholder decision making and inefficient business processes. Some issues include:
      • The lack of clean customer list results in poor customer service.
      • Hindering good analytics and business predictions, such as incorrect supply chain decision when having duplicate product and vendor data between plants.
      • Creating cross-group consolidated reports from duplicate and inconsistent local data requires too much manual effort and resources.

    On average, 25 different data sources are used for generating customer insights and engagement.

    On average, 16 different technology applications are used to leverage customer data.

    Source: Deloitte Digital, 2020

    Common Obstacles

    Finding a single source of truth throughout the organization can be difficult.

    Changes in business process often come with challenges for CIOs and IT leaders. From an IT perspective, there are several common business operating models that can result in multiple sets of master data being created and held in various locations. Some examples could be:

    • Integrate systems following corporate mergers and acquisitions
    • Enterprise with multi-product line
    • Multinational company or multi-geographic operations with various ERP systems
    • Digital transformation projects such as omnichannel

    In such situations, implementing an MDM solution helps achieve harmonization and synchronization of master data and provide a single, reliable, and precise view of the organization. However, MDM is a complex system that requires more than just a technical solution. An organization might experience the following pain points:

    • Failure to identify master data problem and organization’s data needs.
    • Conflicting viewpoints and definitions of data assets that should reside in MDM across business units.

    Building a successful MDM initiative can be a large undertaking that takes some preparation before starting. Understanding the fundamental roles that data governance, data architecture, and data strategy play in MDM is essential before the implementation.

    “Only 3 in 10 of respondents are completely confident in their company's ability to deliver a consistent omnichannel experience.”

    Source: Dun & Bradstreet, 2022

    The image contains an Info-Tech Thought Model of the Develop a Master Data Management Practice & Platform.

    Insight summary

    Overarching insight

    Everybody has master data (e.g. customer, product) but not a master data problem (e.g. duplicate customers and products). MDM is complex in practice and requires investments in data governance, data architecture, and data strategy. Figuring out what the organization needs out of its master data is essential before you pull the trigger on an MDM solution.

    Phase 1 insight

    A master data management solution will assist you in solving master data challenges if your organization is large or complex, such as a multinational corporation or a company with multiple product lines, with frequent mergers and acquisitions, or adopting a digital transformation strategy such as omnichannel.

    Organizations often have trouble getting started because of the difficulty of agreeing on the definition of master data within the enterprise. Reference data is an easy place to find that common ground.

    While the organization may have data that fits into more than one master data domain, it does not necessarily need to be mastered. Determine what master data entities your organization needs.

    Although it is easy to get distracted by the technical aspects of the MDM project – such as extraction and consolidation rules – the true goal of MDM is to make sure that the consumers of master data (such as business units, sales) have access to consistent, relevant, and trusted shared data.

    Phase 2 insight

    An organization with activities such as mergers and acquisitions or multi-ERP systems poses a significant master data challenge. Prioritize your master data practice based on your organization’s ability to locate and maintain a single source of master data.

    Leverage modern capabilities such as artificial intelligence or machine learning to support large and complex MDM deployments.

    Blueprint Overview

    1. Build a Vision for MDM

    2. Build an MDM Practice and Platform

    Phase Steps

    1. Assess Your Master Data Problem
    2. Identify Your Master Data Domains
    3. Create a Strategic Vision
    1. Document Your Organization’s Current Data State
    2. Document Your Organization’s Target Data State
    3. Formulate an Actionable MDM Practice and Platform

    Phase Participants

    CIO, CDO, or IT Executive

    Head of the Information Management Practice

    Business Domain Representatives

    Enterprise Architecture Domain Architects

    Information Management MDM Experts

    Data Stewards or Data Owners

    Phase Outcomes

    This step identifies the essential concepts around MDM, including its definitions, your readiness, and prioritized master data domains. This will ensure the MDM initiatives are aligned to business goals and objectives.

    To begin addressing the MDM project, you must understand your current and target data state in terms of data architecture and data governance surrounding your MDM strategy. With all these considerations in mind, design your organizational MDM practice and platform.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

    1. MDM Readiness Assessment ToolThe image contains a screenshot of the MDM Readiness Assessment Tool. 2. Business Needs Assessment Tool The image contains a screenshot of the Business Needs Assessment Tool.
    3. Business Case Presentation Template The image contains a screenshot of the Business Case Presentation Template. 4. Project Charter Template The image contains a screenshot of the Project Charter Template.
    5. Architecture Design Template The image contains a screenshot of the Architecture Design Template.

    Key deliverable:

    6. MDM Practice Pattern Template

    7. MDM Platform Template

    Define the intentional relationships between the business and the master data through a well-thought-out master data platform and practice.

    The image contains a screenshot to demonstrate the intentional relationships between the business and the master data.

    Measure the value of this blueprint

    Refine the metrics for the overall Master Data Management Practice and Platform.

    In phase 1 of this blueprint, we will help you establish the business context and master data needs.

    In phase 2, we will help you document the current and target state of your organization and develop a practice and platform so that master data is well managed to deliver on those defined metrics.

    Sample Metrics

    Method of Calculation

    Master Data Sharing Availability and Utilization

    # of Business Lines That Use Master Data

    Master Data Sharing Volume

    # of Master Entities

    # of Key Elements, e.g. # of Customers With Many Addresses

    Master Data Quality and Compliance

    # of Duplicate Master Data Records

    Identified Sources That Contribute to Master Data Quality Issues

    # of Master Data Quality Issues Discovered or Resolved

    # of Non-Compliance Issues

    Master Data Standardization/Governance

    # of Definitions for Each Master Entity

    # of Roles (e.g. Data Stewards) Defined and Created

    Trust and Satisfaction

    Trust Indicator, e.g. Confidence Indicator of Golden Record

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Guided Implementation

    What does a typical GI on this topic look like?

    Phase 1 Phase 2

    Call #1: Identify master data problem and assess your organizational readiness for MDM.

    Call #2: Define master data domains and priorities.

    Call #3: Determine business requirements for MDM.

    Call #4: Develop a strategic vision for the MDM project.

    Call #5: Map and understand the flow of data within the business.

    Call #6: Document current architectural state.

    Call #7: Discover the MDM implementation styles of MDM and document target architectural state.

    Call #8: Create MDM data practice and platform.

    Call #9: Summarize results and plan next steps.

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is 8 to 12 calls over the course of 4 to 6 months.

    Workshop Overview

    Contact your account representative for more information.
    workshops@infotech.com 1-888-670-8889

    Day 1 Day 2 Day 3 Day 4 Day 5

    Develop a Vision for the MDM Project

    Document the
    Current State

    Document the
    Target State

    Develop a MDM Practice and Platform

    Next Steps and
    Wrap-Up (offsite)

    Activities

    • Establish business context for master data management.
    • Assess the readiness, value, benefits, challenges, and opportunities associated with MDM.
    • Develop the vision, purpose, and scope of master data management for the business.
    • Identify master data management enablers.
    • Interview business stakeholders.
    • Evaluate the risks and value of critical data.
    • Map and understand the flow of data within the business.
    • Identify master data sources and users.
    • Document the current architectural state of the organization
    • Document the target data state of the organization.
    • Develop alignment of initiatives to strategies.
    • Consolidate master data management initiatives and strategies.
    • Develop a project timeline and define key success measures.
    • Identify master data management capabilities, roles, process, and governance.
    • Build a master data management practice and platform.
    • Complete in-progress deliverables from previous four days.
    • Set up review time for workshop deliverables and to discuss next steps.

    Deliverables

    1. High-level data requirements
    2. Identification of business priorities
    3. Project vision and scope
    1. Data flow diagram with identified master data sources and users
    2. Business data glossary
    3. Documented current data state
    1. Documented target state surrounding MDM
    2. Data and master data management alignment and strategies
    1. Master Data Management Practice and Platform
    1. Master Data Management Strategy for continued success

    Phase 1: Build a Vision for MDM

    Develop a Master Data Management Practice and Platform

    Step 1.1

    Assess Your Master Data Problem

    Objectives

    1. Build a solid foundation of knowledge surrounding MDM.

    2. Recognize MDM problems that the organization faces in the areas of mergers and acquisitions, omnichannel, multi-product line, and multi-ERP setups.

    This step involves the following participants:

    CIO, CDO, or IT Executive

    Head of Information Management

    Outcomes of this step

    An understanding of master data, MDM, and the prerequisites necessary to create an MDM program.

    Determine if there is a need for MDM in the organization.

    Understand your data – it’s not all transactional

    Info-Tech analyzes the value of data through the lenses of its four distinct classes: Master, Transactional, Operational, and Reference.

    Master

    Transactional

    Operational

    Reference

    • Addresses critical business entities that fall into four broad groupings: party (customers, suppliers); product (products, policies); location (physical spaces and segmentations); and financial (contracts, transactions).
    • This data is typically critical to the organization, less volatile, and more complex in nature; it contains many data elements and is used across systems.
    • Transactional data refers to data generated when dealing with external parties, such as clients and suppliers.
    • Transactional data may be needed on a per-use basis or through several activities.
    • The data can also be accessed in real-time if needed.
    • Operational data refers to data that is used to support internal business activities, processes, or workflows.
    • This data is generated during a one-time activity or multiple times through a data hub or orchestration layer.
    • Depending on the need for speed, there can be a real-time aspect to the situation.
    • Examples: scheduling service data or performance data.
    • Reference data refers to simple lists of data that are typically static and help categorize other data using code tables.
    • Examples: list of countries or states, postal codes, general ledger chart of accounts, currencies, or product code.

    Recognize the fundamental prerequisites for MDM before diving into more specific readiness requirements

    Organizational buy-in

    • Ensure there is someone actively invested and involved in the progress of the project. Having senior management support, especially in the form of an executive sponsor or champion, is necessary to approve MDM budgets and resourcing.
    • MDM changes business processes and practices that affect many departments, groups, and people – this type of change may be disruptive so sponsorship from the top ensures your project will keep moving forward even during difficulties.
    • Consider developing a cross-functional master data team involving stakeholders from management, IT, and the business units. This group can ensure that the MDM initiative is aligned with and supports larger organizational needs and everyone understands their role.

    Understanding the existing data environment

    • Knowing the state of an organization’s data architecture, and which data sources are linked to critical business processes, is essential before starting an MDM project.
    • Identify the areas of data pain within your organization and establish the root cause. Determine what impact this is having on the business.

    Before starting to look at technology solutions, make sure you have organizational buy-in and an understanding of the existing data environment. These two prerequisites are the foundation for MDM success.

    Master data management provides opportunities to use data for analytical and operational purposes with greater accuracy

    MDM can be approached in two ways: analytical and operational.

    Think of it in the context of your own organization:

    • How will MDM improve the ability for accurate data to be shared across business processes (Operational MDM)?
    • How will MDM improve the quality of reports for management reporting and executive decision making (Analytical MDM)?

    An investment in MDM will improve the opportunities for using the organization’s most valuable data assets, including opportunities like:

    • Data is more easily shared across the organization’s environment with greater accuracy and trust.
    • Multiple instances of the same data are consistent.
    • MDM enables the ability to find the right data more quickly.

    9.5% of revenue was at risk when bad experiences were offered to customers.

    Source: Qualtrics XM Institute, 2022

    Master data management drives better customer experience

    85% In a survey of nearly 17,000 consumers and business buyers, 85% of customers expect consistent interactions across departments.

    Source: Salesforce, 2022

    Yet, 60% of customer say it generally feels like sales, service, and marketing teams do not share information.

    Source: Salesforce, 2022

    What is a business without the customer? Positive customer service experience drives customer retention, satisfaction, and revenue growth, and ultimately, determines the success of the organization. Effective MDM can improve customer experiences by providing consistent interactions and the ability to meet customer expectations.

    61% of customers say they would switch to a competitor after just one bad customer service experience.

    Source: Zendesk, 2022

    Common business operating models or strategies with master data problems

    Mergers and acquisitions (M&A)

    M&A involves activities related to the consolidation of two companies. From IT’s perspective, whether the organization maintains different IT systems and applications in parallel or undergoes data integration process, it is common to have multiple instances of the same customer or product entity across different systems between companies, leading to incomplete, duplicate, and conflicting data sets. The organization may face challenges in both operational and analytical aspects. For many, the objective is to create a list of master data to have a single view of the organization.

    Multiple-instance ERP or multinational organizations

    Multiple-instance ERP solutions are commonly used by businesses that operate globally to accommodate each country’s needs or financial systems (Brightwork Research). With MDM, having a single source of truth could be a great advantage in certain business units to collaborate globally, such as sharing inventory coding systems to allow common identity and productive resource allocation and shared customer information for analytical purposes.

    Common business operating models or strategies with master data problems (cont.)

    Multiple product lines of business

    An example for firms that sells multiple product lines could be Nike’s multiple product lines including footwear, clothing, and equipment. Keeping track of many product lines is a constant challenge for organizations in terms of inventory management, vendor database, and a tracking system. The ability to track and maintain your product data accurately and consistently is crucial for a successful supply chain (whether in a warehouse, distribution center, or retail office), which leads to improved customer satisfaction and increased sales.

    Info-Tech Insight
    A master data management solution will assist you in solving master data challenges if your organization is large or complex such as a multinational corporation or a company with multiple product lines, frequent mergers and acquisitions, or adopting a digital transformation strategy such as omnichannel.

    Omni-channel

    In e-commerce and retail industry, omnichannel means a business strategy that offers seamless shopping experiences across all channels, such as in-store, mobile, and online (Oracle). This also means the company needs to provide consistent information on orders, inventory, pricing, and promotions to customers and keep the customer records up to date. The challenges of omnichannel include having to synchronize data across channels and systems such as ERP, CRM, and social media. MDM becomes a solution for the success of an omnichannel strategy that refers to the same source of truth across business functions and channels.

    Assess business model using Info-Tech’s MDM Readiness Assessment Tool

    30 Minutes

    • The MDM Readiness Assessment Tool will help you make the decision to stop the MDM project now or to continue on the path to MDM.
    • Not all organizations need MDM. Don’t waste precious IT time and resources if your organization does not have a master data problem.

    The image contains screenshots of the MDM Readiness Assessment Tool.

    Download the MDM Readiness Assessment Tool

    Input Output
    • List of key MDM decision points
    • MDM readiness
    Materials Participants
    • Master Data Management Readiness Assessment Tool
    • Head of Information Management
    • CIO, CDO, or IT Executive

    Step 1.2

    Identify the Master Data Domains

    Objectives

    Determine which data domain contains the most critical master data in the organization for an MDM strategy.

    This step involves the following participants:

    Business Domain Representatives

    Data Stewards or Data Owners

    Information Management Team

    Outcomes of this step

    Determine the ideal data domain target for the organization based on where the business is experiencing the largest pains related to master data and where it will see the most benefit from MDM.

    Reference data makes tackling master data easier

    Reference data serves as a great starting place for an MDM project.

    • Reference data is the simple lists of data that are typically static and help categorize other data using code tables. Examples include lists of countries or states, postal codes, general ledger charts of accounts, currencies, or product codes.
    • Loading information into the warehouse or an MDM hub usually requires reconciling reference data from multiple sources. By getting reference data in order first, MDM will be easier to implement.
    • Reference data also requires a relatively small investment with good returns so the value of the project can easily be demonstrated to stakeholders.
    • One example of how reference data makes master data easier to tackle is a master list of an organization’s customers that needs an attribute of an address. By maintaining a list of postal codes or cities as reference data, this is made much easier to manage than simply allowing free text.

    Info-Tech Insight

    Organizations often have trouble getting started because of the difficulty of agreeing on the definition of master data within the enterprise. Reference data is an easy place to find that common ground.

    There are several key considerations when defining which data is master data in the organization

    A successful implementation of MDM depends on the careful selection of the data element to be mastered. As departments often have different interests, establishing a standard set of data elements can lead to a lot of discussion. When selecting what data should be considered master data, consider the following:

    • Complexity. As the number of elements in a set increases, the likelihood that the data is master data also increases.
    • Volatility. Master data tends to be less volatile. The more volatile data is, the more likely it is transactional data.
    • Risk. The more likely data may have a risk associated with it, the more likely it should be managed with MDM.
    • Value. The more valuable a data set is to the organization, the greater the chance it is master data.
    • Sharing. If the data set is used in multiple systems, it likely should be managed with an MDM system.

    Begin by documenting the existing data sources within the organization.

    Use Info-Tech’s Master Data Management Business Needs Assessment Tool to determine master data sources.

    Info-Tech Insight

    While the organization may have data that fits into more than one master data domain, it does not necessarily need to be mastered. Determine what master data entities your organization needs.

    Master data also fall into these four areas

    More perspectives to consider and define which data is your master data.

    Internally Created Entities

    Externally Created Entities

    Large Non-Recurring Transactions

    Categories/Relationships/ Hierarchies/Aggregational Patterns

    • Business objects and concepts at the core of organizational activities that are created and maintained only by this organization.
    • Examples: customers, suppliers, products, projects
    • Business objects and concepts at the core of organizational activities that are created outside of this organization, but it keeps its own master list of these entities with additional attributions.
    • Examples: equipment, materials, industry classifications
    • Factual records reflecting the organization’s activities.
    • Examples: large purchases, large sales, measuring equipment data, student academic performance
    • Lateral and hierarchical relationships across master entities.
    • Organization-wide standards for data / information organization and aggregation.
    • Examples: classifications of equipment and materials, legal relationships across legal entities, sales regions or sub-regions

    Master data types can be divided into four main domains

    Parties

    • Data about individuals, organizations, and the roles they play in business relationships.
    • In the commercial world this means customer, employee, vendor, partner, and competitor data.

    Product

    • Can focus on organization's internal products or services or the entire industry, including competitor products and services.
    • May include information about part/ingredient usage, versions, patch fixes, pricing, and bundles.

    Financial

    • Data about business units, cost centers, profit centers, general ledger accounts, budgets, projections, and projects
    • Typically, ERP systems serve as the central hub for this.

    Locations

    • Often seen as the domain that encompasses other domains. Typically includes geopolitical data such as sales territories.
    • Provides ability to track and share reference information about different geographies and create hierarchical relationships based on information.

    Single Domain vs. Multi-Domain

    • By focusing on a single master data domain, organizations can start with smaller, more manageable steps, rather than trying to tackle everything at once.
    • MDM solutions can be domain-specific or be designed to support multiple domains.
    • Multi-domain MDM is a solution that manages multiple types of master data in one repository. By implementing multi-domain from the beginning, an organization is better able to support growth across all dimensions and business units.

    Use Info-Tech’s Master Data Management Business Needs Assessment Tool to determine master data priorities

    2 hours

    Use the Master Data Management Business Needs Assessment Tool to assist you in determining the master data domains present in your organization and the suggested domain(s) for your MDM solution.

    The image contains screenshots of the Master Data Management Business Needs Assessment Tool.

    Download the MDM Business Needs Assessment Tool

    Input Output
    • Current data sources within the organization
    • Business requirements of master data
    • Prioritized list of master data domains
    • Project scope
    Materials Participants
    • Master Data Management Business Needs Assessment Tool
    • Data Stewards or Data Custodians
    • Information Management Team

    Step 1.3

    Create a Strategic Vision for Your MDM Program

    Objectives

    1. Understand the true goal of MDM – ensuring that the needs of the master data users in the organization are fulfilled.

    2. Create a plan to obtain organizational buy-in for the MDM initiative.

    3. Organize and officialize your project by documenting key metrics, responsibilities, and goals for MDM.

    This step involves the following participants:

    CEO, CDO, or CIO

    Business Domain Representatives

    Information Management Team

    Outcomes of this step

    Obtain business buy-in and direction for the MDM initiative.

    Create the critical foundation plans that will guide you in evaluating, planning, and implementing your immediate and long-term MDM goals.

    MDM is not just IT’s responsibility

    Make sure the whole organization is involved throughout the project.

    • Master data is created for the organization as a whole, so get business input to ensure IT decisions fit with corporate goals and objectives.
    • The ownership of master data is the responsibility of the business. IT is responsible for the MDM project’s technology, support, platforms, and infrastructure; however, the ownership of business rules and standards reside with the business.
    • MDM requires IT and the business to form a partnership. While IT is responsible for the technical component, the business will be key in identifying master data.
    • MDM belongs to the entire organization – not a specific department – and should be created with the needs of the whole organization in mind. As such, MDM needs to be aligned with company’s overall data strategy. Data strategy planning involves identifying and translating business objectives and capability goals into strategies for improving data usage by the business and enhancing the capabilities of MDM.

    Keep the priorities of the users of master data at the forefront of your MDM initiative.

    • To fully satisfy the needs of the users of master data, you have to know how the data is consumed. Information managers and architects must work with business teams to determine how organizational objectives are achieved by using master data.
    • Steps to understanding the users of master data and their needs:
    1. Identify and document the users of master data – some examples include business units such as marketing, sales, and innovation teams.
    2. Interview those identified to understand how their strategic goals can be enabled by MDM. Determine their needs and expectations.
    3. Determine how changes to the master data management strategy will bring about improvements to information sharing and increase the value of this critical asset.

    Info-Tech Insight

    Although it is easy to get distracted by the technical aspects of the MDM project – such as extraction and consolidation rules – the true goal of MDM is to make sure that the consumers of master data (such as business units, sales reps) have access to consistent, relevant, and trusted shared data.

    Interview business stakeholders to understand how IT’s implementation of MDM will enable better business decisions

    1 hours

    Instructions

    1. Identify which members of the business you would like to interview to gather an understanding of their current data issues and desired data usage. (Recommendation: Gather a diverse set of individuals to help build a broader and more holistic knowledge of data consumption wants or requirements.)
    2. Prepare your interview questions.
    3. Interview the identified members of the business.
    4. Debrief and document results.

    Tactical Tips

    • Include members of your team to help heighten their knowledge of the business.
    • Identify a team member to operate as the formal scribe.
    • Keep the discussion as free flowing as possible; it will likely enable the business to share more. Don’t get defensive – one of the goals of the interviews is to open communication lines and identify opportunities for change, not create tension between IT and the business.
    Input Output
    • Current master data pain points and issues
    • Desired master data usage
    • Prioritized list of master data management enablers
    • Understanding of organizational strategic plan
    Materials Participants
    • Interview questions
    • Whiteboard/flip charts
    • Information Management Team
    • Business Line Representatives

    Info-Tech Insight

    Prevent the interviews from being just a venue for the business to complain about data by opening the discussion of having them share current concerns and then focus the second half on what they would like to do with data and how they see master data assets supporting their strategic plans.

    Ensure buy-in for the MDM project by aligning the MDM vision and the drivers of the organization

    MDM exists to enable the success of the organization as a whole, not just as a technology venture. To be successful in the MDM initiative, IT must understand how MDM will help the critical aspects of the business. Likewise, the business must understand why it is important to them to ensure long-term support of the project.

    The image contains a screenshot example of the text above.

    “If an organization only wants to look at MDM as a tech project, it will likely be a failure. It takes a very strong business and IT partnership to make it happen.”

    – Julie Hunt, Software Industry Analyst, Hub Designs Magazine

    Use Info-Tech’s Master Data Management Business Case Presentation Template to help secure business buy-in

    1-2 hours

    The image contains screenshots of the Master Data Management Business Case Presentation Template.

    Objectives

    • This presentation should be used to help obtain momentum for the ongoing master data management initiative and continued IT- business collaboration.
    • Master data management and the state of processes around data can be a sensitive business topic. To overcome issues of resistance from the operational or strategic levels, create a well-crafted business case.
    Input Output
    • Business requirements
    • Goals of MDM
    • Pain points of inadequate MDM
    • Awareness built for MDM project
    • Target data domains
    • Project scope
    Materials Participants
    • Master Data Management Business Case Presentation Template
    • Data Stewards or Data Custodians
    • CEO, CDO, or CIO
    • Information Management Team

    Download the MDM Business Case Presentation Template

    Use Info-Tech’s project charter to support your team in organizing their master data management plans

    Use this master document to centralize the critical information regarding the objectives, staffing, timeline, budget, and expected outcome of the project.

    1. MDM Vision and Mission

    Overview

    Define the value proposition behind addressing master data strategies and developing the organization's master data management practice.

    Consider

    Why is this project critical for the business?

    Why should this project be done now, instead of delayed further down the road?

    2. Goals or Objectives

    Overview

    Your goals and objectives should be practical and measurable. Goals and objectives should be mapped back to the reasons for MDM that we identified in the Executive Brief.

    Example Objectives

    Align the organization’s IT and business capabilities in MDM to the requirements of the organization’s business processes and the data that supports it.

    3. Expected Outcomes

    Overview

    Master data management as a concept can change based on the organization and with definitions and expectations varying heavily for individuals. Ensure alignment at the outset of the project by outlining and attaining agreement on the expectations and expected outcomes (deliverables) of the project.

    Recommended Outcomes

    Outline of an action plan

    Documented data strategies

    4. Outline of Action Plan

    Overview

    Document the plans for your project in the associated sections of the project charter to align with the outcomes and deliverables associated with the project. Use the sample material in the charter and the “Develop Your Timeline for the MDM Project” section to support developing your project plans.

    Recommended Project Scope

    Align master data MDM plan with the business.

    Document current and future architectural state of MDM.

    Download the MDM Project Charter Template

    5. Identify the Resourcing Requirements

    Overview

    Create a project team that has representation of both IT and the business (this will help improve alignment and downstream implementation planning).

    Business Roles to Engage

    Data owners (for subject area data)

    Data stewards who are custodians of business data (related to subject areas evaluated)

    Data scientists or other power users who are heavy consumers of data

    IT Roles to Engage

    Data architect(s)

    Any data management professionals who are involved in modeling data, managing data assets, or supporting the systems in which the data resides.

    Database administrators or data warehousing architects with a deep knowledge of data operations.

    Individuals responsible for data governance.

    Phase 2: Build the MDM Practice and Platform

    Develop a Master Data Management Practice and Platform

    Step 2.1

    Document the Current Data State

    Objectives

    1. Understand roles that data strategy, data governance, and data architecture play in MDM.

    2. Document the organization’s current data state for MDM.

    This step involves the following participants:

    Data Stewards or Data Custodians

    Data or Enterprise Architect

    Information Management Team

    Outcomes of this step

    Document the organization’s current data state, understanding the business processes and movement of data across the company.

    Effective data governance will create the necessary roles and rules within the organization to support MDM

    • A major success factor for MDM falls under data governance. If you don’t establish data governance early on, be prepared to face major obstacles throughout your project. Governance includes data definitions, data standards, access rights, and quality rules and ensures that MDM continues to offer value.
    • Data governance involves an organizational committee or structure that defines the rules of how data is used and managed – rules around its quality, processes to remediate data errors, data sharing, managing data changes, and compliance with internal and external regulations.
    • What is required for governance of master data? Defined roles, including data stewards and data owners, that will be responsible for creating the definitions relevant to master data assets.

    The image contains a screenshot of the Data Governance Key to Data Enablement.

    For more information, see Info-Tech Research Group’s Establish Data Governance blueprint.

    Ensure MDM success by defining roles that represent the essential high-level aspects of MDM

    Regardless of the maturity of the organization or the type of MDM project being undertaken, all three representatives must be present and independent. Effective communication between them is also necessary.

    Technology Representative

    Governance Representative

    Business Representative

    Role ensures:

    • MDM technology requirements are defined.
    • MDM support is provided.
    • Infrastructure to support MDM is present.

    Role ensures:

    • MDM roles and responsibilities are clearly defined.
    • MDM standards are adhered to.

    Role ensures:

    • MDM business requirements are defined.
    • MDM business matching rules are defined.

    The following roles need to be created and maintained for effective MDM:

    Data Owners are accountable for:

    • Data created and consumed.
    • Ensuring adequate data risk management is in place.

    Data Stewards are responsible for:

    • The daily and routine care of all aspects of data systems.
    • Supporting the user community.
    • Collecting, collating, and evaluating issues and problems with data.
    • Managing standard business definitions and metadata for critical data elements.

    Another crucial aspect of implementing MDM governance is defining match rules for master data

    • Matching, merging, and linking data from multiple systems about the same item, person, group, etc. attempts to remove redundancy, improve data quality, and provide information that is more comprehensive.
    • Matching is performed by applying inference rules. Data cleansing tools and MDM applications often include matching engines used to match data.
      • Engines are dependent on clearly defined matching rules, including the acceptability of matches at different confidence levels.
    • Despite best efforts, match decisions sometimes prove to be incorrect. It is essential to maintain the history of matches so that matches can be undone when they are discovered to be incorrect.
    • Artificial intelligence (AI) for match and merge is also an option, where the AI engine can automatically identify duplicate master data records to create a golden record.

    Match-Merge Rules vs. Match-Link Rules

    Match-Merge Rules

    • Match records and merge the data from these records into a single, unified, reconciled, and comprehensive record. If rules apply across data sources, create a single unique and comprehensive record in each database.
    • Complex due to the need to identify so many possible circumstances, with different levels of confidence and trust placed on data values in different fields from different sources.
    • Challenges include the operational complexity of reconciling the data and the cost of reversing the operation if there is a false merge.

    Match-Link Rules

    • Identify and cross-reference records that appear to relate to a master record without updating the content of the cross-referenced record.
    • Easier to implement and much easier to reverse.
    • Simple operation; acts on the cross-reference table and not the individual fields of the merged master data record, even though it may be more difficult to present comprehensive information from multiple records.

    Data architecture will assist in producing an effective data integration model for the technology underlying MDM

    Data quality is directly impacted by architecture.

    • With an MDM architecture, access, replication, and flow of data are controlled, which increases data quality and consistency.
    • Without an MDM architecture, master data occurs in application silos. This can cause redundant and inconsistent data.

    Before designing the MDM architecture, consider:

    • How the business is going to use the master data.
    • Architectural style (this is often dependent on the existing IT architecture, but generally, organizations starting with MDM find a hub architecture easiest to work with).
    • Where master data is entered, updated, and stored.
    • Whether transactions should be processed as batch or real-time.
    • What systems will contribute to the MDM system.
    • Implementation style. This will help ensure the necessary applications have access to the master data.

    “Having an architectural oversight and reference model is a very important step before implementing the MDM solutions.”

    – Selwyn Samuel, Director of Enterprise Architecture

    Document the organization’s data architecture to generate an accurate picture of the current data state

    2-3 hours

    Populate the template with your current organization's data components and the business flow that forms the architecture.

    Think about the source of master data and what other systems will contribute to the MDM system.

    The image contains a screenshot of the MDM Architecture Design Template.

    Input Output
    • Business process streamline
    • Current data state
    Materials Participants
    • MDM Architecture Design Template ArchiMate file
    • Enterprise Architect
    • Data Architect

    Download the MDM Architecture Design Template ArchiMate file

    Step 2.2

    Document the Target Data State

    Objectives

    1. Understand four implementation styles for MDM deployments.

    2. Document target MDM implementation systems.

    This step involves the following participants:

    Data Stewards or Data Custodians

    Data or Enterprise Architect

    Information Management Team

    Outcomes of this step

    Document the organization’s target architectural state surrounding MDM, identifying the specific MDM implementation style.

    How the organization’s data flows through IT systems is a convenient way to define your MDM state

    Understanding the data sources present in the organization and how the business organizes and uses this data is critical to implementing a successful MDM strategy.

    Operational MDM

    • As you manage data in an operational MDM system, the data gets integrated back into the systems that were the source of the data in the first place. The “best records” are created from a combination of data elements from systems that create relevant data (e.g. billing system, call center, reservation system) and then the data is sent back to the systems to update it to the best record. This includes both batch and real-time processing data.

    Analytical MDM

    • Generates “best records” the same way that operational MDM does. However, the data doesn’t go back to the systems that generated the data but rather to a repository for analytics, decision management, or reporting system purposes.

    Discovery of master data is the same for both approaches, but the end use is very different.

    The approaches are often combined by technologically mature organizations, but analytical MDM is generally more expensive due to increased complexity.

    Central to an MDM program is the implementation of an architectural framework

    Info-Tech Research Group’s Reference MDM Architecture uses a top-down approach.

    A top-down approach shows the interdependent relationship between layers – one layer of functionality uses services provided by the layers below, and in turn, provides services to the layers above.

    The image contains a screenshot of the Architectural Framework.

    Info-Tech Research Group’s Reference MDM Architecture can meet the unique needs of different organizations

    The image contains a screenshot of Info-Tech Research Group's Reference MDM Architecture.

    The MDM service layers that make up the hub are:

    • Virtual Registry. The virtual registry is used to create a virtual view of the master data (this layer is not necessary for every MDM implementation).
    • Interface Services. The interface services work directly with the transport method (e.g. Web Service, Pub/Sub, Batch/FTP).
    • Rules Management. The rules management layer manages business rules and match rules set by the organization.
    • Lifecycle Management. This layer is responsible for managing the master data lifecycle. This includes maintaining relationships across domains, modeling classification and hierarchies within the domains, helping with master data quality through profiling rules, deduplicating and merging data to create golden records, keeping authoring logs, etc.
    • Base Services. The base services are responsible for managing all data (master, history, metadata, and reference) in the MDM hub.
    • Security. Security is the base layer and is responsible for protecting all layers of the MDM hub.

    An important architectural decision concerns where master data should live

    All MDM architectures will contain a system of entry, a system of record, and in most cases, a system of reference. Collectively, these systems identify where master data is authored and updated and which databases will serve as the authoritative source of master data records.

    System of Entry (SOE)

    System of Record (SOR)

    System of Reference (SORf)

    Any system that creates master data. It is the point in the IT architecture where one or more types of master data are entered. For example, an enterprise resource planning (ERP) application is used as a system of entry for information about business entities like products (product master data) and suppliers (supplier master data).

    The system designated as the authoritative data source for enterprise data. The true system of record is the system responsible for authoring and updating master data and this is normally the SOE. An ideal MDM system would contain and manage a single, up-to-date copy of all master data. This database would provide timely and accurate business information to be used by the relevant applications. In these cases, one or more SOE applications (e.g. customer relationship management or CRM) will be declared the SOR for certain types of data. The SOR can be made up of multiple physical subsystems.

    A replica of master data that can be synchronized with the SOR(s). It is updated regularly to resolve discrepancies between data sets, but will not always be completely up to date. Changes in the SOR are typically batched and then transmitted to the SORf. When a SORf is implemented, it acts as the authoritative source of enterprise data, given that it is updated and managed relative to the SOR. The SORf can only be used as a read-only source for data consumers.

    Central to an MDM program is the implementation of an architectural framework

    These styles are complementary and see increasing functionality; however, organizations do not need to start with consolidation.

    Consolidation

    Registry

    Coexistence

    Transactional

    What It Means

    The MDM is a system of reference (application systems serve as the systems of record). Data is created and stored in the applications and sent (generally in batch mode) to a centralized MDM system.

    The MDM is a system of reference. Master data is created and stored in the

    application systems, but key master data identifiers are linked with the MDM system, which allows a view of master data records to be assembled.

    The MDM is a system of reference. Master data is created and stored in application systems; however, an authoritative record of master data is also created (through matching) and stored in the MDM system.

    The MDM is a genuine source of record. All master data records are centrally authored and materialized in the MDM system.

    Use Case

    This style is ideal for:

    • Organizations that want to have access to master data for reporting.
    • Organizations that do not need real-time access to master data.

    This style is ideal for:

    • A view of key master data identifiers.
    • Near real-time master data reference.
    • Organizations that need access to key master data for operational systems.
    • Organizations facing strict data replication regulations.

    This style is ideal for:

    • A complete view of each master data entity.
    • Deployment of workflows for collaborative authoring.
    • A central reference system for master data.

    This style is ideal for:

    • Organizations that want true master data management.
    • Organizations that need complete, accurate, and consistent master data at all times.
    • Transactional access to master data records.
    • Tight control over master data.

    Method of Use

    Analytical

    Operational

    Analytical, operational, or collaborative

    Analytical, operational, or collaborative

    Consolidation implementation style

    Master data is created and stored in application systems and then placed in a centralized MDM hub that can be used for reference and reporting.

    The image contains a screenshot of the architectural framework and MDM hub.

    Advantages

    • Prepares master data for enterprise data warehouse and reporting by matching/merging.
    • Can serve as a basis for coexistence or transactional MDM.

    Disadvantages

    • Does not provide real-time reference because updates are sent to the MDM system in batch mode.
    • New data requirements will need to be managed at the system of entry.

    Registry implementation style

    Master data is created and stored in applications. Key identifiers are then linked to the MDM system and used as reference for operational systems.

    The image contains a screenshot of the architectural framework with a focus on registry implementation style.

    Advantages

    • Quick to deploy.
    • Can get a complete view of key master data identifiers when needed.
    • Data is always current since it is accessed from the source systems.

    Disadvantages

    • Depends on clean data at the source system level.
    • Can be complex to manage.
    • Except for the identifiers persisting in the MDM system, all master data records remain in the applications, which means there is not a complete view of all master data records.

    Coexistence implementation style

    Master data is created and stored in existing systems and then synced with the MDM system to create an authoritative record of master data.

    The image contains a screenshot of the architectural framework with a focus on the coexistence implementation style.

    Advantages

    • Easier to deploy workflows for collaborative authoring.
    • Creates a complete view for each master data record.
    • Increased master data quality.
    • Allows for data harmonization across systems.
    • Provides organizations with a central reference system.

    Disadvantages

    • Master data is altered in both the MDM system and source systems. Data may not be up to date until synchronization takes place.
    • Higher deployment costs because all master data records must be harmonized.

    Transactional implementation style

    All master data records are materialized in the MDM system, which provides the organization with a single, complete source of master data at all times.

    The image contains a screenshot of the architectural framework with a focus on the transactional implementation style.

    Advantages

    • Functions as a system of record, providing complete, consistent, accurate, and up-to-date data.
    • Provides a single location for updating and managing master data.

    Disadvantages

    • The implementation of this style may require changes to existing systems and business processes.
    • This implementation style comes with increased cost and complexity.

    All organizations are different; identify the architecture and implementation needs of your organization

    Architecture is not static – it must be able to adapt to changing business needs.

    • The implementation style an organization chooses is dependent on organizational factors such as the purpose of MDM and method of use.
    • Some master data domains may require that you start with one implementation style and later graduate to another style while retaining the existing data model, metadata, and matching rules. Select a starting implementation style that will best suit the organization.
    • Organizations with multi-domain master data may have to use multiple implementation styles. For example, data domain X may require the use of a registry implementation, while domain Y requires a coexistence implementation.

    Document your target data state surrounding MDM

    2-3 hours

    Populate the template with your target organization’s data architecture.

    Highlight new capabilities and components that MDM introduced based on MDM implementation style.

    The image contains a screenshot of the MDM Architecture Design Template.

    Input Output
    • Business process streamline
    • MDM architectural framework
    • Target data state
    Materials Participants
    • MDM Architecture Design Template ArchiMate File
    • Enterprise Architect
    • Data Architect
    • Head of Data

    Step 2.3

    Develop MDM Practice and Platform

    Objectives

    1. Review Info-Tech’s practice pattern and design your master data management practice.

    2. Design your master data management platform.

    3. Consider next steps for the MDM project.

    This step involves the following participants:

    Data Stewards or Data Custodians

    Data or Enterprise Architect

    Information Management Team

    Outcomes of this step

    Define the key services and outputs that must be delivered by establishing core capabilities, accountabilities, roles, and governance for the practice and platform.

    What does a master data management practice pattern look like?

    The master data management practice pattern describes the core capabilities, accountabilities, processes, and essential roles and the elements that provide oversight or governance of the practice, all of which are required to deliver on high-value services and deliverables or output for the organization.

    The image contains a screenshot to demonstrate the intentional relationships between the business and the master data.

    Download the Master Data Management Practice Pattern Template ArchiMate File

    Master data management data practice setup

    • Define the practice lead’s accountabilities and responsibilities.
    • Assign the practice lead.
    • Design the practice, defining the details of the practice (including the core capabilities, accountabilities, processes, and essential roles; the elements that provide oversight or governance of the practice; and the practice’s services and deliverables or output for the organization).
    • Define services and accountabilities:
    1. Define deployment and engagement model
    2. Define practice governance and metrics
    3. Define processes and deliverables
    4. Summarize capabilities
    5. Use activity slide to assign the skills to the role

    General approach to setting up data practices

    Guidelines for designing and establishing your various data practices.

    Understand master data management practice pattern

    A master data management practice pattern includes key services and outputs that must be delivered by establishing core capabilities, accountabilities, roles, and governance for the practice.

    Assumption:

    The accountabilities and responsibilities for the master data management practice have been established and assigned to a practice lead.

    1. Download and review Master Data Management Practice Pattern (Level 1 – Master Data Management Practice Pattern).
    2. Review and update master data management processes for your organization.

    Download the Master Data Management Practice Pattern Template ArchiMate File

    Info-Tech Insight

    An organization with heavy merger and acquisition activity poses a significant master data challenge. Prioritize your master data practice based on your organization’s ability to locate and maintain a single source of master data.

    The image contains a screenshot of the Master Data Management Process.

    Initiate your one-time master data management practice setup

    1. Ensure data governance committees are established.
    2. Align master data management working group responsibilities with data governance committee.
    3. Download and review Master Data Management Practice Pattern Setup (Level 1 – Master Data Management Practice Setup).
    4. Start establishing your master data practice:
    5. 4.1 Define services and accountabilities

      4.2 Define processes and deliverables by stakeholder

      4.3 Design practice operating model

      4.4 Perform skills inventory and design roles

      4.5 Determine practice governance and metrics

      4.6 Summarize practice capabilities

    6. Define key master data management deliverable and processes.

    The image contains a screenshot of the Process Template MDM Conflict Resolution.

    Download and Update:

    Process Template: MDM Conflict Resolution

    MDM operating model

    The operating model is a visualization of how MDM commonly operates and the value it brings to the organization. It illustrates the master data flow, which works from left to right, from source system to consumption layer. Another important component of the model is the business data glossary, which is part of your data governance plan, to define terminology and master data’s key characteristics across business units.

    The image contains a screenshot of the MDM Operating Model.

    Choosing the appropriate technology capabilities

    An MDM platform should include certain core technical capabilities:

    • Master data hub: Functions as a system of reference, providing an authoritative source of data in read-only format to systems downstream.
    • Data modeling: Ability to model complex relationships between internal application sources and other parties.
    • Workflow management: Ability to support flexible and comprehensive workflow-based capabilities.
    • Relationship and hierarchies: Ability to determine relationships and identify hierarchies within the same domain or across different domains of master data.
    • Information quality: Ability to profile, cleanse, match, link, identify, and reconcile master data in different data sources to create and maintain the “golden record.”
    • Loading, integration, synchronization: Ability to load data quality tools and integrate so there is a bidirectional flow of data. Enable data migration and updates that prevent duplicates within the incoming data and data found in the hub.
    • Security: Ability to control access of MDM and the ability to report on activities. Ability to configure and manage different rules and visibilities.
    • Ease of use: Including different user interfaces for technical and business roles.
    • Scalability and high performance/high availability: Ability to expand or shrink depending on the business needs and maintain a high service level.

    Other requirements may include:

    • MDM solution that can handle multiple domains on a single set of technology and hardware.
    • Offers a broad set of data integration connectors out of the box.
    • Offers flexible deployments (on-premises, cloud, as-a-service).
    • Supports all architectural implementation styles: registry, consolidation, coexistence, and transactional.
    • Data governance tools: workflow and business process management (BPM) functionality to link data governance with operational MDM.
    • Uses AI to automate MDM processes.

    Info-Tech Research Group’s MDM platform

    The image contains a screenshot of Info-Tech's MDM Platform.

    Info-Tech Research Group’s MDM platform summarizes an organization’s data environment and the technical capabilities that should be taken into consideration for your organization's MDM implementation.

    Design your master data management platform

    2-3 hours

    Instructions

    Download the Master Data Management Platform Template.

    The platform is not static. Adapt the template to your own needs based on your target data state, required technical capabilities, and business use cases.

    The image contains a screenshot of Info-Tech's MDM Platform.

    Input Output
    • Technology capabilities
    • Target data state
    • Master Data Management Platform
    Materials Participants
    • Master Data Management Platform Template
    • Data Architect
    • Enterprise Architect
    • Head of Data

    Download the MDM Platform Template

    Next steps for the MDM project

    There are several deployment options for MDM platforms; pick the one best suited to the organization’s business needs:

    On-Premises Solutions

    Cloud Solutions

    Hybrid Solutions

    Embrace the technology

    MDM has traditionally been an on-premises initiative. On-premises solutions have typically had different instances for various divisions. On-premises solutions offer interoperability and consistency.

    Many IT teams of larger companies prefer an on-premises implementation. They want to purchase a perpetual MDM software license, install it on hardware systems, configure and test the MDM software, and maintain it on an ongoing basis.

    Cloud MDM solutions can be application-specific or platform-specific, which involves using a software platform or web-based portal interface to connect internal and external data. Cloud is seen as a more cost-effective MDM solution as it doesn’t require a large IT staff to configure the system and can be paid for through a monthly subscription. Because many organizations are averse to storing their master data outside of their firewalls, some cloud MDM solutions manage the data where it resides (either software as a service or on-premises), rather than maintaining it in the cloud.

    MDM system resides both on premises and in the cloud. As many organizations have some applications on premises and others in the cloud, having a hybrid MDM solution is a realistic option for many. MDM can be leveraged from either on-premises or in the cloud solutions, depending on the current needs of the organization.

    • Vendor-supplied MDM solutions often provide complete technical functionality in the package and various deployment options.
    • Consider leverage Info-Tech’s SoftwareReviews to accelerate and improve your software selection process.

    Capitalizing on trends in the MDM technology space would increase your competitive edge

    AI improves master data management.

    • With MDM technology improving every year, there are a greater number of options to choose from than ever before. AI is one of the hottest trends in MDM.
    • By using machine learning (ML) techniques, AI can automate many activities surrounding MDM to ease manual processes and improve accuracy, such as automating master data profiling, managing workflow, identifying duplication, and suggesting match and merge proposals.
    • Some other powerful applications include product categorization and hierarchical management. The product is assigned to the correct level of the category hierarchy based on the probability that a block of words in a product title or description belongs to product categories (Informatica, 2021).

    Info-Tech Insight

    Leverage modern capabilities such as AI and ML to support large and complex MDM deployments.

    The image contains a screenshot of the AI Activities in MDM.

    Informatica, 2021

    Related Info-Tech Research

    Build Your Data Quality Program

    • Data needs to be good, but truly spectacular data may go unnoticed. Provide the right level of data quality, with the appropriate effort, for the correct usage. This blueprint will help you determine what “the right level of data quality” means and create a plan to achieve that goal for the business.

    Build a Data Architecture Roadmap

    • Optimizing data architecture requires a plan, not just a data model.

    Create a Data Management Roadmap

    • Streamline your data management program with our simplified framework.

    Related Info-Tech Research

    Build a Robust and Comprehensive Data Strategy

    • Formulate a data strategy that stitches all of the pieces together to better position you to unlock the value in your data.

    Build Your Data Practice and Platform

    • The true value of data comes from defining intentional relationships between the business and the data through a well-thought-out data platform and practice.

    Establish Data Governance

    • Establish data trust and accountability with strong governance.

    Research Authors and Contributors

    Authors:

    Name

    Position

    Company

    Ruyi Sun

    Research Specialist, Data & Analytics

    Info-Tech Research Group

    Rajesh Parab

    Research Director, Data & Analytics

    Info-Tech Research Group

    Contributors:

    Name

    Position

    Company

    Selwyn Samuel

    Director of Enterprise Architecture

    Furniture manufacturer

    Julie Hunt

    Consultant and Author

    Hub Designs Magazine and Julie Hunt Consulting

    David Loshin

    President

    Knowledge Integrity Inc.

    Igor Ikonnikov

    Principal Advisory Director

    Info-Tech Research Group

    Irina Sedenko

    Advisory Director

    Info-Tech Research Group

    Anu Ganesh

    Principal Research Director

    Info-Tech Research Group

    Wayne Cain

    Principal Advisory Director

    Info-Tech Research Group

    Reddy Doddipalli

    Senior Workshop Director

    Info-Tech Research Group

    Imad Jawadi

    Senior Manager, Consulting

    Info-Tech Research Group

    Andy Neill

    Associate Vice President

    Info-Tech Research Group

    Steve Wills

    Practice Lead

    Info-Tech Research Group

    Bibliography

    “DAMA Guide to the Data Management Body of Knowledge (DAMA-DMBOK Guide).” First Edition. DAMA International. 2009. Digital. April 2014.
    “State of the Connected Customer, Fifth Edition.” Salesforce, 2022. Accessed Jan. 2023.
    “The new digital edge: Rethinking strategy for the postpandemic era.” McKinsey & Company, 26 May. 2021. Assessed Dec. 2022.
    “Value and resilience through better risk management.” Mckinsey & Company, 1 Oct. 2018. Assessed Dec. 2022.
    “Plotting a course through turbulent times (9TH ANNUAL B2B SALES & MARKETING DATA REPORT)” Dun & Bradstreet, 2022. Assessed Jan. 2023.
    ““How to Win on Customer Experience.”, Deloitte Digital, 2020. Assessed Dec. 2022.
    “CX Trends 2022.”, Zendesk, 2022. Assessed Jan. 2023
    .”Global consumer trends to watch out for in 2023.” Qualtrics XM Institute, 8 Nov. 2022. Assessed Dec. 2022
    “How to Understand Single Versus Multiple Software Instances.” Brightwork Research & Analysis, 24 Mar. 2021. Assessed Dec. 2022
    “What is omnichannel?” Oracle. Assessed Dec. 2022
    “How AI Improves Master Data Management (MDM).” Informatica, 30 May. 2021. Assessed Dec. 2022

    Develop a Cloud Testing Strategy for Today's Apps

    • Buy Link or Shortcode: {j2store}470|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Cloud Strategy
    • Parent Category Link: /cloud-strategy
    • The growth of the Cloud and the evolution of business operations have shown that traditional testing strategies do not work well with modern applications.
    • Organizations require a new framework around testing cloud applications that account for on-demand scalability and self-provisioning.
    • Expectations of application consumers are continually increasing with speed-to-market and quality being the norm.

    Our Advice

    Critical Insight

    • Cloud technology does not change the traditional testing processes that many organizations have accepted and adopted. It does, however, enhance traditional practices with increased replication capacity, execution speed, and compatibility through its virtual infrastructure and automated processes. Consider these factors when developing the cloud testing strategy.
    • Involving the business in strategy development will keep them engaged and align business drivers with technical initiatives.
    • Implement cloud testing solutions in a well-defined rollout process to ensure business objectives are realized and cloud testing initiatives are optimized.
    • Cloud testing is green and dynamic. Realize the limitations of cloud testing and play on its strengths.

    Impact and Result

    • Engaging in a formal and standardized cloud testing strategy and consistently meeting business needs throughout the organization maintains business buy-in.
    • The Cloud compounds the benefits from virtualization and automation because of the Cloud’s scalability, speed, and off-premise and virtual infrastructure and data storage attributes.
    • Cloud testing presents a new testing avenue. Realize that only certain tests are optimized in the Cloud, i.e., load, stress, and functional testing.

    Develop a Cloud Testing Strategy for Today's Apps Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Develop a cloud testing strategy.

    Obtain organizational buy-ins and build a standardized and formal cloud testing strategy.

    • Storyboard: Develop a Cloud Testing Strategy for Today's Apps
    • None

    2. Assess the organization's readiness for cloud testing.

    Assess your people, process, and technology for cloud testing readiness and realize areas for improvement.

    • Cloud Testing Readiness Assessment Tool

    3. Plan and manage the resources allocated to each project task.

    Organize and monitor cloud project planning tasks throughout the project's duration.

    • Cloud Testing Project Planning and Monitoring Tool
    [infographic]

    Tech Trend Update: If Contact Tracing Then Distributed Trust

    • Buy Link or Shortcode: {j2store}424|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity

    With COVID-19's rapid spread through populations, governments are looking for technology tools that can augment the efforts of manual contact tracing processes. How the system is designed is crucial to a positive outcome.

    • CIOs must understand how distributed trust principles achieve embedded privacy and help encourage user adoption.
    • CEOs must consider how society's waning trust in institutions affects the way they engage their customers.

    Our Advice

    Critical Insight

    Mobile contact tracing apps that use a decentralized design approach will be the most likely to be adopted by a wide swath of the population.

    Impact and Result

    There are some key considerations to realize from the way different governments are approaching contact tracing:

    1. If centralized, then seek to ensure privacy protections.
    2. If decentralized, then seek to enable collaboration.
    3. In either case, put in place data governance to create trust.

    Tech Trend Update: If Contact Tracing Then Distributed Trust Research & Tools

    Learn why distributed trust is becoming critical to technology systems design

    Understand the differences between mobile app architectures available to developers and how to achieve success in implementation based on your goals.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Tech Trend Update: If Contact Tracing Then Distributed Trust Storyboard
    [infographic]

    Implement a Transformative IVR Experience That Empowers Your Customers

    • Buy Link or Shortcode: {j2store}68|cart{/j2store}
    • member rating overall impact: 8.5/10 Overall Impact
    • member rating average dollars saved: $6,499 Average $ Saved
    • member rating average days saved: 15 Average Days Saved
    • Parent Category Name: Development
    • Parent Category Link: /development
    • Today’s customers expect a top-tier experience when interacting with businesses.
    • The advancements in IVR technology mean that IT departments are managing added complexity in drafting a strategy for a top-tier IVR approach.
    • Implementing best practices and the right enabling technology stack is critical to supporting world-class customer experience through IVR.

    Our Advice

    Critical Insight

    • Don’t assume that contact centers and IVR systems are relics of the past. Customers still look to phone calls as being the most effective way to get a fast answer.
    • Tailor your IVR system for your customers. There is no “one-size-fits-all” approach – understand your key customer demographics and support their experience by implementing the most effective strategies for them.
    • Don’t buy best of breed, buy best for you. Base your enabling technology selection on your requirements and use cases, not on the latest industry trends and developments.

    Impact and Result

    • Before selecting and deploying technology solutions, create a database of common customer pain points and FAQs to act as an outline for the call flow tree.
    • Understand and apply operational best practices, such as ensuring proper call menu organization and using self-service applications, to improve IVR metrics and, ultimately, the customer experience.
    • Understand emerging technologies and evolving trends in the IVR space, including natural language processing and integrating your IVR with other essential enterprise applications (e.g. customer relationship management platforms).

    Implement a Transformative IVR Experience That Empowers Your Customers Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Transformative IVR Experience Deck – A deck outlining the best strategies and enabling technologies to implement in your IVR approach to improve your customer experience.

    This storyboard offers insight into impactful strategies and beneficial enabling technologies to implement in your IVR approach to improve your customers’ experience and to reduce the load on your support staff. This deck outlines IT’s role in the IVR development process, offering insight into how to develop an effective IVR call flow and providing details on relevant enabling technologies to consider implementing to further improve your offering.

    • Implement a Transformative IVR Experience That Empowers Your Customers – Phases 1-4

    2. IVR Call Flow Template – A template designed to help you build an effective call flow tree by providing further insight into how to better understand your customers.

    This template demonstrates an ideal IVR approach, outlining a sample call flow for a telecommunications company designed to meet the needs of a curated customer persona. Use this template to gain a better understanding of your own key customers and to construct your own call flow tree.

    • Create an IVR Call Flow That Empowers Your Customers
    [infographic]

    Further reading

    Implement a Transformative IVR Experience That Empowers Your Customers

    Learn the strategies that will allow you to develop an effective interactive voice response (IVR) framework that supports self-service and improves customer experience.

    Stop! Are you ready for this project?

    This Research Is Designed For:

    • Business analysts, application directors/managers, and customer service leaders tasked with developing and executing a technology enablement strategy for optimizing their contact center approach.
    • Any organization aiming to improve its customer experience by implementing a customer-centric approach to over-the-phone service via an IVR system.

    This Research Will Help You:

    • Adopt the best strategies for outlining an effective IVR approach and for transforming an existing IVR system.
    • Improve customer experience and ultimately customer satisfaction by enabling you to create a more efficient IVR call flow tree.
    • Select the proper IVR strategies to focus on based on the maturity level of your organization's call center.
    • Review the "art of the possible" and learn of the latest developments in successful IVR execution.
    • Learn IT's role in developing a successful IVR system and in developing a technology strategy that optimizes your IVR approach.

    Executive Summary

    Your Challenge

    • Today's customers expect a top-tier experience when interacting with businesses.
    • The advancements in IVR technology mean that IT departments are managing added complexity in drafting a strategy for a top-tier IVR approach.
    • Implementing best practices and the right enabling technology stack is critical to supporting world-class customer experience through IVR.

    Common Obstacles

    • Many organizations do not have a clear understanding of customers' drivers for contacting their IVR.
    • As many contact centers look to improve the customer experience, the need for an impactful IVR system has markedly increased. The proliferation of recommendations for IVR best practices and related technologies has made it difficult to identify and implement the right approach.
    • With a growing number of IVR-related requests, IT must be prepared to speak intelligently about requirements and the "art of the possible."

    Info-Tech's Approach

    • Before selecting and deploying technology solutions, create a database of common customer call drivers to act as an outline for the call flow tree.
    • Understand and apply operational best practices, such as ensuring proper call menu organization and using self-service applications, to improve IVR metrics and, ultimately, the customer experience.
    • Understand evolving trends and emerging technologies in the IVR space, including offering personalized service and using natural language processing/conversational AI.

    Info-Tech Insight

    Tailor your IVR system specifically for your customers. There is no one-size-fits-all approach. Understand your key customers and support their experience by implementing the most effective strategies for them.

    Voice is still the dominant way in which customers choose to receive support

    Despite the contrary beliefs that the preference for phone support and IVR systems is declining, studies have consistently shown that consumers still prefer receiving customer service over the phone.

    76%

    of customers prefer the "traditional" medium of phone calls to reach customer support agents.

    50%

    of customers across all age groups generally use the phone to contact customer support, making it the most-used customer service channel.

    Your IVR approach can make or break your customers' experience

    The feelings that customers are left with after interacting with contact centers and support lines has a major impact on their future purchase decisions

    Effective IVR systems provide customers with positive experiences, keeping them happy and satisfied. Poorly executed IVR systems leave customers feeling frustrated and contribute to an overall negative experience. Negative experiences with your IVR system could lead to your customers taking their business elsewhere.

    In fact, research by Haptik shows that an average of $262 per customer is lost each year due to poor IVR experiences ("7 Conversational IVR Trends for 2021 and Beyond," Haptik, 2021).

    50%

    of customers have abandoned their business transactions while dealing with an IVR system.

    Source: Vonage, 2020

    45%

    of customers will abandon a business altogether due to a poor IVR experience.

    Source: "7 Remarkable IVR Trends For the Year 2022 And Beyond," Haptik, 2021

    IVR systems only improve your customers' experience when done properly

    There are many common mistakes that organizations make when implementing their own IVR strategies:

    1. Offering too many menu options. IVR systems are supposed to allow customers to resolve their inquiries quickly, so it is integral that you organize your menu effectively. Less is more when it comes to your IVR call flow tree.
    2. A lack of self-service capabilities. IVR systems are meant to maximize customer service and improve the customer experience by offering self-service functionality. If resolutions for common issues can't be found through IVR, your return on investment (ROI) is limited.
    3. Having callers get stuck in an "IVR loop." Customers caught hearing the same information repeatedly will often abandon their call. Don't allow customers to get "tangled" in your call flow tree; always make human contact an option.
    4. Not offering personalized service. The inability to identify customers by their number or other identifying features leads to poor personalization and time wasted repeating information, contributing to an overall negative experience.
    5. Not updating the IVR system. By not taking advantage of new developments in IVR technology and by not using customer and employee feedback to upgrade your offering, you are missing out on the potential to improve your customers' experience. Complacency kills, and your organization will be at a competitive disadvantage because of it.

    Implement a transformative IVR approach that empowers your customers

    Call flow trees don't grow overnight; they require commitment, nurturing, and care

    1. Focus on the Roots of Your Call Flow Tree
      • Your call flow tree will only grow as strong as the roots allow it; begin beneath the surface by understanding the needs of your customers and the goals of your organization first, before building your initial IVR menu.
    2. Allow Customers the Opportunity to Branch Out
      • Empower your customers by directing your call flow tree to self-service applications where possible and to live agents when necessary.
    3. Let Your Call Flow Tree Flourish
      • Integrate your IVR with other relevant business applications and apply technological developments that align with the needs of your customers and the goals of your organization.
    4. Keep Watering Your Call Flow Tree
      • Don't let your call flow tree die! Elicit feedback from relevant stakeholders and develop an iterative review cycle to identify and implement necessary changes to your call flow tree, ensuring continued growth.

    IT plays an integral role in supporting the IVR approach

    IT is responsible for providing technology enablement of the IVR strategy

    While IT may not be involved in organizing the call flow tree itself, their impact on an organization's IVR approach is undeniable. Not only will IT assist with the implementation and integration of your IVR system, they will also be responsible for maintaining the technology on an ongoing basis. As such, IT should be a part of your organization's software selection team, following Info-Tech's methodology for optimizing your software selection process.

    • With an understanding of the organization's customer experience management strategy and business goals, IT should be looked toward to:
    • Provide insight into the "art of the possible" with IVR systems.
    • Recommend enabling technologies relative to your call center's maturity (e.g. agent assist and natural language processing).
    • Outline integration capabilities with your existing application portfolio.
    • Highlight any security concerns.
    • Assist with vendor engagement.
    • Take part in stakeholder feedback groups, consulting with agents about their pain points and attempting to solve their problems.

    Guided Implementation

    What does a typical GI on this topic look like?

    Focus on the Roots of Your Call Flow Tree

    Allow Customers the Opportunity to Branch Out Let Your IVR Call Flow Tree Flourish Keep Watering Your Call Flow Tree

    Call #1: Introduce the project, scoping customer call drivers and defining metrics of success.

    Call #3: Discuss the importance of promoting self-service and how to improve call routing processes, assessing the final tiers of the IVR.

    Call #4: Discuss the benefits of integrating your IVR within your existing business architecture and using relevant enabling technologies.

    Call #5: Discuss how to elicit feedback from relevant stakeholders and develop an iterative IVR review cycle, wrapping up the project.

    Call #2: Begin assessing initial IVR structure.

    A Guided Implementation (GI) is a series

    of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is 5 to 7 calls over the course of 4 to 6 months.

    Phase 1

    Focus on the Roots of Your Call Flow Tree

    Phase 1

    Phase 2

    Phase 3

    Phase 4

    1.1 Understand your customers

    1.2 Develop goals for your IVR

    1.3 Align goals with KPIs

    1.4 Build your initial IVR menu

    2.1 Build the second tier of your IVR menu

    2.2 Build the third tier of your IVR menu

    3.1 Learn the benefits of a personalized IVR

    3.2 Review new technology to apply to your IVR

    4.1 Gather insights on your IVR's performance

    4.2 Create an agile review method

    This phase will walk you through the following activities:

    • Building a database of your customers' call drivers
    • Developing IVR-related goals and connecting them with your key performance indicators (KPIs)
    • Developing the first tier of your IVR menu

    This phase involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Implement a Transformative IVR Approach That Empowers Your Customers

    Step 1.1

    Understand Your Customers

    This step will walk you through the following activity:

    1.1.1 Build a database of the reasons why your customers call your contact center

    Focus on the Roots of Your Call Flow Tree

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • List of your customers' call drivers

    Help your customers get to where they need to go

    Understand which questions customers need answered the most and organize your IVR menu accordingly

    • With any IVR system, your primary focus should be creating a simple, easily navigated call flow. You not only want your customers to be able to find the solutions that they are looking for, but you want them to be able to do so easily and quickly.
    • In order to direct customers more efficiently, you need to understand why they're motivated to call your contact center. This will be different for every organization, so it requires a deeper understanding of your customers.
    • After understanding the motivators behind your customers' reasons for calling, you'll be able to organize your call flow tree effectively.
    • Assign the most popular reasons that customers call first in your IVR call flow. Organizing your call flow in such a way will ensure a quicker turn around time for customer inquiries, providing callers with the immediate resolution that they are seeking.

    "Call flows are the structure of a call center's interactive voice response (IVR). They define the path a caller takes to reach a resolution. The more efficient the flow, the quicker a resolution can be – thereby delivering a better caller experience."

    Thomas Randall, Ph.D.
    Senior Research Analyst
    Info-Tech Research Group

    1.1.1 Activity: Build a list of the most common reasons that your key customers call your contact center

    30 minutes

    1. As a group, review the reasons that customers call your contact center. This includes reviewing which questions are asked most frequently, what services are most often inquired about, and what pain points and complaints live agents hear most regularly.
    2. Organize each call driver from most to least popular based on how often they are heard.
    3. Record your findings.
    Input Output
    • List of common customer questions
    • List of common customer pain points/complaints
    • Database of customer call drivers
    Materials Participants
    • Whiteboard
    • Markers
    • Project team
    • Customer service leaders/live agents

    Info-Tech Insight

    To understand why your customers are calling, first you need to know who your customers are. Improve your caller understanding by creating customer personas.

    1.1.1 Activity: Build a list of the most common reasons that your key customers call your contact center

    Example

    Customer Call Drivers
    Need to pay a bill
    Complaints about an outage to their service
    Inquiry about new plans
    Need to update account information
    Complaints about their last bill

    Step 1.2

    Develop Goals for Your IVR

    This step will walk you through the following activity:

    1.2.1 Outline IVR-related goals relevant to your organization.

    Focus on the Roots of Your Call Flow Tree

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Goals for your organizational IVR

    Create IVR-related goals you wish for your organization to achieve

    Organizations across different industries will measure success in a multitude of ways; develop goals that are relevant to your needs and desires

    Based on your customer experience strategy and what industry you're in, the goals that you aim to accomplish will look different. A doctor's office will be more concerned with an accurate diagnosis and high first call resolution rate than low average talk time!

    Setting business goals relevant to your organization is only half of the battle; it's just as important to hold your organization accountable to those goals and measure your continued progress toward meeting them.

    1.2.1 Activity: Brainstorm a list of goals that you would like your organization to achieve when optimizing your IVR approach

    30 minutes

    1. In two to three groups, brainstorm goals related to your IVR that are relevant to your organization.
    2. Classify these goals as being either quick wins or part of a longer-term engagement based on the time they would take to accomplish.
    3. Introduce your goals to the entire group, coming to an agreement on the top goals that the organization should aim to achieve through implementing a new/transformed IVR approach.
    InputOutput
    • Customer experience strategy
    • Desired IVR-related achievements
    • Organizational IVR goals
    MaterialsParticipants
    • Whiteboard
    • Markers
    • Project team

    1.2.1 Activity: Brainstorm a list of goals that you would like your organization to achieve when optimizing your IVR approach

    Example

    Goal Designation
    Lower the average queue time Quick win
    Lower call abandonment rate Quick win
    Lower customer attrition Long-term
    Lower employee attrition Long-term
    Increase average speed of answer Quick win

    Step 1.3

    Align Your Goals With Your KPIs

    This step will walk you through the following activity:

    1.3.1 Review your organizational IVR goals and connect them with your key performance indicators (KPIs)

    Focus on the Roots of Your Call Flow Tree

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Metrics used to measure organizational success related to your IVR

    Ensure you are using the proper metrics for measuring the success of your call flow tree

    You won't know if your IVR is operating successfully if you don't know what success looks like for you. It is important to align your contact center KPIs with your business goals so you can hold your IVR system accountable.

    Example

    Metric Description Current Score Target Score [Date/Year]
    First call resolution
    Average abandonment rate
    Customer attrition
    Employee attrition
    Average queue time
    Service level
    Average speed of answer
    Average handle time
    Average call transfer rate
    Average talk time
    Customer self-service resolution
    Agent satisfaction
    Customer satisfaction

    1.3.1 Activity: Develop KPIs for your contact center and connect them to your organization's business goals

    30 minutes

    1. As a group, establish the metrics or KPIs that will be used to measure your progress against the organizational IVR goals created in Activity 1.2.1.
    2. Take note of your current score for each of your organizational goals and determine your target score.
    3. Attach a deadline or target date by which you would like to reach your target score. Target dates can vary based on whether your goal is classified as a quick win or part of a longer-term engagement.
    InputOutput
    • Organizational IVR goals
    • KPIs
    MaterialsParticipants
    • Whiteboard
    • Markers
    • Project team

    Step 1.4

    Build Your Initial IVR Menu

    This step will walk you through the following activity:

    1.4.1 Develop the first tier of your IVR menu, determining the initial selections that customers will have to choose from

    Focus on the Roots of Your Call Flow Tree

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Tier one of your IVR call flow tree

    Keep your IVR concise – minimize the length of your voice prompts and limit the depth of your menus

    You don't want to overload your customers with information. Providing your callers with overly detailed prompts and too many menu options will only lead to frustration, ultimately diminishing both the efficiency and the effectiveness of your IVR. Limiting the length of your voice prompts and the depth of your menus will lay out a clear path for your callers, increasing the likelihood that they are able to navigate your IVR accurately.

    Each of your IVR menus should provide your customers with no more than five selections.

    Your IVR should offer a maximum of three menu tiers.

    Each of your selection "descriptions" or voice prompts should be no longer than four seconds in length.

    Info-Tech Insight

    According to a study by Telzio (2020), introductory IVR messages that greet your customers and identify your company should be under 7.9 seconds in length. Longer introductions will only bore, frustrate, and overload the customer before the call really even begins.

    When developing your voice prompts, it is integral to speak clearly using simple and easily understood language

    • Speak clearly and stay away from industry-specific jargon to ensure that your voice prompts are widely understood by your customer base. This will allow callers to digest the information relayed through your IVR more accurately.
    • Part of increasing the retention of information communicated through your IVR is also ensuring that sufficient pauses are taken between each of your voice prompts. Just as you want to avoid overloading your customers with voice prompts that are too long and too detailed, you also want to give your callers adequate time to process the information that is being relayed to them.
    • Improving the ease of listening to your IVR will reduce the risk of overwhelming your callers and will increase the likelihood that they are able to follow along appropriately, directing themselves down the proper call flow.

    Info-Tech Insight

    Securing voice talent and be expensive and cumbersome. Consider using an automated voice through a text-to-speech solution for your prompts. This will ensure that all your prompts are consistent throughout your menus, and it also makes it significantly easier to provide crucial updates within your IVR system.

    When sufficient pauses are taken between menu options, input errors can be reduced by over…

    Source: Ansafone Contact Centers, 2019

    1.4.1 Activity: Begin building your call flow tree by developing the initial selections that customers will choose from when dialing into your IVR

    30 minutes

    1. Review the database of customer call drivers completed in Activity 1.1.1 to create the opening menu of your IVR call flow tree.
    2. Limit your selections/prompts to a maximum of five by grouping related questions, services, and complaints/pain points into broad categories.
    3. Organize your selections/prompts according to how often customers call in relating to that topic.

    Info-Tech Insight

    Remember: You don't need five selections! That is the maximum recommended number of prompts to use and will most likely be reserved for more complex call flows. More isn't always better. If you can limit your initial menu to fewer selections, then do so.

    InputOutput
    • Database of customer call drivers
    • Initial IVR menu
    MaterialsParticipants
    • Whiteboard
    • Markers
    • Project team

    1.4.1 Activity: Begin building your call flow tree by developing the initial selections that customers will choose from when dialing into your IVR

    Example

    IVR Initial Greeting

    1. For Billing and Payments

    2. To Report an Outage

    3. To Make Changes to Your Plan or Account

    Phase 2

    Allow Customers the Opportunity to Branch Out

    Phase 1

    Phase 2

    Phase 3

    Phase 4

    1.1 Understand your customers

    1.2 Develop goals for your IVR

    1.3 Align goals with KPIs

    1.4 Build your initial IVR menu

    2.1 Build the second tier of your IVR menu

    2.2 Build the third tier of your IVR menu

    3.1 Learn the benefits of a personalized IVR

    3.2 Review new technology to apply to your IVR

    4.1 Gather insights on your IVR's performance

    4.2 Create an agile review method

    This phase will walk you through the following activities:

    • Completing the second tier of your call flow tree
    • Completing the third and final tier of your call flow tree

    This phase involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Implement a Transformative IVR Approach That Empowers Your Customers

    Step 2.1

    Build the Second Tier of Your IVR Menu

    This step will walk you through the following activity:

    • 2.1.1 Complete the second tier of your call flow tree, branching out from your initial menu

    Allow Customers the Opportunity to Branch Out

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Tier 2 of your IVR call flow tree

    An IVR system should empower your customers to solve problems on their own

    Integrate business applications into your IVR menus to enable self-service capabilities and automate processes where possible

    • An IVR system should assist your customer service team while also empowering your customers. This can be accomplished through offering self-service and using automated messaging via a broadcast messaging system.
    • Some common self-service practices include providing callers with the ability to check credit card statements, pay bills, and track shipments.
    • Automated messaging can be used to address common customer questions. For instance, if a company-wide issue exists, an automated message can outline the issue and highlight the approximate time for resolution, providing customers with the answer they were seeking while eliminating the need to speak to a live agent. This technique is commonly practiced by internet providers during outages.
    • Providing callers with the opportunity to find a resolution for themselves through self-service and automated messaging not only improves the customer experience but also frees up your customer service team for more pressing matters.

    73%

    of customers want to be provided with the ability to solve issues on their own.

    67%

    of customers prefer to use self-service options over speaking with a customer service representative.

    Source: Raffle, 2020

    2.1.1 Activity: Grow your call flow tree! Begin branching out from your initial menu options and develop the second tier of your IVR system

    30 minutes

    1. Branch out from your initial IVR menu created in Activity 1.4.1. Get more specific in your prompts, branching out from the general groupings you have created.
    2. Consult with your database of customer call drivers created in Activity 1.1.1 to organize your subgroupings, again prioritizing the services most sought and the questions, complaints, and pain points most frequently heard.
    3. Limit each subsection to a maximum of five prompts.

    Info-Tech Insight

    Always provide your callers with the option to go back to a previous menu or to have menu options repeated.

    InputOutput
    • Database of customer call drivers
    • Initial IVR menu
    • Second IVR menu
    MaterialsParticipants
    • Whiteboard
    • Markers
    • Project team

    2.1.1 Activity: Grow your call flow tree! Begin branching out from your initial menu options and develop the second tier of your IVR system

    Example

    This is an image of the sample flow tree from Activity 2.1.1


    Step 2.2

    Build the Third Tier of Your IVR Menu

    This step will walk you through the following activity:

    2.2.1 Complete your call flow tree by branching out your third and final tier of menu options.

    Allow Customers the Opportunity to Branch Out

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Third and final tier of your IVR call flow tree

    Provide your callers with the option to speak to a live agent – but not too soon

    While promoting self-service and automating certain processes will improve the functionality of your IVR, it is also important to realize that some issues will ultimately require human intervention. An effective IVR system harmonizes these concepts by making human contact an option, but not too early in the process. You need to find the right balance!

    When organizing your IVR call flow tree, you need to be conscious of sending clients in an endless "IVR loop." You should never have your IVR continually repeat its menu options. Customers will abandon an IVR if they are stuck in an IVR loop, being forced to listen to the same information repeatedly without having a way to reach an agent.

    If a problem cannot be solved within three steps or by the third tier of your IVR menus, callers should be provided with the option to speak to a live agent, if not automatically routed to one. By providing your callers with the option to speak to a live agent on the third tier of your IVR, you are still offering ample time for customers to discover an avenue to solve their issue on their own through self-service, without frustrating them by losing them in an endless loop of IVR options.

    30%

    of customers say that not being able to reach a human agent is the most frustrating aspect of a poor customer service experience.

    Source: ProProfs Chat, 2022

    Info-Tech Insight

    Consider routing callers to a live agent not only on the third tier of your IVR menus but also after three input errors. Multiple input errors can show an eagerness to speak to a representative or a strong misunderstanding of the IVR offering.

    How you direct a customer to a live agent can make all the difference

    Don't think that just offering your customers the option to speak to a live agent is enough. When aiming to significantly improve your customers' experience, how you direct calls to your live agents plays a major role. When a call is being directed to a live agent, be sure to:

    • Optimize your call routing and minimize call transfers. Use skills-based routing to direct your incoming client calls to the most suitable agent to resolve their issue. Inaccurately routing callers through your IVR leads to having to transfer the customer to another agent, which is a major contributor to a negative customer experience.
    • Include wait-time expectations and call-back functionality. There is no denying it: Waiting on hold can be a real pain. If a customer needs to go on hold, inform them of where they are in the queue and what the approximate wait time is. A little transparency can go a long way. You should also provide customers with the option to have a representative call them back. This greatly improves the customer experience, particularly when wait times are long.
    • Play useful on-hold messages. If a customer does decide to wait on the line to speak to a representative, ensure your on-hold messaging doesn't negatively impact their experience. Always have multiple songs and messages available to cycle through to limit customer annoyance. For on-hold messages, consider mentioning self-service capabilities available on other channels or providing company news and information on special promotions. Know your key customer demographics and plan your on-hold messaging accordingly.

    72%

    of customers view having to talk to multiple agents as poor customer service.

    Source: ProProfs Chat, 2022

    33%

    of customers highlight waiting on hold as being their biggest frustration.

    Source: EmailAnalytics, 2022

    2.2.1 Activity: Complete your call flow tree!

    30 minutes

    1. Branch out from the second tier of your IVR call flow tree created in Activity 2.1.1, connecting relevant prompts with self-service applications and automated responses. Keep in mind, most of your frequently asked questions can and should be directed toward an automated response.
    2. Direct all remaining prompts to a live agent, ensuring each selection from your second-tier menu is capped off appropriately.

    Info-Tech Insight

    Remember: Your IVR system doesn't live in isolation. The information offered by your IVR, particularly from automated messages, should be consistent with information found within other resources (e.g. online knowledge bases).

    InputOutput
    • Tier 1 and 2 of your IVR menus
    • Completed IVR call flow
    MaterialsParticipants
    • Whiteboard
    • Markers
    • Project team

    2.2.1 Activity: Complete your call flow tree!

    Example

    This is an image of the sample flow tree from Activity 2.2.1

    Phase 3

    Let Your IVR Call Flow Tree Flourish

    Phase 1

    Phase 2

    Phase 3

    Phase 4

    1.1 Understand your customers

    1.2 Develop goals for your IVR

    1.3 Align goals with KPIs

    1.4 Build your initial IVR menu

    2.1 Build the second tier of your IVR menu

    2.2 Build the third tier of your IVR menu

    3.1 Learn the benefits of a personalized IVR

    3.2 Review new technology to apply to your IVR

    4.1 Gather insights on your IVR's performance

    4.2 Create an agile review method

    This phase will walk you through the following activities:

    • Reviewing the benefits of offering personalized service
    • Reviewing new technologies offered in the IVR space

    This phase involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Implement a Transformative IVR Approach That Empowers Your Customers

    Step 3.1

    Learn the Benefits of a Personalized IVR

    This step will walk you through the following activity:

    3.1.1 Review the benefits of offering personalized service, namely by connecting your IVR system with your customer knowledge base

    Let Your IVR Call Flow Tree Flourish

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Understanding the importance of offering personalized service

    Personalizing service is integral for improving your customer experience

    Integrate your IVR system with your customer relationship management (CRM) system or customer knowledge base of choice to provide support to your customers on a personal level.

    The integration of your IVR system with your CRM or other applicable knowledge base allows for customer data (e.g. customer history and previous interactions) to be accessible to your staff during calls. Access to this data allows for a deeper understanding of your customers and for personalization of service. This provides immediate benefits to your contact center that will improve your customer experience.

    When you inevitably do need to transfer a customer to another agent, they won't have to repeat their issue to a new representative, as all their information will now be easily accessible. Being forced to repeat themselves to multiple agents is a major cause of frustration for customers. This integration would also allow you to route callers to the previous agent that they dealt with whenever possible for the purpose of continuity, and it would enable you to implement other beneficial technologies as well.

    One such example is "agent assist." Agent assist is an AI bot that listens in on calls, learning customer context and automatically searching knowledge bases to help resolve queries without the agent having to put the caller on hold to manually perform that work themselves. Not only does agent assist improve customer resolution times, but it also ramps up onboarding time, allowing for new agents to enter the workforce and perform with confidence earlier.

    76%

    of consumers expect personalized experiences.

    71%

    of customers expect internal collaboration so that they don't have to repeat themselves.

    Source: Zendesk, 2019

    Personalization can empower your IVR in many ways

    Personalizing your IVR does much more than just provide your customer service representatives with conversational context. Personalization enables your IVR to recognize callers by their phone number, or even by voice via biometric authentication technologies.

    This advanced level of recognition allows your IVR to greet your callers by name, speak to them in their preferred language, send follow-up correspondence to their preferred method of communication (i.e. email or SMS), and even provide them with contact numbers and addresses for your organization's physical locations that are closest to them.

    An example of a more advanced functionality is having your IVR call flow personalized for each customer based on their call history. As customers call in, their data is collected, ultimately improving your IVR's ability to predict and understand caller intent. This makes personalized call flows possible. If customers typically call in to make payments, your IVR can logically deduce that their next call will be for the same reason, and it will alter the call menu to direct them to that functionality more efficiently.

    Step 3.2

    Review New Technology to Apply to Your IVR

    This step will walk you through the following activity:

    3.2.1 Review new technologies offered in the IVR space and understand their impact

    Let Your IVR Call Flow Tree Flourish

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Understanding of key technologies

    Let your customers tell you exactly what they need

    Use natural language processing and conversational AI to further advance your IVR offering

    Instead of making your customers work their way through your call flow tree to find out what they need, why not just ask them? Conversational IVR, also known as an "intuitive IVR system," makes this possible.

    Think Google Assistant, Siri, and Alexa. Your customers can simply tell you what they need and your conversational IVR, using the advancements in natural language processing and conversational AI, will take it from there, directing callers to the resources needed to resolve their issues.

    Powerful enough to understand full sentences and not just select words or phrases, the increased intelligence of a conversational IVR system allows it to handle complex customer inquiries. Leveraging machine learning capabilities, the system will only continue to improve its ability to understand caller intent, ultimately leading to increased call routing accuracy as it fields more and more calls.

    Info-Tech Insight

    Remember: Your customers want fast and easy, not overwhelming and confusing. Some customers who are greeted with an open-ended question from a conversational IVR may not be sure how to respond.

    Understand your key customer demographics and act accordingly. It may be beneficial to provide your callers with guidelines of what to say. Outlining appropriate responses that will guide your customers to their desired department quicker will boost their experience with your conversational IVR.

    There are a lot of benefits to implementing a conversational IVR

    • Putting your callers in control and offering a more humanized approach, conversational IVRs are the preferred first point of contact for customers.
    • Conversational IVRs reduce the time required to reach resolution and can handle more calls than a standard IVR.
    • Conversational IVRs allow for the collection of more relevant data. By not limiting callers to predetermined menu options, you can track the reasons behind customers' calls with more accuracy, using this data to drive future IVR developments.
    • Conversational IVRs are more cost-effective than standard IVRs. According to a report by IBM, companies world-wide spend over $1.3 trillion to address 256 billion customer calls annually. This means that each call a live agent addresses costs an average of $30 (Cognigy, 2020). With a conversational IVR, that cost can be reduced to one-eighth (ETCIO.com, 2020).
    • Conversational IVRs can be handle calls in multiple languages, offering improved scalability for companies operating multi-nationally.

    60%

    of callers will bypass the pre-recorded messages in a standard IVR to reach a human voice.

    Source: Cognigy, 2020

    66%

    of requests can be resolved faster by a conversational IVR than by a live agent.

    Source: Cognigy, 2020

    Despite this, only...

    28%

    of IVR systems contacted use voice response as their primary input method.

    Source: Telzio, 2020

    How do you know if a conversational IVR is right for your organization?

    Large, enterprise-level organizations that field a high volume of customer calls are more likely to receive the benefits and higher ROI from implementing a conversational IVR

    Instead of updating the entire IVR system and implementing a conversational IVR, smaller and mid-level organizations should consider attaching a natural language processing front-end to their existing IVR. Through this, you will be able to reap a lot of the same benefits you would if you were to upgrade to a conversational IVR.

    You can attach a natural language processing front-end to your existing IVR in two ways.

    1. Use an API to recognize your customer's voice prompts. Greet your customers with a question, such as "what is your reason for calling," as your initial IVR menu, and when your customer answers, their response will be sent to your selected API (Amazon Lex, IBM Watson, Google Dialogflow, etc.). The API will then process the customer's input and direct the caller to the appropriate branch of your call flow tree.
    2. Use a conversational AI platform to field your calls. Implement a conversational AI platform to be the first point of contact for your customers. After receiving and analyzing the input from your customers, the platform would then route your callers to your current IVR system and to the appropriate menu, whether that be to an automated message, a self-service application, or a live agent.

    Phase 4

    Keep Watering Your IVR Call Flow Tree

    Phase 1

    Phase 2

    Phase 3

    Phase 4

    1.1 Understand your customers

    1.2 Develop goals for your IVR

    1.3 Align goals with KPIs

    1.4 Build your initial IVR menu

    2.1 Build the second tier of your IVR menu

    2.2 Build the third tier of your IVR menu

    3.1 Learn the benefits of a personalized IVR

    3.2 Review new technology to apply to your IVR

    4.1 Gather insights on your IVR's performance

    4.2 Create an agile review method

    This phase will walk you through the following activities:

    • Understanding the importance of receiving feedback from relevant stakeholders and the best practices for obtaining feedback
    • Understanding the best practices for developing an ongoing review cycle

    This phase involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Implement a Transformative IVR Approach That Empowers Your Customers

    Step 4.1

    Gather Insights on Your IVR's Performance

    This step will walk you through the following activity:

    4.1.1 Understand the importance of receiving feedback and review the best methods for obtaining it from your clients.

    Keep Watering Your IVR Call Flow Tree

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Understanding of the importance of receiving feedback and how to obtain it from customers

    Elicit feedback from your employees and from your customers

    Your live agents are on the proverbial front lines, fielding calls from customers daily. As such, they are the prime stakeholders for knowing what kinds of calls the organization receives and how often. Their input on the most frequent reasons that customers call, whether it be to address common pain points or to have FAQs answered, is invaluable. Ask them regularly for their feedback on how the IVR system is performing and which updates should be implemented.

    While improving the agent experience is a driver behind adopting an IVR system, the focus should always be improving your customer experience. So why wouldn't you ask your customers for their feedback on your IVR offering? Most customers don't only want to be asked to provide feedback, they expect to be asked. Have your agents ask your customers directly about their experience with your IVR or use the functions of your IVR to offer automated end-of-call surveys.

    Info-Tech Insight

    Many IVR systems are capable of recording calls. Listening back on previous calls is another great way to further understand how your IVR is performing, and it also can provide a glimpse into your customers' experience.

    Surveys provide great insight into your customers' level of satisfaction – not only with your IVR but also with your live agents

    Customer satisfaction score (CSAT) is a great way to determine how happy callers are with their experiences with your organization. CSAT surveys ask your clients outright how satisfied they are with their recent interaction and have them rate your service on a scale. While straightforward, the feedback received from CSAT surveys is more general and can lack depth.

    For more detailed responses, consider asking your clients an open-ended question as opposed to using a rating scale. This will provide you with a more specific understanding of your customers' experience. For this, an IVR system that supports voice transcription is best. Automated speech-to-text functionality will ensure rapid results.

    Another option is to offer a survey that includes skip logic. These multi-tiered surveys, much like an IVR call flow tree, direct your callers to different follow-up questions based on their previous answers. While capable of providing more insight into the customer experience, these surveys are only recommended for more complex service offerings.

    Customer feedback is vitally important

    Asking for feedback makes your callers feel valued, and it also provides your organization with extremely useful information – including an understanding of what you may need to change within your IVR

    90%

    of consumers believe that organizations should provide them with the opportunity to give customer feedback.

    Source: SmallBizGenius, 2022

    41%

    of customer support professionals say that CSAT is their team's most important KPI.

    Source: Hiver, 2022

    Step 4.2

    Create an Agile Review Method

    This step will walk you through the following activity:

    4.2.1 Understand the best practices for developing an ongoing review cycle for your IVR approach

    Keep Watering Your IVR Call Flow Tree

    This step involves the following participants:

    • Business stakeholders (business analysts, application director/manager, customer service leaders)
    • IT project team

    Outcomes of this step

    • Understanding of the importance of IVR maintenance and of the development of an iterative review cycle

    Create an agile review method to continually enhance your call flows

    • Track items
      • Elicit feedback from your key stakeholders (i.e. live agents) as part of a regular review – every month, two months, six months, or year – of your call flow tree's efficiency. Delve into the feedback elicited from your customers at the same intervals. Look for patterns and trends and record items accordingly.
    • Manage backlog
      • Store and organize your recorded items into a backlog, prioritizing items to implement in order of importance. This could be structured by way of identifying which items are a quick win vs. which items are part of a more strategic and long-term implementation.
    • Perform iteration
      • Record key metric scores and communicate the changes you have planned to stakeholders before you implement items. Then, make the change.
    • Be retrospective
      • Examine the success of the implementation by comparing your metric scores from before and after the change. Record instances where performing similar changes could be carried out better in future iterations.

    Summary of Accomplishment

    • Knowledge Gained
      • Benefits of enabling personalized service
      • IVR-enabling technologies
      • Methods of eliciting feedback
    • Processes Optimized
      • IVR voice prompt creation
      • IVR voice prompt organization
      • IVR review cycles
    • Deliverables Completed
      • Database of customer call drivers
      • Organizational IVR goals and KPIs
      • IVR call flow tree

    Related Info-Tech Research

    This is a picture of a hand holding a cellular phone

    Choose a Right-Sized Contact Center Solution

    • IT needs a method to pinpoint which contact center solution best aligns with business objectives, adapting to a post-COVID-19 world of remote work, flexibility, and scalability.
    This image contains a screenshot from Info-tech's Build a Strong Technology Foundation for Customer Experience Management.

    Build a Strong Technology Foundation for Customer Experience Management

    • Customer expectations around personalization, channel preferences, and speed-to-resolution are at an all-time high. Your customers are willing to pay more for high-value experiences, and having a strong customer experience management (CXM) strategy is a proven path to creating sustainable value for the organization.
    This image contains a screenshot from Info-tech's IT Strategy Research Center

    IT Strategy Research Center

    • Create an IT strategy based on business needs, not just intuition.
    This image contains a screenshot from Info-tech's SoftwareReviews blueprint.

    SoftwareReviews

    • Accelerate and improve your software selection process with enterprise software reviews. Focus on available resources for communications platform as a service providers and conversational intelligence software.

    Bibliography

    "7 Conversational IVR Trends for 2021 and Beyond." Haptik, 25 March 2021. Accessed 16 June 2022.
    "7 Remarkable IVR Trends For the Year 2022 And Beyond." Haptik, 30 Dec. 2021. Accessed 27 April 2022.
    "8 IVR Strategies that Keep Customers Happy." Ansafone Contact Centers, 31 May 2019. Accessed 25 April 2022.
    "Agent Assist." Speakeasy AI, 19 April 2022. Accessed 27 April 2022.
    "AI chatbot that's easy to use." IBM, n.d. Accessed 21 June 2022.
    "IVR Trends to Watch in 2020 and Beyond: Inside CX." Intrado, 1 May 2020. Accessed 27 April 2022.
    "RIP IVR: 1980-2020." Vonage, 2 June 2020. Accessed 16 June 2022.
    Andrea. "What do Customers Want? – 37 Customer Service Statistics." SmallBizGenius, 17 March 2022. Accessed 24 May 2022.
    Anthony, James. "106 Customer Service Statistics You Must See: 2021/2022 Data & Analysis." FinancesOnline, 14 Jan. 2022. Accessed 27 April 2022.
    Brown, James. "14 stats that prove the importance of self-service in customer service." raffle, 13 Oct. 2020. Accessed 17 June 2022.
    Buesing, Eric, et al. "Getting the best customer service from your IVR: Fresh eyes on an old problem." McKinsey & Company, 1 Feb. 2019. Accessed 25 April 2022.
    Callari, Ron. "IVR Menus and Best Practices." Telzio, 4 Sep. 2020. Accessed 27 April 2022.
    Cornell, Jared. "104 Customer Service Statistics & Facts of 2022." ProProfs Chat, 6 April 2022. Accessed 16 June 2022.
    DeCarlo, Matthew. "18 Common IVR Mistakes & How To Configure Effective IVR." GetVoIP, 13 June 2019. Accessed 27 April 2022.
    DeMers, Jayson. "77 Customer Service Statistics to Know." EmailAnalytics, 23 March 2022. Accessed 27 April 2022.
    Frants, Valeriy. Interview. Conducted by Austin Wagar, 22 June 2022.
    Grieve, Patrick. "Personalized customer service: what it is and how to provide it." Zendesk, 28 June 2019. Accessed 27 April 2022.
    "How Natural Language Processing Can Help Your Interactive Voice Response System Meet Best Practice." Hostcomm, 15 July 2019. Accessed 25 April 2022.
    "IVR and customer experience: get the best UX for your clients." Kaleyra, 14 Dec. 2020. Accessed 25 April 2022.
    Irvine, Bill. "Selecting an IVR System for Customer Satisfaction Surveys." IVR Technology Group, 14 April 2020. Accessed 22 June 2022.
    Kulbyte, Toma. "Key Customer Experience Statistics to Know." SuperOffice, 24 June 2021. Accessed 24 May 2022.
    Leite, Thiago. "What's the Difference Between Standard & Conversational IVR?" Cognigy, 27 Oct. 2020. Accessed 24 May 2022.
    Maza, Cristina. "What is IVR? The ultimate guide." Zendesk, 30 Sep. 2020. Accessed 25 April 2022.
    McCraw, Corey. "What is IVR Call Flow? Benefits, Features, Metrics & More." GetVoIP, 30 April 2020. Accessed 25 April 2022.
    Mircevski, Bruno. "Smart IVR Introduction – What Is It and Why You Should Use It." Ideta, 7 March 2022. Accessed 28 April 2022.
    Oriel, Astha. "Artificial Intelligence in IVR: A Step Towards Faster Customer Services." Analytics Insight, 19 Aug. 2020. Accessed 24 May 2022.
    Perzynska, Kasia. "What is CSAT & How to Measure Customer Satisfaction?" Survicate, 9 March 2022. Accessed 22 June 2022.
    Pratt, Mary K. "How to set business goals, step by step." TechTarget, 27 April 2022. Accessed 21 June 2022.
    Robinson, Kerry. "Insight of the Week: Make Your IVR More Like Alexa." Waterfield Tech, 20 April 2022. Accessed 25 April 2022.
    Sehgal, Karishma. "Exclusive Research – 76% of customer service teams offer support outside of business hours." Hiver, 4 May 2022. Accessed 22 June 2022.
    Smith, Mercer. "111 Customer Service Statistics and Facts You Shouldn't Ignore." Help Scout, 23 May 2022. Accessed 24 June 2022.
    Thompson, Adrian. "A Guide to Conversational IVR." The Bot Forge, 27 Jan. 2021. Accessed 21 June 2022.
    Tolksdorf, Juergen. " 5 Ways to Leverage AI and Agent-Assist to Improve Customer Experience." Genesys, 19 May 2020. Accessed 27 April 2022.
    Vaish, Aakrit. "5 ways conversational IVR is helping businesses revolutionize customer service." ETCIO.com, 20 March 2020. Web.
    Westfall, Leah. "Improving customer experience with the right IVR strategy." RingCentral, 23 July 2021. Accessed 25 April 2022.

    Secure IT-OT Convergence

    • Buy Link or Shortcode: {j2store}382|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: $10,499 Average $ Saved
    • member rating average days saved: 19 Average Days Saved
    • Parent Category Name: Security Processes & Operations
    • Parent Category Link: /security-processes-and-operations

    IT and OT are both very different complex systems. However, significant benefits have driven OT to be converged to IT. This results in IT security leaders, OT leaders and their teams' facing challenges in:

    • Governing and managing IT and OT security and accountabilities.
    • Converging security architecture and controls between IT and OT environments.
    • Compliance with regulations and standards.
    • Metrics for OT security effectiveness and efficiency.

    Our Advice

    Critical Insight

    • Returning to isolated OT is not beneficial for the organization, therefore IT and OT need to learn to collaborate starting with communication to build trust and to overcome differences between IT and OT. Next, negotiation is needed on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and metrics for OT security.
    • Most OT incidents start with attacks against IT networks and then move laterally into the OT environment. Therefore, converging IT and OT security will help protect the entire organization.
    • OT interfaces with the physical world while IT system concerns more on cyber world. Thus, the two systems have different properties. The challenge is how to create strategic collaboration between IT-OT based on negotiation and this needs top-down support.

    Impact and Result

    Info-Tech’s approach in preparing for IT/OT convergence in the planning phase is coordination and collaboration of IT and OT to

    • initiate communication to define roles and responsibilities.
    • establish governance and build cross-functional team.
    • identify convergence components and compliance obligations.
    • assess readiness.

    Secure IT/OT Convergence Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Secure IT/OT Convergence Storyboard – A step-by-step document that walks you through how to secure IT-OT convergence.

    Info-Tech provides a three-phase framework of secure IT/OT convergence, namely Plan, Enhance, and Monitor & Optimize. The essential steps in Plan are to:

  • Initiate communication to define roles and responsibilities.
  • Establish governance and build a cross-functional team.
  • Identify convergence components and compliance obligations.
  • Assess readiness.
    • Secure IT/OT Convergence Storyboard

    2. Secure IT/OT Convergence Requirements Gathering Tool – A tool to map organizational goals to secure IT-OT goals.

    This tool serves as a repository for information about the organization, compliance, and other factors that will influence your IT/OT convergence.

    • Secure IT/OT Convergence Requirements Gathering Tool

    3. Secure IT/OT Convergence RACI Chart Tool – A tool to identify and understand the owners of various IT/OT convergence across the organization.

    A critical step in secure IT/OT convergence is populating a RACI (Responsible, Accountable, Consulted, and Informed) chart. The chart assists you in organizing roles for carrying out convergence steps and ensures that there are definite roles that different individuals in the organization must have. Complete this tool to assign tasks to suitable roles.

    • Secure IT/OT Convergence RACI Chart Tool
    [infographic]

    Further reading

    Secure IT/OT Convergence

    Create a holistic IT/OT security culture.

    Analyst Perspective

    Are you ready for secure IT/OT convergence?

    IT/OT convergence is less of a convergence and more of a migration. The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.

    In the past, OT systems were engineered to be air gapped, relying on physical protection and with little or no security in design, (e.g. OT protocols without confidentiality properties). However, now, OT has become dependent on the IT capabilities of the organization, thus OT inherits IT’s security issues, that is, OT is becoming more vulnerable to attack from outside the system. IT/OT convergence is complex because the culture, policies, and rules of IT are quite foreign to OT processes such as change management, and the culture, policies, and rules of OT are likewise foreign to IT processes.

    A secure IT/OT convergence can be conceived of as a negotiation of a strong treaty between two systems: IT and OT. The essential initial step is to begin with communication between IT and OT, followed by necessary components such as governing and managing OT security priorities and accountabilities, converging security controls between IT and OT environments, assuring compliance with regulations and standards, and establishing metrics for OT security.

    Photo of Ida Siahaan, Research Director, Security and Privacy Practice, Info-Tech Research Group. Ida Siahaan
    Research Director, Security and Privacy Practice
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    IT and OT are both very different complex systems. However, significant benefits have driven OT to converge with IT. This results in IT security leaders, OT leaders, and their teams facing challenges with:

    • Governing and managing IT and OT security and accountabilities.
    • Converging security architecture and controls between IT and OT environments.
    • Compliance with regulations and standards.
    • Metrics for OT security effectiveness and efficiency.
    Common Obstacles
    • IT/OT network segmentation and remote access issues, as most OT incidents indicate that the attackers gained access through the IT network, followed by infiltration into OT networks.
    • OT proprietary devices and unsecure protocols use outdated systems which may be insecure by design.
    • Different requirements of OT and IT security – i.e. IT (confidentiality, integrity, and availability) vs. OT (safety, reliability, and availability).
    Info-Tech’s Approach

    Info-Tech’s approach in preparing for IT/OT convergence (i.e. the Plan phase) is coordination and collaboration of IT and OT to:

    • Initiate communication to define roles and responsibilities.
    • Establish governance and build a cross-functional team.
    • Identify convergence components and compliance obligations.
    • Assess readiness.

    Info-Tech Insight

    Returning to isolated OT is not beneficial for the organization, so IT and OT need to learn to collaborate, starting with communication to build trust and to overcome their differences. Next, negotiation is needed on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.

    Consequences of unsecure IT/OT convergence

    OT systems were built with no or little security design

    90% of organizations that use OT experienced a security incident. (Fortinet, 2021. Ponemon, 2019.)

    Bar graph comparing three years, 2019-2021, of four different OT security incidents: 'Ransomeware', 'Insider breaches', 'Phishing', and 'Malware'.
    (Source: Fortinet, 2021.)
    Lack of visibility

    86% of OT security-related service engagements lack complete visibility of OT network in 2021 (90% in 2020, 81% in 2019). (Source: “Cybersecurity Year In Review” Dragos, 2022.)

    The need for secure IT/OT convergence

    Important Industrial Control System (ICS) cyber incidents

    2000
    Target: Australian sewage plant. Method: Insider attack. Impact: 265,000 gallons of untreated sewage released.
    2012
    Target: Middle East energy companies. Method: Shamoon. Impact: Overwritten Windows-based systems files.
    2014
    Target: German Steel Mill. Method: Spear-phishing. Impact: Blast furnace failed to shut down.
    2017
    Target: Middle East safety instrumented system (SIS). Method: TRISIS/TRITON. Impact: Modified SIS ladder logic.
    2022
    Target: Viasat’s KA-SAT network. Method: AcidRain. Impact: Significant loss of communication for the Ukrainian military, which relied on Viasat’s services.
    Timeline of Important Industrial Control System (ICS) cyber incidents.
    1903
    Target: Marconi wireless telegraph presentation. Method: Morse code. Impact: Fake message sent “Rats, rats, rats, rats. There was a young fellow of Italy, Who diddled the public quite prettily.”
    2010
    Target: Iranian uranium enrichment plant. Method: Stuxnet. Impact: Compromised programmable logic controllers (PLCs).
    2013
    Target: ICS supply chain. Method: Havex. Impact: Remote Access Trojan (RAT) collected information and uploaded data to command-and-control (C&C) servers
    2016
    Target: Ukrainian power grid. Method: BlackEnergy. Impact: For 1-6 hours, power outages for 230,000 consumers.
    2021
    Target: Colonial Pipeline. Method: DarkSide ransomware. Impact: Compromised billing infrastructure halted the pipeline operation.

    (Source: US Department of Energy, 2018.


    ”Significant Cyber Incidents,” CSIS, 2022


    MIT Technology Review, 2022.)

    Info-Tech Insight

    Most OT incidents start with attacks against IT networks and then move laterally into the OT environment. Therefore, converging IT and OT security will help protect the entire organization.

    Case Study

    Horizon Power
    Logo for Horizon Power.
    INDUSTRY
    Utilities
    SOURCE
    Interview

    Horizon Power is the regional power provider in Western Australia and stands out as a leader not only in the innovative delivery of sustainable power, but also in digital transformation. Horizon Power is quite mature in distributed energy resource management; moving away from centralized generation to decentralized, community-led generation, which reflects in its maturity in converging IT and OT.

    Horizon Power’s IT/OT convergence journey started over six years ago when advanced metering infrastructure (AMI) was installed across its entire service area – an area covering more than one quarter of the Australian continent.

    In these early days of the journey, the focus was on leveraging matured IT approaches such as adoption of cloud services to the OT environment, rather than converging the two. Many years later, Horizon Power has enabled OT data to be more accessible to derive business benefits such as customer usage data using data analytics with the objective of improving the collection and management of the OT data to improve business performance and decision making.

    The IT/OT convergence meets legislation such as the Australian Energy Sector Cyber Security Framework (AESCSF), which has impacts on the architectural layer of cybersecurity that support delivery of the site services.

    Results

    The lessons learned in converging IT and OT from Horizon Power were:

    • Start with forming relationships to build trust and overcome any divide between IT and OT.
    • Collaborate with IT and OT teams to successfully implement solutions, such as vulnerability management and discovery tools for OT assets.
    • Switch the focus from confidentiality and integrity to availability in solutions evaluation
    • Develop training and awareness programs for all levels of the organization.
    • Actively encourage visible sponsorship across management by providing regular updates and consistent messaging.
    • Monitor cybersecurity metrics such as vulnerabilities, mean time to treat vulnerabilities, and intrusion attempts.
    • Manage third-party vendors using a platform which not only performs external monitoring but provides third-party vendors with visibility or potential threats in their organization.

    The Secure IT/OT Convergence Framework

    IT/OT convergence is less of a convergence and more of a migration. The previously entirely separate OT ecosystem is migrating onto the IT ecosystem, to improve access via the internet and to leverage other standard IT capabilities. However, IT and OT are historically very different, and without careful calculation, simply connecting the two systems will result in a problem. Therefore, IT and OT need to learn to live together starting with communication to build trust and to overcome differences between IT and OT.
    Convergence Elements
    • Process convergence
    • Software and data convergence
    • Network and infrastructure convergence
    Target Groups
    • OT leader and teams
    • IT leader and teams
    • Security leader and teams
    Security Components
    • Governance and compliance
    • Security strategy
    • Risk management
    • Security policies
    • IR, DR, BCP
    • Security awareness and training
    • Security architecture and controls

    Plan

    • Initiate communication
    • Define roles and responsibilities
    • Establish governance and build a cross-functional team
    • Identify convergence elements and compliance obligations
    • Assess readiness

    Governance

    Compliance

    Enhance

    • Update security strategy for IT/OT convergence
    • Update risk-management framework for IT/OT convergence
    • Update security policies and procedures for IT/OT convergence
    • Update incident response, disaster recovery, and business continuity plan for IT/OT convergence

    Security strategy

    Risk management

    Security policies and procedures

    IR, DR, and BCP

    Monitor &
    Optimize

    • Implement awareness, induction, and cross-training program
    • Design and deploy converging security architecture and controls
    • Establish and monitor IT/OT security metrics on effectiveness and efficiency
    • Red-team followed by blue-team activity for cross-functional team building

    Awareness and cross-training

    Architecture and controls

    Phases
    Color-coded phases with arrows looping back up from the bottom to top phase.
    • Plan
    • Enhance
    • Monitor & Optimize
    Plan Outcomes
    • Mapping business goals to IT/OT security goals
    • RACI chart for priorities and accountabilities
    • Compliance obligations register
    • Readiness checklist
    Enhance Outcomes
    • Security strategy for IT/OT convergence
    • Risk management framework
    • Security policies & procedures
    • IR, DR, BCP
    Monitor & Optimize Outcomes
    • Security awareness and training
    • Security architecture and controls
    Plan Benefits
    • Improved flexibility and less divided IT/OT
    • Improved compliance
    Enhance Benefits
    • Increased strategic common goals
    • Increased efficiency and versatility
    Monitor & Optimize Benefits
    • Enhanced security
    • Reduced costs

    Plan

    Initiate communication

    To initiate communication between the IT and OT teams, it is important to understand how the two groups are different and to build trust to find a holistic approach which overcomes those differences.
    IT OT
    Remote Access Well-defined access control Usually single-level access control
    Interfaces Human Machine, equipment
    Software ERP, CRM, HRIS, payroll SCADA, DCS
    Hardware Servers, switches, PCs PLC, HMI, sensors, motors
    Networks Ethernet Fieldbus
    Focus Reporting, communication Up-time, precision, safety
    Change management Frequent updates and patches Infrequent updates and patches
    Security Confidentiality, integrity, availability Safety, reliability, availability
    Time requirement Normally not time critical Real time

    Info-Tech Insight

    OT interfaces with the physical world while IT system concerns more on cyber world. Thus, the two systems have different properties. The challenge is how to create strategic collaboration between IT and OT based on negotiation, and this needs top-down support.

    Identifying organization goals is the first step in aligning your secure IT/OT convergence with your organization’s vision.

    • Security leaders need to understand the direction the organization is headed in.
    • Wise security investments depend on aligning your security initiatives to the organization.
    • Secure IT/OT convergence should contribute to your organization’s objectives by supporting operational performance and ensuring brand protection and shareholder value.

    Map organizational goals to IT/OT security goals

    Input: Corporate, IT, and OT strategies

    Output: Your goals for the security strategy

    Materials: Secure IT/OT Convergence Requirements Gathering Tool

    Participants: Executive leadership, OT leader, IT leader, Security leader, Compliance, Legal, Risk management

    1. As a group, brainstorm organization goals.
      1. Review relevant corporate, IT, and OT strategies.
    2. Record the most important business goals in the Secure IT/OT Convergence Requirements Gathering Tool. Try to limit the number of business goals to no more than 10 goals. This limitation will be critical to helping focus on your secure IT/OT convergence.
    3. For each goal, identify one to two security alignment goals. These should be objectives for the security strategy that will support the identified organization goals.

    Download the Secure IT/OT Convergence Requirements Gathering Tool

    Record organizational goals

    Sample of the definitions table with columns numbered 1-4.

    Refer to the Secure IT/OT Convergence Framework when filling in the following elements.

    1. Record your identified organization goals in the Goals Cascade tab of the Secure IT/OT Convergence Requirements Gathering Tool.
    2. For each of your organizational goals, identify IT alignment goals.
    3. For each of your organizational goals, identify OT alignment goals.
    4. For each of your organizational goals, select one to two IT/OT security alignment goals from the drop-down lists.

    Establish scope and boundaries

    It is important to know at the outset of the strategy: What are we trying to secure in IT/OT convergence ?
    This includes physical areas we are responsible for, types of data we care about, and departments or IT/OT systems we are responsible for.

    This also includes what is not in scope. For some outsourced services or locations, you may not be responsible for their security. In some business departments, you may not have control of security processes. Ensure that it is made explicit at the outset what will be included and what will be excluded from security considerations.

    Physical Scope and Boundaries

    • How many offices and locations does your organization have?
    • Which locations/offices will be covered by your information security management system (ISMS)?
    • How sensitive is the data residing at each location?
    • You may have many physical locations, and it is not necessary to list each one. Rather, list exceptional cases that are specifically in or out of scope.

    IT Systems Scope and Boundaries

    • There may be hundreds of applications that are run and maintained in your organization. Some of these may be legacy applications. Do you need to secure all your programs or only a select few?
    • Is the system owned or outsourced?
    • Where are you accountable for security?
    • How sensitive is the data that each system handles?

    Organizational Scope and Boundaries

    • Will your ISMS cover all departments within your organization? For example, do certain departments (e.g. operations) not need any security coverage?
    • Do you have the ability to make security decisions for each department?
    • Who are the key stakeholders/data owners for each department?

    OT Systems Scope and Boundaries

    • There may be hundreds of OT systems that are run and maintained in your organization. Do you need to secure all OT or a select subset?
    • Is the system owned or outsourced?
    • Where are you accountable for safety and security?
    • What reliability requirements does each system handle?

    Record scope and boundaries

    Sample Scope and Boundaries table. Refer to the Secure IT/OT Convergence Framework when filling in the following elements:
    • Record your security-related organizational scope, physical location scope, IT systems scope, and OT systems scope in the Scope tab of the Secure IT/OT Convergence Requirements Gathering Tool.
    • For each item scoped, give the rationale for including it in the comments column. Careful attention should be paid to any elements that are not in scope.

    Plan

    Define roles and responsibilities

    Input: List of relevant stakeholders

    Output: Roles and responsibilities for the secure IT/OT convergence program

    Materials: Secure IT/OT Convergence RACI Chart Tool

    Participants: Executive leadership, OT leader, IT leader, Security leader

    There are many factors that impact an organization’s level of effectiveness as it relates to IT/OT convergence. How the two groups interact, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, it is imperative in the planning phase to identify stakeholders who are:

    • Responsible: The people who do the work to accomplish the activity; they have been tasked with completing the activity and/or getting a decision made.
    • Accountable: The person who is accountable for the completion of the activity. Ideally, this is a single person and will often be an executive or program sponsor.
    • Consulted: The people who provide information. This is usually several people, typically called subject matter experts (SMEs).
    • Informed: The people who are updated on progress. These are resources that are affected by the outcome of the activities and need to be kept up to date.

    Download the Secure IT/OT Convergence RACI Chart Tool

    Define RACI Chart

    Sample RACI chart with only the 'Plan' section enlarged.

    Define responsible, accountable, consulted, and informed (RACI) stakeholders.
    1. Customize the "work units" to best reflect your operation with applicable stakeholders.
    2. Customize the "action“ rows as required.
    Info-Tech Insight

    The roles and responsibilities should be clearly defined. For example, IT network should be responsible for the communication and configuration of all access points and devices from the remote client to the control system DMZ, and controls engineering should be responsible from the control system DMZ to the control system.

    Plan

    Establish governance and build cross-functional team

    To establish governance and build an IT/OT cross-functional team, it is important to understand the operation of OT systems and their interactions with IT within the organization, e.g. ad hoc, centralized, decentralized.

    The maturity ladder with levels 'Fully Converged', 'Collaborative Partners', 'Trusted Resources', 'Affiliated Entities', and 'Siloed' at the bottom. Each level has four maturity indicators listed.

    Info-Tech Insight

    To determine IT/OT convergence maturity level, Info-Tech provides the IT/OT Convergence Self-Evaluation Tool.

    Centralized security governance model example

    Example of a centralized security governance model.

    Plan

    Identify convergence elements and compliance obligations

    To switch the focus from confidentiality and integrity to safety and availability for OT system, it is important to have a common language such as the Purdue model for technical communication.
    • A lot of OT compliance standards are technically focused and do not address governance and management, e.g. IT standards like the NIST Cybersecurity Framework. For example, OT system modeling with Purdue model will help IT teams to understand assets, networking, and controls. This understanding is needed to know the possible security solutions and where these solutions could be embedded to the OT system with respect to safety, reliability, and availability.
    • However, deployment of technical solutions or patches to OT system may nullify warranty, so arrangements should be made to manage this with the vendor or manufacturer prior to modification.
    • Finally, OT modernizations such as smart grid together with the advent of IIoT where data flow is becoming less hierarchical have encouraged the birth of a hybrid Purdue model, which maintains segmentation with flexibility for communications.

    Level 5: Enterprise Network

    Level 4: Site Business

    Level 3.5: DMZ
    Example: Patch Management Server, Application Server, Remote Access Server

    Level 3: Site Operations
    Example: SCADA Server, Engineering Workstation, Historian

    Level 2: Area Supervisory Control
    Example: SCADA Client, HMI

    Level 1: Basic Control
    Example: Batch Controls, Discrete Controls, Continuous Process Controls, Safety Controls, e.g. PLCs, RTUs

    Level 0: Process
    Example: Sensors, Actuators, Field Devices

    (Source: “Purdue Enterprise Reference Architecture (PERA) Model,” ISA-99.)

    Identify compliance obligations

    To manage compliance obligations, it is important to use a platform which not only performs internal and external monitoring, but also provides third-party vendors with visibility on potential threats in their organization.
    Example table of compliance obligations standards. Example tables of compliance obligations regulations and guidelines.

    Source:
    ENISA, 2013
    DHS, 2009.

    • OT system has compliance obligations with industry regulations and security standards/regulations/guidelines. See the lists given. The lists are not exhaustive.
    • OT system owner can use the standards/regulations/guidelines as a benchmark to determine and manage the security level provided by third parties.
    • It is important to understand the various frameworks and to adhere to the appropriate compliance obligations, e.g. IEC/ISA 62443 - Security for Industrial Automation and Control Systems Series.

    IEC/ISA 62443 - Security for Industrial Automation and Control Systems Series

    International series of standards for asset owners, system integrators, and product manufacturers.
    Diagram of the international series of standards for asset owners.
    (Source: Cooksley, 2021)
    • IEC/ISA 62443 is a comprehensive international series of standards covering security for ICS systems, which recognizes three roles, namely: asset owner, system integrator, and product manufacturer.
    • In IEC/ISA 62443, requirements flow from the asset owner to the product manufacturer, while solutions flow in the opposite direction.
    • For the asset owner who owns and operates a system, IEC 62443-2 enables defining target security level with reference to a threat level and using the standard as a benchmark to determine the current security level.
    • For the system integrator, IEC 62443-3 assists to evaluate the asset owner’s requirements to create a system design. IEC 62443-3 also provides a method for verification that components provided by the product manufacturer are securely developed and support the functionality required.

    Record your compliance obligations

    Refer to the “Goals Cascade” tab of the Secure IT/OT Convergence Requirements Gathering Tool.
    1. Identify your compliance obligations. Most organizations have compliance obligations that must be adhered to. These can include both mandatory and voluntary obligations. Mandatory obligations include:
      1. Laws
      2. Government regulations
      3. Industry standards
      4. Contractual agreements
      Voluntary obligations include standards that the organization has chosen to follow for best practices and any obligations that are required to maintain certifications. Organizations will have many different compliance obligations. For the purposes of your secure IT/OT convergence, include only those that have OT security requirements.
    2. Record your compliance obligations, along with any notes, in your copy of the Secure IT/OT Convergence Requirements Gathering Tool.
    3. Refer to the “Compliance DB” tab for lists of standards/regulations/guidelines.
    Table of mandatory and voluntary security compliance obligations.

    Plan

    Assess readiness

    Readiness checklist for secure IT/OT convergence

    People

    • Define roles and responsibilities on interaction based on skill sets and the degree of support and alignment.
    • Adopt well-established security governance practices for cross-functional teams.
    • Analyze and develop skills required by implementing awareness, induction, and cross-training program.

    Process

    • Conduct a maturity assessment of key processes and highlight interdependencies.
    • Redesign cybersecurity processes for your secure IT/OT convergence program.
    • Develop a baseline and periodically review on risks, security policies and procedures, incident response, disaster recovery, and business continuity plan.

    Technology

    • Conduct a maturity assessment and identify convergence elements and compliance obligations.
    • Develop a roadmap and deploy converging security architecture and controls step by step, working with trusted technology partners.
    • Monitor security metrics on effectiveness and efficiency and conduct continuous testing by red-team and blue-team activities.

    (Source: “Grid Modernization: Optimize Opportunities And Minimize Risks,” Info-Tech)

    Enhance

    Update security strategy

    To update security strategy, it is important to actively encourage visible sponsorship across management and to provide regular updates.

    Cycle for updating security strategy: 'Architecture design', 'Procurement', 'Installation', 'Maintenance', 'Decommissioning'.
    (Source: NIST SP 800-82 Rev.3, “Guide to Operational Technology (OT) Security,” NIST, 2022.)
    • OT system life cycle is like the IT system life cycle, starting with architectural design and ending with decommissioning.
    • Currently, IT only gets involved from installation or maintenance, so they may not fully understand the OT system. Therefore, if OT security is compromised, the same personnel who commissioned the OT system (e.g. engineering, electrical, and maintenance specialists) must be involved. Thus, it is important to have the IT team collaborate with the OT team in each stage of the OT system’s life cycle.
    • Finally, it is necessary to have propositional sharing of responsibilities between IT leaders, security leaders, and OT leaders who have broader responsibilities.

    Enhance

    Update risk management framework

    The need for asset and threat taxonomy

    • One of issues in IT/OT convergence is that OT systems focus on production, so IT solutions like security patching or updates may deteriorate a machine or take a machine offline and may not be applicable. For example, some facilities run with reliability of 99.999%, which only allows maximum of 5 minutes and 35 seconds or less of downtime per year.
    • Managing risks requires an understanding of the assets and threats for IT/OT systems. Having a taxonomy of the assets and the threats cand help.
    • Applying normal IT solutions to mitigate security risks may not be applicable in an OT environment, e.g. running an antivirus tool on OT system may remove essential OT operations files. Thus, this approach must be avoided; instead, systems must be rebuilt from golden images.
    Risk management framework.
    (Source: ENISA, 2018.)

    Enhance

    Update security policies and procedures

    • Policy is the link between people, process, and technology for any size of organization. Small organizations may think that having formal policies in place is not necessary for their operations, but compliance is applicable to all organizations, and vulnerabilities affect organizations of all sizes as well. Small organizations partnering with clients or other organizations are sometimes viewed as ideal proxies for attackers.
    • Updating security policies to align with the OT system so that there is a uniform approach to securing both IT and OT environments has several benefits. For example, enhancing the overall security posture as issues are pre-emptively avoided, being better prepared for auditing and compliance requirements, and improving governance especially when OT governance is weak.
    • In updating security policies, it is important to redefine the policy framework to include the OT framework and to prioritize the development of security policies. For example, entities that own or manage US and Canadian electric power grids must comply with North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards, specifically CIP-003 for Policy and Governance. This can be achieved by understanding the current state of policies and by right-sizing the policy suite based on a policy hierarchy.
    The White House released an Executive Order on Improving the Nation’s Cybersecurity (EO 14028) in 2021 that establishes new requirements on the scope of protection and security policy such that it must include both IT and OT.

    Policy hierarchy example

    This example of a policy hierarchy features templates from Info-Tech’s Develop and Deploy Security Policies and Identify the Best Framework for Your Security Policies research.

    Example policy hierarchy with four levels, from top-down: 'Governance', 'Process-based policies', 'Prescriptive/ technical (for IT including OT elements)', 'Prescriptive/ technical (for users)'.

    Enhance

    Update IR, DR, and BCP

    A proactive approach to security is important, so actions such as updating and testing the incident response plan for OT are a must. (“Cybersecurity Year In Review” Dragos, 2022.)

    1. Customize organizational chart for IT/OT IR, DR, BCP based on governance and management model.
      E.g. ad hoc, internal distributed, internal centralized, combined distributed, and decentralized. (Software Engineering Institute, 2003)
    2. Adjust the authority of the new organizational chart and decide if it requires additional staffing.
      E.g. full authority, shared authority. (Software Engineering Institute, 2003)
    3. Update IR plan, DR plan, and BCP for IT/OT convergence.
      E.g. incorporate zero trust principles for converge network
    4. Testing updated IR plan, DR plan, and BCP.

    Optimize

    Implement awareness, induction, and cross-training

    To develop training and awareness programs for all levels of the organization, it is important to understand the common challenges in IT security that also affect secure IT/OT convergence and how to overcome those challenges.

    Alert Fatigue

    Too many false alarms, too many events to process, and an evolving threat landscape that wastes analysts’ valuable time on mundane tasks such as evidence collection. Meanwhile, only limited time is given for decision and conclusion, which results in fear of missing an incident and alert fatigue.

    Skill Shortages

    Obtaining and retaining cybersecurity-skilled talent is challenging. Organizations need to invest in the people, but not all organizations will be able to invest sufficiently to have their own dedicated security team.

    Lack of Insight

    To report progress, clear metrics are needed. However, cybersecurity still falls short in this area, as the system itself is complex, and much work is siloed. Furthermore, lessons learned are not yet distilled into insights yet for improving future accuracy.

    Lack of Visibility

    Ensuring complete visibility of the threat landscape, risks, and assets requires system integration and consistent workflow across the organization, and the convergence of OT, IoT, and IT enhances this challenge (e.g. machines cannot be scanned during operational uptime).
    (Source: Security Intelligence, 2020.)
    “Cybersecurity staff are feeling burnout and stressed to the extent that many are considering leaving their jobs.” (Danny Palmer, ZDNET News, 2022)

    Awareness may not correspond to readiness

    • An issue with IT/OT convergence training and awareness happens when awareness exists, but the personnel are trained only for IT security and are not trained for OT-specific security. For example, some organizations still use generic topics such as not opening email attachments, when the personnel do not even operate using email nor in a web browsing environment. (“Assessing Operational Readiness,” Dragos, 2022)
    • Meanwhile, as is the case with IT, OT security training topics are broad, such as OT threat intelligence, OT-specific incident response, and tabletop exercises.
    • Hence, it requires the creation of a training program development plan that considers the various audiences and topics and maps them accordingly.
    • Moreover, roles are also evolving due to convergence and modernization. These new roles require an integrative skill set. For example, the grid security & ops team might consist of an IT security specialist, SCADA technician/engineer, and OT/IIOT security specialist where OT/IIOT security specialist is a new role. (Grid Modernization: Optimize Opportunities and Minimize Risks,” Info-Tech)
    • In conclusion, it is important to approach talent development with an open mind. The ability to learn and flexibility in the face of change are important attributes, and technical skill sets can be improved with certifications and training.
    “One area regularly observed by Dragos is a weakness in overall cyber readiness and training tailored specific to the OT environment.” (“Assessing Operational Technology,” Dragos, 2022.)

    Certifications

    What are the options?
    • One of issues in certification is the complexity on relevancy in topics with respect to roles and levels.
    • An example solution is the European Union Agency for Cybersecurity (ENISA)’s approach to analyzing existing certifications by orientation, scope, and supporting bodies, grouped into specific certifications, relevant certifications, and safety certifications.

    Specific cybersecurity certification of ICS/SCADA
    Example: ISA-99/IEC 62443 Cybersecurity Certificate Program, GIAC Global Industrial Cyber Security Professional (GICSP), Certified SCADA Security Architect (CSSA), EC-Council ICS/SCADA Cybersecurity Training Course.

    Other relevant certification schemes
    Example: Network and Information Security (NIS) Driving License, ISA Certified Automation Professional (CAP), Industrial Security Professional Certification (NCMS-ISP).

    Safety Certifications
    Example: Board of Certified Safety Professionals (BCSP), European Network of Safety and Health Professional Organisations (ENSHPO).

    Order of certifications with 'Orientation' at the top, 'Scope', then 'Support'.(Source: ENISA, 2015.)

    Optimize

    Design and deploy converging security architecture and controls

    • IT/OT convergence architecture can be modeled as a layered structure based on security. In this structure, the bottom layer is referred as “OT High-Security Zone” and the topmost layer is “IT Low-Security Zone.” In this model, each layer has its own set of controls configured and acts like an additional layer of security for the zone underneath it.
    • The data flows from the “OT High-Security Zone” to the topmost layer, the “IT Low-Security Zone,” and the traffic must be verified to pass to another zone based on the need-to-know principle.
    • In the normal control flow within the “OT High-Security Zone” from level 3 to level 0, the traffic must be verified to pass to another level based on the principle of least privilege.
    • Remote access (dotted arrow) is allowed under strict access control and change control based on the zero-trust principle with clear segmentation and a point for disconnection between the “OT High-Security Zone” and the “OT Low-Security Zone”
    • This model simplifies the security process, as if the lower layers have been compromised, then the compromise can be confined on that layer, and it also prevents lateral movement as access is always verified.
    Diagram for the deployments of converging security architecture.(Source: “Purdue Enterprise Reference Architecture (PERA) model,” ISA-99.)

    Off-the-shelf solutions

    Getting the right recipe: What criteria to consider?

    Image of a shopping cart with the four headlines on the right listed in order from top to bottom.
    Icon of an eye crossed out. Visibility and Asset Management

    Passive data monitoring using various protocol layers, active queries to devices, or parsing configuration files of OT, IoT, and IT environments on assets, processes, and connectivity paths.

    Icon of gears. Threat Detection, Mitigation, and Response (+ Hunting)

    Automation of threat analysis (signature-based, specification-based, anomaly-based, sandboxing) not only in IT but also in relevant environments, e.g. IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.

    Icon of a check and pen. Risk Assessment and Vulnerability Management

    Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.

    Icon of a wallet. Usability, Architecture, Cost

    The user and administrative experience, multiple deployment options and extensive integration capabilities, and affordability.

    Optimize

    Establish and monitor IT/OT security metrics for effectiveness and efficiency

    Role of security metrics in a cybersecurity program (EPRI, 2017.)
    • Requirements for secure IT/OT are derived from mandatory or voluntary compliance, e.g. NERC CIP, NIST SP 800-53.
    • Frameworks for secure IT/OT are used to build and implement security, e.g. NIST CSF, AESCSF.
    • Maturity of secure IT/OT is used to measure the state of security, e.g. C2M2, CMMC.
    • Security metrics have the role of measuring effectiveness and efficiency.

    Icon of a person ascending stairs.
    Safety

    OT interfaces with the physical world. Thus, metrics based on risks related with life, health, and safety are crucial. These metrics motivate personnel by making clear why they should care about security. (EPRI, 2017.)

    Icon of a person ascending stairs.
    Business Performance

    The impact of security on the business can be measured in various metrics such as operational metrics, service level agreements (SLAs), and financial metrics. (BMC, 2022.)

    Icon of a person ascending stairs.
    Technology Performance

    Early detection will lead to faster remediation and less damage. Therefore, metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability. (Dark Reading, 2022)

    Icon of a person ascending stairs.
    Security Culture

    The metrics for the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.

    Further information

    Related Info-Tech Research

    Sample of 'Build an Information Security Strategy'.

    Build an Information Security Strategy

    Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.

    This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.

    Sample of 'Preparing for Technology Convergence in Manufacturing'.

    Preparing for Technology Convergence in Manufacturing

    Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.

    Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.

    Sample of 'Implement a Security Governance and Management Program'.

    Implement a Security Governance and Management Program

    Your security governance and management program needs to be aligned with business goals to be effective.

    This approach also helps provide a starting point to develop a realistic governance and management program.

    This project will guide you through the process of implementing and monitoring a security governance and management program that prioritizes security while keeping costs to a minimum.

    Bibliography

    Assante, Michael J. and Robert M. Lee. “The Industrial Control System Cyber Kill Chain.” SANS Institute, 2015.

    “Certification of Cyber Security Skills of ICS/SCADA Professionals.” European Union Agency for Cybersecurity (ENISA), 2015. Web.

    Cooksley, Mark. “The IEC 62443 Series of Standards: A Product Manufacturer‘s Perspective.” YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.

    “Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.

    “Cybersecurity and Physical Security Convergence.” Cybersecurity and Infrastructure Security Agency (CISA). Accessed 19 May 2022.

    “Cybersecurity in Operational Technology: 7 Insights You Need to Know,” Ponemon, 2019. Web.

    “Developing an Operational Technology and Information Technology Incident Response Plan.” Public Safety Canada, 2020. Accessed 6 Sep. 2022.

    Gilsinn, Jim. “Assessing Operational Technology (OT) Cybersecurity Maturity.” Dragos, 2021. Accessed 02 Sep. 2022.

    “Good Practices for Security of Internet of Things.” European Union Agency for Cybersecurity (ENISA), 2018. Web.

    Greenfield, David. “Is the Purdue Model Still Relevant?” AutomationWorld. Accessed 1 Sep. 2022

    Hemsley, Kevin E., and Dr. Robert E. Fisher. “History of Industrial Control System Cyber Incidents.” US Department of Energy (DOE), 2018. Accessed 29 Aug. 2022.

    “ICS Security Related Working Groups, Standards and Initiatives.” European Union Agency for Cybersecurity (ENISA), 2013.

    Killcrece, Georgia, et al. “Organizational Models for Computer Security Incident Response Teams (CSIRTs).” Software Engineering Institute, CMU, 2003.

    Liebig, Edward. “Security Culture: An OT Survival Story.” Dark Reading, 30 Aug. 2022. Accessed 29 Aug. 2022.

    Bibliography

    O'Neill, Patrick. “Russia Hacked an American Satellite Company One Hour Before the Ukraine Invasion.” MIT Technology Review, 10 May 2022. Accessed 26 Aug. 2022.

    Palmer, Danny. “Your Cybersecurity Staff Are Burned Out – And Many Have Thought About Quitting.” Zdnet, 08 Aug. 2022. Accessed 19 Aug. 2022.

    Pathak, Parag. “What Is Threat Management? Common Challenges and Best Practices.” SecurityIntelligence, 23 Jan. 2020. Web.

    Raza, Muhammad. “Introduction To IT Metrics & KPIs.” BMC, 5 May 2022. Accessed 12 Sep. 2022.

    “Recommended Practice: Developing an Industrial Control Systems Cybersecurity Incident Response Capability.” Department of Homeland Security (DHS), Oct. 2009. Web.

    Sharma, Ax. “Sigma Rules Explained: When and How to Use Them to Log Events.” CSO Online, 16 Jun. 2018. Accessed 15 Aug. 2022.

    “Significant Cyber Incidents.” Center for Strategic and International Studies (CSIS). Accessed 1 Sep. 2022.

    Tom, Steven, et al. “Recommended Practice for Patch Management of Control Systems.” Department of Homeland Security (DHS), 2008. Web.

    “2021 ICS/OT Cybersecurity Year In Review.” Dragos, 2022. Accessed 6 Sep. 2022.

    “2021 State of Operational Technology and Cybersecurity Report,” Fortinet, 2021. Web.

    Zetter, Kim. “Pre-Stuxnet, Post-Stuxnet: Everything Has Changed, Nothing Has Changed.” Black Hat USA, 08 Aug. 2022. Accessed 19 Aug. 2022.

    Research Contributors and Experts

    Photo of Jeff Campbell, Manager, Technology Shared Services, Horizon Power, AU. Jeff Campbell
    Manager, Technology Shared Services
    Horizon Power, AU

    Jeff Campbell has more than 20 years' experience in information security, having worked in both private and government organizations in education, finance, and utilities sectors.

    Having focused on developing and implementing information security programs and controls, Jeff is tasked with enabling Horizon Power to capitalize on IoT opportunities while maintaining the core security basics of confidentiality, integrity and availability.

    As Horizon Power leads the energy transition and moves to become a digital utility, Jeff ensures the security architecture that supports these services provides safer and more reliable automation infrastructures.

    Christopher Harrington
    Chief Technology Officer (CTO)
    Carolinas Telco Federal Credit Union

    Frank DePaola
    Vice President, Chief Information Security Officer (CISO)
    Enpro

    Kwasi Boakye-Boateng
    Cybersecurity Researcher
    Canadian Institute for Cybersecurity

    Implement Hardware Asset Management

    • Buy Link or Shortcode: {j2store}312|cart{/j2store}
    • member rating overall impact: 9.4/10 Overall Impact
    • member rating average dollars saved: $29,447 Average $ Saved
    • member rating average days saved: 25 Average Days Saved
    • Parent Category Name: Asset Management
    • Parent Category Link: /asset-management
    • Executives are often aware of the benefits asset management offers, but many organizations lack a defined program to manage their hardware.
    • Efforts to implement hardware asset management (HAM) are stalled because organizations feel overwhelmed navigating the process or under use the data, failing to deliver value.

    Our Advice

    Critical Insight

    • Organizations often implement an asset management program as a one-off project and let it stagnate.
    • Organizations often fail to dedicate adequate resources to the HAM process, leading to unfinished processes and inconsistent standards.
    • Hardware asset management programs yield a large amount of useful data. Unfortunately, this data is often underutilized. Departments within IT become data siloes, preventing effective use of the data.

    Impact and Result

    • As the IT environment continues to change, it is important to establish consistency in the standards around IT asset management.
    • A current state assessment of your HAM program will shed light on the steps needed to safeguard your processes.
    • Define the assets that will need to be managed to inform the scope of the ITAM program before defining processes.
    • Build and involve an ITAM team in the process from the beginning to help embed the change.
    • Define standard policies, processes, and procedures for each stage of the hardware asset lifecycle, from procurement through to disposal.

    Implement Hardware Asset Management Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should Implement Hardware Asset Management, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Lay foundations

    Build the foundations for the program to succeed.

    • Implement Hardware Asset Management – Phase 1: Lay Foundations
    • HAM Standard Operating Procedures
    • HAM Maturity Assessment Tool
    • IT Asset Manager
    • IT Asset Administrator

    2. Procure & receive

    Define processes for requesting, procuring, receiving, and deploying hardware.

    • Implement Hardware Asset Management – Phase 2: Procure and Receive
    • HAM Process Workflows (Visio)
    • HAM Process Workflows (PDF)
    • Non-Standard Hardware Request Form
    • Purchasing Policy

    3. Maintain & dispose

    Define processes and policies for managing, securing, and maintaining assets then disposing or redeploying them.

    • Implement Hardware Asset Management – Phase 3: Maintain and Dispose
    • Asset Security Policy
    • Hardware Asset Disposition Policy

    4. Plan implementation

    Plan the hardware budget, then build a communication plan and roadmap to implement the project.

    • Implement Hardware Asset Management – Phase 4: Plan Implementation 
    • HAM Budgeting Tool
    • HAM Communication Plan
    • HAM Implementation Roadmap
    [infographic]

    Workshop: Implement Hardware Asset Management

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Lay Foundations

    The Purpose

    Build the foundations for the program to succeed.

    Key Benefits Achieved

    Evaluation of current challenges and maturity level

    Defined scope for HAM program

    Defined roles and responsibilities

    Identified metrics and reporting requirements

    Activities

    1.1 Outline hardware asset management challenges.

    1.2 Conduct HAM maturity assessment.

    1.3 Classify hardware assets to define scope of the program.

    1.4 Define responsibilities.

    1.5 Use a RACI chart to determine roles.

    1.6 Identify HAM metrics and reporting requirements.

    Outputs

    HAM Maturity Assessment

    Classified hardware assets

    Job description templates

    RACI Chart

    2 Procure & Receive

    The Purpose

    Define processes for requesting, procuring, receiving, and deploying hardware.

    Key Benefits Achieved

    Defined standard and non-standard requests for hardware

    Documented procurement, receiving, and deployment processes

    Standardized asset tagging method

    Activities

    2.1 Identify IT asset procurement challenges.

    2.2 Define standard hardware requests.

    2.3 Document standard hardware request procedure.

    2.4 Build a non-standard hardware request form.

    2.5 Make lease vs. buy decisions for hardware assets.

    2.6 Document procurement workflow.

    2.7 Select appropriate asset tagging method.

    2.8 Design workflow for receiving and inventorying equipment.

    2.9 Document the deployment workflow(s).

    Outputs

    Non-standard hardware request form

    Procurement workflow

    Receiving and tagging workflow

    Deployment workflow

    3 Maintain & Dispose

    The Purpose

    Define processes and policies for managing, securing, and maintaining assets then disposing or redeploying them.

    Key Benefits Achieved

    Policies and processes for hardware maintenance and asset security

    Documented workflows for hardware disposal and recovery/redeployment

    Activities

    3.1 Build a MAC policy, request form, and workflow.

    3.2 Design process and policies for hardware maintenance, warranty, and support documentation handling.

    3.3 Revise or create an asset security policy.

    3.4 Identify challenges with IT asset recovery and disposal and design hardware asset recovery and disposal workflows.

    Outputs

    User move workflow

    Asset security policy

    Asset disposition policy, recovery and disposal workflows

    4 Plan Implementation

    The Purpose

    Select tools, plan the hardware budget, then build a communication plan and roadmap to implement the project.

    Key Benefits Achieved

    Shortlist of ITAM tools

    Hardware asset budget plan

    Communication plan and HAM implementation roadmap

    Activities

    4.1 Generate a shortlist of ITAM tools that will meet requirements.

    4.2 Use Info-Tech’s HAM Budgeting Tool to plan your hardware asset budget.

    4.3 Build HAM policies.

    4.4 Develop a communication plan.

    4.5 Develop a HAM implementation roadmap.

    Outputs

    HAM budget

    Additional HAM policies

    HAM communication plan

    HAM roadmap tool

    Further reading

    Implement Hardware Asset Management

    Build IT services value on the foundation of a proactive asset management program.

    ANALYST PERSPECTIVE

    IT asset data impacts the entire organization. It’s time to harness that potential.

    "Asset management is like exercise: everyone is aware of the benefits, but many struggle to get started because the process seems daunting. Others fail to recognize the integrative potential that asset management offers once an effective program has been implemented.

    A proper hardware asset management (HAM) program will allow your organization to cut spending, eliminate wasteful hardware, and improve your organizational security. More data will lead to better business decision-making across the organization.

    As your program matures and your data gathering and utility improves, other areas of your organization will experience similar improvements. The true value of asset management comes from improved IT services built upon the foundation of a proactive asset management program." - Sandi Conrad, Practice Lead, Infrastructure & Operations Info-Tech Research Group

    Our understanding of the problem

    This Research Is Designed For:

    • Asset Managers and Service Delivery Managers tasked with developing an asset management program who need a quick start.
    • CIOs and CFOs who want to reduce or improve budgeting of hardware lifecycle costs.
    • Information Security Officers who need to mitigate the risk of sensitive data loss due to insecure assets.

    This Research Will Help You:

    • Develop a hardware asset management (HAM) standard operating procedure (SOP) that documents:
      • Process roles and responsibilities.
      • Data classification scheme.
      • Procurement standards, processes, and workflows for hardware assets.
      • Hardware deployment policies, processes, and workflows.
      • Processes and workflows for hardware asset security and disposal.
    • Identify requirements for an IT asset management (ITAM) solution to help generate a shortlist.
    • Develop a hardware asset management implementation roadmap.
    • Draft a communication plan for the initiative.

    Executive summary

    Situation

    • Executives are aware of the numerous benefits asset management offers, but many organizations lack a defined ITAM program and especially a HAM program.
    • Efforts to implement HAM are stalled because organizations cannot establish and maintain defined processes and policies.

    Complication

    • Organizations often implement an asset management program as a one- off project and let it stagnate, but asset management needs to be a dynamic, continually involving process to succeed.
    • Organizations often fail to dedicate adequate resources to the HAM process, leading to unfinished processes and inconsistent standards.
    • Hardware asset management programs yield a large amount of useful data. Unfortunately, this data is often underused. Departments within IT become data siloes, preventing effective use of the data.

    Resolution

    • As the IT environment continues to change, it is important to establish consistency in the standards around IT asset management.
    • A current state assessment of your HAM program will shed light on the steps needed to safeguard your processes.
    • Define the assets that will need to be managed to inform the scope of the ITAM program before defining processes.
    • Build and involve an ITAM team in the process from the beginning to help embed the change.
    • Define standard policies, processes, and procedures for each stage of the hardware asset lifecycle, from procurement through to disposal.
    • Pace yourself; a staged implementation will make your ITAM program a success.

    Info-Tech Insight

    1. HAM is more than just tracking inventory. A mature asset management program provides data for proactive planning and decision making to reduce operating costs and mitigate risk.
    2. ITAM is not just IT. IT leaders need to collaborate with Finance, Procurement, Security, and other business units to make informed decisions and create value across the enterprise.
    3. Treat HAM like a process, not a project. HAM is a dynamic process that must react and adapt to the needs of the business.

    Implement HAM to reduce and manage costs, gain efficiencies, and ensure regulatory compliance

    Save & Manage Money

    • Companies with effective HAM practices achieve cost savings through redeployment, reduction of lost or stolen equipment, power management, and on-time lease returns.
    • The right HAM system will enable more accurate planning and budgeting by business units.

    Improve Contract Management

    • Real-time asset tracking to vendor terms and conditions allows for more effective negotiation.

    Inform Technology Refresh

    • HAM provides accurate information on hardware capacity and compatibility to inform upgrade and capacity planning

    Gain Service Efficiencies

    • Integrating the hardware lifecycle with the service desk will enable efficiencies through Install/Moves/Adds/Changes (IMAC) processes, for larger organizations.

    Meet Regulatory Requirements

    • You can’t secure organizational assets if you don’t know where they are! Meet governance and privacy laws by knowing asset location and that data is secure.

    Prevent Risk

    • Ensure data is properly destroyed through disposal processes, track lost and stolen hardware, and monitor hardware to quickly identify and isolate vulnerabilities.

    HAM is more than just inventory; 92% of organizations say that it helps them provide better customer support

    Hardware asset management (HAM) provides a framework for managing equipment throughout its entire lifecycle. HAM is more than just keeping an inventory; it focuses on knowing where the product is, what costs are associated with it, and how to ensure auditable disposition according to best options and local environmental laws.

    Implementing a HAM practice enables integration of data and enhancement of many other IT services such as financial reporting, service management, green IT, and data and asset security.

    Cost savings and efficiency gains will vary based on the organization’s starting state and what measures are implemented, but most organizations who implement HAM benefit from it. As organizations increase in size, they will find the greatest gains operationally by becoming more efficient at handling assets and identifying costs associated with them.

    A 2015 survey by HDI of 342 technical support professionals found that 92% say that HAM has helped their teams provide better support to customers on hardware-related issues. Seventy-seven percent have improved customer satisfaction through managing hardware assets. (HDI, 2015)

    HAM delivers cost savings beyond only the procurementstage

    HAM cost savings aren’t necessarily realized through the procurement process or reduced purchase price of assets, but rather through the cost of managing the assets.

    HAM delivers cost savings in several ways:

    • Use a discovery tool to identify assets that may be retired, redeployed, or reused to cut or reallocate their costs.
    • Enforce power management policies to reduce energy consumption as well as costs associated with wasted energy.
    • Enforce policies to lock down unauthorized devices and ensure that confidential information isn’t lost (and you don’t have to waste money recovering lost data).
    • Know the location of all your assets and which are connected to the network to ensure patches are up to date and avoid costly security risks and unplanned downtime.
    • Scan assets to identify and remediate vulnerabilities that can cause expensive security attacks.
    • Improve vendor and contract management to identify areas of hardware savings.

    The ROI for HAM is significant and measurable

    Benefit Calculation Sample Annual Savings

    Reduced help desk support

    • The length of support calls should be reduced by making it easier for technicians to identify PC configuration.
    # of hardware-related support tickets per year * cost per ticket * % reduction in average call length 2,000 * $40 * 20% = $16,000

    Greater inventory efficiency

    • An ITAM solution can automate and accelerate inventory preparation and tasks.
    Hours required to complete inventory * staff required * hourly pay rate for staff * number of times a year inventory required 8 hours * 5 staff * $33 per hour * 2 times a year = $2,640

    Improved employee productivity

    • Organizations can monitor and detect unapproved programs that result in lost productivity.
    # of employees * percentage of employees who encounter productivity loss through unauthorized software * number of hours per year spent using unauthorized software * average hourly pay rate 500 employees * 10% * 156 hours * $18 = $140,400

    Improved security

    • Improved asset tracking and stronger policy enforcement will reduce lost and stolen devices and data.
    # of devices lost or stolen last year * average replacement value of device + # of devices stolen * value of data lost from device (50 * $1,000) + (50 * $5,000) = $300,000
    Total Savings: $459,040
    1. Weigh the return against the annual cost of investing in an ITAM solution to calculate the ROI.
    2. Don’t forget about the intangible benefits that are more difficult to quantify but still significant, such as increased visibility into hardware, more accurate IT planning and budgeting, improved service delivery, and streamlined operations.

    Avoid these common barriers to ITAM success

    Organizations that struggle to implement ITAM successfully usually fall victim to these barriers:

    Organizational resistance to change

    Senior-level sponsorship, engagement, and communication is necessary to achieve the desired outcomes of ITAM; without it, ITAM implementations stall and fail or lack the necessary resources to deliver the value.

    Lack of dedicated resources

    ITAM often becomes an added responsibility for resources who already have other full-time responsibilities, which can quickly cause the program to lose focus. Increase the chance of success through dedicated resources.

    Focus on tool over process

    Many organizations buy a tool thinking it will do most of the work for them, but without supporting processes to define ITAM, the data within the tool can become unreliable.

    Choosing a tool or process that doesn’t scale

    Some organizations are able to track assets through manual discovery, but as their network and user base grows, this quickly becomes impossible. Choose a tool and build processes that will support the organization as it grows.

    Using data only to respond to an audit without understanding root causes

    Often, organizations implement ITAM only to the extent necessary to achieve compliance for audits, but without investigating the underlying causes of non-compliance and thus not solving the real problems.

    To help you make quick progress, Info-Tech Research Group parses hardware asset management into essential processes

    Focus on hardware asset lifecycle management essentials:

    IT Asset Procurement:

    • Define procurement standards for new hardware along with related warranties and support options.
    • Develop processes and workflows for purchasing and work out financial implications to inform budgeting later.

    IT Asset Intake and Deployment:

    • Define policies, processes, and workflows for hardware and receiving, inventory, and tracking practices.
    • Develop processes and workflows for managing imaging, change and moves, and large-scale rollouts.

    IT Asset Security and Maintenance:

    • Develop processes, policies, and workflows for asset tracking and security.
    • Maintain contracts and agreements.

    IT Asset Disposal or Recovery:

    • Manage the employee termination and equipment recovery cycle.
    • Securely wipe and dispose of assets that have reached retirement stage.

    The image is a circular graphic, with Implement HAM written in the middle. Around the centre circle are four phrases: Recover or Dispose; Plan & Procure; Receive & Deploy; Secure & Maintain. Around that circle are six words: Retire; Plan; Request; Procure; Receive; Manage.

    Follow Info-Tech’s methodology to build a plan to implement hardware asset management

    Phase 1: Assess & Plan Phase 2: Procure & Receive Phase 3: Maintain & Dispose Phase 4: Plan Budget & Build Roadmap
    1.1 Assess current state & plan scope 2.1 Request & procure 3.1 Manage & maintain 4.1 Plan budget
    1.2 Build team & define metrics 2.2 Receive & deploy 3.2 Redeploy or dispose 4.2 Communicate & build roadmap
    Deliverables
    Standard Operating Procedure (SOP)
    HAM Maturity Assessment Procurement workflow User move workflow HAM Budgeting Tool
    Classified hardware assets Non-standard hardware request form Asset security policy HAM Communication Plan
    RACI Chart Receiving & tagging workflow Asset disposition policy HAM Roadmap Tool
    Job Descriptions Deployment workflow Asset recovery & disposal workflows Additional HAM policies

    Asset management is a key piece of Info-Tech's COBIT- inspired IT Management and Governance Framework

    The image shows a graphic which is a large grid, showing Info-Tech's research, sorted into categories.

    Cisco IT reduced costs by upwards of $50 million through implementing ITAM

    CASE STUDY

    Industry IT

    Source Cisco Systems, Inc.

    Cisco Systems, Inc.

    Cisco Systems, Inc. is the largest networking company in the world. Headquartered in San Jose, California, the company employees over 70,000 people.

    Asset Management

    As is typical with technology companies, Cisco boasted a proactive work environment that encouraged individualism amongst employees. Unfortunately, this high degree of freedom combined with the rapid mobilization of PCs and other devices created numerous headaches for asset tracking. At its peak, spending on hardware alone exceeded $100 million per year.

    Results

    Through a comprehensive ITAM implementation, the new asset management program at Cisco has been a resounding success. While employees did have to adjust to new rules, the process as a whole has been streamlined and user-satisfaction levels have risen. Centralized purchasing and a smaller number of hardware platforms have allowed Cisco to cut its hardware spend in half, according to Mark Edmondson, manager of IT services expenses for Cisco Finance.

    This case study continues in phase 1

    The image shows four bars, from bottom to top: 1. Asset Gathering; 2. Asset Distribution; 3. Asset Protection; 4. Asset Data. On the right, there is an arrow pointing upwards labelled ITAM Program Maturity.

    Info-Tech delivers: Use our tools and templates to accelerate your project to completion

    HAM Standard Operating Procedures (SOP)

    HAM Maturity Assessment

    Non-Standard Hardware Request Form

    HAM Visio Process Workflows

    HAM Policy Templates

    HAM Budgeting Tool

    HAM Communication Plan

    HAM Implementation Roadmap Tool

    Measured value for Guided Implementations (GIs)

    Engaging in GIs doesn’t just offer valuable project advice, it also results in significant cost savings.

    GI Measured Value
    Phase 1: Lay Foundations
    • Time, value, and resources saved by using Info-Tech’s tools and templates to assess current state and maturity, plan scope of HAM program, and define roles and metrics.
    • For example, 2 FTEs * 14 days * $80,000/year = $8,615
    Phase 2: Procure & Receive
    • Time, value, and resources saved by using Info-Tech’s tools and templates to build processes for hardware request, procurement, receiving, and deployment.
    • For example, 2 FTEs * 14 days * $80,000/year = $8,615
    Phase 3: Maintain & Dispose
    • Time, value, and resources saved by following Info-Tech’s tools and methodology to build processes and policies for managing and maintaining hardware and disposing or redeploying of equipment.
    • For example, 2 FTE * 14 days * $80,000/year = $8,615
    Phase 4: Plan Implementation
    • Time, value, and resources saved by following Info-Tech’s tools and methodology to select tools, plan the hardware budget, and build a roadmap.
    • For example, 2 FTE * 14 days * $80,000/year = $8,615
    Total savings $25,845

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Guided Implementation overview

    1. Lay Foundations 2. Procure & Receive 3. Maintain & Dispose 4. Budget & Implementation
    Best-Practice Toolkit

    1.1 Assess current state & plan scope

    1.2 Build team & define metrics

    2.1 Request & procure

    2.2 Receive & deploy

    3.1 Manage & maintain

    3.2 Redeploy or dispose

    4.1 Plan budget

    4.2 Communicate & build roadmap

    Guided Implementation
    • Assess current state.
    • Define scope of HAM program.
    • Define roles and metrics.
    • Define standard and non-standard hardware.
    • Build procurement process.
    • Determine asset tagging method and build equipment receiving and deployment processing.
    • Define processes for managing and maintaining equipment.
    • Define policies for maintaining asset security.
    • Build process for redeploying or disposing of assets.
    • Discuss best practices for effectively managing a hardware budget.
    • Build communications plan and roadmap.
    Results & Outcomes
    • Evaluation of current maturity level of HAM
    • Defined scope for the HAM program including list of hardware to track as assets
    • Defined roles and responsibilities
    • Defined and documented KPIs and metrics to meet HAM reporting requirements
    • Defined standard and non- standard requests and processes
    • Defined and documented procurement workflow and purchasing policy
    • Asset tagging method and process
    • Documented equipment receiving and deployment processes
    • MAC policies and workflows
    • Policies and processes for hardware maintenance and asset security
    • Documented workflows for hardware disposal and recovery/redeployment
    • Shortlist of ITAM tools
    • Hardware asset budget plan
    • Communication plan and HAM implementation roadmap

    Workshop overview

    Contact your account representative or email Workshops@InfoTech.comfor more information.

    Phases: Teams, Scope & Hardware Procurement Hardware Procurement and Receiving Hardware Maintenance & Disposal Budgets, Roadmap & Communications
    Duration* 1 day 1 day 1 day 1 day
    * Activities across phases may overlap to ensure a timely completion of the engagement
    Projected Activities
    • Outline hardware asset management goals
    • Review HAM maturity and anticipated milestones
    • Define scope and classify hardware assets
    • Define roles and responsibilities
    • Define metrics and reporting requirements
    • Define standard and non-standard hardware requests
    • Review and document procurement workflow
    • Discuss appropriate asset tagging method
    • Design and document workflow for receiving and inventorying equipment
    • Review/create policy for hardware procurement and receiving
    • Identify data sources and methodology for inventory and data collection
    • Define install/moves/adds/changes (MAC) policy
    • Build workflows to document user MAC processes and design request form
    • Design process and policies for hardware maintenance, warranty, and support documentation handling
    • Design hardware asset recovery and disposal workflows
    • Define budgeting process and review Info-Tech’s HAM Budgeting Tool
    • Develop a communication plan
    • Develop a HAM implementation plan
    Projected Deliverables
    • Standard operating procedures for hardware
    • Visio diagrams for all workflows
    • Workshop summary with milestones and task list
    • Budget template
    • Policy draft

    Phase 1

    Lay Foundations

    Implement Hardware Asset Management

    A centralized procurement process helped cut Cisco’s hardware spend in half

    CASE STUDY

    Industry IT

    Source Cisco Systems, Inc.

    Challenge

    Cisco Systems’ hardware spend was out of control. Peaking at $100 million per year, the technology giant needed to standardize procurement processes in its highly individualized work environment.

    Users had a variety of demands related to hardware and network availability. As a result, data was spread out amongst multiple databases and was managed by different teams.

    Solution

    The IT team at Cisco set out to solve their hardware-spend problem using a phased project approach.

    The first major step was to identify and use the data available within various departments and databases. The heavily siloed nature of these databases was a major roadblock for the asset management program.

    This information had to be centralized, then consolidated and correlated into a meaningful format.

    Results

    The centralized tracking system allowed a single point of contact (POC) for the entire lifecycle of a PC. This also created a centralized source of information about all the PC assets at the company.

    This reduced the number of PCs that were unaccounted for, reducing the chance that Cisco IT would overspend based on its hardware needs.

    There were still a few limitations to address following the first step in the project, which will be described in more detail further on in this blueprint.

    This case study continues in phase 2

    Step 1.1: Assess current state and plan scope

    Phase 1: Assess & Plan

    1.1 Assess current state & plan scope

    1.2 Build team & define metrics

    This step will walk you through the following activities:

    1.1.1 Complete MGD (optional)

    1.1.2 Outline hardware asset management challenges

    1.1.3 Conduct HAM maturity assessment

    1.1.4 Classify hardware assets to define scope of the program

    This step involves the following participants:

    • CIO/CFO
    • IT Director
    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Security (optional)
    • Operations (optional)

    Step Outcomes

    • Understand key challenges related to hardware asset management within your organization to inform program development.
    • Evaluate current maturity level of hardware asset management components and overall program to determine starting point.
    • Define scope for the ITAM program including list of hardware to track as assets.

    Complete the Management & Governance Diagnostic (MGD) to weigh the effectiveness of ITAM against other services

    1.1.1 Optional Diagnostic

    The MGD helps you get the data you need to confirm the importance of improving the effectiveness of your asset management program.

    The MGD allows you to understand the landscape of all IT processes, including asset management. Evaluate all team members’ perceptions of each process’ importance and effectiveness.

    Use the results to understand the urgency to change asset management and its relevant impact on the organization.

    Establish process owners and hold team members accountable for process improvement initiatives to ensure successful implementation and realize the benefits from more effective processes.

    To book a diagnostic, or get a copy of our questions to inform your own survey, visit Info-Tech’s Benchmarking Tools, contact your account manager, or call toll-free 1-888-670-8889 (US) or 1-844-618-3192 (CAN).

    Sketch out challenges related to hardware asset management to shape the direction of the project

    Common HAM Challenges

    Processes and Policies:

    • Existing asset management practices are labor intensive and time consuming
    • Manual spreadsheets are used, making collaboration and automation difficult
    • Lack of HAM policies and standard operating procedures
    • Asset management data is not centralized
    • Lack of clarity on roles and responsibilities for ITAM functions
    • End users don’t understand the value of asset management

    Tracking:

    • Assets move across multiple locations and are difficult to track
    • Hardware asset data comes from multiple sources, creating fragmented datasets
    • No location data is available for hardware
    • No data on ownership of assets

    Security and Risk:

    • No insight into which assets contain sensitive data
    • There is no information on risks by asset type
    • Rogue systems need to be identified as part of risk management best practices
    • No data exists for assets that contain critical/sensitive data

    Procurement:

    • No centralized procurement department
    • Multiple quotes from vendors are not currently part of the procurement process
    • A lack of formal process can create issues surrounding employee onboarding such as long lead times
    • Not all procurement standards are currently defined
    • Rogue purchases create financial risk

    Receiving:

    • No formal process exists, resulting in no assigned receiving location and no assigned receiving role
    • No automatic asset tracking system exists

    Disposal:

    • No insight into where disposed assets go
    • Formal refresh and disposal system is needed

    Contracts:

    • No central repository exists for contracts
    • No insight into contract lifecycle, hindering negotiation effectiveness and pricing optimization

    Outline hardware asset management challenges

    1.1.1 Brainstorm HAM challenges

    Participants

    • CIO/CFO
    • IT Director
    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Security
    • Operations (optional)

    A. As a group, outline the hardware asset management challenges facing the organization.

    Use the previous slide to help you get started. You can use the following headings as a guide or think of your own:

    • Processes and Policies
    • Tracking
    • Procurement
    • Receiving
    • Security and Risk
    • Disposal
    • Contracts

    B. If you get stuck, use the Hardware Asset Management Maturity Assessment Tool to get a quick view of your challenges and maturity targets and kick-start the conversation.

    To be effective with hardware asset management, understand the drivers and potential impact to the organization

    Drivers of effective HAM Results of effective HAM
    Contracts and vendor licensing programs are complex and challenging to administer without data related to assets and their environment. Improved access to accurate data on contracts, licensing, warranties, installed hardware and software for new contracts, renewals, and audit requests.
    Increased need to meet compliance requires a formal approach to tracking and managing assets, regardless of device type. Encryption, hardware tracking and discovery, software application controls, and change notifications all contribute to better asset controls and data security.
    Cost cutting is on the agenda, and management is looking to reduce overall IT spend in the organization in any possible way. Reduction of hardware spend by as much as 5% of the total budget through data for better forecasting and planning.
    Assets with sensitive data are not properly secured, go missing, or are not safely disposed of when retired. Document and enforce security policies for end users and IT staff to ensure sensitive data is properly secured, preventing costs much larger than the cost of only the device.

    Each level of HAM maturity comes with its own unique challenges

    Maturity People & Policies Processes Technology
    Chaos
    • No dedicated staff
    • No policies published
    • Procedures not documented or standardized
    • Hardware not safely secured or tagged
    • Hardware purchasing decisions not based on data
    • Minimal tracking tools in place
    Reactive
    • Semi-focused HAM manager
    • No policies published
    • Reliance on suppliers to provide reports for hardware purchases
    • Hardware standards are enforced
    • Discovery tools and spreadsheets used to manage hardware
    Controlled
    • Full-time HAM manager
    • End-user policies published
    • HAM manager involved in budgeting and planning sessions
    • Inventory tracking is in place
    • Hardware is secured and tagged
    • Discovery and inventory tools used to manage hardware
    • Compliance reports run as needed
    Proactive
    • Extended HAM team, including Help Desk, HR, Purchasing
    • Corporate hardware use policies in place and enforced
    • HAM process integrated with help desk and HR processes
    • More complex reporting and integrated financial information and contracts with asset data
    • Hardware requests are automated where possible
    • Product usage reports and alerts in place to harvest and reuse licenses
    • Compliance and usage reports used to negotiate software contracts
    Optimized
    • HAM manager trained and certified
    • Working with HR, Legal, Finance, and IT to enforce policies
    • Quarterly meetings with ITAM team to review policies, procedures, upcoming contracts, and rollouts; data is reviewed before any financial decisions made
    • Full transparency into hardware lifecycle
    • Aligned with business objectives
    • Detailed savings reports provided to executive team annually
    • Automated policy enforcement and process workflows

    Conduct a hardware maturity assessment to understand your starting point and challenges

    1.1.3 Complete HAM Maturity Assessment Tool

    Complete the Hardware Asset Management Maturity Assessment Tool to understand your organization’s overall maturity level in HAM, as well as the starting maturity level aligned with each step of the blueprint, in order to identify areas of strength and weakness to plan the project. Use this to track progress on the project.

    An effective asset management project has four essential components, with varying levels of management required

    The hardware present in your organization can be classified into four categories of ascending strategic complexity: commodity, inventory, asset, and configuration.

    Commodity items are devices that are low-cost, low-risk items, where tracking is difficult and of low value.

    Inventory is tracked primarily to identify location and original expense, which may be depreciated by Finance. Typically there will not be data on these devices and they’ll be replaced as they lose functionality.

    Assets will need the full lifecycle managed. They are identified by cost and risk. Often there is data on these devices and they are typically replaced proactively before they become unstable.

    Configuration items will generally be tracked in a configuration management database (CMDB) for the purpose of enabling the support teams to make decisions involving dependencies, configurations, and impact analysis. Some data will be duplicated between systems, but should be synchronized to improve accuracy between systems.

    See Harness Configuration Management Superpowers to learn more about building a CMDB.

    Classify your hardware assets to determine the scope and strategy of the program

    Asset: A unique device or configuration of devices that enables a user to perform productive work tasks and has a defined location and ownership attributes.

    • Hardware asset management involves tracking and managing physical components from procurement through to retirement. It provides the base for software asset management and is an important process that can lead to improved lifecycle management, service request fulfillment, security, and cost savings through harvesting and redeployment.
    • When choosing your strategy, focus on those devices that are high cost and high risk/function such as desktops, laptops, servers, and mobile devices.

    ASSET - Items of high importance and may contain data, such as PCs, mobile devices, and servers.

    INVENTORY - Items that require significant financial investment but no tracking beyond its existence, such as a projector.

    COMMODITY - Items that are often in use but are of relatively low cost, such as keyboards or mice.

    Classify your hardware assets to define the scope of the program

    1.1.4 Define the assets to be tracked within your organization

    Participants

    • Participants
    • CIO/CFO
    • IT Director
    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Security (optional)
    • Operations (optional)

    Document

    Document in the Standard Operating Procedures, Section 1 – Overview & Scope

    1. Determine value/risk threshold at which items should be tracked (e.g. over $1,000 and holding data).
    2. Divide a whiteboard or flip chart into three columns: commodity, asset, and inventory.
    3. Divide participants into groups by functional role to brainstorm devices in use within the organization. Write them down on sticky notes.
    4. Place the sticky notes in the column that best describes the role of the product in your organization.

    Align the scope of the program with business requirements

    CASE STUDY

    Industry Public Administration

    Source Client Case Study

    Situation

    A state government designed a process to track hardware worth more than $1,000. Initially, most assets consisted of end-user computing devices.

    The manual tracking process, which relied on a series of Excel documents, worked well enough to track the lifecycle of desktop and laptop assets.

    However, two changes upended the organization’s program: the cost of end-user computing devices dropped dramatically and the demand for network services led to the proliferation of expensive equipment all over the state.

    Complication

    The existing program was no longer robust enough to meet business requirements. Networking equipment was not only more expensive than end-user computing devices, but also more critical to IT services.

    What was needed was a streamlined process for procuring high-cost, high-utility equipment, tracking their location, and managing their lifecycle costs without compromising services.

    Resolution

    The organization decided to formalize, document, and automate hardware asset management processes to meet the new challenges and focus efforts on high-cost, high-utility end-user computing devices only.

    Step 1.2: Build team and define metrics

    Phase 1: Assess & Plan

    1.1 Assess current state & plan scope

    1.2 Build team and define metrics

    This step will walk you through the following activities:

    1.2.1 Define responsibilities for Asset Manager and Asset Administrator

    1.2.2 Use a RACI chart to determine roles within HAM team

    1.2.3 Further clarify HAM responsibilities for each role

    1.2.4 Identify HAM reporting requirements

    This step involves the following participants:

    • CIO/CFO
    • IT Director
    • IT Managers
    • Asset Manager
    • Asset Coordinators
    • ITAM Team
    • Service Desk
    • End-User Device Support Team

    Step Outcomes:

    • Defined responsibilities for Asset Manager and Asset Administrator
    • Documented RACI chart assigning responsibility and accountability for core HAM processes
    • Documented responsibilities for ITAM/HAM team
    • Defined and documented KPIs and metrics to meet HAM reporting requirements

    Form an asset management team to lead the project

    Asset management is an organizational change. To gain buy-in for the new processes and workflows that will be put in place, a dedicated, passionate team needs to jump-start the project.

    Delegate the following roles to team members and grow your team accordingly.

    Asset Manager

    • Responsible for setting policy and governance of process and data accuracy
    • Support budget process
    • Support asset tracking processes in the field
    • Train employees in asset tracking processes

    Asset Administrator

    • The front-lines of asset management
    • Communicates with and supports asset process implementation teams
    • Updates and contributes information to asset databases
    Service Desk, IT Operations, Applications
    • Responsible for advising asset team of changes to the IT environment, which may impact pricing or ability to locate devices
    • Works with Asset Coordinator/Manager to set standards for lifecycle stages
    • The ITAM team should visit and consult with each component of the business as well as IT.
    • Engage with leaders in each department to determine what their pain points are.
    • The needs of each department are different and their responses will assist the ITAM team when designing goals for asset management.
    • Consultations within each department also communicates the change early, which will help with the transition to the new ITAM program.

    Info-Tech Insight

    Ensure that there is diversity within the ITAM team. Assets for many organizations are diverse and the composition of your team should reflect that. Have multiple departments and experience levels represented to ensure a balanced view of the current situation.

    Define the responsibilities for core ITAM/HAM roles of Asset Manager and Asset Administrator

    1.2.1 Use Info-Tech’s job description templates to define roles

    The role of the IT Asset Manager is to oversee the daily and long-term strategic management of software and technology- related hardware within the organization. This includes:

    • Planning, monitoring, and recording software licenses and/or hardware assets to ensure compliance with vendor contracts.
    • Forming procurement strategies to optimize technology spend across the organization.
    • Developing and implementing procedures for tracking company assets to oversee quality control throughout their lifecycles.

    The role of the IT Asset Administrator is to actively manage hardware and software assets within the organization. This includes:

    • Updating and maintaining accurate asset records.
    • Planning, monitoring, and recording software licenses and/or hardware assets to ensure compliance with vendor contracts.
    • Administrative duties within procurement and inventory management.
    • Maintaining records and databases regarding warranties, service agreements, and lifecycle management.
    • Product standardization and tracking.

    Use Info-Tech’s job description templates to assist in defining the responsibilities for these roles.

    Organize your HAM team based on where they fit within the strategic, tactical, and operational components

    Typically the asset manager will answer to either the CFO or CIO. Occasionally they answer to a vendor manager executive. The hierarchy may vary based on experience and how strategic a role the asset manager will play.

    The image shows a flowchart for organizing the HAM team, structured by three components: Strategic (at the top); Tactical (in the middle); and Operational (at the bottom). The chart shows how the job roles flow together within the hierarchy.

    Determine the roles and responsibilities of the team who will support your HAM program

    1.2.2 Complete a RACI

    A RACI chart will identify who should be responsible, accountable, consulted, and informed for each key activity during the consolidation.

    Participants

    • Project Sponsor
    • IT Director, CIO
    • Project Manager
    • IT Managers and Asset Manager(s)
    • ITAM Team

    Document

    Document in the Standard Operating Procedure.

    Instructions:

    1. Write out the list of all stakeholders along the top of a whiteboard. Write out the key initiative steps for the consolidation project along the left side (use this list as a starting point).
    2. For each initiative, identify each team member’s role. Are they:
      • Responsible? The one responsible for getting the job done.
      • Accountable? Only one person can be accountable for each task.
      • Consulted? Involved through input of knowledge and information.
      • Informed? Receive information about process execution and quality.
    3. As you proceed through the initiative, continue to add tasks and assign responsibility to this RACI chart.

    A sample RACI chart is provided on the next slide

    Start with a RACI chart to determine the responsibilities

    1.2.2 Complete a RACI chart for your organization

    HAM Tasks CIO CFO HAM Manager HAM Administrator Service Desk (T1,T2, T3) IT Operations Security Procurement HR Business Unit Leaders Compliance /Legal Project Manager
    Policies and governance A I R I I C I C C I I
    Strategy A R R R R
    Data entry and quality management C I A I C C I I C C
    Risk management and asset security A R C C R C C
    Process compliance auditing A R I I I I I
    Awareness, education, and training I A I I C
    Printer contracts C A C C C R C C
    Hardware contract management A I R R I I R R I I
    Workflow review and revisions I A C C C C
    Budgeting A R C I C
    Asset acquisition A R C C C C I C C
    Asset receiving (inspection/acceptance) I A R R I
    Asset deployment A R R I I
    Asset recovery/harvesting A R R I I
    Asset disposal C A R R I I
    Asset inventory (input/validate/maintain) I I A/R R R R I I I

    Further clarify HAM responsibilities for each role

    1.2.3 Define roles and responsibilities for the HAM team

    Participants

    • Participants IT Asset Managers and Coordinators
    • ITAM Team
    • IT Managers and IT Director

    Document

    1. Discuss and finalize positions to be established within the ITAM/HAM office as well as additional roles that will be involved in HAM.
    2. Review the sample responsibilities below and revise or create responsibilities for each key position within the HAM team.
    3. Document in the HAM Standard Operating Procedures.
    Role Responsibility
    IT Manager
    • Responsible for writing policies regarding asset management and approving final documents
    • Build and revise budget, tracking actual spend vs. budget, seeking final approvals from the business
    • Process definition, communication, reporting and ensuring people are following process
    • Awareness campaign for new policy and process
    Asset Managers
    • Approval of purchases up to $10,000
    • Inventory and contract management including contract review and recommendations based on business and IT requirements
    • Liaison between business and IT regarding software and hardware
    • Monitor and improve workflows and asset related processes
    • Monitor controls, audit and recommend policies and procedures as needed
    • Validate, manage and analyze data as related to asset management
    • Provide reports as needed for decision making and reporting on risk, process effectiveness and other purposes as required
    • Asset acquisition and disposal
    Service Desk
    Desktop team
    Security
    Infrastructure teams

    Determine criteria for success: establish metrics to quantify and demonstrate the results and value of the HAM function

    HAM metrics fall in the following categories:

    HAM Metrics

    • Quantity e.g. inventory levels and need
    • Cost e.g. value of assets, budget for hardware
    • Compliance e.g. contracts, policies
    • Quality e.g. accuracy of data
    • Duration e.g. time to procure or deploy hardware

    Follow a process for establishing metrics:

    1. Identify and obtain consensus on the organization’s ITAM objectives, prioritized if possible.
    2. For each ITAM objective, select two or three metrics in the applicable categories (not all categories will apply to all objectives); be sure to select metrics that are achievable with reasonable effort.
    3. Establish a baseline measurement for each metric.
    4. Establish a method and accountability for ongoing measurement and analysis/reporting.
    5. Establish accountability for taking action on reported results.
    6. As ITAM expands and matures, change or expand the metrics as appropriate.

    Define KPIs and associated metrics

    • Identify the critical success factors (CSFs) for your hardware asset management program based on strategic goals.
    • For each success factor, identify the key performance indicators (KPIs) to measure success and specific metrics that will be tracked and reported on.
    • Sample metrics are below:
    CSF KPI Metrics
    Improve accuracy of IT budget and forecasting
    • Asset costs and value
    • Average cost of workstation
    • Total asset spending
    • Total value of assets
    • Budget vs. spend
    Identify discrepancies in IT environment
    • Unauthorized or failing assets
    • Number of unauthorized assets
    • Assets identified as cause of service failure
    Avoid over purchasing equipment
    • Number of unused and underused computers
    • Number of unaccounted-for computers
    • Money saved from harvesting equipment instead of purchasing new
    Make more-effective purchasing decisions
    • Predicted replacement time and cost of assets
    • Deprecation rate of assets
    • Average cost of maintaining an asset
    • Number of workstations in repair
    Improve accuracy of data
    • Accuracy of asset data
    • Accuracy rate of inventory data
    • Percentage improvement in accuracy of audit of assets
    Improved service delivery
    • Time to deploy new hardware
    • Mean time to purchase new hardware
    • Mean time to deploy new hardware

    Identify hardware asset reporting requirements and the data you need to collect to meet them

    1.2.4 Identify asset reporting requirements

    Participants

    • CIO/CFO
    • IT Director
    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)

    Document

    Document in the Standard Operating Procedures, Section 13: Reporting

    1. Discuss the goals and objectives of implementing or improving hardware asset management, based on challenges identified in Step 1.2.
    2. From the goals, identify the critical success factors for the HAM program
    3. For each CSF, identify one to three key performance indicators to evaluate achievement of the success factor.
    4. For each KPI, identify one to three metrics that can be tracked and reported on to measure success. Ensure that the metrics are tangible and measurable and will be useful for decision making or to take action.
    5. Determine who needs this information and the frequency of reporting.
    6. If you have existing ITAM data, record the baseline metric.
    CSF KPI Metrics Stakeholder/frequency

    Phase 1 Guided Implementation

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 1: Lay Foundations

    Proposed Time to Completion: 4 weeks

    Step 1.1: Assess current state and plan scope

    Start with an analyst kick-off call:

    • Review challenges.
    • Assess current HAM maturity level.
    • Define scope of HAM program.

    Then complete these activities…

    • Complete MGD (optional).
    • Outline hardware asset management challenges.
    • Conduct HAM maturity assessment.
    • Classify hardware assets to define scope of the program.

    With these tools & templates:

    HAM Maturity Assessment

    Standard Operating Procedures

    Step 1.2: Build team and define metrics

    Review findings with analyst:

    • Define roles and responsibilities.
    • Assess reporting requirements.
    • Document metrics to track.

    Then complete these activities…

    • Define responsibilities for Asset Manager and Asset Administrator.
    • Use a RACI chart to determine roles within HAM team.
    • Document responsibilities for HAM roles.
    • Identify HAM reporting requirements.

    With these tools & templates:

    RACI Chart

    Asset Manager and Asset Administrator Job Descriptions

    Standard Operating Procedures

    Phase 1 Results & Insights:

    For asset management to succeed, it needs to support the business. Engage business leaders to determine needs and build your HAM program around these goals.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    1.1.4 Classify hardware assets to define scope of the program

    Determine value/risk threshold at which assets should be tracked, then divide a whiteboard into four quadrants representing four categories of assets. Participants write assets down on sticky notes and place them in the appropriate quadrant to classify assets.

    1.2.2 Build a RACI chart to determine responsibilities

    Identify all roles within the organization that will play a part in hardware asset management, then document all core HAM processes and tasks. For each task, assign each role to be responsible, accountable, consulted, or informed.

    Phase 2

    Procure and Receive

    Implement Hardware Asset Management

    Step 2.1: Request and Procure Hardware

    Phase 2: Procure & Receive

    2.1 Request & Procure

    2.2 Receive & Deploy

    This step will walk you through the following activities:

    2.1.1 Identify IT asset procurement challenges

    2.1.2 Define standard hardware requests

    2.1.3 Document standard hardware request procedure

    2.1.4 Build a non-standard hardware request form

    2.1.5 Make lease vs. buy decisions for hardware assets

    2.1.6 Document procurement workflow

    2.1.7 Build a purchasing policy

    This step involves the following participants:

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • CFO or other management representative from Finance

    Step Outcomes:

    • Definition of standard hardware requests for roles, including core vs. optional assets
    • End-user request process for standard hardware
    • Non-standard hardware request form
    • Lease vs. buy decisions for major hardware assets
    • Defined and documented procurement workflow
    • Documented purchasing policy

    California saved $40 million per year using a green procurement strategy

    CASE STUDY

    Industry Government

    Source Itassetmanagement.net

    Challenge

    Signed July 27, 2004, Executive order S-20-04, the “Green Building Initiative,” placed strict regulations on energy consumption, greenhouse gas emissions, and raw material usage and waste.

    In compliance with S-20-04, the State of California needed to adopt a new procurement strategy. Its IT department was one of the worst offenders given the intensive energy usage by the variety of assets managed under the IT umbrella.

    Solution

    A green IT initiative was enacted, which involved an extensive hardware refresh based on a combination of agent-less discovery data and market data (device age, expiry dates, power consumption, etc.).

    A hardware refresh of almost a quarter-million PCs, 9,500 servers, and 100 email systems was rolled out as a result.

    Other changes, including improved software license compliance and data center consolidation, were also enacted.

    Results

    Because of the scale of this hardware refresh, the small changes meant big savings.

    A reduction in power consumption equated to savings of over $40 million per year in electricity costs. Additionally, annual carbon emissions were trimmed by 200,000 tons.

    Improve your hardware asset procurement process to…

    Asset Procurement

    • Standardization
    • Aligned procurement processes
    • SLAs
    • TCO reduction
    • Use of centralized/ single POC

    Standardize processes: Using standard products throughout the enterprise lowers support costs by reducing the variety of parts that must be stocked for onsite repairs or for provisioning and supporting equipment.

    Align procurement processes: Procurement processes must be aligned with customers’ business requirements, which can have unique needs.

    Define SLAs: Providing accurate and timely performance metrics for all service activities allows infrastructure management based on fact rather than supposition.

    Reduce TCO: Management recognizes service infrastructure activities as actual cost drivers.

    Implement a single POC: A consolidated service desk is used where the contact understands both standards (products, processes, and practices) and the user’s business and technical environment.

    Identify procurement challenges to identify process improvement needs

    2.1.1 Identify IT asset procurement challenges

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    1. As a group, brainstorm existing challenges related to IT hardware requests and procurement.
    2. If you get stuck, consider the common challenges listed below.
    3. Use the results of the discussion to focus on which problems can be resolved and integrated into your organization as operational standards.

    Document hardware standards to speed time to procure and improve communications to users regarding options

    The first step in your procurement workflow will be to determine what is in scope for a standard request, and how non-standard requests will be handled. Questions that should be answered by this procedure include:

    • What constitutes a non-standard request?
    • Who is responsible for evaluating each type of request? Will there be one individual or will each division in IT elect a representative to handle requests specific to their scope of work?
    • What additional security measures need to be taken?
    • Are there exceptions made for specific departments or high-ranking individuals?

    If your end-user device strategy requires an overhaul, schedule time with an Info-Tech analyst to review our blueprint Build an End-User Computing Strategy.

    Once you’ve answered questions like these, you can outline your hardware standards as in the example below:

    Use Case Mobile Standard Mac Standard Mobile Power User
    Asset Lenovo ThinkPad T570 iMac Pro Lenovo ThinkPad P71
    Operating system Windows 10 Pro Mac OSX Windows 10 Pro, 64 bit
    Display 15.6" 21.5" 17.3”

    Memory

    32GB 8GB 64GB
    Processor Intel i7 – 7600U Processor 2.3GHz Xeon E3 v6 Processor
    Drive 500GB 1TB 1TB
    Warranty 3 year 1 year + 2 extended 3 year

    Info-Tech Insight

    Approach hardware standards from a continual improvement frame of mind. Asset management is a dynamic process. Hardware standards will need to adapt over time to match the needs of the business. Plan assessments at routine intervals to ensure your current hardware standards align with business needs.

    Document specifications to meet environmental, security, and manageability requirements

    Determine environmental requirements and constraints.

    Power management

    Compare equipment for power consumption and ability to remotely power down machines when not in use.

    Heat and noise

    Test equipment run to see how hot the device gets, where the heat is expelled, and how much noise is generated. This may be particularly important for users who are working in close quarters.

    Carbon footprint

    Ask what the manufacturer is doing to reduce post-consumer waste and eliminate hazardous materials and chemicals from their products.

    Ensure security requirements can be met.

    • Determine if network/wireless cards meet security requirements and if USB ports can be turned off to prevent removal of data.
    • Understand the level of security needed for mobile devices including encryption, remote shut down or wipe of hard drives, recovery software, or GPS tracking.
    • Decide if fingerprint scanners with password managers would be appropriate to enable tighter security and reduce the forgotten-password support calls.

    Review features available to enhance manageability.

    • Discuss manageability goals with your IT team to see if any can be solved with added features, for example:
      • Remote control for troubleshooting and remote management of data security settings.
      • Asset management software or tags for bar coding, radio frequency identification (RFID), or GPS, which could be used in combination with strong asset management practices to inventory, track, and manage equipment.

    If choosing refurbished equipment, avoid headaches by asking the right questions and choosing the right vendor

    • Is the equipment functional and for how long is it expected to last?
    • How long will the vendor stand behind the product and what support can be expected?
      • This is typically two to five years, but will vary from vendor to vendor.
      • Will they repair or replace machines? Many will just replace the machine.
    • How big is the inventory supply?
      • What kind of inventory does the vendor keep and for how long can you expect the vendor to keep it?
      • How does the vendor source the equipment and do they have large quantities of the same make and model for easier imaging and support?
    • How complete is the refurbishment process?
      • Do they test all components, replace as appropriate, and securely wipe or replace hard drives?
      • Are they authorized to reload MS Windows OEM?
    • Is the product Open Box or used?
      • Open Box is a new product returned back to the vendor. Even if it is not used, the product cannot be resold as a new product. Open Box comes with a manufacturer’s warranty and the latest operating system.
      • If used, how old is the product?

    "If you are looking for a product for two or three years, you can get it for less than half the price of new. I bought refurbished equipment for my call center for years and never had a problem". – Glen Collins, President, Applied Sales Group

    Info-Tech Insight

    Price differences are minimal between large and small vendors when dealing with refurbished machines. The decision to purchase should be based on ability to provide and service equipment.

    Define standard hardware requests, including core and optional assets

    2.1.2 Identify standards for hardware procurement by role

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • Representatives from all other areas of the business

    Document

    Document in the Standard Operating Procedures, Section 7: Procurement.

    1. Divide a whiteboard into columns representing all major areas of the business.
    2. List the approximate number of end users present at each tier and record these totals on the board.
    3. Distribute sticky notes. Use two different sizes: large sizes represent critically important hardware and small sizes represent optional hardware.
    4. Define core hardware assets for each division as well as optional hardware assets.
    5. Focus on the small sticky notes to determine if these optional purchases are necessary.
    6. Finalize the group decision to determine the standard hardware procurement for each role in the organization. Record results in a table similar to the example below:
    Department Core Hardware Assets Optional Hardware Assets
    IT PC, tablet, monitor Second monitor
    Sales PC, monitor Laptop
    HR PC, monitor Laptop
    Marketing PC (iMac) Tablet, laptop

    Document procedures for users to make standard hardware requests

    2.1.3 Document standard hardware request procedure

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • Representatives from all other areas of the business

    Document

    Document in the Standard Operating Procedures, Section 6: End-User Request Process.

    Discuss and document the end-user request process:

    1. In which cases can users request a primary device?
    2. In which cases can users request a secondary (optional device)?
    3. What justification is needed to approve of a secondary device?
      1. E.g. The request for a secondary device should be via email to the IS Projects and Procurements Officer. This email should outline the business case for why multiple devices are required.
    4. Will a service catalog be available and integrated with an ITAM solution for users to make standard requests? If so, can users also configure their options?
    5. Document the process in the standard operating procedure. Example:

    End-User Request Process

    • Hardware and software will be purchased through the user-facing catalog.
    • Peripherals will be ordered as needed.
    • End-user devices will be routed to business managers for approval prior to fulfillment by IT.
    • Requests for secondary devices must be accompanied by a business case.
    • Equipment replacements due to age will be managed through IT replacement processes.

    Improve the process for ordering non-standard hardware by formalizing the request process, including business needs

    2.1.4 Build a non-standard hardware request form

    • Although the goal should be to standardize as much as possible, this isn’t always possible. Ensure users who are requesting non-standard hardware have a streamlined process to follow that satisfies the justifications for increased costs to deliver.
    • Use Info-Tech’s template to build a non-standard hardware request form that may be used by departments/users requesting non-standard hardware in order to collect all necessary information for the request to be evaluated, approved, and sent to procurement.
    • Ensure that the requestor provides detailed information around the equipment requested and the reason standard equipment does not suffice and includes all required approvals.
    • Include instructions for completing and submitting the form as well as expected turnaround time for the approval process.

    Info-Tech Insight

    Include non-standard requests in continual improvement assessment. If a large portion of requests are for non-standard equipment, it’s possible the hardware doesn’t meet the recommended requirements for specialized software in use with many of your business users. Determine if new standards need to be set for all users or just “power users.”

    Identify the information you need to collect to ensure a smooth purchasing process

    Categories Peripherals Desktops/Laptops Servers
    Financial
    • Operational expenses
    • Ordered for inventory with the exceptions of monitors that will be ordered as needed
    • Equipment will be purchased through IT budget
    • Capital expenses
    • Ordered as needed…
    • Inventory kept for…
    • End-user devices will be purchased through departmental budgets
    • Capital expenses
    • Ordered as needed to meet capacity or stability requirements
    • Devices will be purchased through IT budgets
    Request authorization
    • Any user can request
    • Users who are traveling can purchase and expense peripherals as needed, with manager approvals
    • Tier 3 technicians
    Required approvals
    • Manager approvals required for monitors
    • Infrastructure and applications manager up to [$]
    • CIO over [$]
    Warranty requirements
    • None
    • Three years
    • Will be approved with project plan
    Inventory requirements
    • Minimum inventory at each location of 5 of each: mice, keyboards, cables
    • Docking stations will be ordered as needed
    • Laptops (standard): 5
    • Laptops (ultra light): 1
    • Desktops: 5
    • Inventory kept in stock as per DR plan
    Tracking requirements
    • None
    • Added to ITAM database, CMDB
    • Asset tag to be added to all equipment
    • Added to ITAM database, CMDB

    Info-Tech Best Practice

    Take into account the possibility of encountering taxation issues based on where the equipment is being delivered as well as taxes imposed or incurred in the location from which the asset was shipped or sent. This may impact purchasing decisions and shipping instructions.

    Develop a procurement plan to get everyone in the business on the same page

    • Without an efficient and structured process around how IT purchases are budgeted and authorized, maverick spending and dark procurement can result, limiting IT’s control and visibility into purchases.
    • The challenge many IT departments face is that there is a disconnect between meeting the needs of the business and bringing in equipment according to existing policies and procedures.
    • The asset manager should demonstrate how they can bridge the gaps and improve tracking mechanisms at the same time.

    Improve procurement decisions:

    • Demonstrate how technology is a value-add.
    • Make a clear case for the budget by using the same language as the rest of the business.
    • Quantify the output of technology investments in tangible business terms to justify the cost.
    • Include the refresh cycle in the procurement plan to ensure mission- critical systems will include support and appropriate warranty.
    • Plan technology needs for the future and ensure IT technology will continue to meet changing needs.
    • Synchronize redundant organizational procurement chains in order to lower cost.

    Document the following in your procurement procedure:

    • Process for purchase requests
    • Roles and responsibilities, including requestors and approvers
    • Hardware assets to purchase and why they are needed
    • Timelines for purchase
    • Process for vendors

    Info-Tech Insight

    IT procurement teams are often heavily siloed from ITAM teams. The procurement team is typically found in the finance department. One way to bridge the gap is to implement routine, reliable reporting between departments.

    Determine if it makes sense to lease or buy your equipment; weigh the pros and cons of leasing hardware

    Pros

    • Keeps operational costs low in the short term by containing immediate cost.
    • Easy, predictable payments makes it easier to budget for equipment over long term.
    • Get the equipment you need to start doing business right away if you’re just starting out.
    • After the leasing term is up, you can continue the lease and update your hardware to the latest version.
    • Typical leases last 2 or 3 years, meaning your hardware can get upgrades when it needs it and your business is in a better position to keep up with technology.
    • Leasing directly from the vendor provides operational flexibility.
    • Focus on the business and let the vendor focus on equipment service and updates as you don’t have to pay for maintenance.
    • Costs structured as OPEX.

    Cons

    • In the long term, leasing is almost always more expensive than buying because there’s no equity in leased equipment and there may be additional fees and interest.
    • Commitment to payment through the entire lease period even if you’re not using the equipment anymore.
    • Early termination fees if you need to get out of the lease.
    • No option to sell equipment once you’re finished with it to make money back.
    • Maintenance is up to leasing company’s specifications.
    • Product availability may be limited.

    Recommended for:

    • Companies just starting out
    • Business owners with limited capital or budget
    • Organizations with equipment that needs to be upgraded relatively often

    Weigh the pros and cons of purchasing hardware

    Pros

    • Complete control over assets.
    • More flexible and straightforward procurement process.
    • Tax incentives: May be able to fully deduct the cost of some newly purchased assets or write off depreciation for computers and peripherals on taxes.
    • Preferable if your equipment will not be obsolete in the next two or three years.
    • You can resell the asset once you don’t need it anymore to recover some of the cost.
    • Customization and management of equipment is easier when not bound by terms of leasing agreement.
    • No waiting on vendor when maintenance is needed; no permission needed to make changes.

    Cons

    • High initial cost of investment with CAPEX expense model.
    • More paperwork.
    • You (as opposed to vendor) are responsible for equipment disposal in accordance with environmental regulations.
    • You are responsible for keeping up with upgrades, updates, and patches.
    • You risk ending up with out-of-date or obsolete equipment.
    • Hardware may break after terms of warranty are up.

    Recommended for:

    • Established businesses
    • Organizations needing equipment with long-term lifecycles

    Make a lease vs. buy decision for equipment purchases

    2.1.4 Decide whether to purchase or lease

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • Representatives from all other areas of the business

    Document

    Document policy decisions in the Standard Operating Procedures – Section 7: Procurement

    1. Identify hardware equipment that requires a purchase vs. lease decision.
    2. Discuss with Finance whether it makes sense to purchase or lease each major asset, considering the following:
    • Costs of equipment through each method
    • Tax deductions
    • Potential resale value
    • Potential revenue from using the equipment
    • How quickly the equipment will be outdated or require refresh
    • Size of equipment
    • Maintenance and support requirements
    • Overall costs
  • The leasing vs. buying decision should take considerable thought and evaluation to make the decision that best fits your organizational needs and situation.
  • Determine appropriate warranty and service-level agreements for your organization

    Determine acceptable response time, and weigh the cost of warranty against the value of service.

    • Standard warranties vary by manufacturer, but are typically one or three years.
    • Next-day, onsite service may be part of the standard offering or may be available as an uplift.
    • Four-hour, same-day service can also be added for high availability needs.
    • Extended warranties can be purchased beyond three years, although not many organizations take advantage of this offering.
    • Other organizations lower or remove the warranty and have reported savings of as much as $150 per machine.

    Speak to your partner to see how they can help the process of distributing machines.

    • Internal components change frequently with laptops and desktops. If purchasing product over time rather than buying in bulk, ensure the model will be available for a reasonable term to reduce imaging and support challenges.
    • Determine which services are important to your organization and request these services as part of the initial quote. If sending out a formal RFQ or RFP, document required services and use as the basis for negotiating SLAs.
    • Document details of SLA, including expectations of services for manufacturer, vendor, and internal team.
    • If partner will be providing services, request they stock an appropriate number of hot spares for frequently replaced parts.
    • If self-certifying, review resource capabilities, understand skill and certification requirements; for example, A+ certification may be a pre-requisite.
    • Understand DOA policy and negotiate a “lemon policy,” meaning if product dies within 15 or 30 days it can be classified as DOA. Seek clarity on return processes.

    Consider negotiation strategies, including how and when to engage with different partners during acquisition

    Direct Model

    • Dell’s primary sales model is direct either through a sales associate or through its e-commerce site. Promotions are regularly listed on the website, or if customization is required, desktops and laptops have some flexibility in configuration. Discounts can be negotiated with a sales rep on quantity purchases, but the discount level changes based on the model and configuration.
    • Other tier-one manufacturers typically sell direct only from their e-commerce sites, providing promotions based on stock they wish to move, and providing some configuration flexibility. They rely heavily on the channel for the majority of their business.

    Channel Model

    • Most tier one manufacturers have processes in place to manage a smaller number of partners rather than billing and shipping out to individual customers. Deviating from this process and dealing direct with end customers can create order processing issues.
    • Resellers have the ability to negotiate discounts based on quantities. Discounts will vary based on model, timing (quarter or year end), and quantity commitment.
    • Negotiations on large quantities should involve a manufacturer rep as well as the reseller to clearly designate roles and services, ensure processes are in place to fulfill your needs, and agree on pricing scheme. This will prevent misunderstandings and bring clarity to any commitments.
    • Often the channel partners are authorized to provide repair services under warranty for the manufacturer.
    • Dell also uses the channel model for distribution where customers demand additional services.

    Expect discounts to reflect quantity and method of purchase

    Transaction-based purchases will receive the smallest discounting.

    • Understand requirements to find the most appropriate make and model of equipment.
    • Prepare a forecast of expected purchases for the year and discuss discounting.
    • Typically initial discounts will be 3-5% off suggested retail price.
    • Once a history is in place, and the vendor is receiving regular orders, it may extend deeper discounts.

    Bulk purchases will receive more aggressive discounting of 5-15% off suggested retail price, depending on quantities.

    • Examine shipping options and costs to take advantage of bulk deliveries; in some cases vendors may waive shipping fees as an extension of the discounting.
    • If choosing end-of-line product, ensure appropriate quantity of a single model is available to efficiently roll out equipment.
    • Various pricing models can be used to obtain best price.

    Larger quantities rolled out over time will require commitments to the manufacturer to obtain deepest discounts.

    • Discuss all required services as part of negotiation to ensure there are no surprise charges.
    • Several pricing models can be used to obtain the best price.
      • Suggested retail price minus as much as 20%.
      • Cost plus 3% up to 10% or more.
      • Fixed price based on negotiating equipment availability with budget requirements.

    If sending out to bid, determine requirements and scoring criteria

    It’s nearly impossible to find two manufacturers with the exact same specifications, so comparisons between vendors is more art than science.

    New or upgraded components will be introduced into configurations when it makes the most sense in a production cycle. This creates a challenge in comparing products, especially in an RFP. The best way to handle this is to:

    • Define and document minimum technology requirements.
    • Define and document service needs.
    • Compare vendors to see if they’ve met the criteria or not; if yes, compare prices.
    • If the vendors have included additional offerings, see if they make sense for your organization. If they do, include that in the scoring. If not, exclude and score based on price.
    • Recognize that the complexity of the purchase will dictate the complexity of scoring.

    "The hardware is the least important part of the equation. What is important is the warranty, delivery, imaging, asset tagging, and if they cannot deliver all these aspects the hardware doesn’t matter." – Doug Stevens, Assistant Manager Contract Services, Toronto District School Board

    Document and analyze the hardware procurement workflow to streamline process

    The procurement process should balance the need to negotiate appropriate pricing with the need to quickly approve and fulfill requests. The process should include steps to follow for approving, ordering, and tracking equipment until it is ready for receipt.

    Within the process, it is particularly important to decide if this is where equipment is added into the database or if it will happen upon receipt.

    A poorly designed procurement workflow:

    • Includes many bottlenecks, stopping and starting points.
    • May impact project and service requests and requires unrealistic lead times.
    • May lead to lost productivity for users and lost credibility for the IT department.

    A well-designed hardware procurement workflow:

    • Provides reasonable lead times for project managers and service or hardware request fulfillment.
    • Provides predictability for technical resources to plan deployments.
    • Reduces bureaucracy and workload for following up on missing shipments.
    • Enables improved documentation of assets to start lifecycle management.

    Info-Tech Insight

    Where the Hardware Asset Manager is unable to affect procurement processes to reduce time to deliver, consider bringing inventory onsite or having your hardware vendor keep stock, ready to ship on demand. Projects, replacements, and new-user requests cannot be delayed in a service-focused IT organization due to bureaucratic processes.

    Document and analyze your procurement workflow to identify opportunities for improvement and communicate process

    Determine if you need one workflow for all equipment or multiples for small vs. large purchases.

    Occasionally large rollouts require significant changes from lower dollar purchases.

    Watch for:

    • Back and forth communications
    • Delays in approvals
    • Inability to get ETAs from vendors
    • Too many requests for quotes for small purchases
    • Entry into asset database

    This sample can be found in the HAM Process Workflows.

    The image shows a workflow, titled Procurement-Equipment-Small Quantity. On the left, the chart is separated into categories: IT Procurment; Tier 2 or Tier 3; IT Director; CIO.

    Design the process workflow for hardware procurement

    2.1.6 Illustrate procurement workflow with a tabletop exercise

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • CFO or other management representative from Finance

    Document

    Document in the Standard Operating Procedures, Section 7: Procurement

    1. In a group, distribute sticky notes or cue cards.
    2. Designate a space on the table/whiteboard to plot the workflow.
    3. Determine which individuals are responsible for handling non-standard requests. Establish any exceptions that may apply to your defined hardware standard.
    4. Gather input from Finance on what the threshold will be for hardware purchases that will require further approval.
    5. Map the procurement process for a standard hardware purchase.
    6. If applicable, map the procurement process for a non-standard request separately.
    7. Evaluate the workflow to identify any areas of inefficiency and make any changes necessary to improve the process.
    8. Be sure to discuss and include:
      • All necessary approvals
      • Time required for standard equipment process
      • Time required for non-standard equipment process
      • How information will be transferred to ITAM database

    Document and share an organizational purchasing policy

    2.1.7 Build a purchasing policy

    A purchasing policy helps to establish company standards, guidelines, and procedures for the purchase of all information technology hardware, software, and computer-related components as well as the purchase of all technical services.

    The policy will ensure that all purchasing processes are consistent and in alignment with company strategy. The purchasing policy is key to ensuring that corporate purchases are effective and the best value for money is obtained.

    Implement a purchasing policy to prevent or reduce:

    • Costly corporate conflict of interest cases.
    • Unauthorized purchases of non-standard, difficult to support equipment.
    • Unauthorized purchases resulting in non-traceable equipment.
    • Budget overruns due to decentralized, equipment acquisition.

    Download Info-Tech’s Purchasing Policytemplate to build your own purchasing policy.

    Step 2.2: Receive and Deploy Hardware

    Phase 2: Procure & Receive

    2.1 Request & Procure

    2.2 Receive & Deploy

    This step will walk you through the following activities:

    2.2.1 Select appropriate asset tagging method

    2.2.2 Design workflow for receiving and inventorying equipment

    2.2.3 Document the deployment workflow(s)

    This step involves the following participants:

    • Asset Manager
    • Purchasing
    • Receiver (optional)
    • Service Desk Manager
    • Operations (optional)

    Step Outcomes:

    • Understanding of the pros and cons of various asset tagging methods
    • Defined asset tagging method, process, and location by equipment type
    • Identified equipment acceptance, testing, and return procedures
    • Documented equipment receiving and inventorying workflow
    • Documented deployment workflows for desktop hardware and large-scale deployments

    Cisco implemented automation to improve its inventory and deployment system

    CASE STUDY

    Industry Networking

    Source Cisco IT

    Challenge

    Although Cisco Systems had implemented a centralized procurement location for all PCs used in the company, inventory tracking had yet to be addressed.

    Inventory tracking was still a manual process. Given the volume of PCs that are purchased each year, this is an incredibly labor-intensive process.

    Sharing information with management and end users also required the generation of reports – another manual task.

    Solution

    The team at Cisco recognized that automation was the key component holding back the success of the inventory management program.

    Rolling out an automated process across multiple offices and groups, both nationally and internationally, was deemed too difficult to accomplish in the short amount of time needed, so Cisco elected to outsource its PC management needs to an experienced vendor.

    Results

    As a result of the PC management vendor’s industry experience, the implementation of automated tracking and management functions drastically improved the inventory management situation at Cisco.

    The vendor helped determine an ideal leasing set life of 30 months for PCs, while also managing installations, maintenance, and returns.

    Even though automation helped improve inventory and deployment practices, Cisco still needed to address another key facet of asset management: security.

    This case study continues in phase 3.

    An effective equipment intake process is critical to ensure product is correct, documented, and secured

    Examine your current process for receiving assets. Typical problems include:

    Receiving inventory at multiple locations can lead to inconsistent processes. This can make invoice reconciliation challenging and result in untracked or lost equipment and delays in deployment.

    Equipment not received and secured quickly. Idle equipment tends to go missing if left unsupervised for too long. Missed opportunities to manage returns where equipment is incorrect or defective.

    Disconnect between procurement and receiving where ETAs are unknown or incorrect. This can create an issue where no one is prepared for equipment arrival and is especially problematic on large orders.

    How do you solve these problems? Create a standardized workflow that outlines clear steps for asset receiving.

    A workflow will help to answer questions such as:

    • How do you deal with damaged shipments? Incorrect shipments?
    • Did you reach an agreement with the vendor to replace damaged/incorrect shipments within a certain timeframe?
    • When does the product get tagged and entered into the system as received?
    • What information needs to get captured on the asset tag?

    Standardize the process for receiving your hardware assets

    The first step in effective hardware asset intake is establishing proper procedures for receiving and handling of assets.

    Process: Start with information from the procurement process to determine what steps need to follow to receive into appropriate systems and what processes will enable tagging to happen as soon as possible.

    People: Ensure anyone who may impact this process is aware of the importance of documenting before deployment. Having everyone who may be handling equipment on board is key to success.

    Security: Equipment will be secured at the loading dock or reception. It will need to be secured as inventory and be secured if delivering directly to the bench for imaging. Ensure all receiving activities are done before equipment is deployed.

    Tools: A centralized ERP system may already provide a place to receive and reconcile with purchasing and invoicing, but there may still be a need to receive directly into the ITAM and/or CMDB database rather than importing directly from the ERP system.

    Tagging: A variety of methods can be used to tag equipment to assist with inventory. Consider the overall lifecycle management when determining which tagging methods are best.

    Info-Tech Insight

    Decentralized receiving doesn’t have to mean multiple processes. Take advantage of enterprise solutions that will centralize the data and ensure everyone follows the same processes unless there is an uncompromising and compelling logistical reason to deviate.

    Evaluate the pros and cons of different asset tagging methods

    Method Cost Strengths Weaknesses Recommendation
    RFID with barcoding – asset tag with both a barcode and RFID solution $$$$
    • Secure, fast, and robust
    • Track assets in real time
    • Quick and efficient
    • Most expensive option, requiring purchase of barcode scanner with RFID reader and software)
    • Does not work as well in an environment with less control over assets
    • Requires management of asset database
    • Best in a controlled environment with mature processes and requirement for secure assets
    RFID only – small chip with significant data capacity $$$
    • Track assets from remote locations
    • RFID can be read through boxes so you don’t have to unpack equipment
    • Scan multiple RFID-tagged hardware simultaneously
    • Large data capacity on small chip
    • Expensive, requiring purchase of RFID reading equipment and software
    • Ideal if your environment is spread over multiple locations
    Barcoding only – adding tags with unique barcodes $$
    • Reasonable security
    • Report inventory directly to database
    • Relatively low cost
    • Only read one at a time
    • Need to purchase barcode scanners and software
    • Can be labor intensive to deploy with manual scanning of individual assets
    • Less secure
    • Can’t hold as much data
    • Not as secure as barcodes with RFID but works for environments that are more widely distributed and less controlled

    Evaluate the pros and cons of different asset tagging methods

    Method Cost Strengths Weaknesses Recommendation
    QR codes – two-dimensional codes that can store text, binary, image, or URL data $$
    • Easily scannable from many angles
    • Save and print on labels
    • Can be read by barcode scanning apps or mobile phones
    • Can encode more data than barcodes
    • QR codes need to be large enough to be usable, which can be difficult with smaller IT assets
    • Scanning on mobile devices takes longer than scanning barcodes
    • Ideal if you need to include additional data and information in labels and want workers to use smartphones to scan labels
    Manual tags – tag each asset with your own internal labels and naming system $
    • Most affordable
    • Manual
    • Tags are not durable
    • Labor intensive and time consuming
    • Leaves room for error, misunderstanding, and process variances between locations
    • As this is the most time consuming and resource intensive with a low payoff, it is ideal for low maturity organizations looking for a low-cost option for tagging assets
    Asset serial numbers – tag assets using their serial number $
    • Less expensive
    • Unique serial numbers identified by vendor
    • Serial numbers have to be added to database manually, which is labor intensive and leaves room for error
    • Serial numbers can rub off over time
    • Hard to track down already existing assets
    • Doesn’t help track location of assets after deployment
    • Potential for duplicates
    • Inconsistent formats of serial numbers by manufacturers makes this method prone to error and not ideal for asset management

    Select the appropriate method for tagging and tracking your hardware assets

    2.2.1 Select asset tagging method

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)

    Document

    Document in the Standard Operating Procedures, Section 8

    1. Define your asset tagging method. For most organizations, asset tracking is done via barcoding or QR codes, either by using one method or a combination of the two. Other methods, including RFID, may be applicable based on cost or tracking complexity. Overall, barcodes embedded with RFID are the most robust and efficient method for asset tagging, but also the most expensive. Choose the best method for your organization, taking into account affordability, labor-intensiveness, data complexity needs, and ease of deployment.
    2. Define the process for tagging assets, including how soon they should receive the tag, whose responsibility it is, and whether the tag type varies depending on the asset type.
    3. Define the location of asset tags according to equipment type. Example:
    Asset Type Asset Tag Location
    PC desktop Right upper front corner
    Laptop Right corner closest to user when laptop is closed
    Server Right upper front corner
    Printer Right upper front corner
    Modems Top side, right corner

    Inspect and test equipment before accepting it into inventory to ensure it’s working according to specifications

    Upon receipt of procured hardware, validate the equipment before accepting it into inventory.

    1. Receive - Upon taking possession of the equipment, stage them for inspection before placing them into inventory or deploying for immediate use.
    2. Inspect - The inspection process should involve at minimum examining the products that have been delivered to determine conformance to purchase specifications.
    3. Test -Depending on the type and cost of hardware, some assets may benefit from additional testing to determine if they perform at a satisfactory level before being accepted.
    4. Accept - If the products conform to the requirements of the purchase order, acknowledge receipt so the supplier may be paid. Most shipments are automatically considered as accepted and approved for payment within a specific timeframe.

    Assign responsibility and accountability for inspection and acceptance of equipment, verifying the following:

    • The products conform to purchase order requirements.
    • The quantity ordered is the same as the quantity delivered.
    • There is no damage to equipment.
    • Delivery documentation is acceptable.
    • Products are operable and perform according to specifications.
    • If required, document an acceptance testing process as a separate procedure.

    Build the RMA procedure into the receiving process to handle receipt of defective equipment

    The return merchandise authorization (RMA) process should be a standard part of the receiving process to handle the return of defective materials to the vendor for either repair or replacement.

    If there is a standard process in place for all returns in the organization, you can follow the same process for returning hardware equipment:

    • Call the vendor to receive a unique RMA number that will be attached to the equipment to be returned, then follow manufacturer specifications for returning equipment within allowable timelines according to the contract where applicable.
    • Establish a lemon policy with vendors, allowing for full returns up to 30 days after equipment is deployed if the product proves defective after initial acceptance.

    Info-Tech Insight

    Make sure you’re well aware of the stipulations in your contract or purchase order. Sometimes acceptance is assumed after 60 days or less, and oftentimes the clock starts as soon as the equipment is shipped out rather than when it is received.

    Info-Tech Best Practice

    Keep in mind that the serial number on the received assed may not be the asset that ultimately ends up on the user’s desk if the RMA process is initiated. Record the serial number after the RMA process or add a correction process to the workflow to ensure the asset is properly accounted for.

    Determine what equipment should be stocked for quick deployment where demand is high or speed is crucial

    The most important feature of your receiving and inventory process should be categorization. A well-designed inventory system should reflect not only the type of asset, but also the usage level.

    A common technique employed by asset managers is to categorize your assets using an ABC analysis. Assets are classified as either A, B, or C items. The ratings are based on the following criteria:

    A

    A items have the highest usage. Typically, 10-20% of total assets in your inventory account for upwards of 70-80% of the total asset requests.

    A items should be tightly controlled with secure storage areas and policies. Avoiding stock depletion is a top priority.

    B

    B items are assets that have a moderate usage level, with around 30% of total assets accounting for 15-25% of total requests.

    B items must be monitored; B items can transition to A or C items, especially during cycles of heavier business activity.

    C

    C items are assets that have the lowest usage, with upwards of 50% of your total inventory accounting for just 5% of total asset requests.

    C items are reordered the least frequently, and present a low demand and high risk for excessive inventory (especially if they have a short lifecycle). Many organizations look to move towards an on-demand policy to mitigate risk.

    Info-Tech Insight

    Get your vendor to keep stock of your assets. If large quantities of a certain asset are required but you lack the space to securely store them onsite, ask your vendor to keep stock for you and release as you issue purchase orders. This speeds up delivery and delays warranty activation until the item is shipped. This does require an adherence to equipment standards and understanding of demand to be effective.

    Define the process for receiving equipment into inventory

    Define the following in your receiving process:

    • When will equipment be opened once delivered?
    • Who will open and validate equipment upon receipt?
    • How will discrepancies be resolved?
    • When will equipment be tagged and identified in the tracking tool?
    • When will equipment be locked in secure storage?
    • Where will equipment go if it needs to be immediately deployed?

    The image shows a workflow chart titled Receiving and Tagging. The process is split into two sections, labelled on the left as: Desktop Support Team and Procurement.

    Design the workflow for receiving and inventorying equipment

    2.2.2 Illustrate receiving workflow with a tabletop exercise

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • CFO or other management representative from Finance

    Document

    Document in the Standard Operating Procedures, Section 8: Receiving and Equipment Inventory

    Option 1: Whiteboard

    1. Discuss the workflow and draw it on the whiteboard.
    2. Assess whether you are using the best workflow. Modify it if necessary.
    3. Use the sample workflow from this step as a guide if starting from scratch.
    4. Engage the team in refining the process workflow.
    5. Transfer data to Visio and add to the SOP.

    Option 2: Tabletop Exercise

    1. Distribute index cards to each member of the team.
    2. Have each person write a single task they perform on the index card. Be granular. Include the title or the name of the person responsible.
    3. Mark cards that are decision points. Use a card of a different color or use a marker to make a colored dot.
    4. Arrange the index cards in order, removing duplicates.
    5. Assess whether you are using the best workflow. Engage the team to refine it if necessary.
    6. Transfer data to Visio and add to the SOP.

    Improve device deployment by documenting software personas for each role

    • Improve the deployment process for new users by having a comprehensive list of software used by common roles within the organization. With large variations in roles, it may be impossible to build a complete list, but as you start to see patterns in requirements, you may find less distinct personas than anticipated.
    • Consider a survey to business units to determine what they need if this will solve some immediate problems. If this portion of the project will be deferred, use the data uncovered in the discovery process to identify which software is used by which roles.
    • Replacement equipment can have the software footprint created by what was actually utilized by the user, not necessarily what software was installed on the previous device.

    The image shows 4 bubbles, representing software usage. The ARC-GIS bubble is the largest, Auto CAD the second largest, and MS Office and Adobe CS equal in size.

    A software usage snapshot for an urban planner/engineer.

    • Once software needs are determined, use this information to review the appropriate device for each persona.
      • Ensure hardware is appropriate for the type of work the user does and supports required software.
      • If it is more appropriate for a user to have a tablet, ensure the software they use can be used on any device.
    • Review deployment methods to determine if there is any opportunity to improve the imaging or software deployment process with better tools or methodologies.
    • Document the device’s location if it will be static, or if the user may be more mobile, add location information for their primary location.
    • Think about the best place to document – if this information can be stored in Active Directory and imported to the ITAM database, you can update once and use in multiple applications. But this process is built into your add/move/change workflows.

    Maintain a lean library to simplify image management

    Simplify, simplify, simplify. Use a minimal number of desktop images and automate as much as you can.

    • Embrace minimalism. When it comes to managing your desktop image library, your ultimate goal should be to minimize the manual effort involved in provisioning new desktops.
    • Less is more. Try to maintain as few standard desktop images as possible and consider a thin gold image, which can be patched and updated on a regular basis. A thin image with efficient application deployment will improve the provisioning process.
    • Standardize and repeat. System provisioning should be a repeatable process. This means it is ripe for standardization and automation. Look at balancing the imaging process with software provisioning, using group policy and deployment tools to reduce time to provision and deliver equipment.
    • Outsource where appropriate. Imaging is one of the most employed services, where the image is built in-house and deployed by the hardware vendor. As a minimum, quarterly updates should still be provided to integrate the latest patches into the operating system.

    Document the process workflow for hardware deployment

    Define the process for deploying hardware to users.

    Include the following in your workflow:

    • How will equipment be configured and imaged before deployment?
    • Which images will be used for specific roles?
    • Which assets are assigned to specific roles?
    • How will the device status be changed in the ITAM tool once deployed?

    The image shows a workflow chart titled Hardware Deployment. It is divided into two categories, listed on the left: Desktop Support Team and Procurement.

    Large-scale deployments should be run as projects, benefitting from economies of scale in each step

    Large-scale desktop deployments or data center upgrades will likely be managed as projects.

    These projects should include project plans, including resources, timelines, and detailed procedures.

    Define the process for large-scale deployment if it will differ from the regular deployment process.

    The image is a graphic of a flowchart titled Deployment-Equipment-Large Quantity Rollout. It is divided into three categories, listed on the left: IT Procurement; Desktop Rollout Team; Asset Manager.

    Document the deployment workflow(s)

    2.2.3 Document deployment workflows for desktop and large-scale deployment

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Operations (optional)
    • CFO or other management representative from Finance

    Document

    Document in the Standard Operating Procedures, Section 9: Deployment

    Document each step in the system deployment process with notecards or on a whiteboard. Identify the challenges faced by your organization and strategize potential solutions.

    1. Outline each step in the process of desktop deployment. Be as granular as possible. On each card, describe the step as well as the individual responsible for it.
    2. When you are satisfied that each step is accurately captured, use a second color of notecard to document any challenges, inefficiencies, or pains associated with each step. Consider further documenting the time on each task.
    3. Examine each challenge or pain point. Discuss whether or not there is a clear solution to the problem. If yes, document the solution and amend the workflow. If not, engage in a broader discussion of possible solutions, taking into account people, processes, and available technology.
    4. Document separately the process for large-scale deployment if required.

    Look for opportunities to improve the request and deployment process with better communication and tools

    The biggest challenge in deploying equipment is meeting expectations of the business, and without cooperation from multiple departments, this becomes significantly more difficult.

    • Work with the procurement and the services team to ensure inventory is accessible, and regularly validate that inventory levels in the ITAM database are accurate.
    • Work with the HR department to predict (where possible) anticipated new hires. Plan for inventory ebbs and flows to match the hiring timelines where there are large variations.
    • If service catalogs will be made available for communicating options and SLAs for equipment purchases, work with the service catalog administrators to automate inventory checks and notifications. Work with the end-user device managers to set standards and reduce equipment variations to a manageable amount.
    • Where deployments are part of equipment refresh, ensure data is up to date for the services team to plan the project rollouts and know which software should be redeployed with the devices.
    • Infrastructure and security teams may have specific hardware assets relating to networking, data centers, and security, which may bypass the end-user device workflows but need to be tagged and entered into inventory early in the process. Work with these teams to have their equipment follow the same receiving and inventory processes. Deployment will vary based on equipment type and location.

    Automate hardware deployment where users are dispersed and deployment volume is high

    Self-serve kiosks (vending machines) can provide cost reductions in delivery of up to 25%. Organizations that have a high distribution rate are seeing reductions in cost of peripherals averaging 30-35% and a few extreme cases of closer to 85%.

    Benefits of using vending machines:

    • Secure equipment until deployed.
    • Equipment can be either purchased by credit card or linked to employee ID cards, enabling secure transactions and reporting.
    • Access rights can be controlled in real time, preventing terminated employees from accessing equipment or managing how many devices can be deployed to each user.
    • Vending machines can be managed through a cellular or wireless network.
    • Technology partners can be tasked with monitoring and refilling vending machines.
    • Employees are able to access technology wherever a vending machine can be located rather than needing to travel to the help desk.
    • Equipment loans and new employee packages can be managed through vending machines.

    Phase 2 Guided Implementation

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 2: Request, Procure, Receive, and Deploy

    Proposed Time to Completion: 4 weeks

    Step 2.1: Request & Procure

    Start with an analyst kick-off call:

    • Define standard and non-standard hardware.
    • Weigh the pros and cons of leasing vs. buying.
    • Build the procurement process.

    Then complete these activities…

    • Define standard hardware requests.
    • Document standard hardware request procedure.
    • Document procurement workflow.
    • Build a purchasing policy.

    With these tools & templates:

    • Standard Operating Procedures
    • Non-Standard Hardware Request Form
    • Hardware Procurement Workflow
    • Purchasing Policy

    Step 2.2: Receive & Deploy

    Review findings with analyst:

    • Determine appropriate asset tagging method.
    • Define equipment receiving process.
    • Define equipment deployment process.

    Then complete these activities…

    • Select appropriate asset tagging method.
    • Design workflow for receiving and inventorying equipment.
    • Document the deployment workflow(s).

    With these tools & templates:

    • Standard Operating Procedures
    • Equipment Receiving & Tagging Workflow
    • Deployment Workflow

    Phase 2 Insight: Bridge the gap between IT and Finance to build a smoother request and procurement process through communication and routine reporting. If you’re unable to affect procurement processes to reduce time to deliver, consider bringing inventory onsite or having your hardware vendor keep stock, ready to ship on demand.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    2.1.2 Define standard hardware requests

    Divide whiteboard into columns representing core business areas. Define core hardware assets for end users in each division along with optional hardware assets. Discuss optional assets to narrow and define standard equipment requests.

    2.2.1 Select appropriate method for tagging and tracking assets

    Discuss the various asset tagging methods and choose the tagging method that is most appropriate for your organization. Define the process for tagging assets and document the standard asset tag location according to equipment type.

    Phase 3

    Maintain and Dispose

    Implement Hardware Asset Management

    Cisco overcame organizational resistance to change to improve asset security

    CASE STUDY

    Industry Networking

    Source Cisco IT

    Challenge

    Cisco Systems had created a dynamic work environment that prized individuality. This environment created high employee satisfaction, but it also created a great deal of risk surrounding device security.

    Cisco lacked an asset security policy; there were no standards for employees to follow. This created a surplus of not only hardware, but software to support the variety of needs amongst various teams at Cisco.

    Solution

    The ITAM team at Cisco recognized that their largest problem was the lack of standardization with respect to PCs. Variance in cost, lifecycle, and software needs/compatibility were primary issues.

    Cisco introduced a PC leasing program with the help of a PC asset management vendor to correct these issues. The primary goal was to increase on-time returns of PCs. A set life of 30 months was defined by the vendor.

    Results

    Cisco engaged employees to help contribute to improving its asset management protocols, and the approach worked.

    On-time returns increased from 60% to 80%. Costs were reduced due to active tracking and disposal of any owned assets still present.

    A reduction in hardware and software platforms has cut costs and increased security thanks to improved tracking capabilities.

    This case study continues in phase 4

    Step 3.1: Manage, Maintain, and Secure Hardware Assets

    Phase 3: Maintain & Dispose

    3.1 Manage & Maintain

    3.2 Dispose or Redeploy

    This step will walk you through the following activities:

    3.1.1 Build a MAC policy and request form

    3.1.2 Build workflows to document user MAC processes

    3.1.3 Design process and policies for hardware maintenance, warranty, and support documentation handling

    3.1.4 Revise or create an asset security policy

    This step involves the following participants:

    • Asset Manager
    • Service Desk Manager
    • Operations (optional)
    • Security Department

    Step Outcomes

    • Understanding of inventory management process best practices
    • Templates for move/add/change request policy and form
    • Documented process workflows for the user move/add/change process
    • Process and policies for hardware maintenance, warranty, and support documentation handling
    • Defined policies for maintaining asset security

    Determine methods for performing inventory audits on equipment

    Auto-discovery

    • Auto-discovery tools will be crucial to the process of understanding what equipment is connected to the network and in use.
    • The core functionality of discovery tools is to scan the environment and collect configuration data from all connected assets, but most tools can also be used to collect usage data, network monitoring, and software asset management data including software distribution, compliance, and license information.
    • These tools may not connect to peripheral devices such as monitors and external drives, will not scan devices that are turned off or disconnected from the network, may not inventory remote users, and will rarely provide location information. This often results in a need to complete physical audits as well.

    Info-Tech Insight

    One of the most common mistakes we see when it comes to asset management is to assume that the discovery tool will discovery most or all of your inventory and do all the work. It is better to assume only 80-90% coverage by the discovery tool and build ownership records to uncover the unreportable assets that are not tied into the network.

    Physical audit

    • The physical audit can be greatly improved with barcode, RFID, or QR codes, allowing items to be scanned, records opened, then updated.
    • If not everything is tagged or entered into the ITAM database, then searching closets, cabinets, and desk drawers may be required to tag and enter those devices into the database.
    • Provide the inventory team with exact instructions on what needs to be collected, verified, and recorded. Depending on the experience and thoroughness of the team, spot checks early in the process may alleviate quality issues often discovered at the end of the inventory cycle.

    Determine requirements for performing inventory audits on equipment

    Conduct an annual hardware audit to ensure hardware is still assigned to the person and location identified in your ITAM system, and assess its condition.

    Perform a quarterly review of hardware stock levels in order to ensure all equipment is relevant and usable. The table below is an example of how to organize this information.

    Item Target Stock Levels Estimated $ Value
    Desktop computers
    Standard issue laptops
    Mice
    Keyboards
    Network cables
    Phones

    Info-Tech Insight

    Don’t forget about your remotely deployed assets. Think about how you plan to inventory remotely deployed equipment. Some tools will allow data collection through an agent that will talk to the server over the internet, and some will completely ignore those assets or provide a way to manually collect the data and email back to the asset manager. Mobile device management tools may also help with this inventory process. Determine what is most appropriate based on the volume of remote workers and devices.

    Build an inventory management process to maintain an accurate view of owned hardware assets

    • Your inventory should capture which assets are on hand, where they are located, and who owns them, at minimum. Maintaining an accurate, up-to-date view of owned hardware assets allows you to see at any time the actual state of the components that make up your infrastructure across the enterprise.
    • Automated inventory practices save time and effort from doing physical inventories and also reduce the interruption to business users while improving accuracy of data.
    • If you are just starting out, define the process for conducting an inventory of deployed assets, and then define the process for regular upkeep and audit of inventory data.

    Inventory Methods

    • Electronic – captures networked asset information only and can be deployed over the network with no deskside service interaction.
    • Physical – captures environmental detail and must be performed manually by a service technician with possible disruption to users.
    • Full inventory – both physical and electronic inventory of assets.

    Internal asset information to collect electronically

    • Hardware configuration
    • Installed software
    • Operating system
    • System BIOS
    • Network configuration
    • Network drive mappings
    • Printer setups
    • System variables

    External asset information that cannot be detected electronically

    • Assigned user
    • Associated assets
    • Asset/user location
    • Usage of asset
    • Asset tag number

    IMAC (Install, Move, Add, Change) services will form the bulk of asset management work while assets are deployed

    IMAC services are usually performed at a user’s deskside by a services technician and can include:

    • Installing new desktops or peripherals
    • Installing or modifying software
    • Physically moving an end user’s equipment
    • Upgrading or adding components to a desktop

    Specific activities may include:

    Changes

    • Add new user IDs
    • Manage IDs
    • Network changes
    • Run auto-discovery scan

    Moves

    • Perform new location site survey
    • Coordinate with facilities
    • Disconnect old equipment
    • Move to new location
    • Reconnect at new location
    • Test installed asset
    • Obtain customer acceptance
    • Close request

    Installs and Adds

    • Perform site survey
    • Perform final configuration
    • Coordinate with Facilities
    • Asset tagging
    • Transfer data from old desktop
    • Wipe old desktop hard drive
    • Test installed asset
    • Initiate auto-discovery scan
    • Obtain customer acceptance
    • Close request

    A strong IMAC request process will lessen the burden on IT asset managers

    • When assets are actively in use, Asset Managers must also participate in the IMAC (Install-Move-Add-Change) process and ensure that any changes to asset characteristics or locations are updated and tracked in the asset management tool and that the value and usefulness of the asset is monitored.
    • The IMAC process should not only be reactive in response to requests, but proactive to plan for moves and relocations during any organizational change events.

    Recommendations:

    Automate. Wherever possible, use tools to automate the IMAC process.

    E-forms, help desk, ticketing, or change management software can automate the request workflow by allowing the requestor to submit a request ticket that can then be automatically assigned to a designated team member according to the established chain of command. As work is completed, the ticket can be updated, and the requestor will be able to check the status of the work at any time.

    Communicate the length of any downtime associated with execution of the IMAC request to lessen the frustration and impatience among users.

    Involve HR. When it comes to adding or removing user accounts, HR can be a valuable resource. As most new employees should be hired through HR, work with them to improve the onboarding process with enough advanced notice to set up accounts and equipment. Role changes with access rights and software modifications can benefit from improved communications. Review the termination process as well, to secure data and equipment.

    Build a MAC request policy and form for end users

    A consistent Move, Add, Change (MAC) request process is essential for lessening the burden on the IT department. MAC requests are used to address any number of tasks, including:

    • Relocation of PCs and/or peripherals.
    • New account setup.
    • Hardware or software upgrades.
    • Equipment swaps or replacements.
    • User account/access changes.
    • Document generation.
    • User acceptance testing.
    • Vendor coordination.

    Create a request form.

    If you are not using help desk or other ticketing software, create a request template that must be submitted for each MAC. The request should include:

    • The name and department of the requester.
    • The date of the request.
    • Severity of the request. For example, severity can be graded on a score of high, medium, or low where high represents a mission-critical change that could compromise business continuity if not addressed immediately, and low represents a more cosmetic change that will not negatively affect operations. The severity of the request can be determined by the service-level agreement (SLA) associated with the service.
    • Date the request must be completed by. Or at least, what would be the ideal date for completion. This will vary greatly depending on the severity of the request. For example, deleting the access of a terminated employee would be very time sensitive.
    • Item or service to be moved, added, or changed. Include location, serial number, or other designated identifier where possible.
    • If the item or service is to be moved, indicated where it is being moved.
    • It is a good idea to include a comments section where the requester can add any additional questions or details.

    Use Info-Tech’s templates to build your MAC policy and request form

    3.1.1 Build a MAC policy and request form

    Desktop Move/Add/Change Policy

    This desktop move/add/change policy should be put in place to mitigate the risk associated with unauthorized changes, minimize disruption to the business, IT department, and end users, and maintain consistent expectations.

    Move, Add, Change Request Form

    Help end users navigate the move/add/change process. Use the Move/Add/Change Request Form to increase efficiency and organization for MAC requests.

    Document the process for user equipment moves

    Include the following in your process documentation:

    • How and when will any changes to user or location information be made in the ITAM tool?
    • Will any changes in AD automatically update in the ITAM tool?
    • How should requests for equipment moves or changes be made?
    • How will resources be scheduled?

    The image shows a flowchart titled SErvice Request - User Moves. The chart of processes is split into three categories, listed on the left side of the chart: User Manager; IT Coordinator; and Tier 2 & Facilities.

    Build workflows to document user MAC processes

    3.1.2 Build MAC process workflows

    Participants

    • Asset Manager
    • Service Desk Manager
    • Operations (optional)

    Document

    Document in the Standard Operating Procedures, Section 10: Equipment Install, Adds, Moves, and Changes

    Document each step in the system deployment process using notecards or on a whiteboard. Identify the challenges faced by your organization and strategize potential solutions.

    1. Outline each step in the process of desktop deployment. Be as granular as possible. On each card, describe the step as well as the individual responsible for each step.
    2. When you are satisfied that each step is accurately captured, use a second color of notecard to document any challenges, inefficiencies, or pains associated with each step. Consider further documenting the time on each task.
    3. Examine each challenge or pain point. Discuss whether or not there is a clear solution to the problem. If so, document the solution and amend the workflow. If not, engage in a broader discussion of possible solutions, taking into account people, processes, and available technology.
    4. Document separately the process for large-scale deployment if required.

    Define a policy to ensure effective maintenance of hardware assets

    Effective maintenance and support of assets provides longer life, higher employee productivity, and increased user satisfaction.

    • Your asset management documentation and database should store equipment maintenance contract information so that it can be consulted whenever hardware service is required.
    • Record who to contact as well as how, warranty information, and any SLAs that are associated with the maintenance agreement.
    • Record all maintenance that hardware equipment receives, which will be valuable for evaluating asset and supplier performance.
    • In most cases, the Service Desk should be the central point of contact for maintenance calls to all suppliers.

    Sample equipment maintenance policy terms:

    • Maintenance and support arrangements are required for all standard and non-standard hardware.
    • All onsite hardware should be covered by onsite warranty agreements with appropriate response times to meet business continuity needs.
    • Defective items under warranty should be repaired in a timely fashion.
    • Service, maintenance, and support shall be managed through the help desk ticketing system.

    Design process and policies for hardware maintenance, warranty, and support documentation handling

    3.1.3 Design process for hardware maintenance

    Participants

    • Asset Manager
    • Purchasing
    • Service Desk Manager
    • Security
    • Operations (optional)

    Document

    Document in the Standard Operating Procedures, Section 10

    1. Discuss and document the policy for hardware maintenance, warranty, and support.
    2. Key outcomes should include:
    • Who signs off on policies?
    • What is the timeline for documentation review?
    • Where are warranty and maintenance documents stored?
    • How will equipment be assessed for condition during audits?
    • How often will deployed equipment be reimaged?
    • How will equipment repair needs be requested?
    • How will repairs for equipment outside warranty be handled?
  • Document in the Standard Operating Procedure.
  • Use your HAM program to improve security and meet regulatory requirements

    ITAM complements and strengthens security tools and processes, improving the company’s ability to protect its data and systems and reduce operational risk.

    It’s estimated that businesses worldwide lose more than $221 billion per year as a result of security breaches. HAM is one important factor in securing data, equipment investment, and meeting certain regulatory requirements.

    How does HAM help keep your organization secure?

    • Educating users on best practices for securing their devices, and providing physical security such as cable locks and tracking mechanisms.
    • Best practices for reporting lost or stolen equipment for quickly removing access and remotely wiping devices.
    • Accurate location and disposal records will enable accurate reporting for HIPAA and PCI DSS audits where movement of media or hardware containing data is a requirement. Best practices for disposal will include properly wiping drives, recording information, and ensuring equipment is disposed of according to environmental regulations.
    • Secure access to data through end-user mobile devices. Use accurate records and MDM tools to securely track, remove access, and wipe mobile devices if compromised.
    • Encrypt devices that may be difficult to track such as USB drives or secure ports to prevent data from being copied to external drives.
    • Managed hardware allows software to be managed and patched on a regular basis.

    Best Practices

    1. Educate end users about traveling with equipment. Phones and laptops are regularly stolen from cars; tablets and phones are left on planes. Encourage users to consider how they store equipment on the way home from work.
    2. Cable locks used at unsecured offsite or onsite work areas should be supplied to employees.
    3. Equipment stored in IT must be secured at all times.

    Implement mobile device management (MDM) solutions

    Organizations with a formal mobile management strategy have fewer problems with their mobile devices.

    Develop a secure MDM to:

    • Provide connection and device support when the device is fully subsidized by the organization to increase device control.
    • Have loaner devices for when traveling to limit device theft or data loss.
    • Personal devices not managed by MDM should be limited to internet access on a guest network.
    • Limit personal device access to only internet access or a limited zone for data access and a subset of applications.
    • Advanced MDM platforms provide additional capabilities including containerization.

    The benefits of a deployed MDM solution:

    • Central management of a variety of devices and platforms is the most important advantage of MDM. Administrators can gain visibility into device status and health, set policies to groups of users, and control who has access to what.
    • Security features such as enforcing passcodes and remote wipe are also essential, given the increased risk of mobile devices.
      • Remote wipe should be able to wipe either the whole device or just selected areas.
    • Separation of personal data is becoming increasingly important as BYOD becomes the norm. This is a feature that vendors are approaching radically differently.
    • Device lock: Be able to lock the device itself, its container, or its SIM. Even if the SIM is replaced, the device should still remain locked. Consider remote locking a device if retrieval is possible.

    Mobile device management is constantly evolving to incorporate new features and expand to new control areas. This is a high-growth area that warrants constant up-to-date knowledge on the latest developments.

    What can be packed into an MDM can vary and be customized in many forms for what your organization needs.

    Secure endpoint devices to protect the data you cannot control

    Endpoint Encryption

    Endpoints Average None
    Desktop 73% 4%
    Laptops 65% 9%
    Smartphones 27% 28%
    Netbooks 26% 48%
    Tablets 16% 59%
    Grand average 41%

    Benefits from endpoint encryption:

    • Reduced risk associated with mobile workers.
    • Enabled sharing of data in secured workspace.
    • Enhanced end-user accountability.
    • Reduced number of data breach incidents.
    • Reduced number of regulatory violations.

    Ways to reduce endpoint encryption costs:

    • Use multiple vendors (multiple platforms): 33%
    • Use a single vendor (one platform): 40%
    • Use a single management console: 22%
    • Outsource to managed service provider: 26%
    • Permit user self-recovery: 26%

    Remote Wiping

    • If all else fails, a device can always be erased of all its data, protecting sensitive data that may have been on it.
    • Selective wipe takes it a step further by erasing only sensitive data.

    Selective wipe is not perfect.

    It is nearly impossible to keep the types of data separate, even with a sandbox approach. Selective wipe will miss some corporate data, and even a full remote wipe can only catch some of users’ increasingly widely distributed data.

    Selective wipe can erase:

    • Corporate profiles, email, and network settings.
    • Data within a corporate container or other sandbox.
    • Apps deployed across the enterprise.

    Know when to perform a remote wipe.

    Not every violation of policy warrants a wipe. Playing Candy Crush during work hours probably does not warrant a wipe, but jail breaking or removing a master data management client can open up security holes that do warrant a wipe.

    Design an effective asset security policy to protect the business

    Data security is not simply restricted to compromised software. In fact, 70% of all data breaches in the healthcare industry since 2010 are due to device theft or loss, not hacking. (California Data Breach Report – October, 2014) ITAM is not just about tracking a device, it is also about tracking the data on the device.

    Organizations often struggle with the following with respect to IT asset security:

    • IT hardware asset removal control.
    • Personal IT hardware assets (BYOD).
    • Data removal from IT hardware assets.
    • Inventory control with respect to leased hardware and software.
    • Unused software.
    • Repetitive versions of software.
    • Unauthorized software.

    Your security policy should seek to protect IT hardware and software that:

    • Have value to the business.
    • Require ongoing maintenance and support.
    • Create potential risk in terms of financial loss, data loss, or exposure.

    These assets should be documented and controlled in order to meet security requirements.

    The asset security policy should encompass the following:

    • Involved parties.
    • Hardware removal policy/documentation procedure.
    • End-user asset security responsibilities.
    • Theft/loss reporting procedure.
    • BYOD standards, procedures, and documentation requirements.
    • Data removal.
    • Software usage.
    • Software installation.

    Info-Tech Insight

    Hardware can be pricey; data is priceless. The cost of losing a device is minimal compared to the cost of losing data contained on a device.

    Revise or create an asset security policy

    3.1.4 Develop IT asset security policy

    Participants

    • CIO or IT Director
    • Asset Manager
    • Service Desk Manager
    • Security
    • Operations (optional)

    Document

    Document in the Asset Security Policy.

    1. Identify asset security challenges within your organization. Record them in a table like the one below.
    Challenge Current Security Risk Target Policy
    Hardware removal Secure access and storage, data loss Designated and secure storage area
    BYOD No BYOD policy in place N/A → phasing out BYOD as an option
    Hardware data removal Secure data disposal Data disposal, disposal vendor
    Unused software Lack of support/patching makes software vulnerable Discovery and retirement of unused software
    Unauthorized software Harder to track, less secure Stricter stance on pirated software
    1. Brainstorm the reasons for why these challenges exist.
    2. Identify target policy details that pertain to each challenge. Record the outcomes in section(s) 5.1, 5.2, or 5.3 of the Asset Security Policy.

    Poor asset security and data protection had costly consequences for UK Ministry of Justice

    CASE STUDY

    Industry Legal

    Source ICO

    Challenge

    The Ministry of Justice (MoJ) in the UK had a security problem: hard drives that contained sensitive prisoner data were unencrypted and largely unprotected for theft.

    These hard drives contained information related to health, history of drug use, and past links to organized crime.

    After two separate incidents of hard drive theft that resulted in data breaches, the Information Commissioner’s Office (ICO), stepped in.

    Solution

    It was determined that after the first hard drive theft in October 2011, replacement hard drives with encryption software were provisioned to prisons managed by the MoJ.

    Unfortunately, the IT security personnel employed by the MoJ were unaware that the encryption software required manual activation.

    When the second hard drive theft occurred, the digital encryption could not act as a backup to poor physical security (the hard drive was not secured in a locker as per protocol).

    Results

    The perpetrators were never found and the stolen hard drives were never recovered.

    As a result of the two data breaches, the MoJ had to implement costly security upgrades to its data protection system.

    The ICO fined the MoJ £180,000 for its repeated security breaches. This costly fine could have been avoided if more diligence was present in the MoJ’s asset management program.

    Step 3.2: Dispose or Redeploy Assets

    3.1 Manage & Maintain

    3.2 Dispose or Redeploy

    This step will walk you through the following activities:

    3.2.1 Identify challenges with IT asset recovery and disposal

    3.2.2 Design hardware asset recovery and disposal workflows

    3.2.3 Build a hardware asset disposition policy

    This step involves the following participants:

    • Infrastructure Director/Manager
    • Asset Manager
    • Service Desk Manager
    • Operations (optional)

    Step Outcomes:

    • Defined process to determine when to redeploy vs. dispose of hardware assets
    • Process for recovering and redeploying hardware equipment
    • Process for safely disposing of assets that cannot be redeployed
    • Comprehensive asset disposition policy

    Balance the effort to roll out new equipment against the cost to maintain equipment when building your lifecycle strategy

    The image shows two line graphs. The graph on the left is titled: Desktop Refresh Rate by Company Size (based on Revenue). The graph on the right is titled: Laptop Refresh Rate by Company Size (based on Revenue). Each graph has four lines, defined by a legend in the centre of the image: yellow is small ($25mm); dark blue is Mid ($25-500MM); light blue is large ( data-verified=$500MM); and orange is Overall.">

    (Info-Tech Research Group; N=96)

    Determining the optimal length of time to continue to use equipment will depend on use case and equipment type

    Budget profiles Refresh methods

    Stretched

    Average equipment age: 7+ years

    To save money, some organizations will take a cascading approach, using the most powerful machines for engineers or scientists to ensure processing power, video requirements and drives will meet the needs of their applications and storage needs; then passing systems down to departments who will require standard-use machines. The oldest and least powerful machines are either used as terminals or disposed.

    Generous

    Average equipment age: 3 years

    Organizations that do not want to risk user dissatisfaction or potential compatibility or reliability issues will take a more aggressive replacement approach. These organizations often have less people assigned to end-user device maintenance and will not repair equipment outside of warranty. There is little variation in processing power among devices, with major differences determined by mobility and operating system.

    Cautious

    Average equipment age: 4 to 5 years

    Organizations that fit between the other two profiles will look to stretch the budget beyond warranty years, but will keep a close eye on maintenance requirements. Repairs needed outside of warranty will require an eye to costs, efforts, and subsequent administrative work of loaning equipment to keep the end user productive while waiting on service.

    Recommendations to keep users happy and equipment in prime form is to check condition at the 2-3 year mark, reimage at least once to improve performance, and have backup machines, if equipment starts to become problematic.

    Build a process to determine when and how to redeploy or dispose of hardware assets at end of use

    • When equipment is no longer needed for the function or individual to whom it was assigned, the Hardware Asset Manager needs to use data to ensure the right decision is made as to what to do with the asset.
    • End of use involves evaluating options for either continuing to use the equipment in another capacity or by another individual or determining that the asset has no remaining value to the organization in any capacity and it is time to retire it.
    • If the asset is retired, it may still have capacity for continued use outside of the organization or it may be disposed.

    Redeployment

    • Deliver the asset to a new user if it is no longer needed by the original user but still has value and usability.
    • Redeployment saves money and prevents unnecessary purchases.
    • Common when employees leave the company or a merge or acquisition changes the asset pool.

    VS.

    Disposal

    • When an asset is no longer of use to the organization, it may be disposed of.
    • Need to consider potential financial and public relations considerations if disposal is not done according to environmental legislation.
    • Need to ensure proper documentation and data removal is built into disposition policy.

    Use persistent documentation and communication to improve hardware disposal and recovery

    Warning! Poor hardware disposal and recovery practices can be caused by the following:

    1. Your IT team is too busy and stretched thin. Data disposal is one of many services your IT team is likely to have to deal with, but this service requires undivided attention. By standardizing hardware refreshes, you can instill more predictability with your hardware life cycles and better manage disposal.
    2. Poor inventory management. Outdated data and poor tracking practices can result in lost assets during the disposal phase. It only takes a single lost asset to cause a disastrous data breach in your supply chain.
    3. Obliviousness to disposal regulations. Electronic disposal and electronically stored data are governed by strict regulation.

    How do you improve your hardware disposal and recovery process?

    • A specific, controlled process needs to be in place to wipe all equipment and verify that it’s been wiped properly. Otherwise, companies will continue to spend money to protect data while equipment is in use, but overlook the dangerous implications of careless IT asset disposal. Create a detailed documentation process to track your assets every step of the way to ensure that data and applications are properly disposed of. Detailed documentation can also help bolster sustainability reporting for organizations wishing to track such data.
    • Better communication should be required. Most decommissioning or refresh processes use multiple partners for manufacturing, warehousing, data destruction, product resale, and logistics. Setting up and vetting these networks can take years, and even then, managing them can be like playing a game of telephone; transparency is key.

    Address three core challenges of asset disposal and recovery

    Asset Disposal

    Data Security

    Sixty-five percent of organizations cite data security as their top concern. Many data breaches are a result of hardware theft or poor data destruction practices.

    Choosing a reputable IT disposal company or data removal software is crucial to ensuring data security with asset disposal.

    Environmental

    Electronics contain harmful heavy metals such as mercury, arsenic, and cadmium.

    Disposal of e-waste is heavily regulated, and improper disposal can result in hefty fines and bad publicity for organizations.

    Residual value

    Many obsolete IT assets are simply confined to storage at their end of life.

    This often imposes additional costs with maintenance or storage fees and leaves a lot of value on the table through assets that could be sold or re-purposed within the organization.

    Identify challenges with IT asset recovery and disposal with a triple bottom line scorecard

    3.2.1 Identify challenges with IT asset recovery and disposal

    Participants

    • Infrastructure Director/Manager
    • Asset Manager
    • Service Desk Manager
    • Operations (optional)
    1. Divide the whiteboard into three boxes: Social, Economic, and Environmental.
    2. Divide each box into columns like the one shown below:
    Economic
    Challenge Objectives Targets Initiatives
    No data capture during disposal Develop reporting standards 80% disposed assets recorded Work with Finance to develop reporting procedure
    Idle assets Find resale market/dispose of idle assets 50% of idle assets disposed of within the year Locate resale vendor and disposal service
    1. Ask participants to list challenges associated with each area.
    2. Once challenges facing recovery and disposal have been exhausted from the group, assign a significance of 1-5 (1 being the lowest and 5 being the highest) to each challenge.
    3. Discuss the most significant challenges and how they might be addressed through the next steps of building recovery & disposal processes.

    Build a process for recovery and redeployment of hardware

    • Having hardware standards in place makes redeploying easier by creating a larger pool of possible users for a standardized asset.
    • Most redeployment activities will be carried out by the Help Desk as a service request ticket, so it is important to have clear communication and guidelines with the Help Desk as to which tasks need to be carried out as part of the request.

    Ensure the following are addressed:

    • Where will equipment be stored before being redeployed?
    • Will shipping be required and are shipping costs factored into analysis?
    • Ensure equipment is cleaned before it is redeployed.
    • Do repairs and reconfigurations need to be made?
    • How will software be removed and licenses harvested and reported to Software Asset Manager?
    • How will data be securely wiped and protected?

    The image shows a work process in flowchart format titled Equipment Recovery. The chart is divided into two sections, listed on the left: Business Manager/HR and Desktop Support Team.

    Define the process for safely disposing of assets that cannot be redeployed

    Asset Disposal Checklist

    1. Review the data stored on the device.
    2. Determine if there has been any sensitive or confidential information stored.
    3. Remove all sensitive/confidential information.
    4. Determine if software licenses are transferable.
    5. Remove any non- transferable software prior to reassignment.
    6. Update the department’s inventory record to indicate new individual assigned custody.
    7. In the event of a transfer to another department, remove data and licensed software.
    8. If sensitive data has been stored, physically destroy the storage device.
    • Define the process for retiring and disposing of equipment that has reached replacement age or no longer meets minimum conditions or standards.
    • Clearly define the steps that need to be taken both before and after the involvement of an ITAD partner.

    The image shows a flowchart titled Equipment Disposal. It is divided into two sections, labelled on the left as: Desktop Support Team and Asset Manager.

    Design hardware asset recovery and disposal workflows

    3.2.2 Design hardware asset recovery and disposal policies and workflows

    Participants

    • Infrastructure Director/Manager
    • Asset Manager
    • Service Desk Manager
    • Operations (optional)

    Document

    Document in the Standard Operating Procedures, Sections 11 and 12

    Document each step in the recovery and disposal process in two separate workflows using notecards or on a whiteboard. Identify the challenges faced by your organization and strategize potential solutions.

    1. Keeping in mind current challenges around hardware asset recovery and disposal, design the target state for both the asset recovery and disposal processes.
    2. Outline each step of the process and be as granular as possible.
    3. When you are satisfied that each step is accurately captured, use a second color of notecard to document any challenges, inefficiencies, or pains associated with each step. Consider further documenting the time on each task.
    4. Examine each challenge or pain point. Discuss whether or not there is a clear solution to the problem. If so, document the solution and amend the workflow. If not, engage in a broader discussion of possible solutions, taking into account people, processes, and available technology.
    5. Review the checklists on the previous slides to ensure all critical tasks are accounted for in your process workflows.

    Add equipment disposition to asset lifecycle decisions to meet environmental regulations and mitigate risk

    Although traditionally an afterthought in asset management, IT asset disposition (ITAD) needs to be front and center. Increase focus on data security and concern surrounding environmental sustainability and develop an awareness of the cost efficiencies possible through best-practices disposition.

    Optimized ITAD solutions:

    1. Protect sensitive or valuable data
    2. Support sustainability
    3. Focus on asset value recovery

    Info-Tech Insight

    A well-thought-out asset management program mitigates risk and is typically less costly than dealing with a large-scale data loss incident or an inappropriate disposal suit. Also, it protects your company’s reputation – which is difficult to put a price on.

    Partner with an ITAD vendor to support your disposition strategy

    Maximizing returns on assets requires knowledge and skills in asset valuation, upgrading to optimize market return, supply chain management, and packaging and shipping. It’s unlikely that the return will be adequate to justify that level of investment, so partnering with a full-service ITAD vendor is a no-brainer.

    • An ITAD vendor knows the repurpose and resale space better than your organization. They know the industry and have access to more potential buyers.
    • ITAD vendors can help your organization navigate costly environmental regulations for improper disposal of IT assets.

    Disposal doesn’t mean your equipment has to go to waste.

    Additionally, your ITAD vendor can assist with a large donation of hardware to a charitable organization or a school.

    Donating equipment to schools or non-profits may provide charitable receipts that can be used as taxable benefits.

    Before donating:

    • Ensure equipment is needed and useful to the organization.
    • Be prepared for an appraisal requirement. Receipts can only be issued for fair market value.
    • Prevent compromised data by thoroughly wiping or completely replacing drives.
    • Ensure official transfer of ownership to prevent liability if improper disposal practices follow.

    Info-Tech Insight

    Government assistance grants may be available to help keep your organization’s hardware up to date, thereby providing incentives to upgrade equipment while older equipment still has a useful life.

    Protect the organization by sufficiently researching potential ITAD partners

    Research ITAD vendors as diligently as you would primary hardware vendors.

    Failure to thoroughly investigate a vendor could result in a massive data breach, fines for disposal standards violations, or a poor resale price for your disposed assets. Evaluate vendors using questions such as the following:

    • Are you a full-service vendor or are you connected to a wholesaler?
    • Who are your collectors and processors?
    • How do you handle data wiping? If you erase the data, how many passes do you perform?
    • What do you do with the e-waste? How much is reused? How much is recycled?
    • Do you have errors and omissions insurance in case data is compromised?
    • How much will it cost to recycle or dispose of worthless equipment?
    • How much will I receive for assets that still have useful life?

    ITAD vendors that focus on recycling will bundle assets to ship to an e-waste plant – leaving money on the table.

    ITAD vendors with a focus on reuse will individually package salable assets for resale – which will yield top dollars.

    Info-Tech Insight

    To judge the success of a HAM overhaul, you need to establish a baseline with which to compare final results. Be sure to take HAM “snapshots” before ITAD partnering so it’s easy to illustrate the savings later.

    Work with ITAD partner or equipment supplier to determine most cost-effective method and appropriate time for disposal

    2-4 Two-to-four year hardware refresh cycle

    • Consider selling equipment to an ITAD partner who specializes in sales of refurbished equipment.
    • Consider donating equipment to schools or non-profits, possibly using an ITAD partner who specializes in refurbishing equipment and managing the donation process.

    5-7 Five-to-seven year hardware refresh cycle

    • At this stage equipment may still have a viable life, but would not be appropriate for school or non-profit donations, due to a potentially shorter lifespan. Consider selling equipment to an ITAD partner who has customers interested in older, refurbished equipment.

    7+ Seven or more years hardware refresh cycle

    • If keeping computers until they reach end of life, harvest parts for replacement on existing machines and budget for disposal fees.
    • Ask new computer supplier about disposal services or seek out ITAD partner who will disassemble and dispose of equipment in an environmentally responsible manner.

    Info-Tech Insight

    • In all cases, ensure hard drives are cleansed of data with no option for data recovery. Many ITAD partners will provide a drive erasure at DoD levels as part of their disposal service.
    • Many ITAD partners will provide analysts to help determine the most advantageous time to refresh.

    Ensure data security and compliance by engaging in reliable data wiping before disposition

    Failure to properly dispose of data can not only result in costly data breaches, but also fines and other regulatory repercussions. Choosing an ITAD vendor or a vendor that specializes in data erasure is crucial. Depending on your needs, there are a variety of data wiping methods available.

    Certified data erasure is the only method that leaves the asset’s hard drive intact for resale or donation. Three swipes is the bare minimum, but seven is recommended for more sensitive data (and required by the US Department of Defense). Data erasure applications may be destructive or non-destructive – both methods overwrite data to make it irretrievable.

    Physical destruction must be done thoroughly, and rigorous testing must be done to verify data irretrievability. Methods such as hand drilling are proven to be unreliable.

    Degaussing uses high-powered magnets to erase hard drives and makes them unusable. This is the most expensive option; degaussing devices can be purchased or rented.

    Info-Tech Best Practice

    Data wiping can be done onsite or can be contracted to an ITAD partner. Using an ITAD partner can ensure greater security at a more affordable price.

    Make data security a primary driver of asset disposition practices

    It is estimated that 10-15% of data loss cases result from insecure asset disposal. Protect yourself by following some simple disposition rules.

    1. Reconcile your data onsite
    • Verify that bills of landing and inventory records match before assets leave. Otherwise, you must take the receiver’s word on shipment contents.
  • Wipe data at least once onsite
    • Do at least one in-house data wipe before the assets leave the site for greater data security.
  • Transport promptly after data wiping
    • Prompt shipment will minimize involvement with the assets, and therefore, cost. Also, the chance of missing assets will drop dramatically.
  • Avoid third-party transport services
    • Reputable ITAD companies maintain strict chain of custody control over assets. Using a third party introduces unnecessary risk.
  • Keep detailed disposition records
    • Records will protect you in the event of an audit, a data loss incident, or an environmental degradation claim. They could save you millions.
  • Wipe all data-carrying items
    • Don’t forget cell phones, fax machines, USB drives, scanners, and printers – they can carry sensitive information that can put the organization at risk.
  • Only partner with insured ITAD vendors
    • You are never completely out of danger with regards to liability, but partnering with an insured vendor is potent risk mitigation.
  • Work these rules into your disposition policy to mitigate data loss risk.

    Support your HAM efforts with a comprehensive disposition policy

    3.2.3 Build a Hardware Asset Disposition Policy

    Implementation of a HAM program is a waste of time if you aren’t going to maintain it. Maintenance requires the implementation of detailed policies, training, and an ongoing commitment to proper management.

    Use Info-Tech’s Hardware Asset Disposition Policy to:

    1. Establish and define clear standards, procedures, and restrictions surrounding disposition.
    2. Ensure continual compliance with applicable data security and environmental legislation.
    3. Assign specific responsibilities to individuals or groups to ensure ongoing adherence to policy standards and that costs or benefits are in line with expectations.

    Phase 3 Guided Implementation

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 3: Maintain & Dispose

    Proposed Time to Completion: 4 weeks

    Start with an analyst kick-off call:

    • Discuss inventory management best practices.
    • Build process for moves, adds, and changes.
    • Build process for hardware maintenance.
    • Define policies for maintaining asset security.

    Then complete these activities…

    • Build a MAC policy and request form.
    • Build workflows to document user MAC processes.
    • Design processes and policies for hardware maintenance, warranty, and support documentation handling.
    • Build an asset security policy.

    With these tools & templates:

    • Standard Operating Procedures
    • Asset Security Policy

    Step 3.2: Dispose or Redeploy Assets

    Review findings with analyst:

    • Discuss when to dispose vs. redeploy assets.
    • Build process for redeploying vs. disposing of assets.
    • Review ITAD vendors.

    Then complete these activities…

    • Identify challenges with IT asset recovery and disposal.
    • Design hardware asset recovery and disposal workflows.
    • Build a hardware asset disposition policy.

    With these tools & templates:

    • Standard Operating Procedures
    • Asset Recovery Workflow
    • Asset Disposal Workflow
    • Hardware Asset Disposition Policy

    Phase 3 Insight: Not all assets are created equal. Taking a blanket approach to asset maintenance and security is time consuming and costly. Focus on the high-cost, high-use, and data-sensitive assets first.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    3.1.4 Revise or create an asset security policy

    Discuss asset security challenges within the organization; brainstorm reasons the challenges exist and process changes to address them. Document a new asset security policy.

    3.2.2 Design hardware asset recovery and disposal workflows

    Document each step in the hardware asset recovery and disposal process, including all decision points. Examine challenges and amend the workflow to address them.

    Phase 4

    Plan Budget Process and Build Roadmap

    Implement Hardware Asset Management

    Cisco deployed an enterprise-wide re-education program to implement asset management

    CASE STUDY

    Industry Networking

    Source Cisco IT

    Challenge

    Even though Cisco Systems had designed a comprehensive asset management program, implementing it across the enterprise was another story.

    An effective solution, complete with a process that could be adopted by everyone within the organization, would require extensive internal promotion of cost savings, efficiencies, and other benefits to the enterprise and end users.

    Cisco’s asset management problem was as much a cultural challenge as it was a process challenge.

    Solution

    The ITAM team at Cisco began discussions with departments that had been tracking and managing their own assets.

    These sessions were used as an educational tool, but also as opportunities to gather internal best practices to deploy across the enterprise.

    Eventually, Cisco introduced weekly meetings with global representation to encourage company-wide communication and collaboration.

    Results

    By establishing a process for managing PC assets, we have cut our hardware costs in half.” – Mark Edmonson, Manager – IT Services Expenses

    Cisco reports that although change was difficult to adopt, end-user satisfaction has never been higher. The centralized asset management approach has resulted in better contract negotiations through better data access.

    A reduced number of hardware and software platforms has streamlined tracking and support, and will only drive down costs as time goes on.

    Step 4.1: Plan Hardware Asset Budget

    Phase 4: Plan Budget & Build Roadmap

    4.1 Plan Budget

    4.2 Communicate & Build Roadmap

    This step will walk you through the following activities:

    4.1 Use Info-Tech’s HAM Budgeting Tool to plan your hardware asset budget

    This step involves the following participants:

    • IT Director
    • Asset Manager
    • Finance Department

    Step Outcomes

    • Know where to find data to budget for hardware needs accurately
    • Learn how to manage a hardware budget
    • Plan hardware asset budget with a budgeting tool

    Gain control of the budget to increase the success of HAM

    A sophisticated hardware asset management program will be able to uncover hidden costs, identify targets for downsizing, save money through redistributing equipment, and improve forecasting of equipment to help control IT spending.

    While some asset managers may not have experience managing budgets, there are several advantages to ITAM owning the hardware budget:

    • Be more involved in negotiating pricing with suppliers.
    • Build better relationships with stakeholders across the business.
    • Forecast requirements more accurately.
    • Inform benchmarks for hardware performance.
    • Gain more responsibility and have a greater influence on purchasing decisions.
    • Directly impact the reduction in IT spend.
    • Manage the asset database more easily and have a greater understanding of hardware needs.
    • Build a continuous rolling refresh.

    Use ITAM data to forecast hardware needs accurately and realistically

    Your IT budget should be realistic, accounting for business needs, routine maintenance, hardware replacement costs, unexpected equipment failures, and associated support and warranty costs. Know where to find the data you need and who to work with to forecast hardware needs as accurately as possible.

    What type of data should I take into account?

    Plan for:

    • New hardware purchases required
      • Planned refreshes based on equipment lifecycle
      • Inventory for break and fix
      • Standard equipment for new hires
      • Non-standard equipment required
      • Hardware for planned projects
      • Implementation and setup costs
      • Routine hardware implementation
      • Large hardware implementation for projects
      • Support and warranty costs

    Take into account:

    • Standard refresh cycle for each hardware asset
    • Amount of inventory to keep on hand
    • Length of time from procurement to inventory
    • Current equipment costs and equipment price increases
    • Equipment depreciation rates and resale profits

    Where do I find the information I need to budget accurately?

    • Work with HR to forecast equipment needs for new hires.
    • Work with the Infrastructure Manager to forecast devices and equipment needed for approved and planned projects.
    • Use the asset management database to forecast hardware refresh and replacement needs based on age and lifecycle.
    • Work with business stakeholders to ensure all new equipment needs are accounted for in the budget.

    Use Info-Tech’s HAM Budgeting Tool to plan your hardware asset budget

    4.1.1 Build HAM budget

    This tool is designed to assist in developing and justifying the budget for hardware assets for the upcoming year. The tool will allow you to budget for projects requiring hardware asset purchases as well as equipment requiring refresh and to adjust the budget as needed to accommodate both projects and refreshes. Follow the instructions on each tab to complete the tool.

    The hardware budget should serve as a planning and communications tool for the organization

    The most successful relationships have a common vocabulary. Thus, it is important to translate “tech speak” into everyday language and business goals and initiatives as you plan your budget.

    One of the biggest barriers that infrastructure and operations team face with regards to equipment budgeting is the lack of understanding of IT infrastructure and how it impacts the rest of the organization. The biggest challenge is to help the rest of the organization overcome this barrier.

    There are several things you can do to overcome this barrier:

    • Avoid using technical terms or jargon. Terms many would consider common knowledge, such as “WLAN,” are foreign to many.
    • Don’t assume the business knows how the technology you’re referring to will impact their day-to-day work. You will need to demonstrate it to them.
    • Help the audience understand the business impact of not implementing each initiative. What does this mean for them?
    • Discuss the options on the table in terms of the business value that the hardware can enable. Review how deferring refresh projects can impact user-facing applications, systems, and business unit operations.
    • Present options. If you can’t implement everything on the project list, present what you can do at different levels of funding.

    Info-Tech Insight

    Err on the side of inviting more discussion. Your budgeting process relies on business decision makers and receiving actionable feedback requires an ongoing exchange of information.

    Help users understand the importance of regular infrastructure refreshes

    Getting business users to support regular investments in maintenance relies on understanding and trust. Present the facts in plain language. Provide options, and clearly state the impact of each option.

    Example: Your storage environment is nearing capacity.

    Don’t:

    Explain the project exclusively in technical terms or slang.

    We’re exploring deduping technology as well as cheap solid state, SATA, and tape storage to address capacity.”

    Do:

    • Explain impact in terms that the business can understand.

    Deduplication technology can reduce our storage needs by up to 50%, allowing us to defer a new storage purchase.”

    • Be ready to present project alternatives and impacts.

    Without implementing deduplication technology, we will need to purchase additional storage by the end of the year at an estimated cost of $25,000.”

    • Connect the project to business initiatives and strategic priorities.

    This is a cost-effective technique to increase storage capacity to manage annual average data growth at around 20% per year.

    Step 4.2: Build Communication Plan and Roadmap

    Phase 4: Plan Budget & Build Roadmap

    4.1 Plan Budget

    4.2 Communicate & Build Roadmap

    This step will walk you through the following activities:

    4.2 Develop a HAM implementation roadmap

    This step involves the following participants:

    • CIO
    • IT Director
    • Asset Manager
    • Service Desk Manager

    Step Outcomes

    • Documented end-user hardware asset management policies
    • Communications plan to achieve support from end users and other business units
    • HAM implementation roadmap

    Educate end users through ITAM training to increase program success

    As part of your communication plan and overall HAM implementation, training should be provided to end users within the organization.

    All facets of the business, from management to new hires, should be provided with ITAM training to help them understand their role in the project’s success.

    ITAM solutions are complex by nature with both business process and technical knowledge required to use them correctly. Keep the message appropriate to the audience – end users don’t need to know the complete process, but will need to know policy and how to request.

    Management may have priorities that appear to clash with new processes. Engage management by making them aware of the benefits and importance of ITAM. Include the benefits and consequences of not implementing ITAM in your education approach. Encourage them to support efforts by reinforcing your messages to end users.

    New hires should have ITAM training bundled into their onboarding process. Fresh minds are easier to train and the ITAM program will be seen as an organizational standard, not merely a change.

    Policy documents can help summarize end users’ obligations and clarify processes. Consider an IT Resources Acceptable UsePolicy.

    "The lowest user is the most important user in your asset management program. New employees are your most important resource. The life cycle of the assets will go much smoother if new employees are brought on board." – Tyrell Hall, ITAM Program Coordinator

    Info-Tech Insight

    During training, you should present the material through the lens of “what’s in it for me?” Otherwise, you risk alienating end users through implementing organizational change viewed as low value.

    Include policy design and enforcement in your communication plan

    • Hardware asset management policies should define the actions to be taken to protect and preserve technology assets from failure, loss, destruction, theft, or damage.
    • Implementing asset management policies enforces the notion that the organization takes its IT assets and the management of them seriously, and will help ensure the benefits of ITAM are achieved.
    • Designing, approving, documenting, and adopting one set of standard ITAM policies for each department to follow will ensure the processes are enforced equally across the organization.
    • Good ITAM policies answer the “what, how, and why” of IT asset management, provide the means for ITAM governance, and provide a basis for strategy and decision making.

    Info-Tech Insight

    Use policy templates to jumpstart your policy development and ensure policies are comprehensive, but be sure to modify and adapt policies to suit your corporate culture or they will not gain buy-in from employees. For a policy to be successful, it must be a living document and have participation and involvement from the committees and departments to whom it will pertain.

    Use Info-Tech’s policy templates to build HAM policies

    4.2.1 Build HAM policies

    Use these HAM policy templates to get started:

    Information Technology Standards Policy

    This policy establishes standards and guidelines for a company’s information technology environment to ensure the confidentiality, integrity, and availability of company computing resources.

    Desktop Move/Add/Change Policy

    This desktop move/add/change policy is put in place for users to request to change their desktop computing environments. This policy applies configuration changes within a company.

    Purchasing Policy

    The purchasing policy helps to establish company standards, guidelines, and procedures for the purchase of all information technology hardware, software, and computer-related components as well as the purchase of all technical services.

    Hardware Asset Disposition Policy

    This policy assists in creating guidelines around disposition in the last stage of the asset lifecycle.

    Additional policy templates

    Info-Tech Insight

    Use policy templates to jumpstart your policy development and ensure policies are comprehensive, but modify and adapt them to suit your corporate culture or they will not gain buy-in from employees. For a policy to be successful, it must be a living document and have participation from the committees and departments to whom it will pertain.

    Create a communication plan to achieve end-user support and adherence to policies

    Communication is crucial to the integration and overall implementation of your ITAM program. An effective communication plan will:

    • Gain support from management at the project proposal phase.
    • Create end-user buy-in once the program is set to launch.
    • Maintain the presence of the program throughout the business.
    • Instill ownership throughout the business from top-level management to new hires.

    Use the variety of components as part of your communication plan in order to reach the organization.

    1. Advertise successes.
    • Regularly demonstrate the value of the ITAM program with descriptive statistics focused on key financial benefits.
    • Share data with the appropriate personnel; promote success to obtain further support from senior management.
  • Report and share asset data.
    • Sharing detailed asset-related reports frequently gives decision makers useful data to aid in their strategy.
    • These reports can help your organization prepare for audits, adjust asset budgeting, and detect unauthorized assets.
  • Communicate the value of ITAM.
    • Educate management and end users about how they fit into the bigger picture.
    • Individuals need to know that their behaviors can adversely affect data quality and, ultimately, lead to better decision making.
  • Develop a communication plan to convey the right messages

    4.2.2 Develop a communication plan to convey the right messages

    Participants

    • CIO
    • IT Director
    • Asset Manager
    • Service Desk Manager

    Document

    Document in the HAM Communication Plan

    1. Identify the groups that will be affected by the HAM program as those who will require communication.
    2. For each group requiring a communication plan, identify the following:
    • Benefits of HAM for that group of individuals (e.g. better data, security).
    • The impact the change will have on them (e.g. change in the way a certain process will work).
    • Communication method (i.e. how you will communicate).
    • Timeframe (i.e. when and how often you will communicate the changes).
  • Complete this information in a table like the one below and document in the Communication Plan.
  • Group Benefits Impact Method Timeline
    Service Desk Improve end-user device support Follow new processes Email campaign 3 months
    Executives Mitigate risks, better security, more data for reporting Review and sign off on policies
    End Users Smoother request process Adhere to device security and use policies
    Infrastructure Faster access to data and one source of truth Modified processes for centralized procurement and inventory

    Implement ITAM in a phased, constructive approach

    • One of the most difficult decisions to make when implementing ITAM is: “where do we start?”
    • The pyramid to the right mirrors Maslow’s hierarchy of needs. The base is the absolute bare minimum that should be in place, and each level builds upon the previous one.
    • As you track up the pyramid, your ITAM program will become more and more mature.

    Now that your asset lifecycle environment has been constructed in full, it’s time to study it. Gather data about your assets and use the results to create reports and new solutions to continually improve the business.

    • Asset Data
    • Asset Protection: safely protect and dispose of assets once they are mass distributed throughout your organization.
    • Asset Distribution: determine standards for asset provisioning and asset inventory strategy.
    • Asset Gathering: define what assets you will procure, distribute, and track. Classifying your assets by tier will allow you to make decisions as you progress up the pyramid.

    ↑ ITAM Program Maturity

    Integrate your HAM program into the organization to assist its implementation

    The HAM program cannot perform on its own – it must be integrated with other functional areas of the organization in order to maintain its stability and support.

    • Effective IT asset management is supported by a comprehensive set of processes as part of its implementation.
    • For example, integration with the purchasing/procurement team is required to gather hardware and software purchase data to control asset costs and mitigate software license compliance risk.
    • Integration with Finance is required to support internal cost allocations and charge backs.

    To integrate your ITAM program into your organization effectively, a clear implementation roadmap needs to be designed. Prioritize “quick wins” in order to demonstrate success to the business early and gain buy-in from your team. Long-term goals should be designed that will be supported by the outcomes of the short-term gains of your ITAM program.

    Short-term goal Long-term goal
    Identify inventory classification and tool (hardware first) Hardware contract data integration (warranty, maintenance, lease)
    Create basic ITAM policies and processes Continual improvement through policy impact review and revision
    Implement ITAM auto-discovery tools Software compliance reports, internal audits

    Info-Tech Insight

    Installing an ITAM tool does not mean you have an effective asset management program. A complete solution needs to be built around your tool, but the strength of ITAM comes from processes embedded in the organization that are shaped and supported by your ITAM data.

    Develop an IT hardware asset management implementation roadmap

    4.2.3 Develop a HAM implementation roadmap

    Participants

    • CIO
    • IT Director
    • Asset Manager
    • Service Desk Manager

    Document

    Document in the IT Hardware Asset Management Implementation Roadmap

    1. Identify up to five streams to work on initiatives for the hardware asset management project.
    2. Fill out key tasks and objectives for each process. Assign responsibility for each task.
    3. Select a start date and end date for each task. See tab 1 of the tool for instructions on which letters to input for each stage of the process.
    4. Once your list is complete, open tab 3 of the tool to see your completed sunshine diagram.
    5. Keep this diagram visible for your team and use it as a guide to task completion as you work towards your future-state value stream.

    Focus on continual improvement to sustain your ITAM program

    Periodically review the ITAM program in order to achieve defined goals, objectives, and benefits.

    Act → Plan → Do → Check

    Once ITAM is in place in your organization, a focus on continual improvement creates the following benefits:

    • Remain in sync with the business: your asset management program reflects the current and desired future states of your organization at the time of its creation. But the needs of the business change. As mentioned previously, asset management is a dynamic process, so in order for your program to keep pace, a focus on continual improvement is needed.
      • For example, imagine if your organization had designed your ITAM program before cloud-based solutions were an option. What if your asset classification scheme did not include personal devices or tablets or your asset security policy lacked a section on BYOD?
    • Create funding for new projects through ITAM continual improvement: one of the goals is to save money through more efficient use of your assets by “sweating” out underused hardware and software.
      • It may be tempting to simply present the results to Finance as savings, but instead, describe the results as “available funds for other projects.” Otherwise, Finance may view the savings as a nod to restrict IT’s budget and allocate funds elsewhere. Make it clear that any saved funds are still required, albeit in a different capacity.

    Info-Tech Best Practice

    Look for new uses for ITAM data. Ask management what their goals are for the next 12-18 months. Analyze the data you are gathering and determine how your ITAM data can assist with achieving these goals.

    Phase 4 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Step 4.1: Plan Budget

    Start with an analyst kick-off call:

    • Know where to find data to budget for hardware needs accurately.
    • Learn how to manage a hardware budget.

    Then complete these activities…

    • Plan hardware asset budget.

    With these tools & templates:

    HAM Budgeting Tool

    Step 4.2: Communicate & Roadmap

    Review findings with analyst:

    • Develop policies for end users.
    • Build communications plan.
    • Build an implementation roadmap.

    Then complete these activities…

    • Build HAM policies.
    • Develop a communication plan.
    • Develop a HAM implementation roadmap.

    With these tools & templates:

    HAM policy templates

    HAM Communication Plan

    HAM Implementation Roadmap

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    4.1.1 Build a hardware asset budget

    Review upcoming hardware refresh needs and projects requiring hardware purchases. Use this data to forecast and budget equipment for the upcoming year.

    4.2.2 Develop a communication plan

    Identify groups that will be affected by the new HAM program and for each group, document a communications plan.

    Insight breakdown

    Overarching Insights

    HAM is more than just tracking inventory. A mature asset management program provides data for proactive planning and decision making to reduce operating costs and mitigate risk.

    ITAM is not just IT. IT leaders need to collaborate with Finance, Procurement, Security, and other business units to make informed decisions and create value across the enterprise.

    Treat HAM like a process, not a project. HAM is a dynamic process that must react and adapt to the needs of the business.

    Phase 1 Insight

    For asset management to succeed, it needs to support the business. Engage business leaders to determine needs and build your HAM program around these goals.

    Phase 2 Insight

    Bridge the gap between IT and Finance to build a smoother request and procurement process through communication and routine reporting. If you’re unable to affect procurement processes to reduce time to deliver, consider bringing inventory onsite or having your hardware vendor keep stock, ready to ship on demand.

    Phase 3 Insight

    Not all assets are created equal. Taking a blanket approach to asset maintenance and security is time consuming and costly. Focus on the high-cost, high-use, and data-sensitive assets first.

    Phase 4 Insight

    Deploying a fancy ITAM tool will not make hardware asset management implementation easier. Implementation is a project that requires you focus on people and process first – the technology comes after.

    Related Info-Tech research

    Implement Software Asset Management

    Build an End-User Computing Strategy

    Find the Value – and Remain Valuable – With Cloud Asset Management

    Consolidate IT Asset Management

    Harness Configuration Management Superpowers

    IT Asset Management Market Overview

    Bibliography

    Chalkley, Martin. “Should ITAM Own Budget?” The ITAM Review. 19 May 2011. Web.

    “CHAMP: Certified Hardware Asset Management Professional Manual.” International Association of Information Technology Asset Managers, Inc. 2008. Web.

    Foxen, David. “The Importance of Effective HAM (Hardware Asset Management).” The ITAM Review. 19 Feb. 2015. Web.

    Foxen, David. “Quick Guide to Hardware Asset Tagging.” The ITAM Review. 5 Sep. 2014. Web.

    Galecki, Daniel. “ITAM Lifecycle and Savings Opportunities – Mapping out the Journey.” International Association of IT Asset Managers, Inc. 16 Nov. 2014. Web.

    “How Cisco IT Reduced Costs Through PC Asset Management.” Cisco IT Case Study. 2007. Web.

    Irwin, Sherry. “ITAM Metrics.” The ITAM Review. 14 Dec. 2009. Web.

    “IT Asset and Software Management.” ECP Media LLC, 2006. Web.

    Rains, Jenny. “IT Hardware Asset Management.” HDI Research Brief. May 2015. Web.

    Riley, Nathan. “IT Asset Management and Tagging Hardware: Best Practices.” Samanage Blog. 5 March 2015. Web.

    “The IAITAM Practitioner Survey Results for 2016 – Lean Toward Ongoing Value.” International Association of IT Asset Managers, Inc. 24 May 2016. Web.

    Passwordless Authentication

    • Buy Link or Shortcode: {j2store}466|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: End-User Computing
    • Parent Category Link: /end-user-computing
    • Stakeholders believe that passwords are still good enough.
    • You don’t know how the vendor products match to the capabilities you need to offer.
    • What do you need to test when you prototype these new technologies?
    • What associated processes/IT domains will be impacted or need to be considered?

    Our Advice

    Critical Insight

    Passwordless is the right direction even if it’s not your final destination.

    Impact and Result

    • Be able to handle objections from those who believe passwords are still “fine.”
    • Prioritize the capabilities you need to offer the enterprise, and match them to products/features you can buy from vendors.
    • Integrate passwordless initiatives with other key functions (cloud, IDaM, app rationalization, etc.).

    Passwordless Authentication Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Passwordless Authentication – Know when you’ve been beaten!

    Back in 2004 we were promised "the end of passwords" – why, then, are we still struggling with them today?

    • Passwordless Authentication Storyboard
    [infographic]

    Further reading

    Passwordless Authentication

    Know when you've been beaten!

    Executive Summary

    Your Challenge

    • The IT world is an increasingly dangerous place.
    • Every year literally billions of credentials are compromised and exposed on the internet.
    • The average employee has between 27 and 191 passwords to manage.
    • The line between business persona and personal persona has been blurred into irrelevancy.
    • You need a method of authenticating users that is up to these challenges

    Common Obstacles

    • Legacy systems aside (wouldn't that be nice) this still won't be easy.
    • Social inertia – passwords worked before, so surely, they can still work today! Besides, users don't want to change.
    • Analysis paralysis – I don't want to get this wrong! How do I choose something that is going to be at the core of my infrastructure for the next 10 years?
    • Identity management – how can you fix authentication when people have multiple usernames?

    Info-Tech's Approach

    • Inaction is not an option.
    • Most commercial, off-the-shelf apps are moving to a SaaS model, so start your efforts with them.
    • Your existing vendors already have technologies you are underusing or ignoring – stop that!
    • Your users want this change – they just might not know it yet…
    • Much like zero trust network access, the journey is more important than the destination. Incremental steps on the path toward passwordless authentication will still yield significant benefits.

    Info-Tech Insight

    Users have been burdened with unrealistic expectations when it comes to their part in maintaining enterprise security. Given the massive rise in the threat landscape, it is time for Infrastructure to adopt a user-experience-based approach if we want to move the needle on improving security posture.

    Password Security Fallacy

    "If you buy the premise…you buy the bit."
    Johnny Carson

    We've had plenty of time to see this coming.

    Why haven't we done something?

    • Passwords are a 1970s construct.
    • End-users are complexity averse.
    • Credentials are leaked all the time.
    • New technologies will defeat even the most complex passwords.

    Build the case, both to business stakeholders and end users, that "password" is not a synonym for "security."

    Be ready for some objection handling!

    This is an image of Bill Gates and Gavin Jancke at the 2004 RSA Conference in San Francisco, CA

    Image courtesy of Microsoft

    RSA Conference, 2004
    San Francisco, CA

    "There is no doubt that over time, people are going to rely less and less on passwords. People use the same password on different systems, they write them down and they just don't meet the challenge for anything you really want to secure."
    Bill Gates

    What about "strong" passwords?

    There has been a password arms race going on since 1988

    A massive worm attack against ARPANET prompted the initial research into password strength

    Password strength can be expressed as a function of randomness or entropy. The greater the entropy the harder for an attacker to guess the password.

    This is an image of Table 1 from Google Cloud Solutions Architects.  it shows the number of bits of entropy for a number of Charsets.

    Table: Modern password security for users
    Ian Maddox and Kyle Moschetto, Google Cloud Solutions Architects

    From this research, increasing password complexity (length, special characters, etc.) became the "best practice" to secure critical systems.

    How many passwords??

    XKCD Comic #936 (published in 2011)

    This is an image of XKCD Comic # 936.

    Image courtesy of Randall Munroe XKCD Comics (CC BY-NC 2.5)

    It turns out that humans however are really bad at remembering complex passwords.

    An Intel study (2016) suggested that the average enterprise employee needed to remember 27 passwords. A more recent study from LastPass puts that number closer to 191.

    PEBKAC
    Problem Exists Between Keyboard and Chair

    Increasing entropy is the wrong way to fight this battle – which is good because we'd lose anyway.

    Over the course of a single year, researchers at the University of California, Berkeley identified and tracked nearly 2 billion compromised credentials.

    3.8 million were obtained via social engineering, another 788K from keyloggers. That's approx. 250,000 clear text credentials harvested every week!

    The entirety of the password ecosystem has significant vulnerabilities in multiple areas:

    • Unencrypted server- and client-side storage
    • Sharing
    • Reuse
    • Phishing
    • Keylogging
    • Question-based resets

    Even the 36M encrypted credentials compromised every week are just going to be stored and cracked later.

    Source: Google, University of California, Berkeley, International Computer Science Institute

     data-verified=22B hash/s">

    Image courtesy of NVIDIA, NVIDIA Grace

    • Current GPUs (2021) have 200+ times more cracking power than CPU systems.

    <8h 2040-bit RSA Key

    Image: IBM Quantum System One (CES 2020) by IBM Research is licensed under CC BY-ND 2.0

    • Quantum computing can smash current encryption methods.
    • Google engineers have demonstrated techniques that reduce the number of qubits required from 1B to a mere 20 million

    Enabling Technologies

    "Give me a place to stand, and a lever long enough, and I will move the world."
    Archimedes

    Technology gives us (too many) options

    The time to prototype is NOW!

    Chances are you are already paying for one or more of these technologies from a current vendor:

    • SSO, password managers
    • Conditional access
    • Multifactor
    • Hardware tokens
    • Biometrics
    • PINs

    Address all three factors of authentication

    • Something the user knows
    • Something the user has
    • Something the user is

    Global Market of $12.8B
    ~16.7% CAGR
    Source: Report Linker, 2022.

    Focus your prototype efforts in four key testing areas

    • Deployment
    • User adoption/training
    • Architecture (points of failure)
    • Disaster recovery

    Three factors for positive identification

    Passwordless technologies focus on alternate authentication factors to supplement or replace shared secrets.

    Knows: A secret shared between the user and the system; Has: A token possessed by the user and identifiable as unique by the system; Is: A distinctive and repeatable attribute of the user sampled by the system

    Something you know

    Shared secrets have well-known significant modern-day problems, but only when used in isolation. For end users, consider time-limited single use options, password managers, rate-limited login attempts, and reset rather than retrieval requests. On the system side, never forget strong cryptographic hashing along with a side of salt and pepper when storing passwords.

    Something you have

    A token (now known as a cryptographic identification device) such as a pass card, fob, smartphone, or USB key that is expected to be physically under the control of the user and is uniquely identifiable by the system. Easily decoupled in the event the token is lost, but potentially expensive and time-consuming to reprovision.

    Something you are or do

    Commonly referred to as biometrics, there are two primary classes. The first is measurable physical characteristics of the user such as a fingerprint, facial image, or retinal scan. The second class is a series of behavioral traits such as expected location, time of day, or device. These traits can be linked together in a conditional access policy.

    Unlike other authentication factors, biometrics DO NOT provide for exact matches and instead rely on a confidence interval. A balance must be struck against the user experience of false negatives and the security risk of a false positive.

    Prototype testing criteria

    Deployment

    Does the solution support the full variety of end-user devices you have in use?

    Can the solution be configured with your existing single sign-on or central identity broker?

    User Experience

    Users already want a better experience than passwords.

    What new behavior are you expecting (compelling) from the user?

    How often and under what conditions will that behavior occur?

    Architecture

    Where are the points of failure in the solution?

    Consider technical elements like session thresholds for reauthorization, but also elements like automation and self-service.

    Disaster Recovery

    Understand the exact responsibilities Infra&Ops have in the event of a system or user failure.

    As many solutions are based in the public cloud, manage stakeholder expectations accordingly.

    Next Steps

    "Move the goalposts…and declare victory."
    Informal Fallacy (yet very effective…)

    It is more a direction than a destination…

    Get the easy wins in the bank and then lay the groundwork for the long campaign ahead.

    You're not going to get to a passwordless world overnight. You might not even get there for many years. But an agile approach to the journey ensures you will realize value every step of the way:

    • Start in the cloud:
    • Choose a single sign-on platform such as Azure Active Directory, Okta, Auth0, AWS IAM, TruSONA, HYPR, or others. Document Your Cloud Strategy.
    • Integrate the SaaS applications from your portfolio with your chosen platform.
    • Establish visibility and rationalize identity management:
      • Accounts with elevated privileges present the most risk – evaluate your authentication factors for these accounts first.
      • There is elegance (and deployment success) in Simplifying Identity & Access Management.
    • Pay your tech debt:

    Fast IDentity Online (2) is now part of the web's DNA and is critical for digital transformation

    • IoT
    • Anywhere remote work
    • Government identity services
    • Digital wallets

    Bibliography

    "Backup Vs. Archiving: Know the Difference." Open-E. Accessed 05 Mar 2022.Web.
    G, Denis. "How to Build Retention Policy." MSP360, Jan 3, 2020. Accessed 10 Mar 2022.
    Ipsen, Adam. "Archive Vs. Backup: What's the Difference? A Definition Guide." BackupAssist, 28 Mar 2017. Accessed 04 Mar 2022.
    Kang, Soo. "Mitigating the Expense of E-Discovery; Recognizing the Difference Between Back-Ups and Archived Data." Zasio Enterprises, 08 Oct 2015. Accessed 3 Mar 2022.
    Mayer, Alex. "The 3-2-1 Backup Rule – An Efficient Data Protection Strategy." Naviko. Accessed 12 Mar 2022.
    Steel, Amber. "LastPass Reveals 8 Truths about Passwords in the New Password Exposé." LastPass Blog, 1 Nov. 2017. Web.
    "The Global Passwordless Authentication Market Size Is Estimated to Be USD 12.79 Billion in 2021 and Is Predicted to Reach USD 53.64 Billion by 2030 With a CAGR of 16.7% From 2022-2030." Report Linker, 9 June 2022. Web.
    "What Is Data-Archiving?" Proofpoint. Accessed 07 Mar 2022.

    Get really good at resilience

    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A

    Why be resilient?

    Well, your clients demand it. And it makes business sense; it is much cheaper to retain a client than to acquire new ones. By all means, always expand your client base; just don't make it a zero-sum game by losing clients because you cannot provide decent service. 

    Although the term has existed since the 17th century, it has only received legal attention since 2020. Now, several years later, the EU and the US require companies to prove their resilience.

    To understand what resilience is, please read our article on resilience

    What does it take to become really good at IT resilience?

    IT resilience is a mindset, a collection of techniques, and people management focused on providing consistent service to clients, all rolled into one discipline. While we discuss IT resilience, it takes more than IT staff or IT processes to become a truly resilient business.

    Here are 10 themes relevant to the (IT) resilient organization:

    Transparent culture

    A transparent company culture empowers its people to act confidently, respond swiftly to challenges, and continuously learn and improve. This builds a strong foundation for resilience, enabling the organization to navigate disruption or adversity much more easily.

    At its core, transparency is about open communication, sharing information, and fostering a culture of honesty and trust. These traits directly influence the various aspects of resilience.

    Client service focus

    A client service focus isn't just about customer satisfaction; it's an integral part of a company's resilience strategy. Service stability and continuous value delivery are the elements that retain existing clients and attract new ones through reputation.  System outages, slowdowns, and errors lead to client frustration and erode confidence. In other words, client service focuses on making sure you are available. Once you have that, then you can look at enhancing and expanding services and products. 

    Resilient systems and processes often also include tools and capabilities for proactive communication with clients. This can include automated notifications during system maintenance or updates, providing transparency and minimizing inconvenience. A proactive approach to communication creates a sense of partnership, and it demonstrates that you value your clients' time and business.

    Adaptability

    Adaptable systems and processes give you the flexibility for rapid incident response and easy workarounds, bringing your service back to the level it is supposed to be at.

    In the bigger picture, when you design your systems for flexibility and modification, you can rapidly adjust to new market conditions, evolving customer demands, and technological advancements. This agility allows you to pivot swiftly, seizing opportunities while mitigating risks.

    In the same vein, adaptable processes, fostered by a culture of continuous improvement and open communication, empower teams to innovate and refine workflows in response to challenges. This constant evolution ensures the company remains competitive and aligned with its ever-changing environment.

    Robust change management

    When you establish standardized procedures for planning, testing, and implementing changes, IT change management ensures that every modification, no matter how seemingly small, is carefully considered and assessed for its impact on the broader IT ecosystem. This structured approach significantly reduces the risk of unexpected side effects, unforeseen conflicts, and costly downtime, protecting the company's operations and its reputation.

    It does not have to be a burdensome bureaucratic process. Modern processes and tools take the sting out of these controls. Many actions within change management can be automated without losing oversight by both the IT custodians and the business process owners.

    Redundancy and fault tolerance

    By having duplicates of essential components or systems in place, you ensure that even if one part fails, another is ready to take over. This helps you minimize the impact of unexpected events like hardware issues, software glitches, or other unforeseen problems. This might mean replicating critical policy data across multiple servers or data centers in different locations.

    Fault tolerance is all about your systems and processes being able to keep working even when facing challenges. By designing your software and systems architecture with fault tolerance in mind, you are sure it can gracefully handle errors and failures, preventing those small problems from causing bigger issues, outages, and unhappy clients.

    Security

    Clients entrust you with valuable information. Demonstrating a commitment to data security through resilient systems builds trust and provides reassurance that their data is safeguarded against breaches and unauthorized access.

    Monitoring and alerting

    Trusting that all working is good. making sure is better.  When you observe your systems and receive timely notifications when something seems off, you'll be able to address issues before they snowball into real problems. 

    In any industry, monitoring helps you keep an eye on crucial performance metrics, resource usage, and system health. You'll get insights into how your systems behave, allowing you to identify bottlenecks or potential points of failure before they cause serious problems. And with a well-tuned alerting system, you'll get those critical notifications when something requires immediate attention. This gives you the chance to respond quickly, minimize downtime, and keep things running smoothly for your customers.

    Monitoring is also all about business metrics. Keep your service chains running smoothly and understand the ebb and flow of when clients access your services. Then update and enhance in line with what you see happening. 

    Incident response processes

    Well-thought-out plans and processes are key. Work with your incident managers, developers, suppliers, business staff and product owners and build an embedded method for reacting to incidents. 

    The key is to limit the time of the service interruption. Not everything needs to be handled immediately, so your plan must be clear on how to react to important vs lower-priority incidents. Making the plan and process well-known in the company helps everybody and keeps the calm.

    Embedded business continuity

    Business continuity planning anticipates and prepares for various scenarios, allowing your company to adapt and maintain essential functions even in the face of unexpected disruptions.

    When you proactively address these non-IT aspects of recovery, you build resilience that goes beyond simply restoring technology. It enables you to maintain customer relationships, meet contractual obligations, and safeguard your reputation, even in the face of significant challenges.

    Business continuity is not about prevention; it is about knowing what to do when bad things happen that may threaten your company in a more existential way or when you face issues like a power outage in your building, a pandemic, major road works rendering your business unreachable and such events.

    Effective disaster recovery  

    Disaster recovery is your lifeline when the worst happens. Whether it's a major cyberattack, a natural disaster, or a catastrophic hardware failure, a solid disaster recovery plan ensures your business doesn't sink. It's your strategy to get those critical systems back online and your data restored as quickly as possible.

    Think of it this way: disaster recovery, just like business continuity, isn't about preventing bad things from happening; it's about being prepared to bounce back when they do. It's like having a spare tire in your car, you hope you never need it, but if you get a flat, you're not stranded. With a well-tested disaster recovery plan, you can minimize downtime, reduce data loss, and keep your operations running even in the face of the unexpected. That translates to happier customers, protected revenue, and a reputation for reliability even amidst chaos.

     

    Resilience is the result of a well-conducted orchestra. Many disciplines come together to help you service your clients in a consistent way.

    The operational lifeline of your company and the reason it exists in the first place is to provide your clients with what they need, when they need it, and be able to command a good price for it. And that will keep your shareholders happy as well.

    Implement Your Negotiation Strategy More Effectively

    • Buy Link or Shortcode: {j2store}225|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management
    • Forty-eight percent of CIOs believe their budgets are inadequate.
    • CIOs and IT departments are getting more involved with negotiations to reduce costs and risk.
    • Not all negotiators are created equal, and the gap between a skilled negotiator and an average negotiator is not always easy to identify objectively.
    • Skilled negotiators are in short supply.

    Our Advice

    Critical Insight

    • Preparation is critical for the success of your negotiation, but you cannot prepare for every eventuality.
    • Communication is the heart and soul of negotiations, but what is being “said” is only part of the picture.
    • Skilled negotiators separate themselves based on skillsets, and outcomes alone may not provide an accurate assessment of a negotiator.

    Impact and Result

    Addressing and managing critical negotiation elements helps:

    • Improve negotiation skills.
    • Implement your negotiation strategy more effectively.
    • Improve negotiation results.

    Implement Your Negotiation Strategy More Effectively Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should create and follow a scalable process for preparing to negotiate with vendors, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. During

    Throughout this phase, ten essential negotiation elements are identified and reviewed.

    • Implement Your Negotiation Strategy More Effectively – Phase 1: During
    • During Negotiations Tool
    [infographic]

    Workshop: Implement Your Negotiation Strategy More Effectively

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 12 Steps to Better Negotiation Preparation

    The Purpose

    Improve negotiation skills and outcomes.

    Understand how to use the Info-Tech During Negotiations Tool.

    Key Benefits Achieved

    A better understanding of the subtleties of the negotiation process and an identification of where the negotiation strategy can go awry.

    The During Negotiation Tool will be reviewed and configured for the customer’s environment (as applicable).

    Activities

    1.1 Manage six key items during the negotiation process.

    1.2 Set the right tone and environment for the negotiation.

    1.3 Focus on improving three categories of intangibles.

    1.4 Improve communication skills to improve negotiation skills.

    1.5 Customize your negotiation approach to interact with different personality traits and styles.

    1.6 Maximize the value of your discussions by focusing on seven components.

    1.7 Understand the value of impasses and deadlocks and how to work through them.

    1.8 Use concessions as part of your negotiation strategy.

    1.9 Identify and defeat common vendor negotiation ploys.

    1.10 Review progress and determine next steps.

    Outputs

    Sample negotiation ground rules

    Sample vendor negotiation ploys

    Sample discussion questions and evaluation matrix

    pricing

    • TymansGroupVideosExcerpt: BasicFor freelancers$19/ month 10 presentations/monthSupport at $25/hour1 campaign/month Choose plan StandardFor medium sized teams$29/ month 50 presentations/month5 hours of free support10 campaigns/month Choose plan EnterpriseFor large companies$79/ month Unlimited presentationsUnlimited supportUnlimited campaigns Choose plan

    Pricing

    Our pricing options will be available soon for simple download,

    In the meantime, please book a free discovery call. No cost, no sales pitch.

    Continue reading

    Define Your Cloud Vision

    • Buy Link or Shortcode: {j2store}448|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $182,333 Average $ Saved
    • member rating average days saved: 28 Average Days Saved
    • Parent Category Name: Cloud Strategy
    • Parent Category Link: /cloud-strategy

    The cloud permeates the enterprise technology discussion. It can be difficult to separate the hype from the value. Should everything go to the cloud, or is that sentiment stoked by vendors looking to boost their bottom lines? Not everything should go to the cloud, but coming up with a systematic way to determine what belongs where is increasingly difficult as offerings get more complex.

    Our Advice

    Critical Insight

    Don’t think about the cloud as an inevitable next step for all workloads. The cloud is merely another tool in the toolbox, ready to be used when appropriate and put away when it’s not needed. Cloud-first isn’t always the way to go.

    Impact and Result

    • Evaluate workloads’ suitability for the cloud using Info-Tech’s methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
    • Codify risks tied to workloads’ cloud suitability and plan mitigations.
    • Build a roadmap of initiatives for actions by workload and risk mitigation.
    • Define a cloud vision to share with stakeholders.

    Define Your Cloud Vision Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define Your Cloud Vision – A step-by-step guide to generating, validating, and formalizing your cloud vision.

    The cloud vision storyboard walks readers through the process of generating, validating and formalizing a cloud vision, providing a framework and tools to assess workloads for their cloud suitability and risk.

    • Define Your Cloud Vision – Phases 1-4

    2. Cloud Vision Executive Presentation – A document that captures the results of the exercises, articulating use cases for cloud/non-cloud, risks, challenges, and high-level initiative items.

    The executive summary captures the results of the vision exercise, including decision criteria for moving to the cloud, risks, roadblocks, and mitigations.

    • Cloud Vision Executive Presentation

    3. Cloud Vision Workbook – A tool that facilitates the assessment of workloads for appropriate service model, delivery model, support model, and risks and roadblocks.

    The cloud vision workbook comprises several assessments that will help you understand what service model, delivery model, support model, and risks and roadblocks you can expect to encounter at the workload level.

    • Cloud Vision Workbook
    [infographic]

    Workshop: Define Your Cloud Vision

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Understand the Cloud

    The Purpose

    Align organizational goals to cloud characteristics.

    Key Benefits Achieved

    An understanding of how the characteristics particular to cloud can support organizational goals.

    Activities

    1.1 Generate corporate goals and cloud drivers.

    1.2 Identify success indicators.

    1.3 Explore cloud characteristics.

    1.4 Explore cloud service and delivery models.

    1.5 Define cloud support models and strategy components.

    1.6 Create state summaries for the different service and delivery models.

    1.7 Select workloads for further analysis.

    Outputs

    Corporate cloud goals and drivers

    Success indicators

    Current state summaries

    List of workloads for further analysis

    2 Assess Workloads

    The Purpose

    Evaluate workloads for cloud value and action plan.

    Key Benefits Achieved

    Action plan for each workload.

    Activities

    2.1 Conduct workload assessment using the Cloud Strategy Workbook tool.

    2.2 Discuss assessments and make preliminary determinations about the workloads.

    Outputs

    Completed workload assessments

    Workload summary statements

    3 Identify and Mitigate Risks

    The Purpose

    Identify and plan to mitigate potential risks in the cloud project.

    Key Benefits Achieved

    A list of potential risks and plans to mitigate them.

    Activities

    3.1 Generate a list of risks and potential roadblocks associated with the cloud.

    3.2 Sort risks and roadblocks and define categories.

    3.3 Identify mitigations for each identified risk and roadblock

    3.4 Generate initiatives from the mitigations.

    Outputs

    List of risks and roadblocks, categorized

    List of mitigations

    List of initiatives

    4 Bridge the Gap and Create the Strategy

    The Purpose

    Clarify your vision of how the organization can best make use of cloud and build a project roadmap.

    Key Benefits Achieved

    A clear vision and a concrete action plan to move forward with the project.

    Activities

    4.1 Review and assign work items.

    4.2 Finalize the decision framework for each of the following areas: service model, delivery model, and support model.

    4.3 Create a cloud vision statement

    Outputs

    Cloud roadmap

    Finalized task list

    Formal cloud decision rubric

    Cloud vision statement

    5 Next Steps and Wrap-Up

    The Purpose

    Complete your cloud vision by building a compelling executive-facing presentation.

    Key Benefits Achieved

    Simple, straightforward communication of your cloud vision to key stakeholders.

    Activities

    5.1 Build the Cloud Vision Executive Presentation

    Outputs

    Completed cloud strategy executive presentation

    Completed Cloud Vision Workbook.

    Further reading

    Define Your Cloud Vision

    Define your cloud vision before it defines you

    Analyst perspective

    Use the cloud’s strengths. Mitigate its weaknesses.

    The cloud isn’t magic. It’s not necessarily cheaper, better, or even available for the thing you want it to do. It’s not mysterious or a cure-all, and it does take a bit of effort to systematize your approach and make consistent, defensible decisions about your cloud services. That’s where this blueprint comes in.

    Your cloud vision is the culmination of this effort all boiled down into a single statement: “This is how we want to use the cloud.” That simple statement should, of course, be representative of – and built from – a broader, contextual strategy discussion that answers the following questions: What should go to the cloud? What kind of cloud makes sense? Should the cloud deployment be public, private, or hybrid? What does a migration look like? What risks and roadblocks need to be considered when exploring your cloud migration options? What are the “day 2” activities that you will need to undertake after you’ve gotten the ball rolling?

    Taken as a whole, answering these questions is difficult task. But with the framework provided here, it’s as easy as – well, let’s just say it’s easier.

    Jeremy Roberts

    Research Director, Infrastructure and Operations

    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • You are both extrinsically motivated to move to the cloud (e.g. by vendors) and intrinsically motivated by internal digital transformation initiatives.
    • You need to define the cloud’s true value proposition for your organization without assuming it is an outsourcing opportunity or will save you money.
    • Your industry, once cloud-averse, is now normalizing the use of cloud services, but you have not established a basic cloud vision from which to develop a strategy at a later point.

    Common Obstacles

    • Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
    • Many organizations have a foot in the cloud already, but these decisions have been made in an ad hoc rather than systematic fashion.
    • You lack a consistent framework to assess your workloads’ suitability for the cloud.

    Info-Tech's Approach

    • Evaluate workloads’ suitability for the cloud using Info-Tech’s methodology to select the optimal migration (or non-migration) path based on the value of cloud characteristics.
    • Codify risks tied to workloads’ cloud suitability and plan mitigations.
    • Build a roadmap of initiatives for actions by workload and risk mitigation.
    • Define a cloud vision to share with stakeholders.

    Info-Tech Insight: 1) Base migration decisions on cloud characteristics. If your justification for the migration is simply getting your workload out of the data center, think again. 2) Address the risks up front in your migration plan. 3) The cloud changes roles and calls for different skill sets, but Ops is here to stay.

    Your challenge

    This research is designed to help organizations who need to:

    • Identify workloads that are good candidates for the cloud.
    • Develop a consistent, cost-effective approach to cloud services.
    • Outline and mitigate risks.
    • Define your organization’s cloud archetype.
    • Map initiatives on a roadmap.
    • Communicate your cloud vision to stakeholders so they can understand the reasons behind a cloud decision and differentiate between different cloud service and deployment models.
    • Understand the risks, roadblocks, and limitations of the cloud.

    “We’re moving from a world where companies like Oracle and Microsoft and HP and Dell were all critically important to a world where Microsoft is still important, but Amazon is now really important, and Google also matters. The technology has changed, but most of the major vendors they’re betting their business on have also changed. And that’s super hard for people..” –David Chappell, Author and Speaker

    Common obstacles

    These barriers make this challenge difficult to address for many organizations:

    • Organizations jump to the cloud before defining their cloud vision and without any clear plan for realizing the cloud’s benefits.
    • Many organizations already have a foot in the cloud, but the choice to explore these solutions was made in an ad hoc rather than systematic fashion. The cloud just sort of happened.
    • The lack of a consistent assessment framework means that some workloads that probably belong in the cloud are kept on premises or with hosted services providers – and vice versa.
    • Securing cloud expertise is remarkably difficult – especially in a labor market roiled by the global pandemic and the increasing importance of cloud services.

    Standard cloud challenges

    30% of all cloud spend is self-reported as waste. Many workloads that end up in the cloud don’t belong there. Many workloads that do belong in the cloud aren’t properly migrated. (Flexera, 2021)

    44% of respondents report themselves as under-skilled in the cloud management space. (Pluralsight, 2021)

    Info-Tech’s approach

    Goals and drivers

    • Service model
      • What type of cloud makes the most sense for workload archetypes? When does it make sense to pick SaaS over IaaS, for example?
    • Delivery model
      • Will services be delivered over the public cloud, a private cloud, or a hybrid cloud? What challenges accompany this decision?
    • Migration Path
      • What does the migration path look like? What does the transition to the cloud look like, and how much effort will be required? Amazon’s 6Rs framework captures migration options: rehosting, repurchasing, replatforming, and refactoring, along with retaining and retiring. Each workload should be assessed for its suitability for one or more of these paths.
    • Support model
      • How will services be provided? Will staff be trained, new staff hired, a service provider retained for ongoing operations, or will a consultant with cloud expertise be brought on board for a defined period? The appropriate support model is highly dependent on goals along with expected outcomes for different workloads.

    Highlight risks and roadblocks

    Formalize cloud vision

    Document your cloud strategy

    The Info-Tech difference:

    1. Determine the hypothesized value of cloud for your organization.
    2. Evaluate workloads with 6Rs framework.
    3. Identify and mitigate risks.
    4. Identify cloud archetype.
    5. Plot initiatives on a roadmap.
    6. Write action plan statement and goal statement.

    What is the cloud, how is it deployed, and how is service provided?

    Cloud Characteristics

    1. On-demand self-service: the ability to access reosurces instantly without vendor interaction
    2. Broad network access: all services delivered over the network
    3. Resource pooling: multi-tenant environment (shared)
    4. Rapid elasticity: the ability to expand and retract capabilities as needed
    5. Measured service: transparent metering

    Service Model:

    1. Software-as-a-Service: all but the most minor configuration is done by the vendor
    2. Platform-as-a-Service: customer builds the application using tools provided by the provider
    3. Infrastructure-as-a-Service: the customer manages OS, storage, and the application

    Delivery Model

    1. Public cloud: accessible to anyone over the internet; multi-tenant environment
    2. Private cloud: provisioned for a single organization with multiple units
    3. Hybrid cloud: two or more connected clouds; data is portage across them
    4. Community cloud: provisioned for a specific group of organizations

    (National Institute of Standards and Technology)

    A workload-first approach will allow you to take full advantage of the cloud’s strengths

    • Under all but the most exceptional circumstances, good cloud strategies will incorporate different service models. Very few organizations are “IaaS shops” or “SaaS shops,” even if they lean heavily in one direction.
    • These different service models (including non-cloud options like colocation and on-premises infrastructure) each have different strengths. Part of your cloud strategy should involve determining which of the services makes the most sense for you.
    • Own the cloud by understanding which cloud (or non-cloud!) offering makes the most sense for you given your unique context.

    Migration paths

    In a 2016 blog post, Amazon introduced a framework for understanding cloud migration strategies. The framework presented here is slightly modified – including a “relocate” component rather than a “retire” component – but otherwise hews close to the standard.

    These migration paths reflect organizational capabilities and desired outcomes in terms of service models – cloud or otherwise. Retention means keeping the workload where it is, in a datacenter or a colocation service, or relocating to a colocation or hosted software environment. These represent the “non-cloud” migration paths.

    In the graphic on the right, the paths within the red box lead to the cloud. Rehosting means lifting and shifting to an infrastructure environment. Migrating a virtual machine from your VMware environment on premises to Azure Virtual machines is a quick way to realize some benefits from the cloud. Migrating from SQL Server on premises to a cloud-based SQL solution looks a bit more like changing platforms (replatforming). It involves basic infrastructure modification without a substantial architectural component.

    Refactoring is the most expensive of the options and involves engaging the software development lifecycle to build a custom solution, fundamentally rewriting the solution to be cloud native and take advantage of cloud-native architectures. This can result in a PaaS or an IaaS solution.

    Finally, repurchasing means simply going to market and procuring a new solution. This may involve migrating data, but it does not require the migration of components.

    Migration Paths

    Retain (Revisit)

    • Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

    Relocate

    • Move the workload between datacenters or to a hosted software/colocation provider.

    Rehost

    • Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

    Replatform

    • Move the application to the cloud and perform a few changes for cloud optimizations.

    Refactor

    • Rewrite the application, taking advantage of cloud-native architectures.

    Repurchase

    • Replace with an alternative, cloud-native application and migrate the data.

    Support model

    Support models by characteristic

    Duration of engagement Specialization Flexibility
    Internal IT Indefinite Varies based on nature of business Fixed, permanent staff
    Managed Service Provider Contractually defined General, some specialization Standard offering
    Consultant Project-based Specific, domain-based Entirely negotiable

    IT services, including cloud services, can be delivered and managed in multiple ways depending on the nature of the workload and the organization’s intended path forward. Three high-level options are presented here and may be more or less valuable based on the duration of the expected engagement with the service (temporary or permanent), the skills specialization required, and the flexibility necessary to complete the job.

    By way of example, a highly technical, short-term project with significant flexibility requirements might be a good fit for an expensive consultant, whereas post-implementation maintenance of a cloud email system requires relatively little specialization and flexibility and would therefore be a better fit for internal management.

    There is no universally applicable rule here, but there are some workloads that are generally a good fit for the cloud and others that are not as effective, with that fit being conditional on the appropriate support model being employed.

    Risks, roadblocks, and strategy components

    No two cloud strategies are exactly alike, but all should address 14 key areas. A key step in defining your cloud vision is an assessment of these strategy components. Lower maturity does not preclude an aggressive cloud strategy, but it does indicate that higher effort will be required to make the transition.

    Component Description Component Description
    Monitoring What will system owners/administrators need visibility into? How will they achieve this? Vendor Management What practices must change to ensure effective management of cloud vendors?
    Provisioning Who will be responsible for deploying cloud workloads? What governance will this process be subject to? Finance Management How will costs be managed with the transition away from capital expenditure?
    Migration How will cloud migrations be conducted? What best practices/standards must be employed? Security What steps must be taken to ensure that cloud services meet security requirements?
    Operations management What is the process for managing operations as they change in the cloud? Data Controls How will data residency, compliance, and protection requirements be met in the cloud?
    Architecture What general principles must apply in the cloud environment? Skills and roles What skills become necessary in the cloud? What steps must be taken to acquire those skills?
    Integration and interoperability How will services be integrated? What standards must apply? Culture and adoption Is there a cultural aversion to the cloud? What steps must be taken to ensure broad cloud acceptance?
    Portfolio Management Who will be responsible for managing the growth of the cloud portfolio? Governing bodies What formal governance must be put in place? Who will be responsible for setting standards?

    Cloud archetypes – a cloud vision component

    Once you understand the value of the cloud, your workloads’ general suitability for cloud, and your proposed risks and mitigations, the next step is to define your cloud archetype.

    Your organization’s cloud archetype is the strategic posture that IT adopts to best support the organization’s goals. Info-Tech’s model recognizes seven archetypes, divided into three high-level archetypes.

    After consultation with your stakeholders, and based on the results of the suitability and risk assessment activities, define your archetype. The archetype feeds into the overall cloud vision and provides simple insight into the cloud future state for all stakeholders.

    The cloud vision itself is captured in a “vision statement,” a short summary of the overall approach that includes the overall cloud archetype.

    We can best support the organization's goals by:

    More Cloud

    Less Cloud

    Cloud Focused Cloud-Centric Providing all workloads through cloud delivery.
    Cloud-First Using the cloud as our default deployment model. For each workload, we should ask “why NOT cloud?”
    Cloud Opportunistic Hybrid Enabling the ability to transition seamlessly between on-premises and cloud resources for many workloads.
    Integrated Combining cloud and traditional infrastructure resources, integrating data and applications through APIs or middleware.
    Split Using the cloud for some workloads and traditional infrastructure resources for others.
    Cloud Averse Cloud-Light Using traditional infrastructure resources and limiting our use of the cloud to when it is absolutely necessary.
    Anti-Cloud Using traditional infrastructure resources and avoiding use of the cloud wherever possible.

    Info-Tech’s methodology for defining your cloud vision

    1. Understand the Cloud 2. Assess Workloads 3. Identify and Mitigate Risks 4. Bridge the Gap and Create the Vision
    Phase Steps
    1. Generate goals and drivers
    2. Explore cloud characteristics
    3. Create a current state summary
    4. Select workloads for analysis
    1. Conduct workload assessments
    2. Determine workload future state
    1. Generate risks and roadblocks
    2. Mitigate risks and roadblocks
    3. Define roadmap initiatives
    1. Review and assign work items
    2. Finalize cloud decision framework
    3. Create cloud vision
    Phase Outcomes
    1. List of goals and drivers
    2. Shared understanding of cloud terms
    3. Current state of cloud in the organization
    4. List of workloads to be assessed
    1. Completed workload assessments
    2. Defined workload future state
    1. List of risks and roadblocks
    2. List of mitigations
    3. Defined roadmap initiatives
    1. Cloud roadmap
    2. Cloud decision framework
    3. Completed Cloud Vision Executive Presentation

    Insight summary

    The cloud may not be right for you – and that’s okay!

    Don’t think about the cloud as an inevitable next step for all workloads. The cloud is merely another tool in the toolbox, ready to be used when appropriate and put away when it’s not needed. Cloud first isn’t always the way to go.

    Not all clouds are equal

    It’s not “should I go to the cloud?” but “what service and delivery models make sense based on my needs and risk tolerance?” Thinking about the cloud as a binary can force workloads into the cloud that don’t belong (and vice versa).

    Bottom-up is best

    A workload assessment is the only way to truly understand the cloud’s value. Work from the bottom up, not the top down, understand what characteristics make a workload cloud suitable, and strategize on that basis.

    Your accountability doesn’t change

    You are still accountable for maintaining available, secure, functional applications and services. Cloud providers share some responsibility, but the buck stops where it always has: with you.

    Don’t customize for the sake of customization

    SaaS providers make money selling the same thing to everyone. When migrating a workload to SaaS, work with stakeholders to pursue standardization around a selected platform and avoid customization where possible.

    Best of both worlds, worst of both worlds

    Hybrid clouds are in fashion, but true hybridity comes with additional cost, administration, and other constraints. A convoy moves at the speed of its slowest member.

    The journey matters as much as the destination

    How you get there is as important as what “there” actually is. Any strategy that focuses solely on the destination misses out on a key part of the value conversation: the migration strategy.

    Blueprint benefits

    Cloud Vision Executive Presentation

    This presentation captures the results of the exercises and presents a complete vision to stakeholders including a desired target state, a rubric for decision making, the results of the workload assessments, and an overall risk profile.

    Cloud Vision Workbook

    This workbook includes the standard cloud workload assessment questionnaire along with the results of the assessment. It also includes the milestone timeline for the implementation of the cloud vision.

    Blueprint benefits

    IT Benefits

    • A consistent approach to the cloud takes the guesswork out of deployment decisions and makes it easier for IT to move on to the execution stage.
    • When properly incorporated, cloud services come with many benefits, including automation, elasticity, and alternative architectures (micro-services, containers). The cloud vision project will help IT readers articulate expected benefits and work towards achieving them.
    • A clear framework for incorporating organizational goals into cloud plans.

    Business benefits

    • Simple, well-governed access to high-quality IT resources.
    • Access to the latest and greatest in technology to facilitate remote work.
    • Framework for cost management in the cloud that incorporates OpEx and chargebacks/showbacks. A clear understanding of expected changes to cost modeling is also a benefit of a cloud vision.
    • Clarity for stakeholders about IT’s response (and contribution to) IT strategic initiatives.

    Measure the value of this blueprint

    Don’t take our word for it:

    • The cloud vision material in various forms has been offered for several years, and members have generally benefited substantially, both from cloud vision workshops and from guided implementations led by analysts.
    • After each engagement, we send a survey that asks members how they benefited from the experience. Of 30 responses, the cloud vision research has received an average score of 9.8/10. Real members have found significant value in the process.
    • Additionally, members reported saving between 2 and 120 days (for an average of 17), and financial savings ranged from $1,920 all the way up to $1.27 million, for an average of $170,577.90! If we drop outliers on both ends, the average reported value of a cloud vision engagement is $37, 613.
    • Measure the value by calculating the time saved from using Info-Tech’s framework vs. a home-brewed cloud strategy alternative and by comparing the overall cost of a guided implementation or workshop with the equivalent offering from another firm. We’re confident you’ll come out ahead.

    9.8/10 Average reported satisfaction

    17 Days Average reported time savings

    $37, 613 Average cost savings (adj.)

    Executive Brief Case Study

    Industry: Financial

    Source: Info-Tech workshop

    Anonymous financial institution

    A small East Coast financial institution was required to develop a cloud strategy. This strategy had to meet several important requirements, including alignment with strategic priorities and best practices, along with regulatory compliance, including with the Office of the Comptroller of the Currency.

    The bank already had a significant cloud footprint and was looking to organize and formalize the strategy going forward.

    Leadership needed a comprehensive strategy that touched on key areas including the delivery model, service models, individual workload assessments, cost management, risk management and governance. The output had to be consumable by a variety of audiences with varying levels of technical expertise and had to speak to IT’s role in the broader strategic goals articulated earlier in the year.

    Results

    The bank engaged Info-Tech for a cloud vision workshop and worked through four days of exercises with various IT team members. The bank ultimately decided on a multi-cloud strategy that prioritized SaaS while also allowing for PaaS and IaaS solutions, along with some non-cloud hosted solutions, based on organizational circumstances.

    Bank cloud vision

    [Bank] will provide innovative financial and related services by taking advantage of the multiplicity of best-of-breed solutions available in the cloud. These solutions make it possible to benefit from industry-level innovations, while ensuring efficiency, redundancy, and enhanced security.

    Bank cloud decision workflow

    • SaaS
      • Platform?
        • Yes
          • PaaS
        • No
          • Hosted
        • IaaS
          • Other

    Non-cloud

    Cloud

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    "Our team has already made this crticial project a priority, and we have the time and capability, but some guidance along the way would be helpful."

    Guided Implementation

    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

    Workshop

    "We need to hit the ground running and get this project kicked off imediately. Our team has the ability to take this over once we get a framework and strategy in place."

    Consulting

    "Our team does not have the time or the knowledge the take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks are used throughout all four options.

    Guided Implementation

    What does a typical GI on this topic look like?

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is between 8 to 12 calls over the course of 4 to 6 months.

    Phase 1

    • Call #1: Discuss current state, challenges, etc.
    • Call #2: Goals, drivers, and current state.

    Phase 2

    • Call #3: Conduct cloud suitability assessment for selected workloads.

    Phase 3

    • Call #4: Generate and categorize risks.
    • Call #5: Begin the risk mitigation conversation.

    Phase 4

    • Call #6: Complete the risk mitigation process
    • Call #7: Finalize vision statement and cloud decision framework.

    Workshop Overview

    Contact your account representative for more information.

    workshops@infotech.com 1-888-670-8889

    Day 1 Day 2 Day 3 Day 4 Offsite day
    Understand the cloud Assess workloads Identify and mitigate risks Bridge the gap and create the strategy Next steps and wrap-up (offsite)
    Activities

    1.1 Introduction

    1.2 Generate corporate goals and cloud drivers

    1.3 Identify success indicators

    1.4 Explore cloud characteristics

    1.5 Explore cloud service and delivery models

    1.6 Define cloud support models and strategy components

    1.7 Create current state summaries for the different service and delivery models

    1.8 Select workloads for further analysis

    2.1 Conduct workload assessments using the cloud strategy workbook tool

    2.2 Discuss assessments and make preliminary determinations about workloads

    3.1 Generate a list of risks and potential roadblocks associated with the cloud

    3.2 Sort risks and roadblocks and define categories

    3.3 Identify mitigations for each identified risk and roadblock

    3.4 Generate initiatives from the mitigations

    4.1 Review and assign work items

    4.2 Finalize the decision framework for each of the following areas:

    • Service model
    • Delivery model
    • Support model

    4.3 Create a cloud vision statement

    5.1 Build the Cloud Vision Executive Presentation
    Deliverables
    1. Corporate goals and cloud drivers
    2. Success indicators
    3. Current state summaries
    4. List of workloads for further analysis
    1. Completed workload assessments
    2. Workload summary statements
    1. List of risks and roadblocks, categorized
    2. List of mitigations
    3. List of initiatives
    1. Finalized task list
    2. Formal cloud decision rubric
    3. Cloud vision statement
    1. Completed cloud strategy executive presentation
    2. Completed cloud vision workbook

    Understand the cloud

    Build the foundations of your cloud vision

    Phase 1

    Phase 1

    Understand the Cloud

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    1.1.1 Generate organizational goals

    1.1.2 Define cloud drivers

    1.1.3 Define success indicators

    1.3.1 Record your current state

    1.4.1 Select workloads for further assessment

    This phase involves the following participants:

    IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders.

    It starts with shared understanding

    Stakeholders must agree on overall goals and what “cloud” means

    The cloud is a nebulous term that can reasonably describe services ranging from infrastructure as a service as delivered by providers like Amazon Web Services and Microsoft through its Azure platform, right up to software as a service solutions like Jira or Salesforce. These solutions solve different problems – just because your CRM would be a good fit for a migration to Salesforce doesn’t mean the same system would make sense in Azure or AWS.

    This is important because the language we use to talk about the cloud can color our approach to cloud services. A “cloud-first” strategy will mean something different to a CEO with a concept of the cloud rooted in Salesforce than it will to a system administrator who interprets it to mean a transition to cloud-hosted virtual machines.

    Add to this the fact that not all cloud services are hosted externally by providers (public clouds) and the fact that multiple delivery models can be engaged at once through hybrid or multi-cloud approaches, and it’s apparent that a shared understanding of the cloud is necessary for a coherent strategy to take form.

    This phase proceeds in four steps, each governed by the principle of shared understanding. The first requires a shared understanding of corporate goals and drivers. Step 2 involves coming to a shared understanding of the cloud’s unique characteristics. Step 3 requires a review of the current state. Finally, in Step 4, participants will identify workloads that are suitable for analysis as candidates for the cloud.

    Step 1.1

    Generate goals and drivers

    Activities

    1.1.1 Define organizational goals

    1.1.2 Define cloud drivers

    1.1.3 Define success indicators

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    This step involves the following participants:

    • IT management
    • Core working group
    • Security
    • Applications
    • Infrastructure
    • Service management
    • Leadership

    Outcomes of this step

    • List of organizational goals
    • List of cloud drivers
    • Defined success indicators

    What can the cloud do for you?

    The cloud is not valuable for its own sake, and not all users derive the same value

    • The cloud is characterized by on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Any or all of those characteristics might be enough to make the cloud appealing, but in most cases, there is an overriding driver.
    • Multiple paths may lead to the cloud. Consider an organization with a need to control costs by showing back to business units, or perhaps by reducing capital expenditure – the cloud may be the most appropriate way to effect these changes. Conversely, an organization expanding rapidly and with a need to access the latest and greatest technology might benefit from the elasticity and pooled resources that major cloud providers can offer.
    • In these cases, the destination might be the same (a cloud solution) but the delivery model – public, private, or hybrid – and the decisions made around the key strategy components, including architecture, provisioning, and cost management, will almost certainly be different.
    • Defining goals, understanding cloud drivers, and – crucially – understanding what success means, are all therefore essential elements of the cloud vision process.

    1.1.1 Generate organizational goals

    1-3 hours

    Input

    • Strategy documentation

    Output

    • Organizational goals

    Materials

    • Whiteboard (digital/physical)

    Participants

    • IT leadership
    • Infrastructure
    • Applications
    • Security
    1. As a group, brainstorm organizational goals, ideally based on existing documentation
      • Review relevant corporate and IT strategies.
      • If you do not have access to internal documentation, review the standard goals on the next slide and select those that are most relevant for you.
    2. Record the most important business goals in the Cloud Vision Executive Presentation. Include descriptions where possible to ensure wide readability.
    3. Make note of these goals. They should inform the answers to prompts offered in the Cloud Vision Workbook and should be a consistent presence in the remainder of the visioning exercise. If you’re conducting the session in person, leave the goals up on a whiteboard and make reference to them throughout the workshop.

    Cloud Vision Executive Presentation

    Standard COBIT 19 enterprise goals

    1. Portfolio of competitive products and services
    2. Managed business risk
    3. Compliance with external laws and regulations
    4. Quality of financial information
    5. Customer-oriented service culture
    6. Business service continuity and availability
    7. Quality of management information
    8. Optimization of internal business process functionality
    9. Optimization of business process costs
    10. Staff skills, motivation, and productivity
    11. Compliance with internal policies
    12. Managed digital transformation programs
    13. Product and business innovation

    1.1.2 Define cloud drivers

    30-60 minutes

    Input

    • Organizational goals
    • Strategy documentation
    • Management/staff perspective

    Output

    • List of cloud drivers

    Materials

    • Sticky notes
    • Whiteboard
    • Markers

    Participants

    • IT leadership
    • Infrastructure
    • Applications
    • Security
    1. Cloud drivers sit at a level of abstraction below organizational goals. Keeping your organizational goals in mind, have each participant in the session write down how they expect to benefit from the cloud on a sticky note.
    2. Solicit input one at a time and group similar responses. Encourage participants to bring forward their cloud goals even if similar goals have been mentioned previously. The number of mentions is a useful way to gauge the relative weight of the drivers.
    3. Once this is done, you should have a few groups of similar drivers. Work with the group to name each category. This name will be the driver reported in the documentation.
    4. Input the results of the exercise into the Cloud Vision Executive Presentation, and include descriptions based on the constituent drivers. For example, if a driver is titled “do more valuable work,” the constituent drivers might be “build cloud skills,” “focus on core products,” and “avoid administration work where possible.” The description would be based on these components.

    Cloud Vision Executive Presentation

    1.1.3 Define success indicators

    1 hour

    Input

    • Cloud drivers
    • Organizational goals

    Output

    • List of cloud driver success indicators

    Materials

    • Whiteboard
    • Markers

    Participants

    • IT leadership
    • Infrastructure
    • Applications
    • Security
    1. On a whiteboard, draw a table with each of the cloud drivers (identified in 1.1.2) across the top.
    2. Work collectively to generate success indicators for each cloud driver. In this case, a success indicator is some way you can report your progress with the stated driver. It is a real-world proxy for the sometimes abstract phenomena that make up your drivers. Think about what would be true if your driver was realized.
      1. For example, if your driver is “faster access to resources,” you might consider indicators like developer satisfaction, project completion time, average time to provision, etc.
    3. Once you are satisfied with your list of indicators, populate the slide in the Cloud Vision Executive Presentation for validation from stakeholders.

    Cloud Vision Executive Presentation

    Step 1.2

    Explore cloud characteristics

    Activities

    Understand the value of the cloud:

    • Review delivery models
    • Review support models
    • Review service models
    • Review migration paths

    Understand the Cloud

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    This step involves the following participants:

    • Core working group
    • Architecture
    • Engineering
    • Security

    Outcomes of this step

    • Understanding of cloud service models and value

    Defining the cloud

    Per NIST, the cloud has five fundamental characteristics. All clouds have these characteristics, even if they are executed in somewhat different ways between delivery models, service models, and even individual providers.

    Cloud characteristics

    On-demand self-service

    Cloud customers are capable of provisioning cloud resources without human interaction (e.g. contacting sales), generally through a web console.

    Broad network access

    Capabilities are designed to be delivered over a network and are generally intended for access by a wide variety of platform types (cloud services are generally device-agnostic).

    Resource pooling

    Multiple customers (internal, in the case of private clouds) make use of a highly abstracted shared infrastructure managed by the cloud provider.

    Rapid elasticity

    Customers are capable of provisioning additional resources as required, pulling from a functionally infinite pool of capacity. Cloud resources can be spun-down when no longer needed.

    Measured service

    Consumption is metered based on an appropriate unit of analysis (number of licenses, storage used, compute cycles, etc.) and billing is transparent and granular.

    Cloud delivery models

    The NIST definition of cloud computing outlines four cloud delivery models: public, private, hybrid, and community clouds. A community cloud is like a private cloud, but it is provisioned for the exclusive use of a like-minded group of organizations, usually in a mutually beneficial, non-competitive arrangement. Universities and hospitals are examples of organizations that can pool their resources in this way without impacting competitiveness. The Info-Tech model covers three key delivery models – public, private, and hybrid, and an overarching model (multi-cloud) that can comprise more than one of the other models – public + public, public + hybrid, etc.

    Public

    The cloud service is provisioned for access by the general public (customers).

    Private

    A private cloud has the five key characteristics, but is provisioned for use by a single entity, like a company or organization.

    Hybrid

    Hybridity essentially refers to interoperability between multiple cloud delivery models (public +private).

    Multi

    A multi-cloud deployment requires only that multiple clouds are used without any necessary interoperability (Nutanix, 2019).

    Public cloud

    This is what people generally think about when they talk about cloud

    • The public cloud is, well, public! Anyone can make use of its resources, and in the case of the major providers, capacity is functionally unlimited. Need to store exabytes of data in the cloud? No problem! Amazon will drive a modified shipping container to your datacenter, load it up, and “migrate” it to a datacenter.
    • Public clouds offer significant variety on the infrastructure side. Major IaaS providers, like Microsoft and Amazon, offer dozens of services across many different categories including compute, networking, and storage, but also identity, containers, machine learning, virtual desktops, and much, much more. (See a list from Microsoft here, and Amazon here)
    • There are undoubtedly strengths to the public cloud model. Providers offer the “latest and greatest” and customers need not worry about the details, including managing infrastructure and physical locations. Providers offer built-in redundancy, multi-regional deployments, automation tools, management and governance solutions, and a variety of leading-edge technologies that would not be feasible for organizations to run in-house, like high performance compute, blockchain, or quantum computing.
    • Of course, the public cloud is not all sunshine and rainbows – there are downsides as well. It can be expensive; it can introduce regulatory complications to have to trust another entity with your key information. Additionally, there can be performance hiccups, and with SaaS products, it can be difficult to monitor at the appropriate (per-transaction) level.

    Prominent examples include:

    AWS

    Microsoft

    Azure

    Salesforce.com

    Workday

    SAP

    Private cloud

    A lower-risk cloud for cloud-averse customers?

    • A cloud is a cloud, no matter how small. Some IT shops deploy private clouds that make use of the five key cloud characteristics but provisioned for the exclusive use of a single entity, like a corporation.
    • Private clouds have numerous benefits. Some potential cloud customers might be uncomfortable with the shared responsibility that is inherent in the public cloud. Private clouds allow customers to deliver flexible, measured services without having to surrender control, but they require significant overhead, capital expenditure, administrative effort, and technical expertise.
    • According to the 2021 State of the Cloud Report, private cloud use is common, and the most frequently cited toolset is VMware vSphere, followed by Azure Stack, OpenStack, and AWS Outposts. Private cloud deployments are more common in larger organizations, which makes sense given the overhead required to manage such an environment.

    Private cloud adoption

    The images shows a graph titled Private Cloud Adoption for Enterprises. It is a horizontal bar graph, with three segments in each bar: dark blue marking currently use; mid blue marking experimenting; and light blue marking plan to use.

    VMware and Microsoft lead the pack among private cloud customers, with Amazon and Red Hat also substantially present across private cloud environments.

    Hybrid cloud

    The best of both worlds?

    Hybrid cloud architectures combine multiple cloud delivery models and facilitate some level of interoperability. NIST suggests bursting and load balancing as examples of hybrid cloud use cases. Note: it is not sufficient to simply have multiple clouds running in parallel – there must be a toolset that allows for an element of cross-cloud functionality.

    This delivery model is attractive because it allows users to take advantage of the strengths of multiple service models using a single management pane. Bursting across clouds to take advantage of additional capacity or disaster recovery capabilities are two obvious use cases that appeal to hybrid cloud users.

    But while hybridity is all the rage (especially given the impact Covid-19 has had on the workplace), the reality is that any hybrid cloud user must take the good with the bad. Multiple clouds and a management layer can be technically complex, expensive, and require maintaining a physical infrastructure that is not especially valuable (“I thought we were moving to the cloud to get out of the datacenter!”).

    Before selecting a hybrid approach through services like VMware Cloud on AWS or Microsoft’s Azure Stack, consider the cost, complexity, and actual expected benefit.

    Amazon, Microsoft, and Google dominate public cloud IaaS, but IBM is betting big on hybrid cloud:

    The image is a screencap of a tweet from IBM News. The tweet reads: IBM CEO Ginni Rometty: Hybrid cloud is a trillion dollar market and we'll be number one #Think2019.

    With its acquisition of Red Hat in 2019 for $34 billion, Big Blue put its money where its mouth is and acquired a substantial hybrid cloud business. At the time of the acquisition, Red Hat’s CEO, Jim Whitehurst, spoke about the benefit IBM expected to receive:

    “Joining forces with IBM gives Red Hat the opportunity to bring more open source innovation to an even broader range of organizations and will enable us to scale to meet the need for hybrid cloud solutions that deliver true choice and agility” (Red Hat, 2019).

    Multi-cloud

    For most organizations, the multi-cloud is the most realistic option.

    Multi-cloud is popular!

    The image shows a graph titled Multi-Cloud Architectures Used, % of all Respondents. The largest percentage is Apps siloed on different clouds, followed by DAta integration between clouds.

    Multi-cloud solutions exist at a different layer of abstraction from public, private, and even hybrid cloud delivery models. A multi-cloud architecture, as the name suggests, requires the user to be a customer of more than one cloud provider, and it can certainly include a hybrid cloud deployment, but it is not bound by the same rules of interoperability.

    Many organizations – especially those with fewer resources or a lack of a use case for a private cloud – rely on a multi-cloud architecture to build applications where they belong, and they manage each environment separately (or occasionally with the help of cloud management platforms).

    If your data team wants to work in AWS and your enterprise services run on basic virtual machines in Azure, that might be the most effective architecture. As the Flexera 2021 State of the Cloud Report suggests, this architecture is far more common than the more complicated bursting or brokering architectures characteristic of hybrid clouds.

    NIST cloud service models

    Software as a service

    SaaS has exploded in popularity with consumers who wish to avail themselves of the cloud’s benefits without having to manage underlying infrastructure components. SaaS is simple, generally billed per-user per-month, and is almost entirely provider-managed.

    Platform as a service

    PaaS providers offer a toolset for their customers to run custom applications and services without the requirement to manage underlying infrastructure components. This service model is ideal for custom applications/services that don’t benefit from highly granular infrastructure control.

    Infrastructure as a service

    IaaS represents the sale of components. Instead of a service, IaaS providers sell access to components, like compute, storage, and networking, allowing for customers to build anything they want on top of the providers’ infrastructure.

    Cloud service models

    • This research focuses on five key service models, each of which has its own strengths and weaknesses. Moving right from “on-prem,” customers gradually give up more control over their environments to cloud service providers.
    • An entirely premises-based environment means that the customer is responsible for everything ranging from the dirt under the datacenter to application-level configurations. Conversely, in a SaaS environment, the provider is responsible for everything but those top-level application configurations.
    • A managed service provider or other third party can manage any or of the components of the infrastructure stack. A service provider may, for example, build a SaaS solution on top of another provider’s IaaS, or might offer configuration assistance with a commercially available SaaS.

    Info-Tech Insight

    Not all workloads fit well in the cloud. Many environments will mix service models (e.g. SaaS for some workloads, some in IaaS, some on-premises), and this can be perfectly effective. It must be consistent and intentional, however.

    On-prem Co-Lo IaaS PaaS SaaS
    Application Application Application Application Application
    Database Database Database Database Database
    Runtime/ Middleware Runtime/ Middleware Runtime/ Middleware Runtime/ Middleware Runtime/ Middleware
    OS OS OS OS OS
    Hypervisor Hypervisor Hypervisor Hypervisor Hypervisor
    Server Network Storage Server Network Storage Server Network Storage Server Network Storage Server Network Storage
    Facilities Facilities Facilities Facilities Facilities

    Organization has control

    Organization or vendor may control

    Vendor has control

    Analytics folly

    SaaS is good, but it’s not a panacea

    Industry: Healthcare

    Source: Info-Tech workshop

    Situation

    A healthcare analytics provider had already moved a significant number of “non-core workloads” to the cloud, including email, HRIS, and related services.

    The company CEO was satisfied with the reduced effort required by IT to manage SaaS-based workloads and sought to extend the same benefits to the core analytics platform where there was an opportunity to reduce overhead.

    Complication

    Many components of the health analytics service were designed to run specifically in a datacenter and were not ready to be migrated to the cloud without significant effort/refactoring. SaaS was not an option because this was a core platform – a SaaS provider would have been the competition.

    That left IaaS, which was expensive and would not bring the expected benefits (reduced overhead).

    Results

    The organization determined that there were no short-term gains from migrating to the cloud. Due to the nature of the application (its extensive customization, the fact that it was a core product sold by the company) any steps to reduce operational overhead were not feasible.

    The CEO recognized that the analytics platform was not a good candidate for the cloud and what distinguished the analytics platform from more suitable workloads.

    Migration paths

    In a 2016 blog post, Amazon Web Services articulated a framework for cloud migration that incorporates elements of the journey as well as the destination. If workload owners do not choose to retain or retire their workloads, there are four alternatives. These alternatives all stack up differently along five key dimensions:

    1. Value: does the workload stand to benefit from unique cloud characteristics? To what degree?
    2. Effort: how much work would be required to make the transition?
    3. Cost: how much money is the migration expected to cost?
    4. Time: how long will the migration take?
    5. Skills: what skills must be brought to bear to complete the migration?

    Not all migration paths can lead to all destinations. Rehosting generally means IaaS, while repurchasing leads to SaaS. Refactoring and replatforming have some variety of outcomes, and it becomes possible to take advantage of new IaaS architectures or migrate workloads over fully to SaaS.

    As part of the workload assessment process, use the five dimensions (expanded upon on the next slide) to determine what migration path makes sense. Preferred migration paths form an important part of the overall cloud vision process.

    Retain (Revisit)

    • Keep the application in its current form, at least for now. This doesn’t preclude revisiting it in the future.

    Retire

    • Get rid of the application completely.

    Rehost

    • Move the application to the cloud (IaaS) and continue to run it in more or less the same form as it currently runs.

    Replatform

    • Move the application to the cloud and perform a few changes for cloud optimizations.

    Refactor

    • Rewrite the application, taking advantage of cloud native architectures.

    Repurchase

    • Replace with an alternative, cloud-native application and migrate the data.

    Migration paths – relative value

    Migration path Value Effort Cost Time Skills
    Retain No real change in the absolute value of the workload if it is retained. No effort beyond ongoing workload maintenance. No immediate hard dollar costs, but opportunity costs and technical debt abound. No time required! (At least not right away…) Retaining requires the same skills it has always required (which may be more difficult to acquire in the future).
    Rehire A retired workload can provide no value, but it is not a drain! Spinning a service down requires engaging that part of the lifecycle. N/A Retiring the service may be simple or complicated depending on its current role. N/A
    Rehost Some value comes with rehosting, but generally components stay the same (VM here vs. a VM there). Minimal effort required, especially with automated tools. The effort will depend on the environment being migrated. Relatively cheap compared to other options. Rehosting infrastructure is the simplest cloud migration path and is useful for anyone in a hurry. Rehosting is the simplest cloud migration path for most workloads, but it does require basic familiarity with cloud IaaS.

    Replatform

    Replatformed workloads can take advantage of cloud-native services (SQL vs. SQLaaS). Replatforming is more effortful than rehosting, but less effortful than refactoring. Moderate cost – does not require fundamental rearchitecture, just some tweaking. Relatively more complicated than a simple rehost, but less demanding than a refactor. Platform and workload expertise is required; more substantial than a simple rehost.
    Refactor A fully formed, customized cloud-based workload that can take advantage of cloud-native architectures is generally quite valuable. Significant effort required based on the requirement to engage the full SDLC. Significant cost required to engage SDLC and rebuild the application/service. The most complicated and time-consuming. The most complicated and time-consuming.
    Repurchase Repurchasing is the quickest way to achieve cloud-native value. There are compromises, however (high cost, vendor-lock-in). Repurchasing is the quickest way to achieve cloud-native value. There are compromises, however (high cost, vendor-lock-in). Repurchasing is the quickest way to achieve cloud-native value. There are compromises, however (high cost, vendor-lock-in). Configuration – especially for massive projects – can be time consuming, but in general repurchasing can be quite fast. Buying software does require knowledge of requirements and integrations, but is otherwise quite simple.

    Where should you get your cloud skills?

    Cloud skills are certainly top of mind right now. With the great upheaval in both work patterns and in the labor market more generally, expertise in cloud-related areas is simultaneously more valuable and more difficult to procure. According to Pluralsight’s 2021 “State of Upskilling” report, 44% of respondents report themselves under-skilled in the cloud management area, making cloud management the most significant skill gap reported on the survey.

    Everyone left the office. Work as we know it is fundamentally altered for a generation or more. Cloud services shot up in popularity by enabling the transition. And yet there is a gap – a prominent gap – in skilling up for this critically important future. What is the cloud manager to do?

    Per the framework presented here, that manager has three essential options. They may take somewhat different forms depending on specific requirements and the quirks of the local market, but the options are:

    1. Train or hire internal resources: This might be easier said than done, especially for more niche skills, but makes sense for workloads that are critical to operations for the long term.
    2. Engage a managed service provider: MSPs are often engaged to manage services where internal IT lacks bandwidth or expertise.
    3. Hire a consultant: Consultants are great for time-bound implementation projects where highly specific expertise is required, such as a migration or implementation project.

    Each model makes sense to some degree. When evaluating individual workloads for cloud suitability, it is critical to consider the support model – both immediate and long term. What makes sense from a value perspective?

    Cloud decisions – summary

    A key component of the Info-Tech cloud vision model is that it is multi-layered. Not every decision must be made at every level. At the workload level, it makes sense to select service models that make sense, but each workload does not need its own defined vision. Workload-level decisions should be guided by an overall strategy but applied tactically, based on individual workload characteristics and circumstances.

    Conversely, some decisions will inevitably be applied at the environment level. With some exceptions, it is unlikely that cloud customers will build an entire private/hybrid cloud environment around a single solution; instead, they will define a broader strategy and fit individual workloads into that strategy.

    Some considerations exist at both the workload and environment levels. Risks and roadblocks, as well as the preferred support model, are concerns that exist at both the environment level and at the workload level.

    The image is a Venn diagram, with the left side titled Workload level, and the right side titled Environment Level. In the left section are: service model and migration path. On the right section are: Overall vision and Delivery model. In the centre section are: support model and Risks and roadblocks.

    Step 1.3

    Create a current state summary

    Activities

    1.3.1 Record your current state

    Understand the Cloud

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    This step involves the following participants: Core working group

    Outcomes of this step

    • Current state summary of cloud solutions

    1.3.1 Record your current state

    30 minutes

    Input

    • Knowledge of existing cloud workloads

    Output

    • Current state cloud summary for service, delivery, and support models

    Materials

    • Whiteboard

    Participants

    • Core working group
    • Infrastructure team
    • Service owners
    1. On a whiteboard (real or virtual) draw a table with each of the cloud service models across the top. Leave a cell below each to list examples.
    2. Under each service model, record examples present in your environment. The purpose of the exercise is to illustrate the existence of cloud services in your environment or the lack thereof, so there is no need to be exhaustive. Complete this in turn for each service model until you are satisfied that you have created an effective picture of your current cloud SaaS state, IaaS state, etc.
    3. Input the results into their own slide titled “current state summary” in the Cloud Vision Executive Presentation.
    4. Repeat for the cloud delivery models and support models and include the results of those exercises as well.
    5. Create a short summary statement (“We are primarily a public cloud consumer with a large SaaS footprint and minimal presence in PaaS and IaaS. We retain an MSP to manage our hosted telephony solution; otherwise, everything is handled in house.”

    Cloud Vision Executive Presentation

    Step 1.4

    Select workloads for current analysis

    Activities

    1.4.1 Select workloads for assessment

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • List of workloads for assessment

    Understand the cloud

    Generate goals and drivers

    Explore cloud characteristics

    Create a current state summary

    Select workloads for analysis

    1.4.1 Select workloads for assessment

    30 minutes

    Input

    • Knowledge of existing cloud workloads

    Output

    • List of workloads to be assessed

    Materials

    • Whiteboard
    • Cloud Vision Workbook

    Participants

    • Core working group
    • IT management
    1. In many cases, the cloud project is inspired by a desire to move a particular workload or set of workloads. Solicit feedback from the core working group about what these workloads might be. Ask everyone in the meeting to suggest a workload and record each one on a sticky note or white board (virtual or physical).
    2. Discuss the results with the group and begin grouping similar workloads together. They will be subject to the assessments in the Cloud Vision Workbook, so try to avoid selecting too many workloads that will produce similar answers. It might not be obvious, but try to think about workloads that have similar usage patterns, risk levels, and performance requirements, and select a representative group.
    3. You should embrace counterintuition by selecting a workload that you think is unlikely to be a good fit for the cloud if you can and subjecting it to the assessment as well for validation purposes.
    4. When you have a list of 4-6 workloads, record them on tab 2 of the Cloud Vision Workbook.

    Cloud Vision Workbook

    Assess your cloud workloads

    Build the foundations of your cloud vision

    Phase 2

    Phase 2

    Evaluate Cloud Workloads

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    • Conduct workload assessments
    • Determine workload future state

    This phase involves the following participants:

    • Subject matter experts
    • Core working group
    • IT management

    Define Your Cloud Vision

    Work from the bottom up and assess your workloads

    A workload-first approach will help you create a realistic vision.

    The concept of a cloud vision should unquestionably be informed by the nature of the workloads that IT is expected to provide for the wider organization. The overall cloud vision is no greater than the sum of its parts. You cannot migrate to the cloud in the abstract. Workloads need to go – and not all workloads are equally suitable for the transition.

    It is therefore imperative to understand which workloads are a good fit for the cloud, which cloud service models make the most sense, how to execute the migration, what support should look like, and what risks and roadblocks you are likely to encounter as part of the process.

    That’s where the Cloud Vision Workbook comes into play. You can use this tool to assess as many workloads as you’d like – most people get the idea after about four – and by the end of the exercise, you should have a pretty good idea about where your workloads belong, and you’ll have a tool to assess any net new or previously unconsidered workloads.

    It’s not so much about the results of the assessment – though these are undeniably important – but about the learnings gleaned from the collaborative assessment exercise. While you can certainly fill out the assessment without any additional input, this exercise is most effective when completed as part of a group.

    Introducing the Cloud Vision Workbook

    • The Cloud Vision Workbook is an Excel tool that answers the age old question: “What should I do with my workloads?”
    • It is divided into eight tabs, each of which offers unique value. Start by reading the introduction and inputting your list of workloads. Work your way through tabs 3-6, completing the suitability, migration, management, and risk and roadblock assessments, and review the results on tab 7.
    • If you choose to go through the full battery of assessments for each workload, expect to answer and weight 111 unique questions across the four assessments. This is an intensive exercise, so carefully consider which assessments are valuable to you, and what workloads you have time to assess.
    • Tab 8 hosts the milestone timeline and captures the results of the phase 3 risk and mitigation exercise.

    Understand Cloud Vision Workbook outputs

    The image shows a graphic with several graphs and lists on it, with sections highlighted with notes. At the top, there's the title Database with the note Workload title (populated from tab 2). Below that, there is a graph with the note Relative suitability of the five service models. The Risks and roadblocks section includes the note: The strategy components – the risks and roadblocks – are captured relative to one another to highlight key focus areas. To the left of that, there is a Notes section with the note Notes populated based on post-assessment discussion. At the bottom, there is a section titled Where should skills be procured?, with the note The radar diagram captures the recommended support model relative to the others (MSP, consultant, internal IT). To the right of that, there is a section titled Migration path, with the note that Ordered list of migration paths. Note: a disconnect here with the suggested service model may indicate an unrealistic goal state.

    Step 2.1

    Conduct workload assessments

    Activities

    2.1.1 Conduct workload assessments

    2.1.2 Interpret your results

    Phase Title

    Conduct workload assessments

    Determine workload future state

    This step involves the following participants:

    • Core working group
    • Workload subject matter experts

    Outcomes of this step

    • Completed workload assessments

    2.1.1 Conduct workload assessments

    2 hours per workload

    Input

    • List of workloads to be assessed

    Output

    • Completed cloud vision assessments

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    • Service owners/workload SMEs
    1. The Cloud Vision Workbook is your one stop shop for all things workload assessment. Open the tool to tab 2 and review the workloads you identified at the end of phase 1. Ensure that these are correct. Once satisfied, project the tool (virtually, if necessary) so that all participants can see the assessment questions.
    2. Work through tabs 3-6, answering the questions and assigning a multiplier for each one. A higher multiplier increases the relative weight of the question, giving it a greater impact on the overall outcome.
    3. Do your best to induce participants to offer opinions. Consensus is not absolutely necessary, but it is a good goal. Ask your participants if they agree with initial responses and occasionally take the opposite position (“I’m surprised you said agree – I would have thought we didn’t care about CapEx vs. OpEx”). Stimulate discussion.
    4. Highlight any questions that you will need to return to or run by someone not present. Include a placeholder answer, as the tool requires all cells to be filled for computation.

    Cloud Vision Workbook

    2.1.2 Interpret your results

    10 minutes

    Input

    • Completed cloud vision assessments

    Output

    • Shared understanding of implications

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    • Service owners/workload SMEs
    1. Once you’ve completed all 111 questions for each workload, you can review your results on tab 7. On tab 7, you will see four populated graphics: cloud suitability, migration path, “where should skills be procured?”, and risks and roadblocks. These represent the components of the overall cloud vision that you will present to stakeholders.
    2. The “cloud suitability” chart captures the service model that the assessment judges to be most suitable for the workload. Ask those present if any are surprised by the output. If there is any disagreement, discuss the source of the surprise and what a more realistic outcome would be. Revisit the assessment if necessary.
    3. Conduct a similar exercise with each of the other outputs. Does it make sense to refactor the workload based on its cloud suitability? Does the fact that we scored so highly on the “consultant” support model indicate something about how we handle upskilling internally? Does the profile of risks and roadblocks identified here align with expectations? What should be ranked higher? What about lower?
    4. Once everyone is generally satisfied with the results, close the tool and take a break! You’ve earned it.

    Cloud Vision Workbook

    Understand the cloud strategy components

    Each cloud strategy will take a slightly different form, but all should contain echoes of each of these components. This process will help you define your vision and direction, but you will need to take steps to execute on that vision. The remainder of the cloud strategy, covered in the related blueprint Document Your Cloud Strategy comprises these fourteen topics divided across three categories: people, governance, and technology. The workload assessment covers these under risks and roadblocks and highlights areas that may require specific additional attention. When interpreting the results, think of these areas as comprising things that you will need to do to make your vision a reality.

    People

    • Skills and roles
    • Culture and adoption
    • Governing bodies

    Governance

    • Architecture
    • Integration and interoperability
    • Operations management
    • Cloud portfolio management
    • Cloud vendor management
    • Finance management
    • Security
    • Data controls

    Technology

    • Monitoring
    • Provisioning
    • Migration

    Strategy component: People

    People form the core of any good strategy. As part of your cloud vision, you will need to understand the implications a cloud transition will have on your staff and users, whether those users are internal or external.

    Component Description Challenges
    Skills and roles The move to the cloud will require staff to learn how to handle new technology and new operational processes. The cloud is a different way of procuring IT resources and may require the definition of new roles to handle things like cost management and provisioning. Staff may not have the necessary experience to migrate to a cloud environment or to effectively manage resources once the cloud transition is made. Cloud skills are difficult to hire for, and with the ever-changing nature of the platforms themselves, this shows no sign of abating. Redefining roles can also be politically challenging and should be done with due care and consideration.
    Culture and adoption If you build it, they will come…right? It is not always the case that a new service immediately attracts users. Ensuring that organizational culture aligns with the cloud vision is a critical success factor. Equally important is ensuring that cloud resources are used as intended. Those unfamiliar with cloud resources may be less willing to learn to use them. If alternatives exist (e.g. a legacy service that has not been shut down), or if those detractors are influential, this resistance may impede your cloud execution. Also, if the cloud transition involves significant effort or a fundamental rework (e.g. a DevOps transition) this role redefinition could cause some internal turmoil.
    Governing bodies A large-scale cloud deployment requires formal governance. Formal governance requires a governing body that is ultimately responsible for designing the said governance. This could take the form of a “center of excellence” or may rest with a single cloud architect in a smaller, less complicated environment. Governance is difficult. Defining responsibilities in a way that includes all relevant stakeholders without paralyzing the decision-making process is difficult. Implementing suggestions is a challenge. Navigating the changing nature of service provision (who can provision their own instances or assign licenses?) can be difficult as well. All these concerns must be addressed in a cloud strategy.

    Strategy component: Governance

    Without guardrails, the cloud deployment will grow organically. This has strengths (people tend to adopt solutions that they select and deploy themselves), but these are more than balanced out by the drawbacks that come with inconsistency, poor administration, duplication of services, suboptimal costing, and any number of other unique challenges. The solution is to develop and deploy governance. The following list captures some of the necessary governance-related components of a cloud strategy.

    Component Description Challenges
    Architecture Enterprise architecture is an important function in any environment with more than one interacting workload component (read: any environment). The cloud strategy should include an approach to defining and implementing a standard cloud architecture and should assign responsibility to an individual or group. Sometimes the cloud transition is inspired by the desire to rearchitect. The necessary skills and knowledge may not be readily available to design and transition to a microservices-based environment, for example, vs. a traditional monolithic application architecture. The appropriateness of a serverless environment may not be well understood, and it may be the case that architects are unfamiliar with cloud best practices and reference architectures.
    Integration and interoperability Many services are only highly functional when integrated with other services. What is a database without its front-end? What is an analytics platform without its data lake? For the cloud vision to be properly implemented, a strategy for handling integration and interoperability must be developed. It may be as simple as “all SaaS apps must be compatible with Okta” but it must be there. Migration to the cloud may require a fundamentally new approach to integration, moving away from a point-to-point integrations and towards an ESB or data lake. In many cases, this is easier said than done. Centralization of management may be appealing, but legacy applications – or those acquired informally in a one-off fashion – might not be so easy to integrate into a central management platform.
    Operations management Service management (ITIL processes) must be aligned with your overall cloud strategy. Migrating to the cloud (where applicable) will require refining these processes, including incident, problem, request, change, and configuration management, to make them more suitable for the cloud environment. Operations management doesn’t go away in the cloud, but it does change in line with the transition to shared responsibility. Responding to incidents may be more difficult on the cloud when troubleshooting is a vendor’s responsibility. Change management in a SaaS environment may be more receptive than staff are used to as cloud providers push changes out that cannot be rolled back.

    Strategy component: Governance (cont.)

    Component Description Challenges
    Cloud portfolio management This component refers to the act of managing the portfolio of cloud services that is available to IT and to business users. What requirements must a SaaS service meet to be onboarded into the environment? How do we account for exceptions to our IaaS policy? What about services that are only available from a certain provider? Rationalizing services offers administrative benefits, but may make some tasks more difficult for end users who have learned things a certain way or rely on niche toolsets. Managing access through a service catalog can also be challenging based on buy-in and ongoing administration. It is necessary to develop and implement policy.
    Cloud vendor management Who owns the vendor management function, and what do their duties entail? What contract language must be standard? What does due diligence look like? How should negotiations be conducted? What does a severing of the relationship look like? Cloud service models are generally different from traditional hosted software and even from each other (e.g. SaaS vs. PaaS). There is a bit of a learning curve when it comes to dealing with vendors. Also relevant: the skills that it takes to build and maintain a system are not necessarily the same as those required to coherently interact with a cloud vendor.
    Finance management Cloud services are, by definition, subject to a kind of granular, operational billing that many shops might not be used to. Someone will need to accurately project and allocate costs, while ensuring that services are monitored for cost abnormalities. Cloud cost challenges often relate to overall expense (“the cloud is more expensive than an alternative solution”), expense variability (“I don’t know what my budget needs to be this quarter”), and cost complexity (“I don’t understand what I’m paying for – what’s an Elastic Beanstalk?”).
    Security The cloud is not inherently more or less secure than a premises-based alternative, though the risk profile can be different. Applying appropriate security governance to ensure workloads are compliant with security requirements is an essential component of the strategy.

    Technical security architecture can be a challenge, as well as navigating the shared responsibility that comes with a cloud transition. There are also a plethora of cloud-specific security tools like cloud access security brokers (CASBs), cloud security posture management (CSPM) solutions, and even secure access services edge (SASE) technology.

    Data controls Data residency, classification, quality, and protection are important considerations for any cloud strategy. With cloud providers taking on outsized responsibility, understanding and governing data is essential. Cloud providers like to abstract away from the end user, and while some may be able to guarantee residency, others may not. Additionally, regulations may prevent some data from going to the cloud, and you may need to develop a new organizational backup strategy to account for the cloud.

    Strategy component: Technology

    Good technology will never replace good people and effective process, but it remains important in its own right. A migration that neglects the undeniable technical components of a solid cloud strategy is doomed to mediocrity at best and failure at worst. Understanding the technical implications of the cloud vision – particularly in terms of monitoring, provisioning, and migration – makes all the difference. You can interpret the results of the cloud workload assessments by reviewing the details presented here.

    Component Description Challenges
    Monitoring The cloud must be monitored in line with performance requirements. Staff must ensure that appropriate tools are in place to properly monitor cloud workloads and that they are capturing adequate and relevant data. Defining requirements for monitoring a potentially unfamiliar environment can be difficult, as can consolidating on a monitoring solution that both meets requirements and covers all relevant areas. There may be some upskilling and integration work required to ensure that monitoring works as required.
    Provisioning How will provisioning be done? Who will be responsible for ensuring the right people have access to the right resources? What tooling must be deployed to support provisioning goals? What technical steps must be taken to ensure that the provisioning is as seamless as possible? There is the inevitable challenge of assigning responsibility and accountability in a changing infrastructure and operations environment, especially if the changes are substantial (e.g. a fundamental operating model shift, reoriented around the cloud). Staff may also need to familiarize themselves with cloud-based provisioning tools like Ansible, Terraform, or even CloudFormation.
    Migration The act of migrating is important as well. In some cases, the migration is as simple as configuring the new environment and turning it up (e.g. with a net new SaaS service). In other cases, the migration itself can be a substantial undertaking, involving large amounts of data, a complicated replatforming/refactoring, and/or a significant configuration exercise.

    Not all migration journeys are created equal, and challenges include a general lack of understanding of the requirements of a migration, the techniques that might be necessary to migrate to a particular cloud (there are many) and the disruption/risk associated with moving large amounts of data. All of these challenges must be considered as part of the overall cloud strategy, whether in terms of architectural principles or skill acquisition (or both!).

    Step 2.2

    Determine workload future state

    Activities

    2.2.1 Determine workload future state

    Conduct workload assessments

    Determine workload future state

    This step involves the following participants:

    • IT management
    • Core working group

    Outcomes of this step

    • Completed workload assessments
    • Defined workload future state

    2.2.1 Determine workload future state

    1-3 hours

    Input

    • Completed workload assessments

    Output

    • Preliminary future state outputs

    Materials

    • Cloud Vision Workbook
    • Cloud Vision Executive Presentation

    Participants

    • Core working group
    • Service owners
    • IT management
    1. After you’ve had a chance to validate your results, refer to tab 7 of the tool, where you will find a blank notes section.
    2. With the working group, capture your answers to each of the following questions:
      1. What service model is the most suitable for the workload? Why?
      2. How will we conduct the migration? Which of the six models makes the most sense? Do we have a backup plan if our primary plan doesn’t work out?
      3. What should the support model look like?
      4. What are some workload-specific risks and considerations that must be taken into account for the workload?
    3. Once you’ve got answers to each of these questions for each of the workloads, include your summary in the “notes” section of tab 7.

    Cloud Vision Executive Presentation

    Paste the output into the Cloud Vision Executive Presentation

    • The Cloud Vision Workbook output is a compact, consumable summary of each workload’s planned future state. Paste each assessment in as necessary.
    • There is no absolutely correct way to present the information, but the output is a good place to start. Do note that, while the presentation is designed to lead with the vision statement, because the process is workload-first, the assessments are populated prior to the overall vision in a bottom-up manner.
    • Be sure to anticipate the questions you are likely to receive from any stakeholders. You may consider preparing for questions like: “What other workloads fit this profile?” “What do we expect the impact on the budget to be?” “How long will this take?” Keep these and other questions in mind as you progress through the vision definition process.

    The image shows the Cloud Vision Workbook output, which was described in an annotated version in an earlier section.

    Info-Tech Insight

    Keep your audience in mind. You may want to include some additional context in the presentation if the results are going to be presented to non-technical stakeholders or those who are not familiar with the terms or how to interpret the outputs.

    Identify and Mitigate Risks

    Build the foundations of your cloud vision

    PHASE 3

    Phase 3

    Identify and Mitigate Risks

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    • Generate risks and roadblocks
    • Mitigate risks and roadblocks
    • Define roadmap initiatives

    This phase involves the following participants:

    • Core working group
    • Workload subject matter experts

    You know what you want to do, but what do you have to do?

    What questions remain unanswered?

    There are workload-level risks and roadblocks, and there are environment-level risks. This phase is focused primarily on environment-level risks and roadblocks, or those that are likely to span multiple workloads (but this is not hard and fast rule – anything that you deem worth discussing is worth discussing). The framework here calls for an open forum where all stakeholders – technical and non-technical, pro-cloud and anti-cloud, management and individual contributor – have an opportunity to articulate their concerns, however specific or general, and receive feedback and possible mitigation.

    Start by soliciting feedback. You can do this over time or in a single session. Encourage anyone with an opinion to share it. Focus on those who are likely to have a perspective that will become relevant at some point during the creation of the cloud strategy and the execution of any migration. Explain the preliminary direction; highlight any major changes that you foresee. Remind participants that you are not looking for solutions (yet), but that you want to make sure you hear any and every concern as early as possible. You will get feedback and it will all be valuable.

    Before cutting your participants loose, remind them that, as with all business decisions, the cloud comes with trade-offs. Not everyone will have every wish fulfilled, and in some cases, significant effort may be needed to get around a roadblock, risks may need to be accepted, and workloads that looked like promising candidates for one service model or another may not be able to realize that potential. This is a normal and expected part of the cloud vision process.

    Once the risks and roadblocks conversation is complete, it is the core working group’s job to propose and validate mitigations. Not every risk can be completely resolved, but the cloud has been around for decades – chances are someone else has faced a similar challenge and made it through relatively unscathed. That work will inevitably result in initiatives for immediate execution. Those initiatives will form the core of the initiative roadmap that accompanies the completed Cloud Vision Executive Presentation.

    Step 3.1

    Generate risks and roadblocks

    Activities

    3.1.1 Generate risks and roadblocks

    3.1.2 Generate mitigations

    Identify and mitigate risks

    Generate risks and roadblocks

    Mitigate risks and roadblocks

    Define roadmap initiatives

    This step involves the following participants:

    • Core working group
    • IT management
    • Infrastructure
    • Applications
    • Security
    • Architecture

    Outcomes of this step

    • List of risks and roadblocks

    Understand risks and roadblocks

    Risk

    • Something that could potentially go wrong.
    • You can respond to risks by mitigating them:
      • Eliminate: take action to prevent the risk from causing issues.
      • Reduce: take action to minimize the likelihood/severity of the risk.
      • Transfer: shift responsibility for the risk away from IT, towards another division of the company.
      • Accept: where the likelihood or severity is low, it may be prudent to accept that the risk could come to fruition.

    Roadblock

    • There are things that aren’t “risks” that we care about when migrating to the cloud.
    • We know, for example, that a complicated integration situation will create work items for any migration – this is not an “unknown.”
    • We respond to roadblocks by generating work items.

    3.1.1 Generate risks and roadblocks

    1.5 hours

    Input

    • Completed cloud vision assessments

    Output

    • List of risks and roadblocks

    Materials

    • Whiteboard
    • Sticky notes

    Participants

    • Core working group
    • Service owners/workload SMEs
    • Anyone with concerns about the cloud
    1. Gather your core working group – and really anyone with an intelligent opinion on the cloud – into a single meeting space. Give the group 5-10 minutes to list anything they think could present a difficulty in transitioning workloads to the cloud. Write each risk/roadblock on its own sticky note. You will never be 100% exhaustive, but don’t let anything your users care about go unaddressed.
    2. Once everyone has had time to write down their risks and roadblocks, have everyone share one by one. Make sure you get them all. Overlap in risks and roadblocks is okay! Group similar concerns together to give a sort of heat map of what your participants are concerned about. (This is called “affinity diagramming.”)
    3. Assign names to these categories. Many of these categories will align with the strategy components discussed in the previous phase (governance, security, etc.) but some will be specific whether by nature or by degree.
    4. Sort each of the individual risks into its respective category, collapsing any exact duplicates, and leaving room for notes and mitigations (see the next slide for a visual).

    Understand risks and roadblocks

    The image is two columns--on the left, the column is titled Affinity Diagramming. Below the title, there are many colored blocks, randomly arranged. There is an arrow pointing right, to the same coloured blocks, now sorted by colour. In the right column--titled Categorization--each colour has been assigned a category, with subcategories.

    Step 3.2

    Mitigate risks and roadblocks

    Activities

    3.2.1 Generate mitigations

    Identify and mitigate risks

    Generate risks and roadblocks

    Mitigate risks and roadblocks

    Define roadmap initiatives

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • List of mitigations

    Is the public cloud less secure?

    This is the key risk-related question that most cloud customers will have to answer at some point: does migrating to the cloud for some services increase their exposure and create a security problem?

    As with all good questions, the answer is “it depends.” But what does it depend on? Consider these cloud risks and potential mitigations:

    1. Misconfiguration: An error grants access to unauthorized parties (as happened to Capital One in 2019). This can be mitigated by careful configuration management and third-party tooling.
    2. Unauthorized access by cloud provider/partner employees: Though rare, it is possible that a cloud provider or partner can be a vector for a breach. Careful contract language, choosing to own your own encryption keys, and a hybrid approach (storing data on-premises) are some possible ways to address this problem.
    3. Unauthorized access to systems: Cloud services are designed to be accessed from anywhere and may be accessed by malicious actors. Possible mitigations include risk-based conditional access, careful identity access management, and logging and detection.

    “The cloud is definitely more secure in that you have much more control, you have much more security tooling, much more visibility, and much more automation. So it is more secure. The caveat is that there is more risk. It is easier to accidentally expose data in the cloud than it is on-premises, but, especially for security, the amount of tooling and visibility you get in cloud is much more than anything we’ve had in our careers on-premises, and that’s why I think cloud in general is more secure.” –Abdul Kittana, Founder, ASecureCloud

    Breach bests bank

    No cloud provider can protect against every misconfiguration

    Industry: Finance

    Source: The New York Times, CNET

    Background

    Capital One is a major Amazon Web Services customer and is even featured on Amazon’s site as a case study. That case study emphasizes the bank’s commitment to the cloud and highlights how central security and compliance were. From the CTO: “Before we moved a single workload, we engaged groups from across the company to build a risk framework for the cloud that met the same high bar for security and compliance that we meet in our on-premises environments. AWS worked with us every step of the way.”

    Complication

    The cloud migration was humming along until July 2019, when the bank suffered a serious breach at the hands of a hacker. That hacker was able to steal millions of credit card applications and hundreds of thousands of Social Security numbers, bank account numbers, and Canadian social insurance numbers.

    According to investigators and to AWS, the breach was caused by an open reverse proxy attack against a misconfigured web app firewall, not by an underlying vulnerability in the cloud infrastructure.

    Results

    Capital One reported that the breach was expected to cost it $150 million, and AWS fervently denied any blame. The US Senate got involved, as did national media, and Capital One’s CEO issued a public apology, writing, “I sincerely apologize for the understandable worry this incident must be causing those affected, and I am committed to making it right.”

    It was a bad few months for IT at Capital One.

    3.2.1 Generate mitigations

    3-4.5 hours

    Input

    • Completed cloud vision assessments

    Output

    • List of risks and roadblocks

    Materials

    • Whiteboard
    • Sticky notes

    Participants

    • Core working group
    • Service owners/workload SMEs
    • Anyone with concerns about the cloud
    1. Recall the four mitigation strategies: eliminate, reduce, transfer, or accept. Keep these in mind as you work through the list of risks and roadblocks with the core working group. For every individual risk or roadblock raised in the initial generation session, suggest a specific mitigation. If the concern is “SaaS providers having access to confidential information,” a mitigation might be encryption, specific contract language, or proof of certifications (or all the above).
    2. Work through this for each of the risks and roadblocks, identifying the steps you need to take that would satisfy your requirements as you understand them.
    3. Once you have gone through the whole list – ideally with input from SMEs in particular areas like security, engineering, and compliance/legal – populate the Cloud Vision Workbook (tab 8) with the risks, roadblocks, and mitigations (sorted by category). Review tab 8 for an example of the output of this exercise.

    Cloud Vision Workbook

    Cloud Vision Workbook – mitigations

    The image shows a large chart titled Risks, roadblocks, and mitigations, which has been annotated with notes.

    Step 3.3

    Define roadmap initiatives

    Activities

    3.3.1 Generate roadmap initiatives

    Identify and mitigate risks

    Generate risks and roadblocks

    Mitigate risks and roadblocks

    Define roadmap initiatives

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • Defined roadmap initiatives

    3.3.1 Generate roadmap initiatives

    1 hour

    Input

    • List of risk and roadblock mitigations

    Output

    • List of cloud initiatives

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Executing on your cloud vision will likely require you to undertake some key initiatives, many of which have already been identified as part of your mitigation exercise. On tab 8 of the Cloud Vision Workbook, review the mitigations you created in response to the risks and roadblocks identified. Initiatives should generally be assignable to a party and should have a defined scope/duration. For example, “assess all net new applications for cloud suitability” might not be counted as an initiative, but “design a cloud application assessment” would likely be.
    2. Design a timeline appropriate for your specific needs. Generally short-term (less than 3 months), medium-term (3-6 months), and long-term (greater than 6 months) will work, but this is entirely based on preference.
    3. Review and validate the parameters with the working group. Consider creating additional color-coding (highlighting certain tasks that might be dependent on a decision or have ongoing components).

    Cloud Vision Workbook

    Bridge the gap and create the vision

    Build the foundations of your cloud vision

    Phase 4

    Phase 4

    Bridge the Gap and Create the Vision

    Phase 1

    1.1 Generate goals and drivers

    1.2 Explore cloud characteristics

    1.3 Create a current state summary

    1.4 Select workloads for analysis

    Phase 2

    2.1 Conduct workload assessments

    2.2 Determine workload future states

    Phase 3

    3.1 Generate risks and roadblocks

    3.2 Mitigate risks and roadblocks

    3.3 Define roadmap initiatives

    Phase 4

    4.1 Review and assign work items

    4.2 Finalize cloud decision framework

    4.3 Create cloud vision

    This phase will walk you through the following activities:

    • Assign initiatives and propose timelines
    • Build a delivery model rubric
    • Build a service model rubric
    • Built a support model rubric
    • Create a cloud vision statement
    • Map cloud workloads
    • Complete the Cloud Vision presentation

    This phase involves the following participants:

    • IT management, the core working group, security, infrastructure, operations, architecture, engineering, applications, non-IT stakeholders

    Step 4.1

    Review and assign work items

    Activities

    4.1.1 Assign initiatives and propose timelines

    Bridge the gap and create the vision

    Review and assign work items

    Finalize cloud decision framework

    Create cloud vision

    This step involves the following participants:

    • Core working group
    • IT management

    Outcomes of this step

    • Populated cloud vision roadmap

    4.1.1 Assign initiatives and propose timelines

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Once the list is populated, begin assigning responsibility for execution. This is not a RACI exercise, so focus on the functional responsibility. Once you have determined who is responsible, assign a timeline and include any notes. This will form the basis of a more formal project plan.
    2. To assign the initiative to a party, consider 1) who will be responsible for execution and 2) if that responsibility will be shared. Be as specific as possible, but be sure to be consistent to make it easier for you to sort responsibility later on.
    3. When assigning timelines, we suggest including the end date (when you expect the project to be complete) rather than the start date, though whatever you choose, be sure to be consistent. Make use of the notes column to record anything that you think any other readers will need to be aware of in the future, or details that may not be possible to commit to memory.

    Cloud Vision Workbook

    Step 4.2

    Finalize cloud decision framework

    Activities

    4.2.1 Build a delivery model rubric

    4.2.2 Build a service model rubric

    4.2.3 Build a support model rubric

    Bridge the gap and create the vision

    Review and assign work items

    Finalize cloud decision framework

    Create cloud vision

    This step involves the following participants:

    • Core working group

    Outcomes of this step

    • Cloud decision framework

    4.2.1 Build a delivery model rubric

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    Participants

    • Core working group
    1. Now that we have a good understanding of the cloud’s key characteristics, the relative suitability of different workloads for the cloud, and a good understanding of some of the risks and roadblocks that may need to be overcome if a cloud transition is to take place, it is time to formalize a delivery model rubric. Start by listing the delivery models on a white board vertically – public, private, hybrid, and multi-cloud. Include a community cloud option as well if that is feasible for you. Strike any models that do not figure into your vision.
    2. Create a table style rubric for each delivery model. Confer with the working group to determine what characteristics best define workloads suitable for each model. If you have a hybrid cloud option, you may consider workloads that are highly dynamic; a private cloud hosted on-premises may be more suitable for workloads that have extensive regulatory requirements.
    3. Once the table is complete, include it in the Cloud Vision Executive Presentation.

    Cloud Vision Executive Presentation

    Vision for the cloud future state (example)

    Delivery model Decision criteria
    Public cloud
    • Public cloud is the primary destination for all workloads as the goal is to eliminate facilities and infrastructure management
    • Offers features, broad accessibility, and managed updates along with provider-managed facilities and hardware
    Legacy datacenter
    • Any workload that is not a good fit for the public cloud
    • Dependency (like a USB key for license validation)
    • Performance requirements (e.g. workloads highly sensitive to transaction thresholds)
    • Local infrastructure components (firewall, switches, NVR)

    Summary statement: Everything must go! Public cloud is a top priority. Anything that is not compatible (for whatever reason) with a public cloud deployment will be retained in a premises-based server closet (downgraded from a full datacenter). The private cloud does not align with the overall organizational vision, nor does a hybrid solution.

    4.2.2 Build a service model rubric

    1 hour

    Input

    • Output of workload assessments
    • Output of risk and mitigation exercise

    Output

    • Service model rubric

    Materials

    • Whiteboard
    • Cloud Vision Executive Presentation

    Participants

    • Core working group
    1. This next activity is like the delivery model activity, but covers the relevant cloud service models. On a whiteboard, make a vertical list of the cloud service models (SaaS, PaaS, IaaS, etc.) that will be considered for workloads. If you have an order of preference, place your most preferred at the top, your least preferred at the bottom.
    2. Describe the circumstances under which you would select each service model. Do your best to focus on differentiators. If a decision criterion appears for multiple service models, consider refining or excluding it. (For additional information, check out Info-Tech’s Reimagine IT Operations for a Cloud-First World blueprint.)
    3. Create a summary statement to capture your overall service model position. See the next slide for an example. Note: this can be incorporated into your cloud vision statement, so be sure that it reflects your genuine cloud preferences.
    4. Record the results in the Cloud Vision Executive Presentation.

    Cloud Vision Executive Presentation

    Vision for the cloud future state (example)

    Service model Decision criteria
    SaaS

    SaaS first; opt for SaaS when:

    • A SaaS option exists that meets all key business requirements
    • There is a strong desire to have someone else (the vendor) manage infrastructure components/the platform
    • Not particularly sensitive to performance thresholds
    • The goal is to transition management of the workload outside of IT
    • SaaS is the only feasible way to consume the desired service
    PaaS
    • Highly customized service/workload – SaaS not feasible
    • Still preferable to offload as much management as possible to third parties
    • Customization required, but not at the platform level
    • The workload is built using a standard framework
    • We have the time/resources to replatform
    IaaS
    • Service needs to be lifted and shifted out of the datacenter quickly
    • Customization is required at the platform level/there is value in managing components
    • There is no need to manage facilities
    • Performance is not impacted by hosting the workload offsite
    • There is value in right-sizing the workload over time
    On-premises Anything that does not fit in the cloud for performance or other reasons (e.g. licensing key)

    Summary statement: SaaS will be the primary service model. All workloads will migrate to the public cloud where possible. Anything that cannot be migrated to SaaS will be migrated to PaaS. IaaS is a transitory step.

    4.2.3 Build a support model rubric

    1 hour

    Input

    • Results of the cloud workload assessments

    Output

    • Support model rubric

    Materials

    • Whiteboard
    • Cloud Vision Executive Presentation

    Participants

    • Core working group
    1. The final rubric covered here is that for the support model. Where will you procure the skills necessary to ensure the vision’s proper execution? Much like the other rubric activities, write the three support models vertically (in order of preference, if you have one) on a whiteboard.
    2. Next to each model, describe the circumstances under which you would select each support model. Focus on the dimensions: the duration of the engagement, specialization required, and flexibility required. If you have existing rules/practices around hiring consultants/MSPs, consider those as well.
    3. Once you have a good list of decision criteria, form a summary statement. This should encapsulate your position on support models and should mention any notable criteria that will contribute to most decisions.
    4. Record the results in the Cloud Vision Executive Presentation.

    Cloud Vision Executive Presentation

    Vision for the cloud future state (example)

    Support model Decision criteria
    Internal IT

    The primary support model will be internal IT going forward

    • Chosen where the primary work required is administrative
    • Where existing staff can manage the service in the cloud easily and effectively
    • Where the chosen solution fits the SaaS service model
    Consultant
    • Where the work required is time-bound (e.g. a migration/refactoring exercise)
    • Where the skills do not exist in house, and where the skills cannot easily be procured (specific technical expertise required in areas of the cloud unfamiliar to staff)
    • Where opportunities for staff to learn from consultant SMEs are valuable
    • Where ongoing management and maintenance can be handled in house
    MSP
    • Where an ongoing relationship is valued
    • Where ongoing administration and maintenance are disproportionately burdensome on IT staff (or where this administration and maintenance is likely to be burdensome)
    • Where the managed services model has already been proven out
    • Where specific expertise in an area of technology is required but this does not rise to the need to hire an FTE (e.g. telephony)

    Summary statement: Most workloads will be managed in house. A consultant will be employed to facilitate the transition to micro-services in a cloud container environment, but this will be transitioned to in-house staff. An MSP will continue to manage backups and telephony.

    Step 4.3

    Create cloud vision

    Activities

    4.3.1 Create a cloud vision statement

    4.3.2 Map cloud workloads

    4.3.3 Complete the Cloud Vision Presentation

    Review and assign work items

    Finalize cloud decision framework

    Create cloud vision

    This step involves the following participants:

    • Core working group
    • IT management

    Outcomes of this step

    Completed Cloud Vision Executive Presentation

    4.3.1 Create a cloud vision statement

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Now that you know what service models are appropriate, it’s time to summarize your cloud vision in a succinct, consumable way. A good vision statement should have three components:
      • Scope: Which parts of the organization will the strategy impact?
      • Goal: What is the strategy intended to accomplish?
      • Key differentiator: What makes the new strategy special?
    2. On a whiteboard, make a chart with three columns (one column for each of the features of a good mission statement). Have the group generate a list of words to describe each of the categories. Ideally, the group will produce multiple answers for each category.
    3. Once you’ve gathered a few different responses for each category, have the team put their heads down and generate pithy mission statements that capture the sentiments underlying each category.
    4. Have participants read their vision statements in front of the group. Use the rest of the session to produce a final statement. Record the results in the Cloud Strategy Executive Presentation.

    Example vision statement outputs

    “IT at ACME Corp. hereby commits to providing clients and end users with an unparalleled, productivity-enabling technology experience, leveraging, insofar as it is possible and practical, cloud-based services.”

    “At ACME Corp. our employees and customers are our first priority. Using new, agile cloud services, IT is devoted to eliminating inefficiency, providing cutting-edge solutions for a fast-paced world, and making a positive difference in the lives of our colleagues and the people we serve.”

    As a global leader in technology, ACME Corp. is committed to taking full advantage of new cloud services, looking first to agile cloud options to optimize internal processes wherever efficiency gaps exist. Improved efficiency will allow associates to spend more time on ACME’s core mission: providing an unrivalled customer experience.”

    Scope

    Goal

    Key differentiator

    4.3.2 Map cloud workloads

    1 hour

    Input

    • List of workloads
    • List of acceptable service models
    • List of acceptable migration paths

    Output

    • Workloads mapped by service model/migration path

    Materials

    • Whiteboard
    • Sticky notes

    Participants

    • Core working group
    1. Now that you have defined your overall cloud vision as well as your service model options, consider aligning your service model preferences with your migration path preferences. Draw a table with your expected migration strategies across the top (retain, retire, rehost, replatform, refactor, repurchase, or some of these) and your expected service models across the side.
    2. On individual sticky notes, write a list of workloads in your environment. In a smaller environment, this list can be exhaustive. Otherwise take advantage of the list you created as part of phase 1 along with any additional workloads that warrant discussion.
    3. As a group, go through the list, placing the sticky notes first in the appropriate row based on their characteristics and the decision criteria that have already been defined, and then in the appropriate column based on the appropriate migration path. (See the next slide for an example of what this looks like.)
    4. Record the results in the Cloud Vision Executive Presentation. Note: not every cell will be filled; some migration path/service model combinations are impossible or otherwise undesirable.

    Cloud Vision Executive Presentation

    Example cloud workload map

    Repurchase Replatform Rehost Retain
    SaaS

    Office suite

    AD

    PaaS SQL Database
    IaaS File Storage DR environment
    Other

    CCTV

    Door access

    4.3.3 Complete the Cloud Vision Presentation

    1 hour

    Input

    • List of cloud initiatives

    Output

    • Initiatives assigned by responsibility and timeline

    Materials

    • Cloud Vision Workbook

    Participants

    • Core working group
    1. Open the Cloud Vision Executive Presentation to the second slide and review the templated executive brief. This comprises several sections (see the next slide). Populate each one:
      • Summary of the exercise
      • The cloud vision statement
      • Key cloud drivers
      • Risks and roadblocks
      • Top initiatives and next steps
    2. Review the remainder of the presentation. Be sure to elaborate on any significant initiatives and changes (where applicable) and to delete any slides that you no longer require.

    Cloud Vision Workbook

    Sample cloud vision executive summary

    • From [date to date], a cross-functional group representing IT and its constituents met to discuss the cloud.
    • Over the course of the week, the group identified drivers for cloud computing and developed a shared vision, evaluated several workloads through an assessment framework, identified risks, roadblocks, and mitigations, and finally generated initiatives and next steps.
    • From the process, the group produced a summary and a cloud suitability assessment framework that can be applied at the level of the workload.

    Cloud Vision Statement

    [Organization] will leverage public cloud solutions and retire existing datacenter and colocation facilities. This transition will simplify infrastructure administration, support, and security, while modernizing legacy infrastructure and reducing the need for additional capital expenditure.

    Cloud Drivers Retire the datacenter Do more valuable work
    Right-size the environment Reduce CapEx
    Facilitate ease of mgmt. Work from anywhere
    Reduce capital expenditure Take advantage of elasticity
    Performance and availability Governance Risks and roadblocks
    Security Rationalization
    Cost Skills
    Migration Remaining premises resources
    BC, backup, and DR Control

    Initiatives and next steps

    • Close the datacenter and colocation site in favor of a SaaS-first cloud approach.
    • Some workloads will migrate to infrastructure-as-a-service in the short term with the assistance of third-party consultants.

    Document your cloud strategy

    You did it!

    Congratulations! If you’ve made it this far, you’ve successfully articulated a cloud vision, assessed workloads, developed an understanding (shared with your team and stakeholders) of cloud concepts, and mitigated risks and roadblocks that you may encounter along your cloud journey. From this exercise, you should understand your mission and vision, how your cloud plans will interact with any other relevant strategic plans, and what successful execution looks like, as well as developing a good understanding of overall guiding principles. These are several components of your overall strategy, but they do not comprise the strategy in its entirety.

    How do you fix this?

    First, validate the results of the vision exercise with your stakeholders. Socialize it and collect feedback. Make changes where you think changes should be made. This will become a key foundational piece. The next step is to formally document your cloud strategy. This is a separate project and is covered in the Info-Tech blueprint Document Your Cloud Strategy.

    The vision exercise tells you where you want to go and offers some clues as to how to get there. The formal strategy exercise is a formal documentation of the target state, but also captures in detail the steps you’ll need to take, the processes you’ll need to refine, and the people you’ll need to hire.

    A cloud strategy should comprise your organizational stance on how the cloud will change your approach to people and human resources, technology, and governance. Once you are confident that you can make and enforce decisions in these areas, you should consider moving on to Document Your Cloud Strategy. This blueprint, Define Your Cloud Vision, often serves as a prerequisite for the strategy documentation conversation(s).

    Appendix

    Summary of Accomplishment

    Additional Support

    Research Contributors

    Related Info-Tech Research

    Vendor Resources

    Bibliography

    Summary of Accomplishment

    Problem Solved

    You have now documented what you want from the cloud, what you mean when you say “cloud,” and some preliminary steps you can take to make your vision a reality.

    You now have at your disposal a framework for identifying and evaluating candidates for their cloud suitability, as well as a series of techniques for generating risks and mitigations associated with your cloud journey. The next step is to formalize your cloud strategy using the takeaways from this exercise. You’re well on your way to a completed cloud strategy!

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

    Contact your account representative for more information.

    workshops@infotech.com

    1-888-670-8889

    Additional Support

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech Workshop.

    Contact your account representative for more information.

    workshops@infotech.com 1-888-670-8889

    To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

    Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    Generate drivers for cloud adoption

    Work with stakeholders to understand the expected benefits of the cloud migration and how these drivers will impact the overall vision.

    Conduct workload assessments

    Assess your individual cloud workloads for their suitability as candidates for the cloud migration.

    Bibliography

    “2021 State of the Cloud Report.” Flexera, 2021. Web.

    “2021 State of Upskilling Report.” Pluralsight, 2021. Web.

    “AWS Snowmobile.” Amazon Web Services, n.d. Web.

    “Azure products.” Microsoft, n.d. Web.

    “Azure Migrate Documentation.” Microsoft, n.d. Web.

    Bell, Harold. “Multi-Cloud vs. Hybrid Cloud: What’s the Difference?” Nutanix, 2019. Web.

    “Cloud Products.” Amazon Web Services, n.d. Web.

    “COBIT 2019 Framework: Introduction and Methodology.” ISACA, 2019. Web.

    Edmead, Mark T. “Using COBIT 2019 to Plan and Execute an Organization’s Transformation Strategy.” ISACA, 2020. Web.

    Flitter, Emily, and Karen Weise. “Capital One Data Breach Compromises Data of Over 100 Million.” The New York Times, 29 July 2019. Web.

    Gillis, Alexander S. “Cloud Security Posture Management (CSPM).” TechTarget, 2021. Web.

    “’How to Cloud’ with Capital One.” Amazon Web Services, n.d. Web.

    “IBM Closes Landmark Acquisition of Red Hat for $34 Billion; Defines Open, Hybrid Cloud Future.” Red Hat, 9 July 2019. Web.

    Mell, Peter, and Timothy Grance. “The NIST Definition of Cloud Computing.” National Institute of Standards and Technology, Sept. 2011. Web.

    Ng, Alfred. “Amazon Tells Senators it Isn't to Blame for Capital One Breach.” CNET, 2019. Web.

    Orban, Stephen. “6 Strategies for Migrating Applications to the Cloud.” Amazon Web Services, 2016. Web.

    Sullivan, Dan. “Cloud Access Security Broker (CASB).” TechTarget, 2021. Web.

    “What Is Secure Access Service Edge (SASE)?” Cisco, n.d. Web.

    Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

    • Buy Link or Shortcode: {j2store}416|cart{/j2store}
    • member rating overall impact: 9.0/10 Overall Impact
    • member rating average dollars saved: $38,999 Average $ Saved
    • member rating average days saved: 17 Average Days Saved
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity
    • Writing SOPs is the last thing most people want to do, so the work gets pushed down the priority list and the documents become dated.
    • Most organizations know it is good practice to have SOPs as it improves consistency, facilitates process improvement, and contributes to efficient operations.
    • Though the benefits are understood, many organizations don't have SOPs and those that do don't maintain them.

    Our Advice

    Critical Insight

    • Create visual documents, not dense SOP manuals.
    • Start with high-impact SOPs, and identify the most critical undocumented SOPs and address them first.
    • Integrate SOP creation into project requirements and create SOP approval steps to ensure documentation is reviewed and completed in a timely fashion.

    Impact and Result

    • Create visual documents that can be scanned. Flowcharts, checklists, and diagrams are quicker to create, take less time to update, and are ultimately more usable than a dense manual.
    • Use simple but effective document management practices.
    • Make SOPs part of your project deliverables rather than an afterthought. That includes checking documentation status as part of your change management process.

    Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind – Make SOPs work for you with visual documents that are easier to create and more effective for process management and optimization.

    Learn best practices for creating, maintaining, publishing, and managing effective SOP documentation.

    • Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind – Phases 1-3

    2. Standard Operating Procedures Workbook and Document Management Checklist – Prioritize, optimize, and document critical SOPs.

    Identify required documentation and prioritize them according to urgency and impact.

    • Standard Operating Procedures Workbook
    • Document Management Checklist

    3. Process Templates and Examples – Review and assess templates to find samples that are fit for purpose.

    Review the wide variety of samples to see what works best for your needs.

    • Standard Operating Procedures Project Roadmap Tool
    • System Recovery Procedures Template
    • Application Development Process – AppDev Example (Visio)
    • Application Development Process – AppDev Example (PDF)
    • Network Backup for Atlanta Data Center – Backups Example
    • DRP Recovery Workflow Template (PDF)
    • DRP Recovery Workflow Template (Visio)
    • Employee Termination Process Checklist – IT Security Example
    • Sales Process for New Clients – Sales Example (Visio)
    • Sales Process for New Clients – Sales Example (PDF)
    • Incident and Service Management Procedures – Service Desk Example (Visio)
    • Incident and Service Management Procedures – Service Desk Example (PDF)
    [infographic]

    Further reading

    Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

    Change your focus from satisfying auditors to driving process optimization, consistent IT operations, and effective knowledge transfer.

    Project Outline

    Two flowcharts are depicted. The first is labelled 'Executive Brief' and the second is labelled 'Tools and Templates Roadmap'. Both outline the following project.

    ANALYST PERSPECTIVE

    Do your SOPs drive process optimization?

    "Most organizations struggle to document and maintain SOPs as required, leading to process inconsistencies and inefficiencies. These breakdowns directly impact the performance of IT operations. Effective SOPs streamline training and knowledge transfer, improve transparency and compliance, enable automation, and ultimately decrease costs as processes improve and expensive breakdowns are avoided. Documenting SOPs is not just good practice; it directly impacts IT efficiency and your bottom line."

    Frank Trovato, Senior Manager, Infrastructure Research Info-Tech Research Group

    Our understanding of the problem

    This Research Is Designed For:

    • IT Process Owners
    • IT Infrastructure Managers
    • IT Service Managers
    • System Administrators
    • And more…

    This Research Will Help You:

    • Identify, prioritize, and document SOPs for critical business processes.
    • Discover opportunities for overall process optimization by documenting SOPs.
    • Develop documentation best practices that support ongoing maintenance and review.

    This Research Will Also Assist:

    • CTOs
    • Business unit leaders

    This Research Will Help Them:

    • Understand the need for and value of documenting SOPs in a usable format.
    • Help set expectations around documentation best practices.
    • Extend IT best practices to other parts of the business.

    Executive summary

    Situation

    • Most organizations know it is good practice to have SOPs as it improves consistency, facilitates process improvement, and contributes to efficient operations.
    • Though the benefits are understood, many organizations don't have SOPs and those that do don't maintain them.

    Complication

    • Writing SOPs is the last thing most people want to do, so the work gets pushed down the priority list and the documents become dated.
    • Promoting the use of SOPs can also face staff resistance as the documentation is seen as time consuming to develop and maintain, too convoluted to be useful, and generally out of date.

    Resolution

    • Overcome staff resistance while implementing a sustainable SOP documentation approach by doing the following:
      • Create visual documents that can be scanned. Flowcharts, checklists, and diagrams are quicker to create, take less time to update, and are ultimately more usable than a dense manual.
      • Use simple, but effective document management practices.
      • Make SOPs part of your project deliverables rather than an afterthought. That includes checking documentation status as part of your change management process.
    • Extend these principles to other areas of IT and business processes. The survey data and examples in this report include application development and business processes as well as IT operations.

    Info-Tech Insight

    1. Create visual documents, not dense SOP manuals.
    2. Start with high-impact SOPs. Identify the most critical undocumented SOPs and document them first.
    3. Integrate SOP creation into project requirements and create SOP approval steps to ensure documentation is reviewed and completed in a timely fashion.

    Most organizations struggle to create and maintain SOP documents, especially in North America, despite the benefits

    North American companies are traditionally more technology focused than process focused, and that is reflected in the approach to documenting SOPs.

    • An ad hoc approach to SOPs almost certainly means documents will be out of date and ineffective. The same is also true when updating SOPs as part of periodic concerted efforts to prepare for an audit, annual review, or certification process, and this makes the task more imposing.
    • Incorporating SOP updates as part of regular change management processes ensures documents are up to date and usable. This can also make reviews and audits much more manageable.

    'It isn’t unusual for us to see infrastructure or operations documentation that is wildly out of date. We’re talking months, even years. Often it was produced as one big effort and then not reliably maintained.'

    – Gary Patterson, Consultant, Quorum Resources

    Organizations are most likely to update documents on an ad hoc basis or via periodic formal reviews. Less than 25% keep SOPs updated as needed.

    Graph depicting North America versus Asia and Europe practices of document updates

    Source: Info-Tech Research Group; N=104

    Document SOPs to improve knowledge transfer, optimize processes, and ultimately save money

    Benefits of documented SOPs Impact of undocumented/undefined SOPs
    Improved training and knowledge transfer: Routine tasks can be delegated to junior staff (freeing senior staff to work on higher priority tasks). Without documented SOPs: Tasks will be difficult to delegate, key staff become a bottleneck, knowledge transfer is inconsistent, and there is a longer onboarding process for new staff.
    IT automation, process optimization, and consistent operations: Defining, documenting, and then optimizing processes enables IT automation to be built on sound processes, so consistent positive results can be achieved. Without documented SOPs: IT automation built on poorly defined, unoptimized processes leads to inconsistent results.
    Compliance: Compliance audits are more manageable because the documentation is already in place. Without documented SOPs: Documenting SOPs to prepare for an audit becomes a major time-intensive project.
    Transparency: Visually documented processes answer the common business question of “why does that take so long?” Without documented SOPs: Other areas of the organization may not understand how IT operates, which can lead to confusion and unrealistic expectations.
    Cost savings: Work can be assigned to the lowest level of support cost, IT operations achieve greater efficiency, and expensive breakdowns are avoided. Without documented SOPs: Work may be distributed uneconomically, money may be wasted through inefficient processes, and the organization is vulnerable to costly disruptions.

    COBIT, ISO, and ITIL aren’t a complete solution

    "Being ITIL and ISO compliant hasn’t solved our documentation problem. We’re still struggling."

    – Vendor Relationship Manager, Financial Services Industry

    • Adopting a framework such as ITIL, COBIT, or ISO doesn’t always mean that SOP documents are accurate, effective, or up to date.
    • Although these frameworks emphasize the importance of documenting processes, they tend to focus more on process development and requirements than on actual documentation. In other words, they deal more with what needs to be done than with how to do it.
    • This research will focus more on the documentation process itself – so how to go about creating, updating, optimizing, managing, and distributing SOP documents.

    Inadequate SOPs lead to major data loss and over $99,000 in recovery costs

    CASE STUDY 1

    Company A mid-sized US organization with over 1,000 employees

    Source Info-Tech Interview

    Situation

    • IT supports storage nodes replicated across two data centers. SOPs for backup procedures did not include an escalation procedure for failed backups or a step to communicate successful backups. Management was not aware of the issue and therefore could not address it before a failure occurred.

    Incident

    • Primary storage had a catastrophic failure, and that put pressure on the secondary storage, which then also failed. All active storage failed and the data corrupted. Daily backups were failing due to lack of disk space on the backup device. The organization had to resort to monthly tape backups.

    Impact

    • Lost 1 month of data (had to go back to the last tape backup).
    • Recovery also took much longer because recovery procedures were also not documented.
    • Key steps such as notifying impacted customers were overlooked. Customers were left unhappy not only with the outage and data loss but also the lack of communication.
    Hard dollar recovery costs
    Backup specialist (vendor) to assist with restoring data from tape $12,000
    Temps to re-enter 1 month of data $5,000
    Weekend OT for 4 people (approximately 24 hours per person) $5,538
    Productivity cost for affected employees for 1 day of downtime $76,923
    Total $99,462

    Intangible costs

    High “goodwill” impact for internal staff and customers.

    "The data loss pointed out a glaring hole in our processes – the lack of an escalation procedure. If I knew backups weren’t being completed, I would have done something about that immediately."

    – Senior Division Manager, Information Technology Division

    IT services company optimizes its SOPs using “Lean” approach

    CASE STUDY 2

    Company Atrion

    SourceInfo-Tech Interview

    Lean and SOPs

    • Standardized work is important to Lean’s philosophy of continuous improvement. SOPs allow for replication of the current best practices and become the baseline standard for member collaboration toward further improvements.
    • For more on Lean’s approach to SOPs, see “Lean Six Sigma Quality Transformation Toolkit (LSSQTT) Tool #17.”

    Atrion’s approach

    • Atrion is focused on documenting high-level processes that improve the client and employee experience or which can be used for training.
    • Cross-functional teams collaborate to document a process and find ways to optimize that SOP.
    • Atrion leverages visual documentation as much as possible: flowcharts, illustrations, video screen captures, etc.

    Outcomes

    • Large increase in usable, up-to-date documentation.
    • Process and efficiency improvements realized and made repeatable.
    • Success has been so significant that Atrion is planning to offer SOP optimization training and support as a service for its clients in the future.

    Atrion

    • Atrion provides IT services, solutions, and leadership to clients in the 250+ user range.
    • After adopting the Lean framework for its organization, it has deliberately focussed on optimizing its documentation.

    When we initiated a formal process efficiency program a little over a year ago and began striving towards a culture of continuous improvement, documenting our SOPs became key. We capture how we do things today and how to make that process more efficient. We call it current state and future state mapping of any process.

    – Michelle Pope, COO, Atrion Networking Corp.

    Strategies to overcome common documentation challenges

    Use Info-Tech’s methodology to streamline the SOP documentation process.

    Common documentation challenges Info-Tech’s methodology
    Where to start. For organizations with very few (if any) documented SOPs, the challenge is where to start. Apply a client focus to prioritize SOPs. Start with mission-critical operations, service management, and disaster recovery.
    Lack of time. Writing SOPs is viewed as an onerous task, and IT staff typically do not like to write documentation or lack the time. Use flowcharts, checklists, and diagrams over traditional dense manuals. Flowcharts, checklists, and diagrams take less time to create and maintain, and the output is far more usable than traditional manuals.
    Inconsistent document management. Documents are unorganized, e.g. hard to find documents, or you don’t know if you have the correct, latest version. Keep it simple. You don’t need a full-time SOP librarian if you stick to a simple, but consistent approach to documentation management. Simple is easier to follow (therefore, be consistent).
    Documentation is not maintained. More urgent tasks displace documentation efforts. There is little real motivation for staff to keep documents current. Ensure accountability at the individual and project level. Incorporate documentation requirements into performance evaluations, project planning, and change control procedures.

    Use this blueprint as a building block to complete these other Info-Tech projects

    Improve IT-Business Alignment Through an Internal SLA

    Understand business requirements, clarify capabilities, and close gaps.

    Standardize the Service Desk – Module 2 & 3

    Improve reporting and management of incidents and build service request workflows.

    Create a Right-Sized Disaster Recovery Plan

    Define appropriate objectives for DR, build a roadmap to close gaps, and document your incident response plan.

    Extend the Service Desk to the Enterprise

    Position IT as an innovator.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Create Visual SOP Documents – project overview

    1. Prioritize, optimize, and document critical SOPs 2. Establish a sustainable documentation process 3. Identify a content management solution
    Best-Practice Toolkit

    1.1 Identify and prioritize undocumented/outdated critical processes

    1.2 Reduce effort and improve usability with visual documentation

    1.3 Optimize and document critical processes

    2.1 Establish guidelines for identifying and organizing SOPs

    2.2 Write an SOP for creating and maintaining SOPs

    2.3 Plan SOP working sessions to put a dent into your documentation backlog

    3.1 Understand the options when it comes to content management solutions

    3.2 Use Info-Tech’s evaluation tool to determine the right approach for you

    Guided Implementations
    • Identify undocumented critical SOPs.
    • Understand the benefits of a visual approach.
    • Work through a tabletop exercise to document two visual SOP documents.
    • Establish documentation information guidelines.
    • Identify opportunities to create a culture that fosters SOP creation.
    • Address outstanding undocumented SOPs by working through process issues together.
    • Review your current approach to content management and discuss possible alternatives.
    • Evaluate options for a content management strategy, in the context of your own environment.
    Onsite Workshop Module 1:

    Identify undocumented critical processes and review the SOP mapping process.

    Module 2:

    Review and improve your documentation process and address your documentation backlog.

    Module 3:

    Evaluate strategies for publishing and managing SOP documentation.

    Phase 1 Outcome:
      Review and implement the process for creating usable SOPs.
    Phase 2 Outcome:
      Optimize your SOP maintenance processes.
    Phase 3 Outcome:
      Choose a content management solution that meets your needs.

    Workshop overview

    Contact your account representative or email Workshops@InfoTech.com for more information.

    Workshop Prep Workshop Day 1 Workshop Day 2 Workshop Day 3 Workshop Day 4
    Activities Scope the SOP pilot and secure resources
    • Identify the scope of the pilot project.
    • Develop a list of processes to document.
    • Ensure required resources are available.
    Prioritize SOPs and review methodology

    1.1 Prioritize undocumented SOPs.

    1.2 Review the visual approach to SOP planning.

    1.3 Conduct a tabletop planning exercise.

    Review SOPs and identify process gaps

    2.1 Continue the tabletop planning exercise with other critical processes.

    2.2 Conduct a gap analysis to identify solutions to issues discovered during SOP mapping.

    Identify projects to meet process gaps

    3.1 Develop a prioritized project roadmap to address gaps.

    3.2 Define a process for documenting and maintaining SOPs.

    3.3 Identify and assign actions to improve SOP management and maintenance.

    Set next steps and put a dent in your backlog

    4.1 Run an SOP working session with experts and process owners to put a dent in the documentation backlog.

    4.2 Identify an appropriate content management solution.

    Deliverables
    1. Defined scope for the workshop.
    2. A longlist of key processes.
    1. Undocumented SOPs prioritized according to business criticality and current state.
    2. One or more documented SOPs.
    1. One or more documented SOPs.
    2. Gap analysis.
    1. SOP Project Roadmap.
    2. Publishing and Document Management Solution Evaluation Tool.
    1. Multiple documented SOPs.
    2. Action steps to improve SOP management and maintenance.

    Measured value for Guided Implementations (GIs)

    Engaging in GIs doesn’t just offer valuable project advice, it also results in significant cost savings.

    GI Measured Value
    Phase 1: Prioritize, optimize, and document critical SOPs
    • Time, value, and resources saved using Info-Tech’s methodology to prioritize and document SOPs in the ideal visual format.
    • For example, 4 FTEs*4 days*$80,000/year = $5,120
    Phase 2: Establish a sustainable documentation process
    • Time, value, and resources saved using our tools and methodology to implement a process to ensure SOPs are maintained, accessible, and up to date.
    • For example: 4 FTEs*5 days*$80,000/year = $6,400
    Phase 3: Identify a content management solution
    • Time, value, and resources saved using our best-practice guidance and tools to select an approach and solution to manage your organization’s SOPs.
    • For example: 2 FTEs*5 days*$80,000/year = $3,200
    Total Savings $14,720

    Note: Documenting SOPs provides additional benefits that are more difficult to quantify: reducing the time spent by staff to find or execute processes, improving transparency and accountability, presenting opportunities for automation, etc.

    Phase 1

    Prioritize, Optimize, and Document Critical SOPs

    Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

    Phase 1 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 1: Prioritize, optimize, and document critical SOPs

    Proposed Time to Completion (in weeks): 2 weeks

    Step 1.1: Prioritize SOPs

    Start with an analyst kick off call:

    • Apply a client focus to critical IT services.
    • Identify undocumented, critical SOPs.

    Then complete these activities…

    • Rank and prioritize your SOP documentation needs.

    With this template:

    Standard Operating Procedures Workbook

    Step 1.2: Develop visual documentation

    Review findings with analyst:

    • Understand the benefits of a visual approach.
    • Review possibilities for visual documentation.

    Then complete these activities…

    • Identify formats that can improve your SOP documentation.

    With these templates:

    • Example DRP Process Flows
    • Example App Dev Process And more…

    Step 1.3: Optimize and document critical processes

    Finalize phase deliverable:

    • Two visual SOP documents, mapped using a tabletop exercise.

    Then complete these activities…

    • Create the visual SOP.
    • Review and optimize the process.

    With this tool:

    SOP Project Roadmap Tool

    Phase 1 Results & Insights:

    Identify opportunities to deploy visual documentation, and follow Info-Tech’s process to capture steps, gaps, and opportunities to improve IT processes.

    Focus first on client-facing and high-impact SOPs

    IT’s number one obligation to internal and external customers is to keep critical services running – that points to mission-critical operations, service management, and disaster recovery.

    Topic Description
    Mission-critical operations
    • Maintenance processes for mission-critical systems (e.g. upgrade procedures, batch processing, etc.).
    • Client-facing services with either formal or informal SLAs.
    • Change management – especially for mission-critical systems, change management is more about minimizing risk of downtime than expediting change.
    Service management
    • Service desk procedures (e.g. ticket assignment and issue response).
    • Escalation procedures for critical outages.
    • System monitoring.
    Disaster recovery procedures
    • Management-level incident response plans, notification procedures, and high-level failover procedures (e.g. which systems must come up first, second, third).
    • Recovery or failover procedures for individual systems.
    • Backup and restore procedures – to ensure backups are available if needed.

    Understand what makes an application or service mission critical

    When email or a shared drive goes down, it may impact productivity, but may not be a significant impact to the business. Ask these questions when assessing whether an application or service is mission critical.

    Criteria Description
    Is there a hard-dollar impact from downtime?
    • For example, when an online catalog system goes down, it impacts sales and therefore revenue. Without determining the actual financial impact, you can make an immediate assessment that this is a Gold system.
    • By contrast, loss of email may impact productivity but may not affect revenue streams, depending on your business. A classification of Silver is most likely appropriate.
    Impact on goodwill/customer trust?
    • If downtime means delays in service delivery or otherwise impacts goodwill, there is an intangible impact on revenue that may make the associated systems Gold status.
    Is regulatory compliance a factor?
    • If a system requires redundancy and/or high availability due to legal or regulatory compliance requirements, it may need to be classified as a Gold system.
    Is there a health or safety risk?
    • For example, police and medical organizations have systems that are mission critical due to their impact on health and safety rather than revenue or cost, and therefore are classified as Gold systems. Are there similar considerations in your organization?

    "Email and other Windows-based applications are important for our day-to-day operations, but they aren’t critical. We can still manufacture and ship clothing without them. However, our manufacturing systems, those are absolutely critical"

    – Bob James, Technical Architect, Carhartt, Inc.

    Create a high-level risk and benefit scale

    1.1a

    15 minutes

    Define criteria for high, medium, and low risks and benefits, as shown in the example below. These criteria will be used in the upcoming exercises to rank SOPs.

    Note: The goal in this section is to provide high-level indicators of which SOPs should be documented first, so a high-level set of criteria is used. To conduct a detailed business impact analysis, see Info-Tech’s Create a Right-Sized Disaster Recovery Plan.

    Materials

    • Whiteboard

    Participants

    • Process Owners
    • SMEs
    Risk to the business Score
    Low: Affects ad hoc activities or non-critical data. 1
    Moderate: Impacts productivity and internal goodwill. 2
    High: Impacts revenue, safety, and external goodwill. 3
    Benefit (e.g. productivity improvement) Score
    Low: Minimal impact. 1
    Moderate: Items with short-term or occasional applicability, so limited benefit. 2
    High: Save time for common or ongoing processes, and extensive improvement to training/knowledge transfer. 3

    Identify and prioritize undocumented mission-critical operations

    1.1b

    15 minutes

    1. To navigate to this exercise, open Info-Tech’s Standard Operating Procedures Workbook.
    2. List your top three–five mission critical applications or services.
    3. Identify relevant SOPs that support those applications or services.
    4. Indicate SOP status: Green = up to date and complete, Yellow = out-of-date or incomplete, Red = undocumented.
    5. Assign risk and benefit scores (3=high, 1=low) to Yellow and Red SOPs based on potential impact if those processes failed (risk) and opportunity for process improvement (benefit).

    OUTPUT

    • Analysis of SOPs supporting mission-critical operations

    Materials

    • Whiteboard

    Participants

    • Process Owners
    • SMEs
    Application SOPs Status Risk Benefit
    Enterprise Resource Planning (ERP)
    • System administration (user administration, adding projects, etc.).
    Red 1 2
    • System upgrades (including OS upgrades and patches).
    Red 2 2
    • Report generation.
    Green n/a n/a
    Network services
    • Network monitoring (including fault detection).
    Yellow 3 2
    • Network upgrades.
    Red 2 1
    • Backup procedures.
    Yellow 3 1

    Identify and prioritize undocumented service management procedures

    1.1c

    15 minutes

    1. To navigate to this exercise, open Info-Tech’s Standard Operating Procedures Workbook.
    2. Identify service management SOPs.
    3. Indicate SOP status: Green = up to date and complete, Yellow = out-of-date or incomplete, Red = undocumented.
    4. Assign risk and benefit scores (3=high, 1=low) to Yellow and Red SOPs based on potential impact if those processes failed (risk) and opportunity for process improvement (benefit).

    OUTPUT

    • Analysis of SOPs supporting service management

    Materials

    • Whiteboard

    Participants

    • Process Owners
    • SMEs
    Service Type SOPs Status Risk Benefit
    Service Request
    • Software install
    Red 3 1
    • Software update
    Yellow 3 1
    • New hardware
    Green n/a n/a
    Incident Management
    • Ticket entry and triage
    Yellow 3 2
    • Ticket escalation
    Red 2 1
    • Notification for critical issues
    Yellow 3 1

    Identify and prioritize undocumented DR procedures

    1.1d

    20 minutes

    1. To navigate to this exercise, open Info-Tech’s Standard Operating Procedures Workbook.
    2. Identify DR SOPs.
    3. Indicate SOP status: Green = up to date and complete, Yellow = out-of-date or incomplete, Red = undocumented.
    4. Assign risk and benefit scores (3=high, 1=low) to Yellow and Red SOPs based on potential impact if those processes failed (risk) and opportunity for process improvement (benefit).

    OUTPUT

    • Analysis of SOPs supporting DR

    Materials

    • Whiteboard

    Participants

    • Process Owners
    • SMEs
    DR Phase SOPs Status Risk Benefit
    Discovery and Declaration
    • Initial detection and escalation
    Red 3 1
    • Notification procedures to Emergency Response Team (ERT)
    Yellow 3 1
    • Notification procedures to staff
    Green n/a n/a
    Recover Gold Systems
    • ERP recovery procedures
    Red 2 2
    • Corporate website recovery procedures
    Yellow 3 2
    Recover Silver Systems
    • MS Exchange recovery procedures
    Red 2 1

    Select the SOPs to focus on for the first round of documentation

    1.1e

    20 minutes

    1. Identify two significantly different priority 1 SOPs to document during this workshop. It’s important to get a sense of how the Info-Tech templates and methodology can be applied to different types of SOPs.
    2. Rank the remaining SOPs that you still need to address post-workshop by priority level within each topic area.

    INPUT

    • SOP analysis from activities 1.1 and 1.2

    OUTPUT

    • A shortlist of critical, undocumented SOPs to review later in this phase

    Materials

    • Whiteboard

    Participants

    • Process Owners
    • SMEs
    Category Area SOPs Status Risk Benefit
    Disaster Recovery Procedures Discovery and Declaration
    • Initial detection and escalation
    Red 3 1
    • Notification procedures to ERT
    Yellow 3 1
    Mission-Critical Operations Network Services
    • Network monitoring (including fault detection)
    Yellow 3 2
    Service Management Procedures Incident Management
    • Ticket entry and triage
    Yellow 3 2

    Change the format of your documentation

    Which document is more effective? Which is more likely to be used?

    "The end result for most SOPs is a 100-page document that makes anyone but the author want to stab themselves rather than read it. Even worse is when you finally decide to waste an hour of your life reading it only to be told afterwards that it might not be quite right because Bob or Stan needed to make some changes last year but never got around to it."

    – Peter Church, Solutions Architect

    Create visual-based documentation to improve usability and effectiveness

    "Without question, 300-page DRPs are not effective. I mean, auditors love them because of the detail, but give me a 10-page DRP with contact lists, process flows, diagrams, and recovery checklists that are easy to follow."

    – Bernard Jones, MBCI, CBCP, CORP, Manager Disaster Recovery/BCP, ActiveHealth Management

    SOPs, including those that support your disaster recovery plan (DRP), are often created to meet certification requirements. However, this often leads to lengthy overly detailed documentation that is geared to auditors and business leaders, not IT staff trying to execute a procedure in a high-pressure, time-sensitive scenario.

    Staff don’t have time to flip through a 300-page manual, let alone read lengthy instructions, so organizations are transforming monster manuals into shorter, visual-based documentation. Benefits include:

    • Quicker to create than lengthy manuals.
    • Easier to be absorb, so they are more usable.
    • More likely to stay up to date because they are easier to maintain.

    Example: DRPs that include visual SOPs are easier to use — that leads to shorter recovery times and fewer mistakes.

    Chart is depicted showing the success rates of traditional manuals versus visual documentation.

    Use flowcharts for process flows or a high-level view of more detailed procedures

    • Flowcharts depict who does what and when; they provide an at-a-glance view that is easy to follow and makes task ownership clear.
    • Use swim lanes, as in this example, to indicate process stages and task ownership.
    • For experienced staff, a high-level reminder of process flows or key steps is sufficient.
    • Where more detail is required, include links to supporting documentation (which could include checklists, vendor documentation, other flowcharts, etc.).

    See Info-Tech’s Incident and Service Management Procedures – Service Desk Example.

    "Flowcharts are more effective when you have to explain status and next steps to upper management."

    – Assistant Director-IT Operations, Healthcare Industry

    Example: SOP in flowchart format

    A flowchart is depicted as an example flowchart. This one is an SOP flowchart labelled 'Triage Process - Incidents'

    Review your options for diagramming software

    Many organizations look for an option that easily integrates with the MS Office suite. The default option is often Microsoft Visio.

    Pros:

    • Easy to learn and use.
    • Has a wide range of features and capabilities.
    • Comes equipped with a large collection of stencils and templates.
    • Offers the convenience of fluid integration with the MS Office Suite.

    Cons:

    • Isn’t included in any version of the MS Office Suite and can be quite expensive to license.
    • Not available for Mac or Linux environments.

    Consider the options below if you’re looking for an alternative to Microsoft Visio:

    Desktop Solutions

    • Dia Diagram Editor
    • Diagram Designer
    • LibreOffice Draw
    • Pencil Project
    • yEd Graph Editor

    • Draw.io
    • Creately
    • Gliffy
    • LucidChart

    Note: No preference or recommendation is implied from the ordering of the options above.

    This list is not intended to be comprehensive.

    Evaluate different solutions to identify one that works for you

    Use the criteria below to identify a flowchart software that fits your needs.

    Criteria Description
    Platform What platform(s) can run the software?
    Description What use cases are identified by the vendor – and do these cover your needs for documenting your SOPs? Is the software open source?
    Features What are the noteworthy features and characteristics?
    Usability How easy is the program to use? What’s the learning curve like? How intuitive is the design?
    Templates and Stencils Availability of templates and stencils.
    Portability Can the solution integrate with other pieces of software? Consider whether other tools can view, open, and/or edit documents; what file formats can be published, etc.
    Cost Cost of the software to purchase or license.

    Use checklists to streamline step-by-step procedures

    • Checklists are ideal when staff just need a reminder of what to do, not how to do it.
    • Remember your audience. You aren’t pulling in a novice to run a complex procedure, so all you really need here are a series of reminders.
    • Where more detail is required, include links to supporting documentation.
    • Note that a flowchart can often be used instead of a checklist, depending on preference.

    For two different examples of a checklist template, see:

    Image depicting an example checklist. This checklist depicts an employee termination checklist

    Use topology diagrams to capture network layout, integrations, and system information

    • Organizations commonly have network topology diagrams for reference purposes, so this is just a re-use of existing resources.
    • Physically label real world equipment to correspond to topology diagrams. While these labels will be redundant for most IT employees, they help give clarity and confidence when changes are being made.
    • If your topology diagrams are housed in a tool such as a systems management product, then export the diagrams so they can be included in your SOP documentation suite.

    "Our network engineers came to me and said our standard SOP template didn't work for them. They're now using a lot of diagrams and flowcharts, and that has worked out better for them."

    The image shows a topology organization diagram as an example network layout

    Use screen captures and tutorials to facilitate training for applications and SOPs

    • Screen capture tutorials or videos are effective for training staff on applications. For example, create a screen capture tutorial to train staff on the use of a help desk application and your company’s specific process for using that tool.
    • Similarly, create tutorials to train end users on straightforward “technical” tasks (e.g. setting up their VPN connection) to reduce the demand on IT staff.
    • Tutorials can be created quickly and easily with affordable software such as Snag-It, ScreenHunter Pro, HyperSnap, PicPick, FastStone, Ashampoo Snap 6, and many others.

    "When contractors come onboard, they usually don't have a lot of time to learn about the organization, and we have a lot of unique requirements. Creating SOP documents with screenshots has made the process quicker and more accurate."

    – Susan Bellamore, Business Analyst, Public Guardian and Trustee of British Columbia

    The image is an example of a screen caption tutorial, depicting desktop icons and a password login

    Example: Disaster recovery notification and declaration procedure

    1. Swim lanes indicate task ownership and process stages.
    2. Links to supporting documentation (which could include checklists, vendor documentation, other flowcharts, etc.) are included where necessary.
    3. Additional DR SOPs are captured within the same spreadsheet for convenient, centralized access.

    Review Info-Tech’s Incident Response and Recovery Process Flows – DRP Example.

    Example: DRP flowchart with links to supporting documents

    The image is an example of an DRP flowchart labelled 'Initial Discovery/Notification and Declaration Procedures'

    Establish flowcharting standards

    If you don’t have existing flowchart standards, then keep it simple and stick to basic flowcharting conventions as described below.

    Start, End, and Connector. Traditional flowcharting standards reserve this shape for connectors to other flowcharts or other points in the existing flowchart. Unified Modeling Language (UML) also uses the circle for start and end points.

    Start, End. Traditional flowcharting standards use this for start and end. However, Info-Tech recommends using the circle shape to reduce the number of shapes and avoid confusion with other similar shapes.

    Process Step. Individual process steps or activities (e.g. create ticket or escalate ticket). If it’s a series of steps, then use the sub-process symbol and flowchart the sub-process separately.

    Sub-Process. A series of steps. For example, a critical incident SOP might reference a recovery process as one of the possible actions. Marking it as a sub-process, rather than listing each step within the critical incident SOP, streamlines the flowchart and avoids overlap with other flowcharts (e.g. the recovery process).

    Decision. Represents decision points, typically with Yes/No branches, but you could have other branches depending on the question (e.g. a “Priority?” question could branch into separate streams for Priority 1, 2, 3, 4, and 5 issues).

    Document/Report Output. For example, the output from a backup process might include an error log.

    Conduct a tabletop planning exercise to build an SOP

    1.3a

    20 minutes

    Tabletop planning is a paper-based exercise where your team walks through a particular process and maps out what happens at each stage.

    1. For this exercise, choose one particular process to document.
    2. Document each step of the process using cue cards, which can be arranged on the table in sequence.
    3. Be sure to include task ownership in your steps.
    4. Map out the process as it currently happens – we’ll think about how to improve it later.
    5. Keep focused. Stay on task and on time.

    OUTPUT

    • Steps in the current process for one SOP

    Materials

    • Tabletop, pen, and cue cards

    Participants

    • Process Owners
    • SMEs

    Info-Tech Insight

    Don’t get weighed down by tools. Relying on software or other technological tools can detract from the exercise. Use simple tools such as cue cards to record steps so that you can easily rearrange steps or insert steps based on input from the group.

    The image depicts three cue cards labelled steps 3 to 5. The cue cards are examples of the tabletop planning exercise.

    Collaborate to optimize the SOP

    1.3b

    20 minutes

    Review the tabletop exercise. What gaps exist in current processes?

    How can the process be made better? What are the outputs and checkpoints?

    The image depicts five cue cards, two of which are examples on how to improve the process. This is an example of the tabletop exercise.

    OUTPUT

    • Identify steps to optimize the SOP

    Materials

    • Tabletop, pen, and cue cards

    Participants

    • Process Owners
    • SMEs

    A note on colors: Use white cards to record steps. Record gaps on yellow cards (e.g. a process step not documented) and risks on red cards (e.g. only one person knows how to execute a step) to highlight your gaps/to-dos and risks to be mitigated or accepted.

    If it’s necessary to clarify complex process flows during the exercise, also use green cards for decision diamonds, purple for document/report outputs, and blue for sub-processes.

    Capture opportunities to improve processes in the Standard Operating Procedures Project Roadmap Tool

    1.3

    Rank and track projects to close gaps you discover in your processes.

    1. As a group, identify potential solutions to close the gaps in your processes that you’ve uncovered through the tabletop mapping exercise.
    2. Add these project names to the Standard Operating Procedures Project Roadmap Tool on the “Project Scoring” tab.
    3. Review and adjust the criteria for evaluating the benefits and costs of different projects on the “Scoring Criteria” tab.
    4. Return to the “Project Scoring” tab, and assign weights at the top of each scoring column. Use the drop-down menus to adjust the scores for each project category. The tool will automatically rank the projects based on your input, but you can adjust the ranks as needed.
    5. Assign dates and descriptions to the projects on the “Implementation Schedule” tab, below.
    The image depicts a graph showing an example of ranked and tracked projects.

    Identify gaps to improve process performance and make SOP documentation a priority

    CASE STUDY

    Industry Government (700+ FTEs)
    Source Info-Tech Workshop

    Challenge

    • Tabletop planning revealed a 77-hour gap between current and desired RTO for critical systems.
    • Similarly, the current achievable RPO gap was up to one week, but the desired RPO was one hour.
    • A DR site was available but not yet set up with the necessary equipment.
    • Lack of documented standard operating procedures (SOPs) was identified as a risk since that increased the dependence on two or three key SMEs.

    Solution

    • Potential projects to close RTO/RPO gaps were identified, including:
      • Deploy servers that were decommissioned (as a result of a server refresh) to the DR site as warm standby servers.
      • Implement site-to-site data replication.
      • Document SOPs to enable tasks to be delegated and minimize resourcing risks.

    Results

    • A DR project implementation schedule was defined.
    • Many of the projects required no further investment, but rather deployment of existing equipment that could function as standby equipment at the DR site.
    • The DR risk from a lack of SOPs enabled SOPs to be made a priority. An expected side benefit is the ability to review and optimize processes and improve consistency in IT operations.

    Document the SOPs from the tabletop exercise

    1.3c

    20 minutes

    Document the results from the tabletop exercise in the appropriate format.

    1. Identify an appropriate visual format for the high-level SOP as well as for any sub-processes or supporting documentation.
    2. Break into groups of two or three.
    3. Each group will be responsible for creating part of the SOP. Include both the high-level SOP itself and any supporting documentation such as checklists, sign-off forms, sub-processes, etc.
    4. Once your document is complete, exchange it with that of another group. Review each other’s documents to check for clarity and completeness.

    OUTPUT

    • Output from activities 1.4 and 1.5

    Materials

    • Flowcharting software, laptops

    Participants

    • Process Owners
    • SMEs

    This image has four cue cards, and an arrow pointing to a flowchart, depicting the transfer of the information on the cue cards into a flowchart software

    Repeat the tabletop exercise for the second process

    Come back together as a large group. Choose a process that is significantly different from the one you’ve just documented, and repeat the tabletop exercise.

    As a reminder, the steps are:

    1. Use the tabletop exercise to map out a current SOP.
    2. Collaborate to optimize the SOP.
    3. Decide on appropriate formats for the SOP and its supporting documents.
    4. Divide into small groups to create the SOP and its supporting documents.
    5. Repeat the steps above as needed for your initial review of critical processes.

    Info-Tech Insight

    If you plan to document more than two or three SOPs at once, consider making it an SOP “party” to add momentum and levity to an otherwise dry process. Review section 2.3 to find out how.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    1.1a-e

    Get started by prioritizing SOPs

    Ensure the SOP project remains business focused, and kick off the project by analyzing critical business services. Identify key IT services that support the relevant business services. Conduct a benefit/risk analysis to prioritize which SOPs should become the focus of the workshop.

    1.3a-c

    Document the SOPs from the tabletop exercise

    Leverage a tabletop planning exercise to walk the team through the SOP. During the exercise, focus on identifying timelines, current gaps, and potential risks. Document the steps via que cards first and transpose the hard copies to an electronic version.

    Phase 2

    Establish a Sustainable Documentation Process

    Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

    Phase 2 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 2: Establish a sustainable SOP documentation process

    Proposed Time to Completion (in weeks): 4 weeks

    Step 2.1: Establish guidelines for identifying and organizing SOPs

    Start with an analyst call:

    • Establish documentation information guidelines.
    • Review version control best practices.

    Then complete these activities…

    • Implement best practices to identify and organize your SOPs.

    With these tools & templates:

    • SOP Workbook

    Step 2.2: Define a process to document and maintain SOPs

    Review findings with analyst:

    • Identify opportunities to create a culture that fosters SOP creation.

    Then complete these activities…

    • Create a plan to address SOP documentation gaps.

    With these tools & templates:

    • Document Management Checklist

    Step 2.3: Plan time with experts to put a dent in your documentation backlog

    Finalize phase deliverable:

    • Address outstanding undocumented SOPs by working through process issues together.

    Then complete these activities…

    • Organize and run a working session to document and optimize processes.

    With these tools & templates:

    • SOP Workbook
    • SOP Project Roadmap Tool

    Phase 2 Results & Insights:

    Improve the process for documenting and maintaining your SOPs, while putting a dent in your documentation backlog and gaining buy-in with staff.

    Identify current content management practices and opportunities for improvement

    DISCUSS

    What is the current state of your content management practices?

    Are you using a content management system? If not, where are documents kept?

    Are your organizational or departmental SOPs easy to find?

    Is version control a problem? What about file naming standards?

    Get everyone on the same page on the current state of your SOP document management system, using the questions above as the starting point.

    Keep document management simple for better adoption and consistency

    If there is too much complexity and staff can’t easily find what they need, you won’t get buy-in and you won’t get consistency.

    Whether you store SOPs in a sophisticated content management system (CMS) or on a shared network drive, keep it simple and focus on these primary goals:

    • Enable staff to find the right document.
    • Know if a document is the latest, approved version.
    • Minimize document management effort to encourage buy-in and consistency.

    If users can’t easily find what they need, it leads to bad practices. For example:

    • Users maintain their own local copies of commonly used documents to avoid searching for them. The risk is that local copies will not be automatically updated when the SOP changes.
    • Separate teams will implement their own document management system and repository. Now you have duplication of effort and company resources, multiple copies of documents (where each group needs their own version), and no centralized control over potentially sensitive documents.
    • Users will ignore documented SOPs or ask a colleague who might also be following the above bad practices.

    Insert a document information block on the first page of every document to identify key attributes

    Include a document information block on the first page of every document to identify key attributes. This strategy is as much about minimizing resistance as it is ensuring key attributes are captured.

    • A consistent document information block saves time (e.g. vs. customized approaches per document). If some fields don’t apply, enter “n/a.”
    • It provides key information about the document without having to check soft copy metadata, especially if you work with hard copies.
    • It’s a built-in reminder of what to capture and easier than updating document properties or header/footer information or entering metadata into a CMS.

    Note: The Info-Tech templates in this blueprint include a copy of the document information block shown in this example. Add more fields if necessary for your organization’s needs.

    For an example of a completed document information block, see Network Backup for Atlanta Data Center – Backups Example

    Info-Tech Insight

    For organizations with more advanced document management requirements, consider more sophisticated strategies (e.g. using metadata) as described in Info-Tech’s Use SharePoint for Enterprise Content Management and Reintroduce the Information Lifecycle to the Content Management Strategy. However, the basic concepts above still apply: establish standard attributes you need to capture and do so in a consistent manner.

    Modify the Info-Tech document information block to meet your requirements

    2.1a

    15 minutes

    1. Review “Guidelines and Template for the Document Information Block” in the Standard Operating Procedures Workbook. Determine if any changes are required, such as additional fields.
    2. Identify which fields you want to standardize and then establish standard terms. Balance the needs for simplicity and consistency – don’t force consistency where it isn’t a good fit.
    3. Pre-fill the document information block with standard terms and examples and add it to an SOP template that’s stored in your content management system.

    Educate staff by pre-filling the document

    • Providing examples built into the templates provides in-context, just-in-time training which is far more effective and easier than formal education efforts.
    • Focus your training on communicating when the template or standard terms change so that staff know to obtain the new version. Otherwise, the tendency for many staff will be to use one of their existing documents as their template.

    OUTPUT

    • Completed document information block

    Materials

    • Laptop
    • Projector

    Participants

    • Process Owners
    • SMEs

    Leverage the document information block to create consistent filenames that facilitate searching

    Use the following filename format to create consistent, searchable, and descriptive filenames:

    Topic – Document Title – Document Type – Version Date

    Filename Component Purpose
    Topic
    • Functions as a filename prefix to group related documents but is also a probable search term. For project work, use a project name/number.
    Document Title
    • The title should be fairly descriptive of the content (if it isn’t, it’s not a good title) so it will help make the file easily identifiable and will include more probable search terms.
    Document Type Further distinguishes similar files (e.g. Maintenance SOP vs. a Maintenance Checklist).
    Version Date (for local files or if not using a CMS)
    • If it’s necessary to work on a file locally, include the version date at the end of the filename. The date is a more recognizable indicator of whether it’s the latest version or an old copy.
    • Establish a standard date format. Although MM-DD-YY is common in the US, the format YYYY-MM-DD reduces confusion between the month and day.

    For example:

    • ERP – System Administration Monthly Maintenance Tasks – Checklist – 2016-01-15.docx
    • ERP – System Administration Monthly Maintenance Tasks – SOP – 2017-01-10.docx
    • Backups – Network Backup Procedure for Atlanta Data Center – SOP – 2017-03-06.docx
    • PROJ437 – CRM Business Requirements – BRD – 2017-02-01.xlsx
    • DRP – Notification Procedures – SOP – 2016-09-14.docx
    • DRP – Emergency Response Team Roles and Responsibilities – Reference – 2018-03-10.xlsx

    Apply filename and document information block guidelines to existing SOPs

    2.1b

    15 minutes

    1. Review the SOPs created during the earlier exercises.
    2. Update the filenames and document information block based on guidelines in this section.
    3. Apply these guidelines to other select existing SOPs to see if additional modifications are required (e.g. additional standard terms).

    INPUT

    • Document Information Block

    OUTPUT

    • Updated filenames and document information blocks

    Materials

    • Laptop and projector

    Participants

    • Process Owners
    • SMEs

    Implement version control policies for local files as well as those in your content management system (CMS)

    1. Version Control in Your CMS

    2. Always keep one master version of a document:

    • When uploading a new copy of an existing SOP (or any other document), ensure the filenames are identical so that you are just adding a new version rather than a separate new file.
    • Do not include version information in the filename (which would create a new separate file in your CMS). Allow your CMS to handle version numbering.
  • Version Control for Local Files

  • Ideally, staff would never keep local copies of files. However, there are times when it is practical or preferable to work from a local copy: for example, when creating or updating an SOP, or when working remotely if the CMS is not easily accessible.

    Implement the following policies to govern these circumstances:

    • Add the version date to the end of the filename while the document is local, as shown in the slide on filenames.
    • Remove the date when uploading it to a CMS that tracks date and version. If you leave the date in the filename, you will end up with multiple copies in your CMS.
    • When distributing copies for review, upload a copy to the CMS and send the link. Do not attach a physical file.
  • Minimize the Need for Version Updates

  • Reduce the need for version updates by isolating volatile information in a separate, linked document. For example:

    • Use Policy documents to establish high-level expectations and goals, and use SOPs to capture workflow, but put volatile details in a separate reference document. For example, for Backup procedures, put offsite storage vendor details such as contact information, pick up times, and approved couriers in a separate document.
    • Similarly, for DRP Notification procedures, reference a separate contacts list.

    Modify the Info-Tech Document Management Checklist to meet your requirements

    2.1c

    15 minutes

    1. Review the Info-Tech Document Management Checklist.
    2. Add or remove checklist items.
    3. Update the document information block.

    OUTPUT

    • Completed document management checklist

    Materials

    • Laptop, projector

    Participants

    • Process Owners
    • SMEs

    See Info-Tech’s Document Management Checklist.

    If you aren’t going to keep your SOPs current, then you’re potentially doing more harm than good

    An outdated SOP can be just as dangerous as having no SOP at all. When a process is documented, it’s trusted to be accurate.

    • Disaster recovery depends as much on supporting SOPs – such as backup and restore procedures – as it does on a master incident response plan.
    • For disaster scenarios, the ability to meet recovery point objectives (i.e. minimize data loss) and recovery time objectives (i.e. minimize downtime) depends on smoothly executed recovery procedures and on having well-defined and up-to-date DR documentation and supporting SOPs. For example:
      • Recovery point (data loss) objectives are directly impacted by your backup procedures.
      • Recovery time is minimized by a well-defined restore procedure that reduces the risk of human error during recovery which could lead to data loss or a delay in the recovery.
      • Similarly, a clearly documented configuration procedure will reduce the time to bring a standby system online.
    A graph depicting the much faster recovery time of up-to-date SOPs versus out-of-date SOPs.

    Follow Info-Tech best practices to keep SOPs current and drive consistent, efficient IT operations

    The following best practices were measured in this chart, and will be discussed further in this section:

    1. Identify documentation requirements as part of project planning.
    2. Require a manager or supervisor to review and approve SOPs.
    3. Check documentation status as part of change management.
    4. Hold staff accountable.
    Higher adoption of Info-Tech best practices leads to more effective SOPs and greater benefits in areas such as training and process improvement.

    Graph depicting the efficiency of adopting Info-Tech practices regarding SOPs. Four categories of 'Training', 'process improvement', 'IT automation', and 'consistent IT operations' are shown increasing in efficiency with a high adoption of Info-Tech strategies.

    Info-Tech Insight

    Audits for compliance requirements have little impact on getting SOPs done in a timely manner or the actual usefulness of those SOPs, because the focus is on passing the audit instead of creating SOPs that improve operations. The frantic annual push to complete SOPs in time for an audit is also typically a much greater effort than maintaining documents as part of ongoing change management.

    Identify documentation requirements as part of project planning

    DISCUSS

    When are documentation requirements captured, including required changes to SOPs?

    Make documentation requirements a clearly defined deliverable. As with any other task, this should include:

    • Owner: The person ultimately responsible for the documentation.
    • Assigned resource: The person who will actually put pen to paper. This could be the same person as the owner, or the owner could be a reviewer.
    • Deadlines: Include documentation deliverables in project milestones.
    • Verification process: Validate completion and accuracy. This could be a peer review or management review.
    Example: Implement a new service desk application.
    • Service desk SOP documentation requirements: SOP for monitoring and managing tickets will require changes to leverage new automation features.
    • Owner: Service Desk Lead.
    • Assigned resource: John Smith (service desk technician).
    • Deadline: Align with “ready for QA testing.”
    • Verification process: Service Desk Lead document review and signoff.

    Info-Tech Insight

    Realistically, documentation will typically be a far less urgent task than the actual application or system changes. However, if you want the necessary documentation to be ultimately completed, even if it’s done after more urgent tasks, it must be tracked.

    Implement document approval steps at the individual and project level

    DISCUSS

    How do you currently review and validate SOP documents?

    Require a manager or supervisor to review and approve SOPs.

    • Avoid a bureaucratic review process involving multiple parties. The goal is to ensure accuracy and not just provide administrative protection.
    • A review by the immediate supervisor or manager is often sufficient. Their feedback and the implied accountability improve the quality and usefulness of the SOPs.

    Check documentation status as part of change management.

    • Including a documentation status check holds the project leaders and management accountable.
    • If SOPs are not critical to the project deliverable, then realistically the deliverable is not held back. However, keep the project open until relevant documents are updated so those tasks can’t be swept under the rug until the next audit.

    SOP reviews, change management, and identifying requirements led to benefits such as training and process improvement.

    A chart depicting the impact and benefits of SOP reviews, change management and identifying requirements. The chart is accompanied by a key for the grey to blue colours depicted

    "Our directors and our CIO have tied SOP work to performance evaluations and SOP status is reviewed during management meetings. People have now found time to get this work done."

    – Assistant Director-IT Operations, Healthcare Industry

    Review SOPs regularly and assign a process owner to avoid reinforcing silos

    CASE STUDY

    Industry

    Public service organization

    Source

    Info-Tech client engagement

    Situation

    • The organization’s IT department consists of five heavily siloed units.
    • Without communication or workflow accountability across units, each had developed incompatible workflows, making estimates of “time to resolution” for service requests difficult.
    • The IT service manager purchases a new service desk tool, attempting to standardize requests across IT to improve efficiency, accountability, and transparency.

    Complication

    • The IT service manager implements the tool and creates standardized workflows without consulting stakeholders in the different service units.
    • The separate units immediately rebel against the service manager and try to undermine the implementation of the new tool.

    Results

    • Info-Tech analysts helped to facilitate a solution between experts in the different units.
    • In order to develop a common workflow and ticket categorization scheme, Info-Tech recommended that each service process should have a single approver.

    The bottom line: ensure that there’s one approver per process to drive process efficiency and accountability and avoid problems down the road.

    Hold staff accountable to encourage SOP work to be completed in a timely manner

    DISCUSS

    Are SOP updates treated as optional or “when I have time” work?

    Hold staff directly accountable for SOP work.

    Holding staff accountable is really about emphasizing the importance of ensuring SOPs stay current. If management doesn’t treat SOPs as a priority, then neither will your staff. Strategies include:

    • Include SOP work in performance appraisals.
    • Keep relevant tickets open until documentation is completed.
    • Ensure documents are reviewed, as discussed earlier.
    • Identify and assign documentation tasks as part of project planning efforts, as discussed earlier.

    Holding staff accountable minimizes procrastination and therefore maintenance effort.

    Chart depicting the impact on reducing SOP maintenance effort followed by a key defining the colours on the chart

    Info-Tech Insight

    Holding staff accountable does not by itself make a significant impact on SOP quality (and therefore the typical benefits of SOPs), but it minimizes procrastination, so the work is ultimately done in a more timely manner. This ensures SOPs are current and usable, so they can drive benefits such as consistent operations, improved training, and so on.

    Assign action items to address SOP documentation process challenges

    2.2

    1. Discuss the challenges mentioned at the start of this section, and other challenges highlighted by the strategies discussed in this section. For example:
    • Are documentation requirements included in project planning?
    • Are SOPs and other documentation deliverables reviewed?
    • Are staff held accountable for documentation?
  • Document the challenges in your copy of the Standard Operating Procedures Workbook and assign action items to address those challenges.
  • Challenge Action Items Action Item Owner
    Documentation requirements are identified at the end of a project.
    • Modify project planning templates and checklists to include “identify documentation requirements.”
    Bob Ryan
    SOPs are not reviewed.
    • When assigning documentation tasks, also assign an owner who will be responsible for reviewing and approving the deliverable.
    • Create a mechanism for officially signing off on the document (e.g. email approval or create a signoff form).
    Susan Jones

    An “SOP party” fosters a collaborative approach and can add some levity to an otherwise dry exercise

    What is an SOP party?

    • An SOP party is a working session, bringing together process owners and key staff to define current SOPs and collaborate to identify optimization opportunities.
    • The party aspect is really just about how you market the event. Order in food or build in a cooking contest (e.g. a chilli cook-off or dessert bake-off) to add some fun to what can be a dry activity.

    Why does this work?

    • Process owners become so familiar with their tasks that many of the steps essentially live in their heads. Questions from colleagues draw out those unwritten steps and get them down on paper so another sufficiently qualified employee could carry out the same steps.
    • Once the processes are defined (e.g. via a tabletop exercise), input from colleagues can help identify risks and optimization opportunities, and process questions can be quickly answered because the key people are all present.
    • The group approach also promotes consistency and enables you to set expectations (e.g. visual-based approach, standards, level of detail, etc.).

    When is collaboration necessary (e.g. via tabletop planning)?

    • Tabletop planning is ideal for complex processes as well as processes that span multiple tasks, people, and/or systems.
    • For processes with a narrow focus (e.g. recovery steps for a specific server), assign these to the SME to document. Then ensure the SOP is reviewed to draw out the unwritten steps as described above.
    • For example, if you use tabletop planning to document a high-level DR plan, sub-processes might include recovery procedures for individual systems; those SOPs can then be assigned to individual SMEs.

    Schedule SOP working sessions until critical processes are documented

    Ultimately, it’s more efficient to create and update SOPs as needed but dedicated working sessions will help address immediate critical needs.

    Organize the working session:
    1. Book a full-day meeting in an out of the way meeting room, invite key staff (system and process owners who ultimately need to be SOP owners), and order in lunch so no one has to leave.
    2. Prioritize SOPs (see Phase 1) and set goals (e.g. complete the top 6 SOPs during this session).
    3. Alternate between collaborative efforts and documenting the SOPs. For example:
      1. Tabletop or flowchart the current SOP. Take a picture of the current state for reference purposes.
      2. Look for process improvements. If you have the authority in the room to enable process changes, then modify the tabletop/flowchart accordingly and capture this desired future state (e.g. take a picture). Otherwise, identify action items to follow up on proposed changes.
      3. Identify all related documentation deliverables (e.g. sub-processes, checklists, approval forms, etc.).
      4. Create the identified documentation deliverables (divide the work among the team). Then repeat the above.
    4. Repeat these working sessions on a monthly or quarterly basis, depending on your requirements, until critical SOPs are completed.
    5. When the SOP backlog is cleared, conduct quarterly or semi-annual refreshers for ongoing review and optimization of key processes.

    Assign action items to capture next steps after SOP working sessions

    2.3

    1. Review the SOPs documented during this workshop. Identify action items to complete and validate those SOPs and related documents. For example, do the SOPs require further approval or testing?
    2. Similarly, review the document management checklist and identify action items to complete, expand, and/or validate proposed standards.
    3. For SOP working sessions, decide on a date, time, and who should be there based on the guidelines in this section. If the SOP party approach does not meet your requirements, then at the very least assign owners for the identified critical SOPs and set deadlines for completing those SOPs. Document these extra action items in your copy of the Standard Operating Procedures Workbook.
    SOP or Task Action Items Action Item Owner
    Ticket escalation SOP
    • Debrief the rest of the Service Desk team on the new process.
    • Modify the SOP further based on feedback, if warranted.
    • Implement the new SOP. This includes communicating visible changes to business users and other IT staff.
    Jeff Sutter
    SOP party
    • Contact prospective attendees to communicate the purpose of the SOP party.
    • Schedule the SOP party.
    Bob Smith

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with out Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    2.1

    Identify current content management practices

    As a group, identify current pain points and opportunities for improvement in your current content management practices.

    2.2

    Assign action items to address documentation process challenges

    Develop a list of action items to address gaps in the SOP documentation and maintenance process.

    Phase 3

    Identify a Content Management Solution

    Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

    Phase 3 outline

    Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

    Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

    Guided Implementation 3: Decide on a content management solution for your SOPs

    Proposed Time to Completion (in weeks): 1 week

    Step 3.1: Understand the options for CM solutions

    Start with an analyst kick off call:

    • Review your current approach to content management and discuss possible alternatives.

    Then complete these activities…

    • Evaluate the pros and cons of different approaches to content management.
    • Discuss approaches for fit with your team.

    Step 3.2: Identify the right solution for you

    Review findings with analyst:

    • Identify 2–3 possible options for a content management strategy.

    Then complete these activities…

    • Identify the best solution based on portability, maintainability, cost, and implementation effort.

    With these tools & templates:

    • Publishing and Document Management Solution Evaluation Tool
    • SOP Project Roadmap
    • SOP Workbook

    Phase 3 Results & Insights:

    Choose an approach to content management that will best support your organization’s SOP documentation and maintenance process.

    Decide on an appropriate publishing and document management strategy for your organization

    Publishing and document management considerations:

    • Portability/External Access: At the best of times, portability is nice because it enables flexibility, but at the worst of times (such as in a disaster recovery situation) it is absolutely essential. If your primary site is down, can you still access your documentation? As shown in this chart, traditional storage strategies still dominate DRP documentation, but these aren’t necessarily the best options.
    • Maintainability/Usability: How easy is it to create, update, and use the documentation? Is it easy to link to other documents? Is there version control? The easier the system is to use, the easier it is to get employees to use it.
    • Cost/Effort: Is the cost and effort appropriate? For example, a large enterprise may need a formal solution like SharePoint or a Content Management System. For smaller organizations, the cost of these tools might be harder to justify.

    Consider these approaches:

    This section reviews the following approaches, their pros and cons, and how they meet publishing and document management requirements:

    • SOP tools.
    • Cloud-based content management software.
    • In-house solutions combining SharePoint and MS Office (or equivalent).
    • Wiki site.
    • “Manual” approaches such as storing documents on a USB drive.
    Chart depicting the portable strategy popularity, followed by a key defining the colours on the graph

    Source: Info-Tech Research Group; N=118

    Note: Percentages total more than 100% due to respondents using more than one portability strategy.

    Develop a content management strategy and process to reduce organizational risk

    CASE STUDY

    Segment

    Mid-market company

    Source

    Info-Tech Interview

    Situation

    • A mid-sized company hired a technical consultancy to manage its network.
    • As part of this move, the company’s network administrator was fired.
    • Over time, this administrator had become a “go-to” person for several other IT functions.

    Complication

    • The consulting team realizes that the network administrator kept critical documentation on his local hard drive.
    • This includes configs, IP addresses, passwords, logins to vendor accounts, and more.
    • It becomes clear the administrator was able to delete some of this information before leaving, which the consultants are required to retrieve and re-document.

    Result

    • Failing to implement effective SOPs for document management and terminating key IT staff exposed the organization to unnecessary risk and additional costs.
    • Allowing a local content management system to develop created a serious security risk.
    • The bottom line: create a secure, centralized, and backed-up location and establish SOPs around using it to help keep the company’s data safe.

    Info-Tech offers a web-based policy management solution with process management capabilities

    Role How myPolicies helps you
    Policy Sponsors
    • CEO
    • Board of Directors

    Reduced Corporate Risk

    Avoid being issued a regulatory fine or sanction that could jeopardize operations or hurt brand image.

    Policy Reviewers
    • Internal Audit
    • Compliance
    • Risk
    • Legal

    A Culture of Compliance

    Adherence with regulatory requirements as well as documented audit trail of all critical policy activities.

    Policy Owners
    • HR
    • IT
    • Finance
    • Operations

    Less Administrative Burden

    Automation and simplification of policy creation, distribution, and tracking.

    Policy Users
    • Employees
    • Vendors
    • Contractors

    Policy Clarity

    Well-written policies are stored in one reliable, easy to navigate location.

    About this Approach:

    myPolicies is a web-based solution to create, distribute, and manage corporate policies, procedures, and forms, built around best practices identified by our research.

    Contact your Account Manager today to find out if myPolicies is right for you.

    SOP software and DR planning tools can help, but they aren’t a silver bullet

    Portability/External Access:
    • Pros: Typically have a SaaS option, providing built-in external access with appropriate security and user administration to vary access rights.
    • Cons: Dependent on the vendor to ensure external access, but this is typically not an issue.
    Maintainability/Usability:
    • Pros: Built-in templates encourage consistency as well as guide initial content development by indicating what details need to be captured.
    • Pros: Built-in document management (e.g. version control, metadata support, etc.), centralized access/navigation to required documents, and some automation (e.g. update contacts throughout the system).
    • Cons: Not a silver bullet. You still have to do the work to define and capture your processes.
    • Cons: Requires end-user and administrator training.
    • Cons: Often modules of larger software suites. If you use the entire suite, it may make sense to use the SOP tool, but otherwise probably not.
    Cost/Effort:
    • Pros: For large enterprises, the convenience of built-in document management and templates can outweigh the cost.
    • Cons: SOP tools can be costly. Expect to pay at least $3,000-7,000 for software licensing, plus additional per user and hosting fees.
    About this Approach:

    SOP tools such as Princeton Center’s SOP ExpressTM and SOP Tracks or MasterControl’s SOP Management and eSOP allow organizations to create, manage, and access SOPs. These programs typically offer a range of SOP templates and formats, electronic signatures, version control, and review options and training features such as quizzes and monitoring.

    Similarly, DR planning solutions (e.g. eBRP, Recovery Planner, LDRPS, etc.) provide templates, tools, and document management to create DR documentation including SOPs.

    Consider leveraging SharePoint to provide document management capabilities

    Portability/External Access:
    • Pros: SharePoint is commonly web-enabled and supports external access with appropriate security and user administration.
    • Cons: Must be installed at redundant sites or be cloud-based to be effective in the event of a worst-case scenario disaster recovery situation in which the primary data center is down.
    Maintainability/Usability:
    • Pros: Built-in document management (e.g. version control, metadata support, etc.) as well as centralized access to required documents.
    • Pros: No tool learning curve – SharePoint and MS Office would be existing solutions already used on a daily basis.
    • Cons: No built-in automated updates (e.g. automated updates to contacts throughout the system).
    • Cons: Consistency depends on creating templates and implementing processes for document updates, review, and approval.
    Cost/Effort:
    • Pros: Using existing tools, so this is a sunk cost in terms of capex.
    • Cons: Additional effort required to create templates and manage the documentation library.

    For more information on SharePoint as a content management solution, see Info-Tech’s Use SharePoint for Enterprise Content Management.

    About this Approach:

    Most SOP documents start as MS Office documents, even if there is an SOP tool available (some SOP tools actually run within MS Office on the desktop). For organizations that decide to bypass a formal SOP tool, the biggest gap they have to overcome is document management.

    Many organizations are turning to SharePoint to meet this need. For those that already have SharePoint in place, it makes sense to further leverage SharePoint for SOP documentation.

    For SharePoint to be a practical solution, the documentation must still be accessible if the primary data center is down, e.g. by having redundant SharePoint instance at multiple in-house locations or using a cloud-based SharePoint solution.

    As an alternative to SharePoint, SaaS tools such as Power DMS, NetDocuments, Xythos on Demand, Knowledge Tree, Spring CM, and Zoho Docs offer cloud-based document management, authoring, and distribution services that can work well for SOPs. Some of these, such as Power DMS and Spring CM, are geared specifically toward workflows.

    A wiki may be all you need

    Portability/External Access:
    • Pros: Wiki sites can support external access as with any web solution.
    • Cons: May lack more sophisticated content management features.
    Maintainability/Usability:
    • Pros: Built-in document management (e.g. version control, metadata support, etc.) as well as centralized access to required information.
    • Pros: Authorized users can make updates dynamically, depending on how much restriction you have on the site.
    • Cons: No built-in automation (e.g. automated updates to contacts throughout the system).
    • Cons: Consistency depends on creating templates and implementing processes for document updates, review, and approval.
    Cost/Effort:
    • Pros: An inexpensive option compared to traditional content management solutions such as SharePoint.
    • Cons: Learning curve if wikis are new to your organization.
    About this Approach:

    Wiki sites are websites where users collaborate to create and edit the content. Wikipedia is an example.

    While wiki sites are typically used for collaboration and dynamic content development, the traditional collaborative authoring model can be restricted to provide structure and an approval process.

    Several tools are available to create and manage wiki sites (and other collaboration solutions), as outlined in the following research:

    An approach that I’ve seen work well is to consult the wiki for any task, activity, job, etc. Is it documented? If not, then document it there and then. Sure, this led to 6-8 weeks of huge effort, but the documentation grew in terms of volume and quality at an alarming but pleasantly surprising rate. Providing an environment to create the documentation is important and a wiki is ideal. Fast, lightweight, in-browser editing leads to little resistance in creating documents.

    - Lee Blackwell, Global IT Operation Services Manager, Avid Technology

    Managing SOPs on a shared network drive involves major challenges and limitations

    Portability/External Access:
    • Cons: Must be hosted at redundant sites in order to be effective in a worst-case scenario that takes down your data center.
    Maintainability/Usability:
    • Pros: Easy to implement and no learning curve.
    • Pros: Access can be easily managed.
    • Cons: Version control, standardization, and document management can be significant challenges.
    Cost/Effort:
    • Pros: Little to no cost and no tool management required.
    • Cons: Managing documents on a shared network drive requires strict attention to process for version control, updates, approvals, and distribution.
    About this Approach:

    With this strategy, SOP documents are stored and managed locally on a shared network drive. Only process owners and administrators have read-write permissions on documents on the shared drive.

    The administrator grants access and manages security permissions.

    Info-Tech Insight

    For small organizations, the shared network drive approach can work, but this is ultimately a short-term solution. Move to an online library by creating a wiki site. Start slow by beginning with a particular department or project, then evaluate how well your staff adapt to this technology as well as its potential effectiveness in your organization. Refer to the Info-Tech collaboration strategy research cited on the previous slide for additional guidance.

    Avoid extensive use of paper copies of SOP documentation

    SOP documents need to be easy to update, accessible from anywhere, and searchable. Paper doesn’t meet these needs.

    Portability/External Access:
    • Pros: Does not rely on technology or power.
    • Cons: Not adequate for disaster recovery situations; would require all staff to have a copy and to have it with them at all times.
    Maintainability/Usability:
    • Pros: In terms of usability, again there is no dependence on technology.
    • Cons: Updates need to be printed and distributed to all relevant staff every time there is a change to ensure staff have access to the latest most accurate documentation.
    • Cons: Navigation to other information is manual – flipping through pages etc. No searching or hyperlinks.
    Cost/Effort:
    • Pros: No technology system to maintain, aside from what you use for printing.
    • Cons: Printing expenses are actually among the highest incurred by organizations and this adds to it.
    • Cons: Labor-intensive due to need to print and physically distribute documentation updates.
    About this Approach

    Traditionally, SOPs were printed and kept somewhere in a large binder (or several large binders). This isn’t adequate to the needs of most organizations and typically results in documents that aren’t up to date or effective.

    Use Info-Tech’s solution evaluation tool to decide on a publishing and document management strategy

    All organizations have existing document management methodologies, even if it’s simply storing documents on a network drive.

    Use Info-Tech’s solution evaluation tool to decide whether your existing solution meets the portability/external access, maintainability/usability, and cost/effort criteria, or whether you need to explore a different option.

    Note: This tool was originally built to evaluate DRP publishing options, so the tool name and terminology refers to DR. However, the same tool can be used to evaluate general SOP publishing and document management solutions.

    The image is a screenshot of Info-Tech's evaluation tool
    Consider using Info-Tech’s DRP Publishing and Document Management Solution Evaluation Tool.

    Info-Tech Insight

    There is no absolute ranking for possible solutions. The right choice will depend on factors such as current in-house tools, maturity around document management, the size of your IT department, and so on. For example, a small shop may do very well with the USB drive strategy, whereas a multi-national company will need a more formal strategy to ensure consistent application of corporate guidelines.

    If you want additional support, have our analysts guide you through this phase as part of an Info-Tech workshop

    Book a workshop with our Info-Tech analysts:

    • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
    • Info-Tech analysts will join you and your team onsite at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.
    • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

    The following are sample activities that will be conducted by Info-Tech analysts with your team:

    3.1

    Decide on a publishing and document management strategy

    Review the pros and cons of different strategies for publishing and document management. Identify needs, priorities, and limitations of your environment. Create a shortlist of options that can meet your organization’s needs and priorities.

    3.2

    Complete the solution evaluation tool

    Evaluate solutions on the shortlist to identify the strongest option for your organization, based on the criteria of maintainability, affordability, effort to implement, and accessibility/portability.

    Insight breakdown

    Create visual documents, not dense SOP manuals.

    • Visual documents that can be scanned are more usable and easier to update.
    • Flowcharts, checklists, and diagrams all have their place in visual documentation.

    Start with high-impact SOPs.

    • It can be difficult to decide where to start when faced with a major documentation backlog.
    • Focus first on client facing and high-impact SOPs, i.e. mission-critical operations, service management, and disaster recovery procedures.

    Integrate SOP creation into project requirements and hold staff accountable.

    • Holding staff accountable does not provide all the benefits of a well documented and maintained SOP, but it minimizes procrastination, so the work is ultimately done in a more timely manner.

    Summary of accomplishment

    Knowledge Gained

    SOPs may not be exciting, but they’re very important to organizational consistency, efficiency, and improvement.

    This blueprint outlined how to:

    • Prioritize and execute SOP documentation work.
    • Establish a sustainable process for creating and maintaining SOP documentation.
    • Choose a content management solution for best fit.

    Processes Optimized

    • Multiple processes supporting mission-critical operations, service management, and disaster recovery were documented. Gaps in those processes were uncovered and addressed.
    • In addition, your process for maintaining process documents was improved, including adding documentation requirements and steps requiring documentation approval.

    Deliverables Completed

    As part of completing this project, the following deliverables were completed:

    • Standard Operating Procedures Workbook
    • Standard Operating Procedures Project Roadmap Tool
    • Document Management Checklist
    • Publishing and Document Management Solution Evaluation Tool

    Project step summary

    Client Project: Create and maintain visual SOP documentation.

    1. Prioritize undocumented SOPs.
    2. Develop visual SOP documentation.
    3. Optimize and document critical processes.
    4. Establish guidelines for identifying and organizing SOPs.
    5. Define a process for documenting and maintaining SOPs.
    6. Plan time with experts to put a dent in your documentation backlog.
    7. Understand the options for content management solutions.
    8. Identify the right content management solution for your organization.

    Info-Tech Insight

    This project has the ability to fit the following formats:

    • Onsite workshop by Info-Tech Research Group consulting analysts.
    • Do-it-yourself with your team.
    • Remote delivery (Info-Tech Guided Implementation).

    Bibliography

    Anderson, Chris. “What is a Standard Operating Procedure (SOP)?” Bizmanualz, Inc. No date. Web. 25 Jan. 2016. https://www.bizmanualz.com/save-time-writing-procedures/what-are-policies-and-procedures-sop.html

    Grusenmeyer, David. “Developing Effective Standard Operating Procedures.” Dairy Business Management. 1 Feb. 2003. Web. 25 Jan. 2016. https://ecommons.cornell.edu/handle/1813/36910

    Mosaic. “The Value of Standard Operating Procedures.” 22 Oct. 2012. Web. 25 Jan. 2016. ttp://www.mosaicprojects.com.au/WhitePapers/WP1086_Standard_Operating_Procedures.pdf

    Sinn, John W. “Lean, Six Sigma, Quality Transformation Toolkit (LSSQTT) Tool #17 Courseware Content – Standard Operating Procedures (SOP) For Lean and Six Sigma: Infrastructure for Understanding Process.” Summer 2006. Web. 25 Jan. 2016. https://www.bgsu.edu/content/dam/BGSU/college-of-technology/documents/LSSQTT/LSSQTT%20Toolkit/toolkit3/LSSQTT-Tool-17.pdf

    United States Environmental Protection Agency. “Guidance for Preparing Standard Operating Procedures (SOPs).” April 2007. Web. 25 Jan. 2016. http://www.epa.gov/sites/production/files/2015-06/documents/g6-final.pdf

    Hire or Develop a World-Class CISO

    • Buy Link or Shortcode: {j2store}243|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Security Strategy & Budgeting
    • Parent Category Link: /security-strategy-and-budgeting
    • It is difficult to find a “unicorn”: a candidate who is already fully developed in all areas.
    • The role of the CISO has changed so much in the past three years, it is unclear what competencies are most important.
    • Current CISOs need to scope out areas of future development.

    Our Advice

    Critical Insight

    The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

    Impact and Result

    • Clarify the competencies that are important to your organizational needs and use them to find a candidate with those specific strengths.
    • If you are a current CISO, complete a self-assessment and identify your high-priority competency gaps so you can actively work to develop those areas.
    • Create an actionable plan to develop the CISO’s capabilities and regularly reassess these items to ensure constant improvement.

    Hire or Develop a World-Class CISO Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Hire of Develop a World-Class CISO Deck – A step-by-step guide on finding or developing the CISO that best fits your organization.

    Use this blueprint to hire or develop a world-class Chief Information Security Officer (CISO) with the competencies that suit your specific organizational needs. Once you have identified the right candidate, create a plan to develop your CISO.

    • Hire or Develop a World-Class CISO – Phases 1-4

    2. CISO Core Competency Evaluation Tool – Determine which competencies your organization needs and which competencies your CISO needs to work on.

    This tool will help you determine which competencies are a priority for your organizational needs and which competencies your CISO needs to develop.

    • CISO Core Competency Evaluation Tool

    3. CISO Stakeholder Power Map Template – Visualize stakeholder and CISO relationships.

    Use this template to identify stakeholders who are key to your security initiatives and to understand your relationships with them.

    • CISO Stakeholder Power Map Template

    4. CISO Stakeholder Management Strategy Template – Develop a strategy to improve stakeholder and CISO relationships.

    Create a strategy to cultivate your stakeholder relationships and manage each relationship in the most effective way.

    • CISO Stakeholder Management Strategy Template

    5. CISO Development Plan Template – Develop a plan to support a world-class CISO.

    This tool will help you create and implement a plan to remediate competency gaps.

    • CISO Development Plan Template

    Infographic

    Further reading

    Hire or Develop a World-Class CISO

    Find a strategic and security-focused champion for your business.

    Analyst Perspective

    Create a plan to become the security leader of tomorrow

    The days are gone when the security leader can stay at a desk and watch the perimeter. The rapidly increasing sophistication of technology, and of attackers, has changed the landscape so that a successful information security program must be elastic, nimble, and tailored to the organization’s specific needs.

    The Chief Information Security Officer (CISO) is tasked with leading this modern security program, and this individual must truly be a Chief Officer, with a finger on the pulses of the business and security processes at the same time. The modern, strategic CISO must be a master of all trades.

    A world-class CISO is a business enabler who finds creative ways for the business to take on innovative processes that provide a competitive advantage and, most importantly, to do so securely.

    Cameron Smith, Research Lead, Security and Privacy

    Cameron Smith
    Research Lead, Security & Privacy
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • CEOs/CXOs are looking to hire or develop a senior security leader and aren’t sure where to start.
    • Conversely, security practitioners are looking to upgrade their skill set and are equally stuck in terms of what an appropriate starting point is.
    • Organizations are looking to optimize their security plans and move from a tactical position to a more strategic one.

    Common Obstacles

    • It is difficult to find a “unicorn”: a candidate who is already fully developed in all areas.
    • The role of the CISO has changed so much in the past three years, it is unclear what competencies are most important.
    • You are a current CISO and need to scope out your areas of future development.

    Info-Tech’s Approach

    • Clarify the competencies that are important to your organizational needs and use them to find a candidate with those specific strengths.
    • If you are a current CISO, complete a self-assessment and identify your high-priority competency gaps so you can actively work to develop those areas.
    • Create an actionable plan to develop the CISO’s capabilities and regularly reassess these items to ensure constant improvement.

    Info-Tech Insight
    The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

    Your challenge

    This Info-Tech blueprint will help you hire and develop a strategic CISO

    • Security without strategy is a hacker’s paradise.
    • The outdated model of information security is tactical, where security acts as a watchdog and responds.
    • The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

    Around one in five organizations don’t have an individual with the sole responsibility for security1

    1 Navisite

    Info-Tech Insight
    Assigning security responsibilities to departments other than security can lead to conflicts of interest.

    Common obstacles

    It can be difficult to find the right CISO for your organization

    • The smaller the organization, the less likely it will have a CISO or equivalent position.
    • Because there is a shortage of qualified candidates, qualified CISOs can demand high salaries and many CISO positions will go unfilled.
    • It is easier for larger companies to attract top CISO talent, as they generally have more resources available.

    Source: Navisite

    Only 36% of small businesses have a CISO (or equivalent position).

    48% of mid-sized businesses have a CISO.

    90% of large organizations have a CISO.

    Source: Navisite

    Strategic versus tactical

    CISOs should provide leadership based on a strategic vision 1

    Strategic CISO Tactical CISO

    Proactive

    Focus is on protecting hyperdistributed business processes and data

    Elastic, flexible, and nimble

    Engaged in business design decisions

    Speaks the language of the audience (e.g. business, financial, technical)

    Reactive

    Focus is on protecting current state

    Perimeter and IT-centric approach

    Communicates with technical jargon

    1 Journal of Computer Science and Information Technology

    Info-Tech has identified three key behaviors of the world-class CISO

    To determine what is required from tomorrow’s security leader, Info-Tech examined the core behaviors that make a world-class CISO. These are the three areas that a CISO engages with and excels in.

    Later in this blueprint, we will review the competencies and skills that are required for your CISO to perform these behaviors at a high level.

    Align

    Aligning security enablement with business requirements

    Enable

    Enabling a culture of risk management

    Manage

    Managing talent and change

    Info-Tech Insight
    Through these three overarching behaviors, you can enable a security culture that is aligned to the business and make security elastic, flexible, and nimble to maintain the business processes.

    Info-Tech’s approach

    Understand what your organization needs in a CISO: Consider the core competencies of a CISO. Assess: Assess candidates' core competencies and the CISO's stakeholder relationships. Plan improvements: Identify resources to close competency gaps and an approach to improve stakeholder relationships. Executive development: Decide next steps to support your CISO moving forward and regularly reassess to measure progress.

    Info-Tech’s methodology to Develop or Hire a World-Class CISO

    1. Launch 2. Assess 3. Plan 4. Execute
    Phase Steps
    1. Understand the core competencies
    2. Measure security and business satisfaction and alignment
    1. Assess stakeholder relationships
    2. Assess core competencies
    1. Identify resources to address your CISO’s competency gaps
    2. Plan an approach to improve stakeholder relationships
    1. Decide next actions and support your CISO moving forward
    2. Regularly reassess to measure development and progress
    Phase Outcomes

    At the end of this phase, you will have:

    • Determined the current gaps in satisfaction and business alignment for your IT security program.
    • Identified the desired qualities in a security leader, specific to your current organizational needs.

    At the end of this phase, you will have:

    • Used the core competencies to help identify the ideal candidate.
    • Identified areas for development in your new or existing CISO.
    • Determined stakeholder relationships to cultivate.

    At the end of this phase, you will have:

    • Created a high-level plan to address any deficiencies.
    • Improved stakeholder relations.

    At the end of this phase, you will have:

    • Created an action-based development plan, including relevant metrics, due dates, and identified stakeholders. This plan is the beginning, not the end. Continually reassessing your organizational needs and revisiting this blueprint’s method will ensure ongoing development.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

    CISO Core Competency Evaluation Tool

    Assess the competency levels of a current or prospective CISO and identify areas for improvement.

    Stakeholder Power Map Template

    Visualize the importance of various stakeholders and their concerns.

    Stakeholder Management Strategy Template

    Document a plan to manage stakeholders and track actions.

    Key deliverable:

    CISO Development Plan Template

    The CISO Development Plan Template is used to map specific activities and time frames for competency development to address gaps and achieve your goal.

    Strategic competencies will benefit the organization and the CISO

    Career development should not be seen as an individual effort. By understanding the personal core competencies that Info-Tech has identified, the individual wins by developing relevant new skills and the organization wins because the CISO provides increased value.

    Organizational Benefits Individual Benefits
    • Increased alignment between security and business objectives
    • Development of information security that is elastic, nimble, and flexible for the business
    • Reduction in wasted efforts and resources, and improvement in efficiency of security and the organization as a whole
    • True synergy between security and business stakeholders, where the goals of both groups are being met
    • Increased opportunity as you become a trusted partner within your organization
    • Improved relationships with peers and stakeholders
    • Less resistance and more support for security initiatives
    • More involvement and a stronger role for security at all levels of the organization

    Measured value of a world-class CISO

    Organizations with a CISO saw an average of $145,000 less in data breach costs.1

    However, we aren’t talking about hiring just any CISO. This blueprint seeks to develop your CISO’s competencies and reach a new level of effectiveness.

    Organizations invest a median of around $375,000 annually in their CISO.2 The CISO would have to be only 4% more effective to represent $15,000 more value from this position. This would offset the cost of an Info-Tech workshop, and this conservative estimate pales in comparison to the tangible and intangible savings as shown below.

    Your specific benefits will depend on many factors, but the value of protecting your reputation, adopting new and secure revenue opportunities, and preventing breaches cannot be overstated. There is a reason that investment in information security is on the rise: Organizations are realizing that the payoff is immense and the effort is worthwhile.

    Tangible cost savings from having a world-class CISO Intangible cost savings from having a world-class CISO
    • Cost savings from incident reduction.
    • Cost savings achieved through optimizing information security investments, resulting in savings from previously misdiagnosed issues.
    • Cost savings from ensuring that dollars spent on security initiatives support business strategy.
    • More opportunities to create new business processes through greater alignment between security and business.
    • Improved reputation and brand equity achieved through a proper evaluation of the organization’s security posture.
    • Continuous improvement achieved through a good security assessment and measurement strategy.
    • Ability to plan for the future since less security time will be spent firefighting and more time will be spent engaged with key stakeholders.

    1 IBM Security
    2 Heidrick & Struggles International, Inc.

    Case Study

    In the middle of difficulty lies opportunity

    SOURCE
    Kyle Kennedy
    CISO, CyberSN.com

    Challenge
    The security program identified vulnerabilities at the database layer that needed to be addressed.

    The decision was made to move to a new vendor. There were multiple options, but the best option in the CISO’s opinion was a substantially more expensive service that provided more robust protection and more control features.

    The CISO faced the challenge of convincing the board to make a financial investment in his IT security initiative to implement this new software.

    Solution
    The CISO knew he needed to express this challenge (and his solution!) in a way that was meaningful for the executive stakeholders.

    He identified that the business has $100 million in revenue that would move through this data stream. This new software would help to ensure the security of all these transactions, which they would lose in the event of a breach.

    Furthermore, the CISO identified new business plans in the planning stage that could be protected under this initiative.

    Results
    The CISO was able to gain support for and implement the new database platform, which was able to protect current assets more securely than before. Also, the CISO allowed new revenue streams to be created securely.

    This approach is the opposite of the cautionary tales that make news headlines, where new revenue streams are created before systems are put in place to secure them.

    This proactive approach is the core of the world-class CISO.

    Info-Tech offers various levels of support to best suit your needs

    Guided Implementation

    What does a typical GI on this topic look like?

    Launch Assess Plan Execute

    Call #1: Review and discuss CISO core competencies.

    Call #2: Discuss Security Business Satisfaction and Alignment diagnostic results.

    Call #3: Discuss the CISO Stakeholder Power Map Template and the importance of relationships.

    Call #4: Discuss the CISO Core Competency Evaluation Tool.

    Call #5: Discuss results of the CISO Core Competency Evaluation and identify resources to close gaps.

    Call #6: Review organizational structure and key stakeholder relationships.

    Call #7: Discuss and create your CISO development plan and track your development

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is 6 to 10 calls over the course of 3 to 6 months.

    Phase 1

    Launch

    Phase 1
    1.1 Understand Core Competencies
    1.2 Measure Security and Business Satisfaction and Alignment

    Phase 2
    2.1 Assess Stakeholder Relationships
    2.2 Assess the Core Competencies

    Phase 3
    3.1 Identify Resources to Address Competency Gaps
    3.2 Plan Approach to Improve Stakeholder Relationships

    Phase 4
    4.1 Decide Next Actions and Support Your CISO Moving Forward
    4.2 Regularly Reassess to Measure Development and Progress

    This phase will walk you through the following activities:

    • Review and understand the core competencies of a world-class CISO.
    • Launch your diagnostic survey.
    • Evaluate current business satisfaction with IT security.
    • Determine the competencies that are valuable to your IT security program’s needs.

    Hire or Develop a World-Class CISO

    Case study

    Mark Lester
    InfoSec Manager, SC Ports Authority

    An organization hires a new Information Security Manager into a static and well-established IT department.

    Situation: The organization acknowledges the need for improved information security, but there is no framework for the Security Manager to make successful changes.

    Challenges Next Steps
    • The Security Manager is an outsider in a company with well-established habits and protocols. He is tasked with revamping the security strategy to create unified threat management.
    • Initial proposals for information security improvements are rejected by executives. It is a challenge to implement changes or gain support for new initiatives.
    • The Security Manager will engage with individuals in the organization to learn about the culture and what is important to them.
    • He will assess existing misalignments in the business so that he can target problems causing real pains to individuals.

    Follow this case study throughout the deck to see this organization’s results

    Step 1.1

    Understand the Core Competencies of a World-Class CISO

    Activities

    Review core competencies the security leader must develop to become a strategic business partner

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step
    Analysis and understanding of the eight strategic CISO competencies required to become a business partner

    Launch

    Core competencies

    Info-Tech has identified eight core competencies affecting the CISO’s progression to becoming a strategic business partner.

    Business Acumen
    A CISO must focus primarily on the needs of the business.

    Leadership
    A CISO must be a security leader and not simply a practitioner.

    Communication
    A CISO must have executive communication skills

    Technical Knowledge
    A CISO must have a broad technical understanding.

    Innovative Problem Solving
    A good CISO doesn’t just say “no,” but rather finds creative ways to say “yes.”

    Vendor Management
    Vendor and financial management skills are critical to becoming a strategic CISO.

    Change Management
    A CISO improves security processes by being an agent of change for the organization.

    Collaboration
    A CISO must be able to use alliances and partnerships strategically.

    1.1 Understand the core competencies a CISO must focus on to become a strategic business partner

    < 1 hour

    Over the next few slides, review each world-class CISO core competency. In Step 1.2, you will determine which competencies are a priority for your organization.

    CISO Competencies Description
    Business Acumen

    A CISO must focus primarily on the needs of the business and how the business works, then determine how to align IT security initiatives to support business initiatives. This includes:

    • Contributing to business growth with an understanding of the industry, core functions, products, services, customers, and competitors.
    • Understanding the business’ strategic direction and allowing it to securely capitalize on opportunities.
    • Understanding the key drivers of business performance and the use of sound business practice.
    Leadership

    A CISO must be a security leader, and not simply a practitioner. This requires:

    • Developing a holistic view of security, risk, and compliance for the organization.
    • Fostering a culture of risk management.
    • Choosing a strong team. Having innovative and reliable employees who do quality work is a critical component of an effective department.
      • This aspect involves identifying talent, engaging your staff, and managing their time and abilities.

    1.1 Understand the core competencies (continued)

    CISO Competencies Description
    Communication

    Many CISOs believe that using technical jargon impresses their business stakeholders – in fact, it only makes business stakeholders become confused and disinterested. A CISO must have executive communication skills. This involves:

    • Clearly communicating with business leaders in meaningful language (i.e. business, financial, social) that they understand by breaking down the complexities of IT security into simple and relatable concepts.
    • Not using acronyms or technological speak. Easy-to-understand translations will go a long way.
    • Strong public speaking and presentation abilities.
    Technical Knowledge

    A CISO must have a broad technical understanding of IT security to oversee a successful security program. This includes:

    • Understanding key security and general IT technologies and processes.
    • Assembling a complementary team, because no individual can have deep knowledge in all areas.
    • Maintaining continuing education to stay on top of emerging technologies and threats.

    1.1 Understand the core competencies (continued)

    CISO Competencies Description
    Innovative Problem Solving

    A good CISO doesn’t just say “no,” but rather finds creative ways to say “yes.” This can include:

    • Taking an active role in seizing opportunities created by emerging technologies.
    • Facilitating the secure implementation of new, innovative revenue models.
    • Developing solutions for complex business problems that require creativity and ingenuity.
    • Using information and technology to drive value around the customer experience.
    Vendor Management

    With the growing use of “anything as a service,” negotiation, vendor, and financial management skills are critical to becoming a strategic CISO.

    • The CISO must be able to evaluate service offerings and secure favorable contracts with the right provider. It is about extracting the maximum value from vendors for the dollars you are spending.
    • Vendor products must be aligned with future business plans to create maximum ongoing value.
    • The CISO must develop financial management skills. This includes the ability to calculate total cost of ownership, return on investment, and project spending over multiyear business plans.

    1.1 Understand the core competencies (continued)

    CISO Competencies Description
    Change Management

    A world-class CISO improves security processes by being an agent of change for the organization. This involves:

    • Leading, guiding, and motivating teams to adopt a responsible risk management culture.
    • Communicating important and complex ideas in a persuasive way.
    • Demonstrating an ability to change themselves and taking the initiative in adopting more efficient behaviors.
    • Handling unplanned change, such as unforeseen attacks or personnel changes, in a professional and proactive manner.
    Collaboration

    A CISO must be able to use alliances and partnerships strategically to benefit both the business and themselves. This includes:

    • Identifying formal and informal networks and constructive relationships to enable security development.
    • Leveraging stakeholders to influence positive outcomes for the organization.
    • Getting out of the IT or IT security sphere and engaging relationships in diverse areas of the organization.

    Step 1.2

    Evaluate satisfaction and alignment between the business and IT security

    Activities

    • Conduct the Information Security Business Satisfaction and Alignment diagnostic
    • Use your results as input into the CISO Core Competency Evaluation Tool

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step
    Determine current gaps in satisfaction and alignment between information security and your organization.

    If seeking to hire/develop a CISO: Your diagnostic results will help develop a profile of the ideal CISO candidate to use as a hiring and interview guide.

    If developing a current CISO, use your diagnostic results to identify existing competency gaps and target them for improvement.

    For the CISO seeking to upgrade capabilities: Use the core competencies guide to self-assess and identify competencies that require improvement.

    Launch

    1.2 Get started by conducting Info-Tech’s Information Security Business Satisfaction and Alignment diagnostic

    Suggested Time: One week for distribution, completion, and collection of surveys
    One-hour follow-up with an Info-Tech analyst

    The primary goal of IT security is to protect the organization from threats. This does not simply mean bolting everything down, but it means enabling business processes securely. To do this effectively requires alignment between IT security and the overall business.

    • Once you have completed the diagnostic, call Info-Tech to review your results with one of our analysts.
    • The results from this assessment will provide insights to inform your entries in the CISO Core Competency Evaluation Tool.

    Call an analyst to review your results and provide you with recommendations.

    Info-Tech Insight
    Focus on the high-priority competencies for your organization. You may find a candidate with perfect 10s across the board, but a more pragmatic strategy is to find someone with strengths that align with your needs. If there are other areas of weakness, then target those areas for development.

    1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

    After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

    • Your diagnostic results will indicate where your information security program is aligned well or poorly with your business.
    • For example, the diagnostic may show significant misalignment between information security and executives over the level of external compliance. The CISO behavior that would contribute to solving this is aligning security enablement with business requirements.
      • This misalignment may be due to a misunderstanding by either party. The competencies that will contribute to resolving this are communication, technical knowledge, and business acumen.
      • This mapping method is what will be used to determine which competencies are most important for your needs at the present moment.

    Download the CISO Core Competency Evaluation Tool

    1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

    After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

    1. Starting on Tab 2: CISO Core Competencies, use your understanding of each competency from section 1.1 along with the definitions described in the tool.
      • For each competency, assign a degree of importance using the drop-down menu in the second column from the right.
      • Importance ratings will range from not at all important at the low end to critically important at the high end.
      • Your importance score will be influenced by several factors, including:
        • The current alignment of your information security department.
        • Your organizational security posture.
        • The size and structure of your organization.
        • The existing skills and maturity within your information security department.

    Download the CISO Core Competency Evaluation Tool

    1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

    After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

    1. Still on Tab 2. CISO Core Competencies, you will now assign a current level of effectiveness for each competency.
      • This will range from foundational at a low level of effectiveness up to capable, then inspirational, and at the highest rating, transformational.
      • Again, this rating will be very specific to your organization, depending on your structure and your current employees.
      • Fundamentally, these scores will reflect what you want to improve in the area of information security. This is not an absolute scale, and it will be influenced by what skills you want to support your goals and direction as an organization.

    Download the CISO Core Competency Evaluation Tool

    Phase 2

    Assess

    Phase 1
    1.1 Understand Core Competencies
    1.2 Measure Security and Business Satisfaction and Alignment

    Phase 2
    2.1 Assess Stakeholder Relationships
    2.2 Assess the Core Competencies

    Phase 3
    3.2 Plan Approach to Improve Stakeholder Relationships

    Phase 4
    4.1 Decide Next Actions and Support Your CISO Moving Forward
    4.2 Regularly Reassess to Measure Development and Progress

    This phase will walk you through the following activities:

    • Use the CISO Core Competency Evaluation Tool to create and implement an interview guide.
    • Assess and analyze the core competencies of your prospective CISOs. Or, if you are a current CISO, use the CISO Core Competency Evaluation Tool as a self-analysis and identify areas for personal development.
    • Evaluate the influence, impact, and support of key executive business stakeholders using the CISO Stakeholder Power Map Template.

    Hire or Develop a World-Class CISO

    Case study

    Mark Lester
    InfoSec Manager, SC Ports Authority

    The new Security Manager engages with employees to learn the culture.

    Outcome: Understand what is important to individuals in order to create effective collaboration. People will engage with a project if they can relate it to something they value.

    Actions Next Steps
    • The Security Manager determines that he must use low-cost small wins to integrate with the organizational culture and create trust and buy-in and investment will follow.
    • The Security Manager starts a monthly newsletter to get traction across the organization, create awareness of his mandate to improve information security, and establish himself as a trustworthy partner.
    • The Security Manager will identify specific ways to engage and change the culture.
    • Create a persuasive case for investing in information security based on what resonates with the organization.

    Follow this case study throughout the deck to see this organization’s results

    Step 2.1

    Identify key stakeholders for the CISO and assess current relationships

    Activities

    Evaluate the power, impact, and support of key stakeholders

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step

    • Power map of executive business stakeholders
    • Evaluation of each stakeholder in terms of influence, impact, and current level of support

    Assess

    Identify key stakeholders who own business processes that intersect with security processes

    Info-Tech Insight
    Most organizations don’t exist for the sole purpose of doing information security. For example, if your organization is in the business of selling pencils, then information security is in business to enable the selling of pencils. All the security in the world is meaningless if it doesn’t enable your primary business processes. The CISO must always remember the fundamental goals of the business.

    The above insight has two implications:

    1. The CISO needs to understand the key business processes and who owns them, because these are the people they will need to collaborate with. Like any C-level, the CISO should be one of the most knowledgeable people in the organization regarding business processes.
    2. Each of these stakeholders stands to win or lose depending on the performance of their process, and they can act to either block or enable your progress.
      • To work effectively with these stakeholders, you must learn what is important to them, and pose your initiatives so that you both benefit.

    When people are not receptive to the CISO, it’s usually because the CISO has not been part of the discussion when plans were being made. This is the heart of proactivity.

    You need to be involved from the start … from the earliest part of planning.

    The job is not to come in late and say “No” ... the job is to be involved early and find creative and intelligent ways to say “Yes.”

    The CISO needs to be the enabling security asset that drives business.

    – Elliot Lewis, CEO at Keyavi Data

    Evaluate the importance of business stakeholders and the support necessary from them

    The CISO Stakeholder Power Map Template is meant to provide a visualization of the CISO’s relationships within the organization. This should be a living document that can be updated throughout the year as relationships develop and the structure of an organization changes.

    At a glance, this tool should show:

    • How influential each stakeholder is within the company.
    • How supportive they currently are of the CISO’s initiatives.
    • How strongly each person is impacted by IT security activities.

    Once this tool has been created, it provides a good reference as the CISO works to develop lagging relationships. It shows the landscape of influence and impact within the organization, which may help to guide the CISO’s strategy in the future.

    Evaluate the importance of business stakeholders and the support necessary from them

    Download the CISO Stakeholder Power Map Template

    Evaluate the importance of business stakeholders and the support necessary from them

    1. Identify key stakeholders.
      1. Focus on owners of important business processes.
    2. Evaluate and map each stakeholder in terms of:
      1. Influence (up/down)
      2. Support (left/right)
      3. Impact (size of circle)
      4. Involvement (color of circle)
    3. Decide whether the level of support from each stakeholder needs to change to facilitate success.

    Evaluate the importance of business stakeholders and the support necessary from them

    Info-Tech Insight
    Some stakeholders must work closely with your incoming CISO. It is worth consideration to include these individuals in the interview process to ensure you will have partners that can work well together. This small piece of involvement early on can save a lot of headache in the future.

    Where can you find your desired CISO?

    Once you know which competencies are a priority in your new CISO, the next step is to decide where to start looking. This person may already exist in your company.

    Internal

    Take some time to review your current top information security employees or managers. It may be immediately clear that certain people will or will not be suitable for the CISO role. For those that have potential, proceed to Step 2.2 to map their competencies.

    Recruitment

    If you do not have any current employees that will fit your new CISO profile, or you have other reasons for wanting to bring in an outside individual, you can begin the recruitment process. This could start by posting the position for applications or by identifying and targeting specific candidates.

    Ready to start looking for your ideal candidate? You can use Info-Tech’s Chief Information Security Officer job description template.

    Use the CISO job description template

    Alternatives to hiring a CISO

    Small organizations are less able to muster the resources required to find and retain a CISO,

    Technical Counselor Seat

    In addition to having access to our research and consulting services, you can acquire a Technical Counselor Seat from our Security & Risk practice, where one of our senior analysts would serve with you on a retainer. You may find that this option saves you the expense of having to hire a new CISO altogether.

    Virtual CISO

    A virtual CISO, or vCISO, is essentially a “CISO as a service.” A vCISO provides an organization with an experienced individual that can, on a part-time basis, lead the organization’s security program through policy and strategy development.

    Why would an organization consider a vCISO?

    • A vCISO can provide services that are flexible, technical, and strategic and that are based on the specific requirements of the organization.
    • They can provide a small organization with program maturation within the organization’s resources.
    • They can typically offer depth of experience beyond what a small business could afford if it were to pursue a full-time CISO.

    Source: InfoSec Insights by Sectigo Store

    Why would an organization not consider a vCISO?

    • The vCISO’s attention is divided among their other clients.
    • They won’t feel like a member of your organization.
    • They won’t have a deep understanding of your systems and processes.

    Source: Georgia State University

    Step 2.2

    Assess CISO candidates and evaluate their current competency

    Activities

    Assess CISO candidates in terms of desired core competencies

    or

    Self-assess your personal core competencies

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO

    or

    • Current CISO seeking to upgrade capabilities

    and

    • Any key stakeholders or collaborators you choose to include in the assessment process

    Outcomes of this step

    • You have assessed your requirements for a CISO candidate.
    • The process of hiring is under way, and you have decided whether to hire a CISO, develop a CISO, or consider a Counselor Seat as another option.

    Assess

    2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to assess your CISO candidate

    Use Info-Tech’s CISO Core Competency Evaluation Tool to assess your CISO candidate

    Download the CISO Core Competency Evaluation Tool

    Info-Tech Insight
    The most important competencies should be your focus. Unless you are lucky enough to find a candidate that is perfect across the board, you will see some areas that are not ideal. Don’t forget the importance you assigned to each competency. If a candidate is ideal in the most critical areas, you may not mind that some development is needed in a less important area.

    2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to evaluate your candidates

    After deciding the importance of and requirements for each competency in Phase 1, assess your CISO candidates.

    Your first pass on this tool will be to look at internal candidates. This is the develop a CISO option.

    1. In the previous phase, you rated the Importance and Current Effectiveness for each competency in Tab 2. CISO Core Competencies. In this step, use Tab 3. Gap Analysis to enter a Minimum Level and a Desired Level for each competency. Keep in mind that it may be unrealistic to expect a candidate to be fully developed in all aspects.
    2. Next, enter a rating for your candidate of interest for each of the eight competencies.
    3. This scorecard will generate an overall suitability score for the candidate. The color of the output (from red to green) indicates the suitability, and the intensity of the color indicates the importance you assigned to that competency.

    Download the CISO Core Competency Evaluation Tool

    2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to evaluate your candidates

    • If the internal search does not identify a suitable candidate, you will want to expand your search.
    • Repeat the scoring process for external candidates until you find your new CISO.
    • You may want to skip your external search altogether and instead contact Info-Tech for more information on our Counselor Seat options.

    Download the CISO Core Competency Evaluation Tool

    Phase 3

    Plan

    Phase 1
    1.1 Understand Core Competencies
    1.2 Measure Security and Business Satisfaction and Alignment

    Phase 2
    2.1 Assess Stakeholder Relationships
    2.2 Assess the Core Competencies

    Phase 3
    3.1 Identify Resources to Address Competency Gaps
    3.2 Plan Approach to Improve Stakeholder Relationships

    Phase 4
    4.1 Decide Next Actions and Support Your CISO Moving Forward
    4.2 Regularly Reassess to Measure Development and Progress

    This phase will walk you through the following activities:

    • Create a plan to develop your competency gaps.
    • Construct and consider your organizational model.
    • Create plan to cultivate key stakeholder relationships.

    Hire or Develop a World-Class CISO

    Case study

    Mark Lester
    InfoSec Manager, SC Ports Authority

    The new Security Manager changes the security culture by understanding what is meaningful to employees.

    Outcome: Engage with people on their terms. The CISO must speak the audience’s language and express security terms in a way that is meaningful to the audience.

    Actions Next Steps
    • The Security Manager identifies recent events where ransomware and social engineering attacks were successful in penetrating the organization.
    • He uses his newsletter to create organization-wide discussion on this topic.
    • This very personal example makes employees more receptive to the Security Manager’s message, enabling the culture of risk management.
    • The Security Manager will leverage his success in improving the information security culture and awareness to gain support for future initiatives.

    Follow this case study throughout the deck to see this organization’s results

    Step 3.1

    Identify resources for your CISO to remediate competency gaps

    Activities

    Create a plan to remediate competency gaps

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO
    • The newly hired CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step

    • Identification of core competency deficiencies
    • A plan to close the gaps

    Plan

    3.1 Close competency gaps with Info-Tech’s Cybersecurity Workforce Development Training

    Resources to close competency gaps

    Info-Tech’s Cybersecurity Workforce Training develops critical cybersecurity skills missing within your team and organization. The leadership track provides the same deep coverage of technical knowledge as the analyst track but adds hands-on support and has a focus on strategic business alignment, program management, and governance.

    The program builds critical skills through:

    • Standardized curriculum with flexible projects tailored to business needs
    • Realistic cyber range scenarios
    • Ready-to-deploy security deliverables
    • Real assurance of skill development

    Info-Tech Insight
    Investing in a current employee that has the potential to be a world-class CISO may take less time, effort, and money than finding a unicorn.

    Learn more on the Cybersecurity Workforce Development webpage

    3.1 Identify resources for your CISO to remediate competency gaps

    < 2 hours

    CISO Competencies Description
    Business Acumen

    Info-Tech Workshops & Blueprints

    Actions/Activities

    • Take a business acumen course: Acumen Learning, What the CEO Wants You to Know: Building Business Acumen.
    • Meet with business stakeholders. Ask them to take you through the strategic plan for their department and then identify opportunities where security can provide support to help drive their initiatives.
    • Shadow another C-level executive. Understand how they manage their business unit and demonstrate an eagerness to learn.
    • Pursue an MBA or take a business development course.

    3.1 Identify resources for your CISO to remediate competency gaps (continued)

    < 2 hours

    CISO Competencies Description
    Leadership

    Info-Tech Training and Blueprints

    Action/Activities

    • Communicate your vision for security to your team. You will gain buy-in from your employees by including them in the creation of your program, and they will be instrumental to your success.

    Info-Tech Insight
    Surround yourself with great people. Insecure leaders surround themselves with mediocre employees that aren’t perceived as a threat. Great leaders are supported by great teams, but you must choose that great team first.

    3.1 Identify resources for your CISO to remediate competency gaps (continued)

    < 2 hours

    CISO Competencies Description
    Communication

    Info-Tech Workshops & Blueprints

    Build and Deliver an Optimized IT Update Presentation: Show IT’s value and relevance by dropping the technical jargon and speaking to the business in their terms.

    Master Your Security Incident Response Communications Program: Learn how to talk to your stakeholders about what’s going on when things go wrong.

    Develop a Security Awareness and Training Program That Empowers End Users: Your weakest link is between the keyboard and the chair, so use engaging communication to create positive behavior change.

    Actions/Activities

    Learn to communicate in the language of your audience (whether business, finance, or social), and frame security solutions in terms that are meaningful to your listener.

    Technical Knowledge

    Actions/Activities

    • In many cases, the CISO is progressing from a strong technical background, so this area is likely a strength already.
    • However, as the need for executive skills are being recognized, many organizations are opting to hire a business or operations professional as a CISO. In this case, various Info-Tech blueprints across all our silos (e.g. Security, Infrastructure, CIO, Apps) will provide great value in understanding best practices and integrating technical skills with the business processes.
    • Pursue an information security leadership certification: GIAC, (ISC)², and ISACA are a few of the many organizations that offer certification programs.

    3.1 Identify resources for your CISO to remediate competency gaps (continued)

    < 2 hours

    CISO Competencies Description
    Innovative Problem Solving

    Info-Tech Workshops & Blueprints

    Actions/Activities

    Vendor Management

    Info-Tech Blueprints & Resources

    Actions/Activities

    3.1 Identify resources for your CISO to remediate competency gaps (continued)

    < 2 hours

    CISO Competencies Description
    Change Management

    Info-Tech Blueprints

    Actions/Activities

    • Start with an easy-win project to create trust and support for your initiatives.
    Collaboration

    Info-Tech Blueprints

    Actions/Activities

    • Get out of your office. Have lunch with people from all areas of the business. Understanding the goals and the pains of employees throughout your organization will help you to design effective initiatives and cultivate support.
    • Be clear and honest about your goals. If people know what you are trying to do, then it is much easier for them to work with you on it. Being ambiguous or secretive creates confusion and distrust.

    3.1 Create the CISO’s personal development plan

    • Use Info-Tech’s CISO Development Plan Template to document key initiatives that will close previously identified competency gaps.
    • The CISO Development Plan Template is used to map specific actions and time frames for competency development, with the goal of addressing competency gaps and helping you become a world-class CISO. This template can be used to document:
      • Core competency gaps
      • Security process gaps
      • Security technology gaps
      • Any other career/development goals
    • If you have a coach or mentor, you should share your plan and report progress to that person. Alternatively, call Info-Tech to speak with an executive advisor for support and advice.
      • Toll-Free: 1-888-670-8889

    What you will need to complete this exercise

    • CISO Core Competency Evaluation Tool results
    • Information Security Business Satisfaction and Alignment diagnostic results
    • Insights gathered from business stakeholder interviews

    Step 3.2

    Plan an approach to improve your relationships

    Activities

    • Review engagement strategies for different stakeholder types
    • Create a stakeholder relationship development plan

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO
    • The newly hired CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step

    • Stakeholder relationship strategy deliverable

    Plan

    Where should the CISO sit?

    Where the CISO sits in the organization can have a big impact on the security program.

    • Organizations with CISOs in the C-suite have a fewer security incidents.1
    • Organizations with CISOs in the C-suite generally have better IT ability.1
    • An organization whose CISO reports to the CIO risks conflict of interest.1
    • 51% of CISOs believe their effectiveness can be hampered by reporting lines.2
    • Only half of CISOs feel like they are in a position to succeed.2

    A formalized security organizational structure assigns and defines the roles and responsibilities of different members around security. Use Info-Tech’s blueprint Implement a Security Governance and Management Program to determine the best structure for your organization.

    Who the CISO reports to, by percentage of organizations3

    Who the CISO reports to, by percentage of organizations

    Download the Implement a Security Governance and Management Program blueprint

    1. Journal of Computer Science and Information
    2. Proofpoint
    3. Heidrick & Struggles International, Inc

    3.2 Make a plan to manage your key stakeholders

    Managing stakeholders requires engagement, communication, and relationship management. To effectively collaborate and gain support for your initiatives, you will need to build relationships with your stakeholders. Take some time to review the stakeholder engagement strategies for different stakeholder types.

    Influence Mediators
    (Satisfy)
    Key Players
    (Engage)
    Spectators
    (Monitor)
    Noisemakers
    (Inform)
    Support for you

    When building relationships, I find that what people care about most is getting their job done. We need to help them do this in the most secure way possible.

    I don’t want to be the “No” guy, I want to enable the business. I want to find to secure options and say, “Here is how we can do this.”

    – James Miller, Information Security Director, Xavier University

    Download the CISO Stakeholder Management Strategy Template

    Key players – Engage

    Goal Action
    Get key players to help champion your initiative and turn your detractors into supporters. Actively involve key players to take ownership.
    Keep It Positive Maintain a Close Relationship
    • Use their positive support to further your objectives and act as your foundation of support.
    • Key players can help you build consensus among other stakeholders.
    • Get supporters to be vocal in your town halls.
    • Ask them to talk to other stakeholders over whom they have influence.
    • Get some quick wins early to gain and maintain stakeholder support and help convert them to your cause.
    • Use their influence and support to help persuade blockers to see your point of view.
    • Collaborate closely. Key players are tuned in to information streams that are important. Their advice can keep you informed and save you from being blindsided.
    • Keep them happy. By definition, these individuals have a stake in your plans and can be affected positively or negatively. Going out of your way to maintain relationships can be well worth the effort.

    Info-Tech Insight
    Listen to your key players. They understand what is important to other business stakeholders, and they can provide valuable insight to guide your future strategy.

    Mediators – Satisfy

    Goal Action
    Turn mediators into key players Increase their support level.
    Keep It Positive Maintain a Close Relationship
    • Make stakeholders part of the conversation by consulting them for input on planning and strategy.
    • Sample phrases:
      • “I’ve heard you have experience in this area. Do you have time to answer a few questions?”
      • “I’m making some decisions and I would value your thoughts. Can I get your perspective on this?”
    • Enhance their commitment by being inclusive. Encourage their support whenever possible.
    • Make them feel acknowledged and solicit feedback.
    • Listen to blockers with an open mind to understand their point of view. They may have valuable insight.
    • Approach stakeholders on their individual playing fields.
      • They want to know that you understand their business perspective.
    • Stubborn mediators might never support you. If consulting doesn’t work, keep them informed of important decision-making points and give them the opportunity to be involved if they choose to be.

    Info-Tech Insight
    Don’t dictate to stakeholders. Make them feel like valued contributors by including them in development and decision making. You don’t have to incorporate all their input, but it is essential that they feel respected and heard.

    Noisemakers – Inform

    Goal Action
    Have noisemakers spread the word to increase their influence. Encourage noisemakers to influence key stakeholders.
    Keep It Positive Maintain a Close Relationship
    • Identify noisemakers who have strong relationships with key stakeholders and focus on them.
      • These individuals may not have decision-making power, but their opinions and advice may help to sway a decision in your favor.
    • Look for opportunities to increase their influence over others.
    • Put effort into maintaining the positive relationship so that it doesn’t dwindle.
    • You already have this group’s support, but don’t take it for granted.
    • Be proactive, pre-emptive, and transparent.
    • Address issues or bad news early and be careful not to exaggerate their significance.
    • Use one-on-one meetings to give them an opportunity to express challenges in a private setting.
    • Show individuals in this group that you are a problem-solver:
      • “The implementation was great, but we discovered problems afterward. Here is what we’re doing about it.”

    Spectators – Monitor

    Goal Action
    Keep spectators content and avoid turning them into detractors. Keep them well informed.
    Keep It Positive Maintain a Close Relationship
    • A hands-on approach is not required with this group.
    • Keep them informed with regular, high-altitude communications and updates.
    • Use positive, exciting announcements to increase their interest in your initiatives.
    • Select a good venue for generating excitement and assessing the mood of spectators.
    • Spectators may become either supporters or blockers. Monitor them closely and keep in touch with them to stop these individuals from becoming blockers.
    • Listen to questions from spectators carefully. View any engagement as an opportunity to increase participation from this group and generate a positive shift in interest.

    3.2 Create the CISO’s stakeholder management strategy

    Develop a strategy to manage key stakeholders in order to drive your personal development plan initiatives.

    • The purpose of the CISO Stakeholder Management Strategy Template is to document the results of the power mapping exercise, create a plan to proactively manage stakeholders, and track the actions taken.
    • Use this in concert with Info-Tech’s CISO Stakeholder Power Map Template to help visualize the importance of key stakeholders to your personal development. You will document:
      • Stakeholder role and type.
      • Current relationship with the stakeholder.
      • Level of power/influence and degree of impact.
      • Current and desired level of support.
      • Initiatives that require the stakeholder’s engagement.
      • Actions to be taken – along with the status and results.

    What you will need to complete this exercise

    • Completed CISO Stakeholder Power Map
    • Security Business Satisfaction and Alignment Diagnostic results

    Download the CISO Stakeholder Management Strategy Template

    Phase 4

    Execute

    Phase 1
    1.1 Understand Core Competencies
    1.2 Measure Security and Business Satisfaction and Alignment

    Phase 2
    2.1 Assess Stakeholder Relationships
    2.2 Assess the Core Competencies

    Phase 3
    3.1 Identify Resources to Address Competency Gaps
    3.2 Plan Approach to Improve Stakeholder Relationships

    Phase 4
    4.1 Decide Next Actions and Support Your CISO Moving Forward
    4.2 Regularly Reassess to Measure Development and Progress

    This phase will walk you through the following activities:

    • Populate the CISO Development Plan Template with appropriate targets and due dates.
    • Set review and reassess dates.
    • Review due dates with CISO.

    Hire or Develop a World-Class CISO

    Case study

    Mark Lester
    InfoSec Manager, SC Ports Authority

    The new Security Manager leverages successful cultural change to gain support for new security investments.

    Outcome: Integrating with the business on a small level and building on small successes will lead to bigger wins and bigger change.

    Actions Next Steps
    • By fostering positive relationships throughout the organization, the Security Manager has improved the security culture and established himself as a trusted partner.
    • In an organization that had seen very little change in years, he has used well developed change management, business acumen, leadership, communication, collaboration, and innovative problem-solving competencies to affect his initiatives.
    • He can now return to the board with a great deal more leverage in seeking support for security investments.
    • The Security Manager will leverage his success in improving the information security culture and awareness to gain support for future initiatives.

    Step 4.1

    Decide next actions and support your CISO moving forward

    Activities

    • Complete the Info-Tech CISO Development Plan Template
    • Create a stakeholder relationship development plan

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO
    • The newly hired CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step

    Next actions for each of your development initiatives

    Execute

    Establish a set of first actions to set your plan into motion

    The CISO Development Plan Template provides a simple but powerful way to focus on what really matters to execute your plan.

    • By this point, the CISO is working on the personal competency development while simultaneously overseeing improvements across the security program, managing stakeholders, and seeking new business initiatives to engage with. This can be a lot to juggle effectively.
    • Disparate initiatives like these can hinder progress by creating confusion.
    • By distilling your plan down to Subject > Action > Outcome, you immediately restore focus and turn your plans into actionable items.
    • The outcome is most valuable when it is measurable. This makes progress (or lack of it) very easy to track and assess, so choose a meaningful metric.
    Item to Develop
    (competency/process/tech)
    First Action Toward Development
    Desired Outcome, Including a Measurable Indicator

    Download the CISO Development Plan Template

    4.1 Create a CISO development plan to keep all your objectives in one place

    Use Info-Tech’s CISO Development Plan Template to create a quick and simple yet powerful tool that you can refer to and update throughout your personal and professional development initiatives. As instructed in the template, you will document the following:

    Your Item to Develop The Next Action Required The Target Outcome
    This could be a CISO competency, a security process item, a security technology item, or an important relationship (or something else that is a priority). This could be as simple as “schedule lunch with a stakeholder” or “email Info-Tech to schedule a Guided Implementation call.” This part of the tool is meant to be continually updated as you progress through your projects. The strength of this approach is that it focuses your project into simple actionable steps that are easily achieved, rather than looking too far down the road and seeing an overwhelming task ahead. This will be something measurable like “reduce spending by 10%” or “have informal meeting with leaders from each department.”

    Info-Tech Insight
    A good plan doesn’t require anything that is outside of your control. Good measurable outcomes are behavior based rather than state based.
    “Increase the budget by 10%” is a bad goal because it is ultimately reliant on someone else and can be derailed by an unsupportive executive. A better goal is “reduce spending by 10%.” This is something more within the CISO’s control and is thus a better performance indicator and a more achievable goal.

    4.1 Create a CISO development plan to keep all your objectives in one place

    Below you will find sample content to populate your CISO Development Plan Template. Using this template will guide your CISO in achieving the goals identified here.

    The template itself is a metric for assessing the development of the CISO. The number of targets achieved by the due date will help to quantify the CISO’s progress.

    You may also want to include improvements to the organization’s security program as part of the CISO development plan.

    Area for Development Item for Development Next Action Required Key Stakeholders/ Owners Target Outcome Due Date Completed
    Core Competencies:
    Communication
    Executive
    communication
    Take economics course to learn business language Course completed [Insert date] [Y/N]
    Core Competencies:
    Communication
    Improve stakeholder
    relationships
    Email Bryce from finance to arrange lunch Improved relationship with finance department [Insert date] [Y/N]
    Technology Maturity: Security Prevention Identity and access management (IAM) system Call Info-Tech to arrange call on IAM solutions 90% of employees entered into IAM system [Insert date] [Y/N]
    Process Maturity: Response & Recovery Disaster recovery Read Info-Tech blueprint on disaster recovery Disaster recovery and backup policies in place [Insert date] [Y/N]

    Check out the First 100 Days as CISO blueprint for guidance on bringing improvements to the security program

    4.1 Use your action plan to track development progress and inform stakeholders

    • As you progress toward your goals, continually update the CISO development plan. It is meant to be a living document.
    • The Next Action Required should be updated regularly as you make progress so you can quickly jump in and take meaningful actions without having to reassess your position every time you open the plan. This is a simple but very powerful method.
    • To view your initiatives in customizable ways, you can use the drop-down menu on any column header to sort your initiatives (i.e. by due date, completed status, area for development). This allows you to quickly and easily see a variety of perspectives on your progress and enables you to bring upcoming or incomplete projects right to the top.
    Area for Development Item for Development Next Action Required Key Stakeholders/ Owners Target Outcome Due Date Completed
    Core Competencies:
    Communication
    Executive
    communication
    Take economics course to learn business language Course completed [Insert date] [Y/N]
    Core Competencies:
    Communication
    Improve stakeholder
    relationships
    Email Bryce from finance to arrange lunch Improved relationship with finance department [Insert date] [Y/N]
    Technology Maturity: Security Prevention Identity and access management (IAM) system Call Info-Tech to arrange call on IAM solutions 90% of employees entered into IAM system [Insert date] [Y/N]
    Process Maturity: Response & Recovery Disaster recovery Read Info-Tech blueprint on disaster recovery Disaster recovery and backup policies in place [Insert date] [Y/N]

    Step 4.2

    Regularly reassess to track development and progress

    Activities

    Create a calendar event for you and your CISO, including which items you will reassess and when

    This step involves the following participants:

    • CEO or other executive seeking to hire/develop a CISO
    • The newly hired CISO

    or

    • Current CISO seeking to upgrade capabilities

    Outcomes of this step

    Scheduled reassessment of the CISO’s competencies

    Execute

    4.2 Regularly evaluate your CISO’s progress

    < 1 day

    As previously mentioned, your CISO development plan is meant to be a living document. Your CISO will use this as a companion tool throughout project implementation, but periodically it will be necessary to re-evaluate the entire program to assess your progress and ensure that your actions are still in alignment with personal and organizational goals.

    Info-Tech recommends performing the following assessments quarterly or twice yearly with the help of our executive advisors (either over the phone or onsite).

    1. Sit down and re-evaluate your CISO core competencies using the CISO Core Competency Evaluation Tool.
    2. Analyze your relationships using the CISO Stakeholder Power Map Template.
    3. Compare all of these against your previous results to see what areas you have strengthened and decide if you need to focus on a different area now.
    4. Consider your CISO Development Plan Template and decide whether you have achieved your desired outcomes. If not, why?
    5. Schedule your next reassessment, then create a new plan for the upcoming quarter and get started.
    Materials
    • Laptop
    • CISO Development Plan Template
    Participants
    • CISO
    • Hiring executive (possibly)
    Output
    • Complete CISO and security program development plan

    Summary of Accomplishment

    Knowledge Gained

    • Understanding of the competencies contributing to a successful CISO
    • Strategic approach to integrate the CISO into the organization
    • View of various CISO functions from a variety of business and executive perspectives, rather than just a security view

    Process Optimized

    • Hiring of the CISO
    • Assessment and development of stakeholder relationships for the CISO
    • Broad planning for CISO development

    Deliverables Completed

    • IT Security Business Satisfaction and Alignment Diagnostic
    • CISO Core Competency Evaluation Tool
    • CISO Stakeholder Power Map Template
    • CISO Stakeholder Management Strategy Template
    • CISO Development Plan Template

    If you would like additional support, have our analysts guide you through an Info-Tech workshop or Guided Implementation

    Contact your account representative for more information

    workshop@infotech.com
    1-888-670-8889

    Related Info-Tech Research

    Build an Information Security Strategy
    Your security strategy should not be based on trying to blindly follow best practices but on a holistic risk-based assessment that is risk aware and aligns with your business context.

    The First 100 Days as CISO
    Every CISO needs to follow Info-Tech’s five-step approach to truly succeed in their new position. The meaning and expectations of a CISO role will differ from organization to organization and person to person, but the approach to the new position will be relatively the same.

    Implement a Security Governance and Management Program
    Business and security goals should be the same. Businesses cannot operate without security, and security's goal is to enable safe business operations.

    Research Contributors

    • Mark Lester, Information Security Manager, South Carolina State Ports Authority
    • Kyle Kennedy, CISO, CyberSN.com
    • James Miller, Information Security Director, Xavier University
    • Elliot Lewis, Vice President Security & Risk, Info-Tech Research Group
    • Andrew Maroun, Enterprise Security Lead, State of California
    • Brian Bobo, VP Enterprise Security, Schneider National
    • Candy Alexander, GRC Security Consultant, Towerall Inc.
    • Chad Fulgham, Chairman, PerCredo
    • Ian Parker, Head of Corporate Systems Information Security Risk and Compliance, Fujitsu EMEIA
    • Diane Kelly, Information Security Manager, Colorado State Judicial Branch
    • Jeffrey Gardiner, CISO, Western University
    • Joey LaCour, VP & Chief Security, Colonial Savings
    • Karla Thomas, Director IT Global Security, Tower Automotive
    • Kevin Warner, Security and Compliance Officer, Bridge Healthcare Providers
    • Lisa Davis, CEO, Vicinage
    • Luis Brown, Information Security & Compliance Officer, Central New Mexico Community College
    • Peter Clay, CISO, Qlik
    • Robert Banniza, Senior Director IT Center Security, AMSURG
    • Tim Tyndall, Systems Architect, Oregon State

    Bibliography

    Dicker, William. "An Examination of the Role of vCISO in SMBs: An Information Security Governance Exploration." Dissertation, Georgia State University, May 2, 2021. Accessed 30 Sep. 2022.

    Heidrick & Struggles. "2022 Global Chief Information Security Officer (CISO) Survey" Heidrick & Struggles International, Inc. September 6, 2022. Accessed 30 Sep. 2022.

    IBM Security. "Cost of a Data Breach Report 2022" IBM. August 1, 2022. Accessed 9 Nov. 2022.

    Mehta, Medha. "What Is a vCISO? Are vCISO Services Worth It?" Infosec Insights by Sectigo, June 23, 2021. Accessed Nov 22. 2022.

    Milica, Lucia. “Proofpoint 2022 Voice of the CISO Report” Proofpoint. May 2022. Accessed 6 Oct. 2022.

    Navisite. "The State of Cybersecurity Leadership and Readiness" Navisite. November 9, 2021. Accessed 9 Nov. 2022.

    Shayo, Conrad, and Frank Lin. “An Exploration of the Evolving Reporting Organizational Structure for the Chief Information Security Officer (CISO) Function” Journal of Computer Science and Information Technology, vol. 7, no. 1, June 2019. Accessed 28 Sep. 2022.

    Maximize the Benefits from Enterprise Applications with a Center of Excellence

    • Buy Link or Shortcode: {j2store}367|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $129,465 Average $ Saved
    • member rating average days saved: 12 Average Days Saved
    • Parent Category Name: Optimization
    • Parent Category Link: /optimization
    • Processes pertaining to managing the application are inconsistent and do not drive excellence.
    • There is a lack of interdepartmental collaboration between different teams pertaining to the application.
    • There are no formalized roles and responsibilities for governance and support around enterprise applications.

    Our Advice

    Critical Insight

    • Scale the Center of Excellence (CoE) based on business needs. There is flexibility in how extensively the CoE methodology is applied and rigidity in how consistently it should be used.
    • The CoE is a refinery. It takes raw inputs from the business and produces an enhanced product, removing waste and isolating it from re-entering day-to-day operations.
    • Excellence is about people as much as it is about process. Documented best practices should include competencies, key resources, and identified champions to advocate the CoE practice.

    Impact and Result

    • Formalize roles and responsibilities for all application initiatives.
    • Develop a standard process of governance and oversight surrounding the application.
    • Develop a comprehensive support network that consists of IT, the business, and external stakeholders to address issues and problem areas surrounding the application.

    Maximize the Benefits from Enterprise Applications with a Center of Excellence Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should establish a Center of Excellence for your enterprise application, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Create a vision for the CoE

    Understand the importance of developing an enterprise application CoE, define its scope, and identify key stakeholders.

    • Maximize the Benefits from Enterprise Applications with a Center of Excellence – Phase 1: Create a Vision for the Center of Excellence
    • Enterprise Application Center of Excellence Project Charter

    2. Design the CoE future state

    Gather high-level requirements to determine the ideal future state.

    • Maximize the Benefits from Enterprise Applications with a Center of Excellence – Phase 2: Design the Center of Excellence Future State
    • Center of Excellence Refinery Model Template

    3. Develop a CoE roadmap

    Assess the required capabilities to reach the ideal state CoE.

    • Maximize the Benefits from Enterprise Applications with a Center of Excellence – Phase 3: Develop a Center of Excellence Roadmap
    • Center of Excellence Exceptions Report
    • Track and Measure Benefits Tool
    • Enterprise Application Center of Excellence Stakeholder Presentation Template
    [infographic]

    Workshop: Maximize the Benefits from Enterprise Applications with a Center of Excellence

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Create a Vision for the CoE

    The Purpose

    Understand the importance of developing a CoE for enterprise applications.

    Determine how to best align the CoE mandate with business objectives.

    Complete a CoE project charter to gain buy-in, build a project team, and track project success. 

    Key Benefits Achieved

    Key stakeholders identified.

    Project team created with defined roles and responsibilities.

    Project charter finalized to gain buy-in.

    Activities

    1.1 Evaluate business needs and priorities.

    1.2 Identify key stakeholders and the project team.

    1.3 Align CoE with business priorities.

    1.4 Map current state CoE.

    Outputs

    Project vision

    Defined roles and responsibilities

    Strategic alignment of CoE and the business

    CoE current state schematic

    2 Design the CoE Future State

    The Purpose

    Gain a thorough understanding of pains related to the lack of application governance.

    Identify and recycle existing CoE practices.

    Visualize the CoE enhancement process.

    Visualize your ideal state CoE. 

    Key Benefits Achieved

    Requirements to strengthen the case for the enterprise application CoE.

    CoE value-add refinery.

    Future potential of the CoE.

    Activities

    2.1 Gather requirements.

    2.2 Map the CoE enhancement process.

    2.3 Sketch future state CoE.

    Outputs

    Classified pains, opportunities, and existing practices

    CoE refinery model

    Future state CoE sketch

    3 Develop a CoE Roadmap

    The Purpose

    Assess required capabilities and resourcing.

    List and prioritize CoE initiatives.

    Track and monitor CoE performance. 

    Key Benefits Achieved

    Next steps for the enterprise application CoE.

    CoE resourcing plan.

    CoE benefits realization tracking.

    Activities

    3.1 Build CoE capabilities.

    3.2 Identify risks and mitigation efforts.

    3.3 Prioritize and track CoE initiatives.

    3.4 Finalize stakeholder presentation.

    Outputs

    CoE potential capabilities

    Risk management plan

    CoE initiatives roadmap

    CoE stakeholder presentation

    Master M&A Cybersecurity Due Diligence

    • Buy Link or Shortcode: {j2store}261|cart{/j2store}
    • member rating overall impact: 10.0/10 Overall Impact
    • member rating average dollars saved: $12,399 Average $ Saved
    • member rating average days saved: 5 Average Days Saved
    • Parent Category Name: Governance, Risk & Compliance
    • Parent Category Link: /governance-risk-compliance

    This research is designed to help organizations who are preparing for a merger or acquisition and need help with:

    • Understanding the information security risks associated with the acquisition or merger.
    • Avoiding the unwanted possibility of acquiring or merging with an organization that is already compromised by cyberattackers.
    • Identifying best practices for information security integration post merger.

    Our Advice

    Critical Insight

    The goal of M&A cybersecurity due diligence is to assess security risks and the potential for compromise. To succeed, you need to look deeper.

    Impact and Result

    • A repeatable methodology to systematically conduct cybersecurity due diligence.
    • A structured framework to rapidly assess risks, conduct risk valuation, and identify red flags.
    • Look deeper by leveraging compromise diagnostics to increase confidence that you are not acquiring a compromised entity.

    Master M&A Cybersecurity Due Diligence Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Start here – read the Executive Brief

    Read our concise Executive Brief to find out how to master M&A cyber security due diligence, review Info-Tech’s methodology, and understand how we can support you in completing this project.

    [infographic]

    Build Your IT Cost Optimization Roadmap

    • Buy Link or Shortcode: {j2store}72|cart{/j2store}
    • member rating overall impact: 8.9/10 Overall Impact
    • member rating average dollars saved: $57,297 Average $ Saved
    • member rating average days saved: 7 Average Days Saved
    • Parent Category Name: Cost & Budget Management
    • Parent Category Link: /cost-and-budget-management

    Cost optimization is misunderstood and inadequately tackled. IT departments face:

    • Top-down budget cuts within a narrow time frame
    • Absence of adequate governance: financial, project, data, etc.
    • Long-standing bureaucratic practices slowing down progress
    • Short-term thinking

    Our Advice

    Critical Insight

    Cost optimization is not just about reducing costs. In fact, you should aim to achieve three objectives:

    • Reduce your unwarranted IT spending.
    • Optimize your cost-to-value.
    • Sustain your cost optimization.

    Impact and Result

    • Follow Info-Tech’s approach to develop a 12-month cost optimization roadmap.
    • Develop an IT cost optimization strategy based on your specific circumstances and timeline.
    • Info-Tech’s methodology helps you maintain sustainable cost optimization across IT by focusing on four levers: assets, vendors, project portfolio, and workforce.

    Build Your IT Cost Optimization Roadmap Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. IT Cost Optimization Roadmap Deck – A step-by-step methodology to achieve sustainable cost optimization and effectively communicate your strategy to stakeholders.

    This blueprint will help you understand your IT cost optimization mandate, identify your journey, assess your IT spend across four levers, develop your IT cost optimization roadmap, and craft a related communication strategy.

    • Build Your IT Cost Optimization Roadmap – Phases 1-4

    2. IT Cost Optimization Workbook – A structured tool to help you document your IT cost optimization goals and outline related initiatives to develop an effective 12-month roadmap.

    This tool guides an IT department in planning and prioritization activities to build an effective IT cost optimization strategy. The outputs include visual charts and a 12-month roadmap to showcase the implementation timelines and potential cost savings.

    • IT Cost Optimization Workbook

    3. IT Cost Optimization Roadmap Samples and Templates – A proactive journey template to help you communicate your IT cost optimization strategy to stakeholders in a clear, concise, and compelling manner.

    This presentation template uses sample data from "Acme Corp" to demonstrate an IT cost optimization strategy following a proactive journey. Use this template to document your final IT cost optimization strategy outputs, including the adopted journey, IT cost optimization goals, related key initiatives, potential cost savings, timelines, and 12-month roadmap.

    • IT Cost Optimization Roadmap Samples and Templates

    Infographic

    Workshop: Build Your IT Cost Optimization Roadmap

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Understand Your Mandate & Objectives

    The Purpose

    Determine your organization’s current context and its cost optimization objectives, IT’s corresponding cost optimization journey, and goals.

    Key Benefits Achieved

    A business-aligned set of specific IT cost optimization goals.

    Activities

    1.1 Understand your organization’s cost optimization objectives and how this impacts IT.

    1.2 Review potential cost optimization target areas based on your ITFM Benchmarking Report.

    1.3 Identify factors constraining cost optimization options.

    1.4 Set concrete IT cost optimization goals.

    1.5 Identify inputs required for decision making.

    Outputs

    IT cost optimization journey and guiding principles for making corresponding decisions

    2 Outline Initiatives for Vendors & Assets

    The Purpose

    Create a longlist of potential cost optimization initiatives focused on two cost optimization levers: assets and vendors.

    Key Benefits Achieved

    A comprehensive list of potential asset- and vendor-focused initiatives including cost savings estimates.

    Activities

    2.1 Identify a longlist of possible initiatives around asset lifecycle management, investment deferral, repurposing, etc., and vendor contract renegotiation, cancelation, etc.

    2.2 Estimate the cost savings of cost optimization initiatives.

    Outputs

    Longlist of potential vendor management and asset optimization IT cost optimization initiatives

    3 Outline Initiatives for Projects & Workforce

    The Purpose

    Create a longlist of potential cost optimization initiatives focused on two cost optimization levers: project portfolio and workforce.

    Key Benefits Achieved

    A comprehensive list of potential initiatives focused on project portfolio and workforce including cost savings estimates.

    Activities

    3.1 Identify a longlist of possible initiatives around project priorities, project backlog reduction, project intake restructuring, etc., and workforce productivity, skills, redeployment, etc.

    3.2 Estimate the cost savings of cost optimization initiatives.

    Outputs

    Longlist of possible cost optimization initiatives and their potential cost savings for project portfolio and workforce levers.

    4 Build an IT Cost Optimization Roadmap

    The Purpose

    Develop a visual IT cost optimization roadmap.

    Key Benefits Achieved

    A prioritized, business-aligned IT cost optimization roadmap

    Activities

    4.1 Assess feasibility of each initiative (effort and risk profile) given cost optimization goals.

    4.2 Prioritize cost optimization initiatives to create a final shortlist.

    4.3 Fine-tune key information about your final cost optimization initiatives and develop a cost optimization roadmap for proposal.

    Outputs

    Prioritized list of key cost optimization initiatives, descriptions, estimated impact, and roadmap.

    5 Communicate & Execute

    The Purpose

    Develop a communication plan and executive presentation.

    Key Benefits Achieved

    A boardroom-ready set of communication materials for gaining buy-in and support for your IT cost optimization roadmap.

    Activities

    5.1 Outline components of a communication plan, including approvers, stakeholders, and governance and management mechanisms to be used.

    5.2 Create an executive presentation.

    5.3 Set up review time for workshop deliverables and post-workshop activities.

    Outputs

    IT cost optimization communication plan and presentation strategy.

    IT Cost Optimization Executive Presentation

    Further reading

    Build Your IT Cost Optimization Roadmap

    Improve cost-to-value in a sustainable manner.

    Analyst Perspective

    Optimize your cost sustainably.

    Whether the industry is in an economic downturn, or your business is facing headwinds in the market, pressure to reduce spending across organizations is inevitable. When it comes to the IT organization, it is often handled as a onetime event. Cost optimization is an industry standard term, but it usually translates into cost cutting. How do you manage this challenge given the day-to-day demands placed on IT? Do you apply cost reduction equally across the IT landscape, or do you apply reductions using a targeted approach? How do you balance the business demands regarding innovation with keeping the lights on? What is the best path forward?

    While the situation isn't unique, all too often the IT organization response is too shortsighted.

    By using the Info-Tech methodology and tools, you will be able to develop an IT cost optimization roadmap based on your specific circumstances and timeline.

    A well-thought-out strategy should help you achieve three objectives:

    1. Reduce your unwarranted IT spending.
    2. Optimize your cost-to-value.
    3. Sustain your cost optimization.

    This blueprint will guide you to understand your mandate, identify your cost optimization journey (reactive, proactive, or strategic), and assess your IT spend across four levers (assets, vendors, project portfolio, and workforce).

    Finally, keep in mind that cost optimization is not a project to be completed, but an ongoing process to be exercised.

    Bilal Alberto Saab, Research Director, IT Financial Management

    Bilal Alberto Saab
    Research Director, IT Financial Management
    Info-Tech Research Group

    Executive Summary

    Cost optimization is misunderstood and inadequately tackled Common obstacles Follow Info-Tech's approach to develop a 12-month cost optimization roadmap
    • Top-down budget cut within a narrow time frame.
    • Absence of adequate governance: financial, project, data, etc.
    • Long-standing bureaucratic practices slowing down progress.
    • Short-term thinking.
    • Lack of alignment and collaboration among stakeholders: communication and relationships.
    • Absence of a clear plan and adequate process.
    • Lack of knowledge, expertise, and skill set.
    • Inadequate funding and no financial transparency.
    • Poor change management practices.

    Develop an IT cost optimization strategy based on your specific circumstances and timeline.

    Info-Tech's methodology helps you maintain sustainable cost optimization across IT by focusing on four levers:

    1. Assets
    2. Vendors
    3. Project Portfolio
    4. Workforce

    Info-Tech Insight
    Cost optimization is not just about reducing costs. In fact, you should aim to achieve three objectives: (1) reduce your unwarranted IT spending, (2) optimize your cost-to-value, and (3) sustain your cost optimization.

    Your challenge

    IT leaders are often asked to cut costs.

    • Cost management is a long-term challenge. Businesses and IT departments look to have a flexible cost structure focused on maximizing business value while maintaining the ability to adapt to market pressure. However, businesses must also be able to respond to unexpected events.
    • In times of economic downturn, many CEOs and CFOs shift their thinking from growth to value protection. This can force a round of cost cutting across all departments focused on short-term, immediate, and measurable objectives.
    • Many IT departments are then faced with the challenge of meeting cost cutting targets. No one knows exactly how markets will behave, but the effects of rising inflation and increasing interest rates, for example, can manifest very quickly.

    When crisis hits, does IT's hard-won gains around being seen as a partner to the business suddenly disappear and IT becomes just a cost center all over again?

    In times of economic slowdown or downturn, the key challenge of IT leaders is to optimize costs without jeopardizing their strategic and innovative contribution.

    Common obstacles

    The 90% of the budget you keep is more important than the 10% of the budget you cut.

    • While the business responds to fluctuating economic conditions, IT must ensure that its budget remains fully aligned with business strategy and expected business value.
    • However, in the face of sudden pressures, a common tendency is to make quick decisions without fully considering their long-term implications.
    • Avoid costly mistakes with a proactive and strategic mindset. Put in place a well-communicated cost optimization strategy rather than hastily cutting back the biggest line items in your budget.

    How can IT optimize costs to achieve a corporate impact, but not cut so deep that the organization can't take advantage of opportunities to recover and thrive?

    Know how you will strategically optimize IT costs before you are forced to cut cost aggressively in a reactive fashion.

    What is cost optimization?

    It's not just about cutting costs

    • While cost optimization may involve cutting costs, it is more about making smart spend and investment decisions.
    • At its core, cost optimization is a strategic decision-making process that sets out to minimize waste and get the most value for money.
    • Cost optimization encompasses near-term, mid-term, and long-term objectives, all of which are related and build upon one another. It is an accumulative practice, not a onetime exercise.
    • A sound cost optimization practice is inherently flexible, sustainable, and consequence-oriented with the positive goal of generating net benefit for the organization over time.

    Change your mindset ...

    An Info-Tech survey of IT staff reveals that while most agree that cost optimization is an important IT process, nearly 20% fewer of them agree that it's being managed well.

    Chart of cost optimization

    Info-Tech IT Management & Governance Diagnostic, 2022.

    A starting point for cost optimization improvement is adjusting your frame of mind. Know that it's not just about making difficult cuts - in reality, it's a creative pursuit that's about thriving in all circumstances, not just surviving.

    Slow revenue growth expectations generate urgency

    Many IT organizations will be directed to trim costs during turbulent times.

    • Cost optimization implies continuous cost management, which entails long-term strategic initiatives (i.e. organizations and their IT departments seek flexible cost structures and practices focused on maximizing business value while maintaining the ability to adapt to changes in the broader economic environment). However, organizations must also be able to respond to unexpected events.
    • During times of turmoil – poor economic outlook expected to negatively impact an organization's bottom line – CEOs and CFOs think more about survival than growth, driving cost cutting across all departments to create short-term, immediate, and measurable financial benefits.
    • In such situations, many IT departments will be hard-pressed to meet cost cutting targets at short notice. If not planned correctly, with a tunnel vision focus instead of a strategic one, you can end up hurting yourself in the not-so-distant future.

    Build Your IT Cost Optimization Roadmap

    Insight summary

    Sustain an optimal cost-to-value ratio across four levers:

    1. Assets
    2. Vendors
    3. Project Portfolio
    4. Workforce

    Cost optimization is not just about reducing costs

    In fact, you should aim to achieve three objectives:
    (1) reduce your unwarranted IT spending, (2) optimize your cost-to-value, and (3) sustain your cost optimization.

    Reduce unwarranted IT spending

    Stop the bleeding or go for quick wins
    Start by reducing waste and bad spending habits while clearly communicating your intentions to your stakeholders – get buy-in.

    Optimize cost-to-value

    Value means tradeoffs
    Pursue value but know that it will lead you to make tradeoffs between cost, performance, and risk.

    Sustain cost optimization

    Think about tomorrow: reduce, reuse, recalibrate, and repeat
    Standardize and automate your cost optimization processes around a proper governance framework. Cost optimization is not a onetime exercise.

    Info-Tech's methodology for building your IT cost optimization roadmap

    Phase 1: Understand Your Mandate & Objectives

    Know where you stand and where you're going.

    Understand your cost optimization mandate within the context of your organization's situation and direction.

    Phase 2: Outline Your Initiatives

    Evaluate many, pick a few.

    Think of all possible cost optimization initiatives across the four optimization levers (Assets, Vendors, Project Portfolio, and Workforce), but only keep the ones that best help you fulfill your goals.

    Phase 3: Develop Your Roadmap

    Keep one eye on today and the other on tomorrow.

    Prioritize cost optimization initiatives that would help you achieve your near-term objectives first, but don't forget about the medium and long term.

    Phase 4: Communicate and Execute

    Communicate and collaborate - you are not a one-person show.

    Reach out to other business units where necessary. Your success relies on getting buy-in from various stakeholders, especially when cost optimization initiatives impact them in one way or another.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

    IT Cost Optimization Roadmap Samples and Templates
    Templates including an abbreviated executive presentation and a final communication presentation based on a 12-month cost optimization roadmap.

    IT Cost Optimization Workbook
    A workbook generating a 12-month cost optimization roadmap.

    Measure the value of this blueprint

    Maintain an optimal IT cost-to-organization revenue ratio.

    This blueprint will guide you to set cost optimization goals across one to three main objectives, depending on your identified journey (reactive, proactive, or strategic):

    • Reduce unwarranted IT spending.
    • Optimize cost-to value.
    • Sustain cost optimization.

    In phase 1 of this blueprint, we will help you establish your goals to satisfy your organization's needs.

    In phase 3, we will help you develop a game plan and a roadmap for achieving those metrics.

    Once you implement your 12-month roadmap, start tracking the metrics below over the next fiscal year (FY) to assess the effectiveness of undertaken measures.

    Cost Optimization Objective Key Success Metric
    Reduce unwarranted IT spending Decrease IT cost in identified key areas
    Optimize cost-to-value Decrease IT cost per IT employee
    Sustain cost optimization Decrease IT cost-to-organization revenue

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit
    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."
    Guided Implementation
    "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."
    Workshop
    "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.
    Consulting
    "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Diagnostics and consistent frameworks are used throughout all four options.

    Guided implementation

    What does a typical GI on this topic look like?

    Phase 1 Phase 2 Phase 3 Phase 4
    Call #1:
    • Identify cost optimization scope requirements, objectives, and your specific challenges.
    • Review and assess cost optimization goals and objectives.
    Call #2:

    Review potential cost optimization initiatives for assets and vendors levers.

    Call #3:

    Assess cost optimization initiatives' cost and feasibility - for assets and vendors levers.

    Call #4:

    Review potential cost optimization initiatives for project portfolio and workforce levers.

    Call #5:

    Assess cost optimization initiatives' cost and feasibility - for project portfolio and workforce levers.

    Call #6:
    • Identify final decision criteria for cost optimization prioritization.
    • Review prioritized cost optimization initiatives and roadmap outputs.
    Call #7:
    • Review the Cost Optimization Communication Plan and IT Cost Optimization Executive Presentation.
    • Discuss next steps.

    A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI will include multiple calls over the course of one to two months.

    IT cost analysis and optimization workshop overview

    Session 1 Session 2 Session 3 Session 4 Session 5
    Activities Understand Your Mandate and Objectives Outline Initiatives for Assets and Vendors Outline Initiatives for Projects and Workforce Develop an IT Cost Optimization Roadmap Communicate and Execute
    1.1 Understand your organization's cost optimization objectives and how this impacts IT.
    1.2 Review potential cost optimization target areas based on your IT financial management benchmarking report.
    1.3 Identify factors constraining cost optimization options.
    1.4 Set concrete IT cost optimization goals.
    1.5 Identify inputs required for decision making.
    2.1 Identify a longlist of possible initiatives around:
    1. Asset lifecycle management, investment deferral, repurposing, etc.
    2. Vendor contract renegotiation, cancelation, etc.
    2.2 Estimate the cost savings of cost optimization initiatives.
    3.1 Identify a longlist of possible initiatives around:
    1. Project priorities, project backlog reduction, project intake restructuring, etc.
    2. Workforce productivity, skills, redeployment, etc.
    3.2 Estimate the cost savings of cost optimization initiatives.
    4.1 Assess the feasibility of each initiative (effort and risk profile) given cost optimization goals.
    4.2 Prioritize cost optimization initiatives to create a final shortlist.
    4.3 Fine-tune key information about your final cost optimization initiatives and develop a cost optimization roadmap for proposal.
    5.1 Outline components of a communication plan, including approvers, stakeholders, and governance and management mechanisms to be used.
    5.2 Create an executive presentation.
    5.3 Set up review time for workshop deliverables and post-workshop activities.
    Output
    • IT cost optimization journey and guiding principles for making corresponding decisions.
    • Long list of possible cost optimization initiatives and their potential cost savings for assets and vendors levers.
    • Long list of possible cost optimization initiatives and their potential cost savings for project portfolio and workforce levers.
    • Prioritized list of key cost optimization initiatives, descriptions, estimated impact, and roadmap.
    • IT cost optimization communication plan and presentation strategy.

    Contact your account representative for more information.
    workshops@infotech.com 1-888-670-8889

    Phase 1

    Understand Your Mandate and Objectives

    Phase 1
    Understand Your Mandate and Objectives

    Phase 2
    Outline Your Cost Optimization Initiatives

    Phase 3
    Develop Your IT Cost Optimization Roadmap

    Phase 4
    Communicate and Execute

    This phase will walk you through the following activities:

    • Business context and cost optimization journey
    • Cost constraints and parameters
    • Cost optimization goals

    This phase involves the following participants:

    • CIO/IT director
    • IT finance lead

    1.1 Gain consensus on the business context and IT cost optimization journey

    60 minutes

    • Using the questions on slide 20, conduct a brief journey assessment to ensure consensus on the direction you are planning to take.
    • Document your findings in the provided template.
    Input Output
    • Understanding business objectives and identifying your IT mandate
    • Determining the cost optimization journey: reactive, proactive, or strategic
    Materials Participants
    • Whiteboard or flip charts
    • Journey assessment template
    • CIO/IT director
    • IT finance lead

    See the next three slides for guidelines and the journey assessment questions and template.

    Distinguishing between three journeys

    By considering business objectives without forgoing your IT mandate.

    Journey Reactive Proactive Strategic
    Description
    • Business objectives are closely tied to cost reduction, forcing cost cutting across IT.
    • Typically occurs during turbulent economic times, when slow revenue growth is expected.
    • Business objectives do not include clear cost optimization initiatives but mandates IT to be fiscally conservative.
    • Typically occurs when economic turbulence is on the horizon and the organization's revenue is stable - executives only have a fiscal discipline guidance.
    • Business objectives do not include clear cost optimization initiatives.
    • Typically occurs when the overall economy is in good shape and the organization is in positive revenue growth territory.
    Main Focus
    • Quick-to-execute measures with few dependencies and concrete impact in response to business urgency and/or executive directive.
    • Enabling the organization to respond to different types and magnitudes of business change in a more planned and controlled manner.
    • Establishing an efficient, agile, sustainable, and strategically aligned cost optimization practice across all stages of the business cycle, regardless of business conditions.

    Questions to help determine your journey

    Business Objectives Business Strategy
    • What are the current business objectives?
    • Are there any stated cost-related objectives? If yes, what cost-related objectives have been stated by organizational leadership, such as cuts, areas of investment, and any targets for both?
    • Does the organization have a business strategy in place?
    • Was the business strategy reviewed or revised recently?
    • What's the business strategy focus for the next 12 months?
    • Are there any cost optimization implications within the current business strategy?
    IT Objectives IT Strategy and Mandate
    • What are your current IT objectives?
    • Are your IT objectives aligned to business objectives?
    • Do you have any IT cost-related objectives? If yes, what are your current IT cost-related objectives?
    • Are your IT cost-related objectives aligned to business objectives?
    • Do you have an IT strategy in place?
    • Is your IT strategy aligned to your organization's business strategy?
    • Do you have a cost optimization mandate? If yes, what is your cost optimization mandate?
    • What's the fiscal guidance and direction in IT?
    Journey
    Agreed-upon journey: reactive, proactive, or strategic.

    Template & Example

    Journey assessment

    Business Objectives Business Strategy
    • The founder's mission around quality persists despite ownership/leadership changes. Reliability and dependability are really important to everyone.
    • Increase visibility and interconnectivity across the supply chain.
    • Increase market share: younger markets and emerging foreign markets.
    • Economic outlook expected to negatively affect the bottom line - will need to trim and protect the core.
    • Grow Gizmo product sales by 10%.
    • Lower production cost of Gizmo product by 5%.
    IT Objectives IT Strategy and Mandate
    • IT/OT convergence, process automation, and modernization are major opportunities to better position the business for the future and introduce more agility into operations and reduce production cost.
    • Very mature and stable production processes with 100% uptime is a priority.
    • Lower IT cost related to Gizmo product.
    • There's no clear cost optimization mandate, but a fiscally conservative budget is recommended.
    Journey
    Agreed-upon journey: proactive.

    1.2 Review internal and external benchmarking reports

    60-90 minutes

    1. Review the IT spend and staffing results, summarized in your Info-Tech IT Spend & Staffing Benchmarking report.
    2. Identify areas where your IT spend is disproportionately high or low in comparison with your industry peers.
    3. Review and document any causes or rationales for high or low spend in each area identified. Do not be specific about any actual optimization targets or actions at this stage - simply make notes.
    4. Start a list of potential cost optimization initiatives to be further analyzed and investigated for feasibility at a later stage (see next slides for guidance, example, and template).
    InputOutput
    • IT Spend & Staffing Benchmarking report
    • A list of potential cost optimization focus areas
    MaterialsParticipants
    • Whiteboard or flip charts
    • Potential cost optimization initiatives list template
    • CIO/IT director
    • IT finance lead

    Info-Tech's approach

    Our IT cost model maps your IT spending and staffing according to four key views, putting IT spend in language that stakeholders across the organization can relate to.

    IT cost model maps

    Template & Example

    Potential cost optimization initiatives list

    Brainstorm and list potential cost optimization initiatives at a macro level.

    Potential Initiative Source Source Contact Notes
    Reduce application maintenance cost Internal Benchmarking Report CIO Based on current year report
    Rationalize software applications Info-Tech IT Benchmarking Report CIO Based on current year report
    Migrate key business applications to the cloud Latest iteration of the IT strategy CIO New IT strategy will be in development concurrent with cost optimization strategy development
    Align job roles to the current IT structure IT org. chart and salaries HR, CIO Based on information of the current year and will likely change in a few months (beginning of a new year)
    Renegotiate the top five vendor contracts up for renewal this year List of IT vendors Procurement office, CIO, IT infrastructure director, IT applications director, IT services manager Based on a list consolidated last week

    Want help with your IT spend transparency and benchmarking efforts?

    Let us fast-track your IT spend journey.

    The path to IT financial management maturity starts with knowing exactly where your money is going. To streamline this effort, Info-Tech offers an IT Spend & Staffing Benchmarking service that provides full transparency into where your money is going without any heavy lifting on your part.

    This unique service features:

    • A client-proven approach to meet your IT spend transparency goals.
    • Spend and staff mapping that reveals business consumption of IT.
    • Industry benchmarking to compare your spending and staffing to that of your peers.
    • Results in a fraction of the time with much less effort than going it alone.
    • Expert review of results and ongoing discussions with Info-Tech analysts.

    If you'd like Info-Tech to pave the way to IT spend transparency, contact your account manager for more information - we're happy to talk anytime.

    1.3 Identify your overarching constraints

    30 minutes

    1. Assess where spend change opportunities are currently limited or nonexistent due to organization edict or policy, industry regulatory requirements, or active contracts. Ask yourself:
      1. Where do IT spend bottlenecks exist and what are they?
      2. What IT spend objectives and practices are absolutely mandatory and nonnegotiable from both a business and an IT perspective?
      3. Are there areas where spend change is possible but would be very difficult to execute due to the stakeholders involved, governance processes, time frames, or another constraining factor?
    2. Identify where reduction or elimination of an IT service would negatively affect required service levels and business continuity or recovery.
    3. List constraints as negotiable or nonnegotiable on the template provided.
    4. Remove areas of focus from your cost optimization scope that land outside achievable parameters, and flag those that are difficult but still possible.
    InputOutput
    • Situational awareness and current state understanding
    • List of negotiable constraints to act on
    • Delimiting the cost optimization scope
    MaterialsParticipants
    • Whiteboard or flip charts
    • Constraints assessment template
    • CIO/IT director
    • IT finance lead

    See the next slides for additional guidance and a constraints assessment template.

    Acknowledge your limitations

    By recognizing your constraints, which will lead you to define your cost optimization scope.

    Constraints Organizational Legal/Regulatory Other
    What An organizational constraint is any work condition that hinders an employee's performance - be it physical, emotional, or otherwise. A legal or regulatory constraint is any law, rule, standard, or regulation - be it industry specific or otherwise - limiting the ability of any stakeholder to get the most out of a certain activity, initiative, or project. Other types of constraints affecting business units.
    Who Collaborate with your IT leaders and business partners to identify all major constraints that would affect cost optimization initiatives.
    How Discussions and information sessions to distinguish between negotiable and nonnegotiable constraints that would thwart cost optimization efforts:
    • Legal/regulatory requirements and related initiatives (past, ongoing, and planned/expected).
      Example: projects cannot be delayed, processes are difficult to simplify, etc.
    • Operational governance - organization policies, processes, methodologies, structure, etc.
      Example: adopting a waterfall model for development instead of an agile one.
    • Financial and accounting practices.
      Example: capital expenditure and operational expenditure classification.
    Challenge Degree to which you can influence certain outcomes within a set time frame:
    • Prioritize negotiating constraints where you can influence the outcome or maximize cost optimization benefits.

    We define a constraint as a restriction controlling the behavior of any of your stakeholders, hence preventing a desired outcome.

    In our context, constraints will determine your playing field: the boundaries of your cost optimization scope.

    Distinguish between constraints

    Negotiable vs. nonnegotiable to delimit your cost optimization scope.

    Distinguish between constraints

    Template & Example

    Constraints assessment

    List high-level limitations that hinder your cost optimization options.

    Nonnegotiable constraints
    Organizational Legal/Regulatory IT/Other
    Prioritization of sales/customer service activities SEC compliance/reporting mandates Production unit incident response service levels
    [Constraint] [Constraint] [Constraint]
    [Constraint] [Constraint] [Constraint]
    [Constraint] [Constraint] [Constraint]
    Negotiable constraints
    Organizational Legal/Regulatory IT/Other
    Core business operations process design Vendor contracts up for near-term renewal Current capital project commitments
    [Constraint] [Constraint] [Constraint]
    [Constraint] [Constraint] [Constraint]
    [Constraint] [Constraint] [Constraint]

    1.4 Establish overarching cost optimization goals

    60-90 minutes

    1. Establish specific IT cost optimization goals. Depending on your journey, step 1.1. You will have one to three overarching cost optimization goals, as follows:
      1. Reactive: Cost-cutting goal to reduce unwarranted IT spending.
      2. Proactive: Cost-to-value optimization goal.
      3. Strategic: Cost optimization sustainability goal.
      Consider amounts and time frames, as well as likely/suitable approaches you plan to employ to achieve these goals.
    2. Document your final cost optimization goals in the IT Cost Optimization Workbook.
    3. Revisit your goals after outlining your initiatives (phase 2) to ensure feasibility depending on your journey.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Situational awareness and current state understanding
    • Defined goals for IT cost optimization
    MaterialsParticipants
    • Whiteboard or flip charts
    • Set Cost Optimization Goals tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead

    Template & Example

    Document your overarching goals

    Excel Workbook: IT Cost Optimization – Set Optimization Goals Worksheet

    Refer to the example and guidelines below on how to document your goals based on your journey:

    Table of Overarching Goals

    Column ID Input Type Guidelines
    B Dropdown Select the appropriate journey: Reactive, Proactive, or Strategic.
    C Dropdown Select the appropriate cost optimization objective: Reduce Unwarranted IT Spending, Optimize Cost-to-Value, Sustain Cost Optimization.
    D Formula Automatic calculation, no entry required. Reduce Unwarranted IT Spending goal is the first priority, followed by Optimize Cost-to-Value, and Sustain Cost Optimization goals, respectively.
    E Text Enter the overarching goal related to each objective.

    Complete the following fields for each goal depending on your journey in the Excel Workbook as per guidelines:

    1. Navigate to the Set Cost Optimization Goals tab.
    2. Identify your journey and objective for each goal.
    3. Document your goal(s).

    Download the IT Cost Optimization Workbook

    Template & Example

    Break down your goals per quarter

    Excel Workbook: IT Cost Optimization - Set Cost Optimization Goals Worksheet

    Refer to the example and guidelines below on how to break down your goals per quarter and track your progress:

    Table break down your goals per quarter

    Column ID Input Type Guidelines
    F, G, H, I Text Enter the target per quarter: It could be a percentage, dollar amount, or description of the breakdown, depending on the cost optimization goal and objective.

    Complete the following fields for each goal depending on your journey in the Excel Workbook as per guidelines:

    1. Navigate to the Set Cost Optimization Goals tab.
    2. Determine your target per quarter for every goal.
    3. Document your targets.

    Download the IT Cost Optimization Workbook

    1.5 Identify inputs required for decision making

    60-90 minutes

    1. Each of the optimization levers (assets, vendors, project portfolio, and workforce) will require specific and unique sources of information which you will need to collect before moving forward. Examples of important sources of information include:
      1. Latest iteration of the IT strategy.
      2. List of IT assets (hardware, software).
      3. List of IT services or IT service catalog.
      4. List of current and planned IT projects and their resourcing allocations.
      5. List of largest vendor contracts and their key details, such as their expiration/renewal date.
      6. IT department organizational chart and salaries (by role).
    2. Review and analyze each of the documents.
    3. Continue to list potential cost optimization initiatives (step 1.2) to be further analyzed and investigated for feasibility at a later stage.
    InputOutput
    • IT strategy
    • Lists of IT assets, services, and projects
    • Top vendor contracts
    • IT org. chart and salaries
    • Macrolevel list of potential cost optimization initiatives
    MaterialsParticipants
    • Potential cost optimization initiatives list template (slide 24)
    • CIO/IT director
    • IT finance lead

    Prepare all pertinent sources of information

    And start drafting your cost optimization laundry list.

    Documents Benchmarking IT Strategy Other Information Sources
    What
    • Review:
      • Your IT spend trend across several years (ideally three to five years): internal benchmarking report.
      • Your IT spend compared to industry peers: external benchmarking report.
    • Analyze your internal and external benchmarking reports across the four views: service, expense, business, and innovation.
    • Review your business aligned IT strategy to identify cost optimization related initiatives.
    • At a later stage, exploit your IT strategy to prioritize cost optimization initiatives as needed.
    • Review your IT organization chart and salaries to determine whether the IT organization structure is optimal, job descriptions are mapped to the desired structure, employee skillsets and salary scale are adequate and aligned to the job description, etc.
    • Compile and examine lists of assets, vendors, projects, and services.
    • Prepare any other information sources you deem meaningful.
    Who Collaborate with your IT leaders and business partners to:
    • Prepare the necessary reports, documents, and required sources of information.
    • Identify potential cost optimization initiatives around areas of improvement.
    How Discussions and information sessions to analyze and deep dive on raw findings.
    Challenge Time to compile and analyze reports without affecting day-to-day operations:
    • Outsource some activities such as external benchmarking to organizations like Info-Tech.
    • Get consulting support on specific reports or tasks through workshops, calls, etc.

    Phase 2

    Outline Your Cost Optimization Initiatives

    Phase 1
    Understand Your Mandate and Objectives

    Phase 2
    Outline Your Cost Optimization Initiatives

    Phase 3
    Develop Your IT Cost Optimization Roadmap

    Phase 4
    Communicate and Execute

    This phase will walk you through the following activities:

    • IT cost optimization initiatives
    • IT cost optimization workbook

    This phase involves the following participants:

    • CIO/IT director
    • IT finance lead
    • IT asset manager
    • IT infrastructure manager
    • IT vendor management lead
    • PMO lead
    • IT talent management representative
    • Other IT management

    Outline your cost optimization initiatives

    Across Info-Tech's four levers.

    Levers ASSETS VENDORS PROJECT PORTFOLI WORKFORCE
    What
    • Maintain trustworthy data to optimize cost, reduce risk, and improve services in line with business priorities and requirements:
      • Optimize cost: reallocate unused hardware and software, end unneeded service agreements, and manage renewals and audits.
      • Reduce risk: provide comprehensive asset data for security controls development and incident management - manage equipment disposal.
      • Improve IT service: support incident, problem, request, and change management with ITAM data.
    • Examine your vendor contracts and vendor management practices to optimize your expected value from every IT provider you deal with.
    • Treat vendor management as a proactive, cross-functional practice aiming to create value by improving communication, relationships, processes, performance, and ultimately reducing cost.
    • Reassess your project portfolio to maximize total value in line with business objectives and strategy.
    • Reduce resource waste with a strategic approach to project portfolio management:
      • Ensure that approved projects can be completed by aligning intake with real project capacity.
      • Minimize over-allocation of resources by allocating based on the proportion of project vs. non-project work.
      • Forecast future resource requirements by maintaining accurate resource capacity data.
    • Review your strategic workforce plan to identify cost optimization opportunities.
    • Determine capability gaps to train or develop current staff and minimize the need for severance payouts and hiring costs, while providing clear career paths to retain high performers.
    • Link workforce planning with strategic planning to ensure that you have the right people in the right positions, in the right places, at the right time, with the knowledge, skills, and attributes to deliver on strategic business goals.
    Who Collaborate with your IT leaders and business partners to:
    • Prepare the necessary reports, documents, and required sources of information.
    • Determine cost optimization initiatives across the four levers.
    How You will decide on the best course of action depending on your journey.

    Most common cost optimization challenges

    Across Info-Tech's four levers.

    Levers ASSETS VENDORS PROJECT PORTFOLI WORKFORCE
    Challenge
    • Incomplete or inaccurate data, poor processes, inadequate tools, and lack of support across the organization is leading to bad decision making while damaging value.
    • Spending on IT providers is increasing while vendor contract expected value - results, output, performance, solutions, or outcomes - is not realized.
    • Poor planning, conflicting priorities, and resource scarcity is affecting project outcomes, resulting in suboptimal value.
    • Talent shortages, lack of prioritization, and experience in managing an IT workforce is leading to higher costs and a loss in value.
    Solution
    • Develop a sustainable IT asset management (ITAM) strategy aligned with your business priorities.
    • Establish a vendor management initiative (VMI) with a solid foundation to fit your organization's culture, environment, and goals.
    • Create a coherent strategy to maximize the total value that projects deliver as a portfolio, rather than a collection of individual projects.
    • Develop a strategic workforce plan (SWP) to ensure you have the right people in place at the right time.
    Related Info-Tech Research Develop an IT Asset Management Strategy Jump-start Your Vendor Management Initiative Develop a Project Portfolio Management Strategy Build a Strategic IT Workforce Plan

    2.1 Determine your cost optimization initiatives

    8 hours

    Now that you have identified your journey and understood your constraints:

    1. Review your list of potential cost optimization initiatives and document viable ones in the IT Cost Optimization Workbook.
    2. Think of potential cost optimization initiatives within the four levers: assets, vendors, project portfolio, and workforce. The following slides will help you in this endeavor.

    Download the IT Cost Optimization Workbook

    Input Output
    • Potential cost optimization initiatives list
    • Outline Initiatives in the IT Cost Optimization Workbook
    Materials Participants
    • Whiteboard or flip charts
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Other IT management - depending on the optimization lever (Assets, Vendors, Project Portfolio, or Workforce)

    Plan your cost optimization initiatives

    Your initiatives will differ depending on your journey

    In terms of aggressiveness and objectives.

    Plan cost optimization initiatives

    Cost optimization initiatives pertaining to a reactive journey are characterized by aggressive cost reduction.

    On the other hand, cost optimization initiatives within a strategic journey can vary in aggressiveness across objectives.

    2.1.1 Identify asset optimization initiatives

    2 hours

    1. Review the IT asset management strategy if available. Compile a list of all hardware, software, and facility asset costs for delivery of IT services.
    2. Analyze hardware and software assets for opportunities to consolidate, reduce, eliminate, and/or enhance functionality/automation. Look for:
      1. Redundancy or duplication of functionality not necessary for disaster recovery or business continuity purposes.
      2. Low or no-use software.
      3. Homegrown or legacy systems with high maintenance/support burdens.
      4. Multiple, old, or unsupported versions of current-use software.
      5. Opportunities to delay hardware/software refreshes or upgrades.
      6. Cloud/outsourced options.
      7. Instances of unsanctioned shadow IT.
    3. Reassess your in-house asset management processes to see where efficiency and effectiveness could be improved overall.
    4. Document cost optimization initiatives that could be driven by asset optimization objectives in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    InputOutput
    • IT asset management strategy
    • List of current assets including hardware, software, and facilities
    • Outline Initiatives driven by asset optimization objectives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Whiteboard or flip charts
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT asset manager
    • IT infrastructure manager
    • Other IT management

    Example

    Asset optimization

    Some examples to get you started

    Journey Reactive, Proactive, or Strategic Proactive or Strategic Strategic
    Initiatives
    • Validate the license cost of performance optimization.
    • Review the utilization of software/hardware before renewal or purchase of additional hardware or software.
    • Assess new license cost against projects to determine possibility of differing or canceling software.
    • Postpone the purchases of hardware.
    • Extend the life of hardware.
    • Consolidate and reconfigure hardware.
    • Return damaged/malfunctioning hardware under warranty.
    • Consolidate and reconfigure software.
    • Optimize software/hardware functionality.
    • Implement hardware/software standard or policy.
    • Develop an infrastructure management outsourcing strategy.
    • Optimize cloud management: review utilization, licensing, cost, etc.
    • Develop a sustainable IT asset management (ITAM) strategy aligned with your business priorities.
    • Minimize shadow IT by creating a policy and improving the service request process.
    • Develop or assess a cloud strategy for a certain service.
    No initiatives for the reactive journey. No initiatives for the reactive or proactive journeys.
    Objective Reduce Unwarranted IT Spending Optimize Cost-to-Value Sustain Cost Optimization

    Template & Example

    List your objectives and initiatives

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to input your asset optimization initiatives and related objectives:

    List your objectives and initiatives

    Column ID Input Type Guidelines
    B Formula Automatic calculation, no entry required. The ID will update once there's an input in column E.
    C Dropdown Select an optimization lever: Assets, Vendors, Project Portfolio, or Workforce.
    D Dropdown Select an initiative focus from the dropdown list - this will help you think of initiatives.
    E Text Enter your initiative.
    F Text Write a brief description per initiative, providing a cost optimization rationale.
    G Dropdown Select the cost type per initiative: OpEx (operating expenditure) or CapEx (capital expenditure).
    H Dropdown Select 1 of 3 objectives for each initiative: Reduce Unwarranted IT Spending, Optimize Cost-to-Value, or Sustain Cost Optimization.

    List your initiatives in the provided Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Enter all your initiatives driven by the asset optimization lever.
    3. Determine the cost optimization objective per initiative.

    2.1.2 Identify vendor optimization initiatives

    2 hours

    1. Revisit the IT vendor classification if available. Identify all existing vendor contracts up for renewal within the current fiscal year and create an inventory.
    2. Examine your vendor contracts to optimize your expected value from every IT provider you deal with. For each contract:
      1. Identify the business purpose/drivers.
      2. Identify the expiration/renewal date to determine time frames for action.
      3. Determine if there is an opportunity to rightsize, cancel, renegotiate costs/service levels, or postpone renewal/purchase.
      4. Identify integrations and interdependencies with other hardware and software systems to understand scope and impact of potential changes.
    3. Reassess your in-house vendor management processes to see where efficiency and effectiveness could be improved overall.
    4. Document cost optimization initiatives that could be driven by vendor optimization objectives in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Vendor classification
    • Vendors contracts
    • Outline Initiatives driven by vendor optimization objectives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Whiteboard or flip charts
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT vendor management lead
    • Other IT management

    Example

    Vendor optimization

    Some examples to get you started.

    Journey Reactive, Proactive, or Strategic Proactive or Strategic Strategic
    Initiatives
    • Renegotiate and rightsize a vendor contract:
      • Cancel vendor/service/type application contract.
      • Renegotiate vendor/service/type contract.
      • Cancel vendor/service/type licenses.
      • Rationalize number of vendor/service/type licenses.
    • Consolidate vendors/resellers with similar services, products and features.
    • Implement a vendor management initiative to maximize value and minimize risk.
    • Consolidate contracts to take advantage of spending power and volume.
    • Set up custom vendor performance metrics.
    • Establish ongoing monitoring of vendor risk (financial, security, etc.).
    No initiatives for the reactive journey. No initiatives for the reactive or proactive journeys.
    Objective Reduce Unwarranted IT Spending Optimize Cost-to-Value Sustain Cost Optimization

    Template & Example

    List your objectives and initiatives

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to input your vendor optimization initiatives and related objectives:

    List your objectives and initiatives

    Column ID Input Type Guidelines
    B Formula Automatic calculation, no entry required. The ID will update once there's an input in column E.
    C Dropdown Select an optimization lever: Assets, Vendors, Project Portfolio, or Workforce.
    D Dropdown Select an initiative focus from the dropdown list - this will help you think of initiatives.
    E Text Enter your initiative.
    F Text Write a brief description per initiative, providing a cost optimization rationale.
    G Dropdown Select the cost type per initiative: OpEx (operating expenditure) or CapEx (capital expenditure).
    H Dropdown Select 1 of 3 objectives for each initiative: Reduce Unwarranted IT Spending, Optimize Cost-to-Value, or Sustain Cost Optimization.

    List your initiatives in the provided Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Enter all your initiatives driven by the vendor optimization lever.
    3. Determine the cost optimization objective per initiative.

    2.1.3 Identify project portfolio optimization initiatives

    2 hours

    1. Review the IT Project Portfolio Strategy if available, and the list of both in-flight and planned projects.
    2. Reassess your project portfolio to maximize total value in line with business objectives and strategy. For each current and pending project on the list, identify a cost optimization initiative, including:
      1. Revisiting, confirming, and documenting actual project rationale with the business in relation to strategic goals.
      2. Rescoping existing projects that are underway.
      3. Accelerating planned or existing projects that enable business cost savings or competitive advantage and revenue growth.
      4. Canceling or postponing projects that are underway or haven't started.
      5. Identifying net-new projects that enhance business capabilities or save business costs.
    3. Reassess your in-house project management and project portfolio management processes to see where efficiency and effectiveness could be improved overall.
    4. Document cost optimization initiatives that could be driven by project portfolio optimization objectives in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    Input Output
    • Project Portfolio Management Strategy
    • List of current and pending projects
    • Outline Initiatives driven by project portfolio optimization objectives in the IT Cost Optimization Workbook
    Materials Participants
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • PMO lead
    • Other IT management

    Example

    Project portfolio optimization

    Some examples to get you started.

    Journey Reactive, Proactive, or Strategic Proactive or Strategic Strategic
    Initiatives
    • Cancel projects with no executive sponsor.
    • Cancel projects with unacceptable timelines.
    • Postpone projects where there is a more urgent need for related resources.
    • Rescope projects where a more effective business case has been identified.
    • Freeze projects where scope and resourcing are uncertain.
    • Accelerate projects that enable business cost savings or a competitive advantage with revenue growth.
    • Combine projects that are better managed by realigning project managers and coordinators.
    • Break projects into phases to front-load realized value.
    • Outsource projects with commoditized skillset requirements.
    • Reassess the technology requirements when multiple vendors are involved.
    • Reexamine project rationale with the business in relation to strategic goals.
    • Identify net-new projects that offer improved value in relation to current economics.
    • Reassess the strategic drivers for project spending in the face of shifting priorities.
    • Implement a project portfolio governance function.
    • Introduce a benefits realization discipline in relation to the benefits forecasted during project approval.
    No initiatives for the reactive journey. No initiatives for the reactive or proactive journeys.
    Objective Reduce Unwarranted IT Spending Optimize Cost-to-Value Sustain Cost Optimization

    Template & Example

    List your objectives and initiatives

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to input your project portfolio optimization initiatives and related objectives:

    List your objectives and initiatives

    Column ID Input Type Guidelines
    B Formula Automatic calculation, no entry required. The ID will update once there's an input in column E.
    C Dropdown Select an optimization lever: Assets, Vendors, Project Portfolio, or Workforce.
    D Dropdown Select an initiative focus from the dropdown list - this will help you think of initiatives.
    E Text Enter your initiative.
    F Text Write a brief description per initiative, providing a cost optimization rationale.
    G Dropdown Select the cost type per initiative: OpEx (operating expenditure) or CapEx (capital expenditure).
    H Dropdown Select 1 of 3 objectives for each initiative: Reduce Unwarranted IT Spending, Optimize Cost-to-Value, or Sustain Cost Optimization.

    List your initiatives in the provided Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Enter all your initiatives driven by the project portfolio optimization lever.
    3. Determine the cost optimization objective per initiative.

    2.1.4 Identify workforce optimization initiatives

    2 hours

    1. Review the IT department's strategic workforce plan (SWP) if available, organizational chart, and salaries by role. Do not review IT staffing in terms of named individuals who occupy a given role - focus on functions, roles, and job descriptions.
    2. Determine capability gaps:
      1. Rectify efficiency, effectiveness, and other performance issues.
      2. Train IT staff to enhance or improve skills and effectiveness.
      3. Add roles, skills, or headcount to improve effectiveness.
      4. Integrate teams to improve collaboration and reduce redundancies or break out new ones to increase focus/specialization.
      5. Redesign job roles and responsibilities.
      6. Redeploy/reassign staff to other teams.
      7. Conduct layoff (as a last resort, starting by assessing contractual employees).
    3. Document cost optimization initiatives that could be driven by workforce optimization objectives in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Strategic workforce plan (SWP)
    • Organizational charts
    • Staff lists
    • Outline Initiatives driven by workforce optimization objectives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Talent management representative
    • Other IT management

    Example

    Workforce optimization

    Some examples to get you started.

    Journey Reactive, Proactive, or Strategic Proactive or Strategic Strategic
    Initiatives
    • Defer vacancy, position, or role.
    • Freeze all overnight and unessential IT staff travel.
    • Outsource project/function to free internal resources.
    • Postpone nonessential IT staff training as per training plans.
    • Suspend IT team discretionary spend.
    • Streamline workforce related to department/service (develop the process).
    • Relocate role or function from division or group to division or group.
    • Adjust framework and level assignments.
    • Promote and train employees for a certain objective.
    • Implement a strategic workforce plan (SWP) to ensure you have the right people in place, at the right time.
    • Set up a workforce performance monitoring framework or process to optimize staffing capabilities aligned with business value.
    No initiatives for the reactive journey. No initiatives for the reactive or proactive journeys.
    Objective Reduce Unwarranted IT Spending Optimize Cost-to-Value Sustain Cost Optimization

    Template & Example

    List your objectives and initiatives

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to input your workforce optimization initiatives and related objectives:

    List your objectives and initiatives

    Column ID Input Type Guidelines
    B Formula Automatic calculation, no entry required. The ID will update once there's an input in column E.
    C Dropdown Select an optimization lever: Assets, Vendors, Project Portfolio, or Workforce.
    D Dropdown Select an initiative focus from the dropdown list - this will help you think of initiatives.
    E Text Enter your initiative.
    F Text Write a brief description per initiative, providing a cost optimization rationale.
    G Dropdown Select the cost type per initiative: OpEx (operating expenditure) or CapEx (capital expenditure).
    H Dropdown Select 1 of 3 objectives for each initiative: Reduce Unwarranted IT Spending, Optimize Cost-to-Value, or Sustain Cost Optimization.

    List your initiatives in the provided Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Enter all your initiatives driven by the workforce optimization lever.
    3. Determine the cost optimization objective per initiative.

    2.2 Estimate the cost savings of cost optimization initiatives

    8 hours

    Now that you have identified your initiatives:

    1. Review your cost optimization initiatives per lever (Assets, Vendors, Project Portfolio, and Workforce).
    2. Determine whether the implementation cost of each of your initiatives is included as part of your budget.
    3. Estimate your cost savings.
    4. Document your assessment in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Potential cost optimization initiatives list
    • Outline Initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Whiteboard or flip charts
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Other IT management - depending on the optimization lever (Assets, Vendors, Project Portfolio, or Workforce)

    2.2.1 Estimate the costs impacting your asset optimization initiatives

    2 hours

    1. Review each asset optimization initiative to estimate cost implications.
    2. Consider implementation cost in terms of your budget, and document it in the IT Cost Optimization Workbook (see next slides). Is the implementation cost of the underlying initiative considered in your current budget? If not, move to the next initiative. You will assess the flagged initiative independently at a later stage if deemed necessary.
    3. Estimate the current cost related to the initiative (including implementation cost), and document it in the IT Cost Optimization Workbook (see next slides). This will be the first of two inputs needed to calculate the initiative's potential cost savings.
    4. Estimate the expected cost, post initiative execution, of the underlying initiative, and document it in the IT Cost Optimization Workbook (see next slides). This will be the second and last input needed to calculate the initiative's potential cost savings.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Asset optimization initiatives
    • Cost and budget information
    • Cost estimates of asset optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT asset manager
    • IT infrastructure manager
    • Other IT management

    Template & Example

    Estimate your cost

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete cost estimates for each asset optimization initiative:

    Estimate your cost

    Column ID Input Type Guidelines
    I Dropdown Select if the implementation cost is considered within your budget or not. If not, the initiative will be flagged to be reviewed, and no further entry is required; move to the next initiative. Implementation cost represents your cost for planning, executing, and monitoring the related initiative.
    J, K Whole Number Input a dollar amount. Current cost represents the yearly cost including implementing the initiative, while the expected cost represents the yearly cost after implementing the initiative.
    L Formula Automatic calculation, no entry required. The difference between current cost and expected cost.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine if the implementation cost is considered within the budget.
    3. If yes, estimate the current cost, and expected cost of the underlying initiative.

    2.2.2 Estimate the costs impacting your vendor optimization initiatives

    2 hours

    1. Review each vendor optimization initiative to estimate cost implications.
    2. Consider implementation cost in terms of your budget, and document it in the IT Cost Optimization Workbook (see next slides). Is the implementation cost of the underlying initiative considered in your current budget? If not, move to the next initiative. You will assess the flagged initiative independently at a later stage if deemed necessary.
    3. Estimate the current cost related to the initiative (including implementation cost), and document it in the IT Cost Optimization Workbook (see next slides). This will be the first of two inputs needed to calculate the initiative's potential cost savings.
    4. Estimate the expected cost, post initiative execution, of the underlying initiative, and document it in the IT Cost Optimization Workbook (see next slides). This will be the second and last input needed to calculate the initiative's potential cost savings.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Vendor optimization initiatives
    • Cost and budget information
    • Cost estimates of vendor optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT vendor management lead
    • Other IT management

    Template & Example

    Estimate your cost

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete cost estimates for each vendor optimization initiative:

    Estimate your cost

    Column ID Input Type Guidelines
    I Dropdown Select if the implementation cost is considered within your budget or not. If not, the initiative will be flagged to be reviewed, and no further entry is required; move to the next initiative. Implementation cost represents your cost for planning, executing, and monitoring the related initiative.
    J, K Whole Number Input a dollar amount. Current cost represents the yearly cost including implementing the initiative, while the expected cost represents the yearly cost after implementing the initiative.
    L Formula Automatic calculation, no entry required. The difference between current cost and expected cost.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine if the implementation cost is considered within the budget.
    3. If yes, estimate the current cost, and expected cost of the underlying initiative.

    2.2.3 Estimate the costs impacting your project portfolio optimization initiatives

    2 hours

    1. Review each project portfolio optimization initiative to estimate cost implications.
    2. Consider implementation cost in terms of your budget, and document it in the IT Cost Optimization Workbook (see next slides). Is the implementation cost of the underlying initiative considered in your current budget? If not, move to the next initiative. You will assess the flagged initiative independently at a later stage if deemed necessary.
    3. Estimate the current cost related to the initiative (including implementation cost), and document it in the IT Cost Optimization Workbook (see next slides). This will be the first of two inputs needed to calculate the initiative's potential cost savings.
    4. Estimate the expected cost, post initiative execution, of the underlying initiative, and document it in the IT Cost Optimization Workbook (see next slides). This will be the second and last input needed to calculate the initiative's potential cost savings.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Project portfolio optimization initiatives
    • Cost and budget information
    • Cost estimates of project portfolio optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • PMO lead
    • Other IT management

    Template & Example

    Estimate your cost

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete cost estimates for each project portfolio optimization initiative:

    Estimate your cost

    Column ID Input Type Guidelines
    I Dropdown Select if the implementation cost is considered within your budget or not. If not, the initiative will be flagged to be reviewed, and no further entry is required; move to the next initiative. Implementation cost represents your cost for planning, executing, and monitoring the related initiative.
    J, K Whole Number Input a dollar amount. Current cost represents the yearly cost including implementing the initiative, while the expected cost represents the yearly cost after implementing the initiative.
    L Formula Automatic calculation, no entry required. The difference between current cost and expected cost.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine if the implementation cost is considered within the budget.
    3. If yes, estimate the current cost, and expected cost of the underlying initiative.

    2.2.4 Estimate the costs impacting your workforce optimization initiatives

    2 hours

    1. Review each workforce optimization initiative to estimate cost implications.
    2. Consider implementation cost in terms of your budget, and document it in the IT Cost Optimization Workbook (see next slides). Is the implementation cost of the underlying initiative considered in your current budget? If not, move to the next initiative. You will assess the flagged initiative independently at a later stage if deemed necessary.
    3. Estimate the current cost related to the initiative (including implementation cost), and document it in the IT Cost Optimization Workbook (see next slides). This will be the first of two inputs needed to calculate the initiative's potential cost savings.
    4. Estimate the expected cost, post initiative execution, of the underlying initiative, and document it in the IT Cost Optimization Workbook (see next slides). This will be the second and last input needed to calculate the initiative's potential cost savings.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Workforce optimization initiatives
    • Cost and budget information
    • Cost estimates of workforce optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Talent management representative
    • Other IT management

    Template & Example

    Estimate your cost

    Excel Workbook: IT Cost Optimization –i Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete cost estimates for each workforce optimization initiative:

    Estimate your cost

    Column ID Input Type Guidelines
    I Dropdown Select if the implementation cost is considered within your budget or not. If not, the initiative will be flagged to be reviewed, and no further entry is required; move to the next initiative. Implementation cost represents your cost for planning, executing, and monitoring the related initiative.
    J, K Whole Number Input a dollar amount. Current cost represents the yearly cost including implementing the initiative, while the expected cost represents the yearly cost after implementing the initiative.
    L Formula Automatic calculation, no entry required. The difference between current cost and expected cost.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine if the implementation cost is considered within the budget.
    3. If yes, estimate the current cost, and expected cost of the underlying initiative.

    Phase 3

    Develop Your IT Cost Optimization Roadmap

    Phase 1
    Understand Your Mandate and Objectives

    Phase 2
    Outline Your Cost Optimization Initiatives

    Phase 3
    Develop Your IT Cost Optimization Roadmap

    Phase 4
    Communicate and Execute

    This phase will walk you through the following activities:

    • IT cost optimization workbook
    • IT cost optimization roadmap

    This phase involves the following participants:

    • CIO/IT director
    • IT finance lead
    • IT asset manager
    • IT infrastructure manager
    • IT vendor management lead
    • PMO lead
    • IT talent management representative
    • Other IT management

    Develop your prioritized and aligned cost optimization roadmap

    The process of developing your roadmap is where you set final cost optimization priorities, conduct a final rationalization to decide what's in and what's out, and document your proposed plan of action.

    First, take a moment to consider if you missed anything. Too often, only the cost cutting elements of the cost optimization equation get attention. Remember that cost optimization also includes making smart investments. Sometimes adding and expanding is better for the business than removing or contracting.

    • Do your proposed initiatives help position the organization to recover quickly if you're dealing with a downturn or recession scenario?
    • Have you fully considered growth or innovation opportunities that will help optimize costs in the long run?

    Feasibility
    Eliminate initiatives from the longlist of potential initiatives that cannot be achieved given the cost optimization goals you determined at the beginning of this exercise.

    Priority
    Rank order the remaining initiatives according to their ability to contribute to goal attainment and dependency relationships with external constraints and one another.

    Action Plan
    Create an overarching visual roadmap that shows how you intend to achieve your cost optimization goals over the short, medium, and long-term.

    3.1 Assess the feasibility of your cost optimization initiatives

    4 hours

    Now that you have identified your initiatives across the four levers and understood the business impacts:

    1. Review each of your cost optimization initiatives and estimate the feasibility in terms of:
      1. Effort required to implement.
      2. Risk: Likelihood of failure and impact on performance.
      3. Approval rights: Within the IT or finance's accountability/domain or not.
    2. Document your assessment in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Cost optimization initiatives
    • Feasibility estimates of cost optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Variables tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Other IT management - depending on the optimization lever (Assets, Vendors, Project Portfolio, or Workforce)

    3.1.1 Estimate the feasibility of your asset optimization initiatives

    1 hour

    1. Review each asset optimization initiative to estimate feasibility implications.
    2. Start by defining the effort required variables. Think in terms of how many dedicated full-time employees you would need to implement the initiative. Document your definition for each of the three variables (High, Medium, or Low) in the IT Cost Optimization Workbook (see next slides). Then, estimate the effort required to implement the related initiative. Consider complexity, scope, and resource availability, before you document it in the IT Cost Optimization Workbook (see next slides).
    3. Define your likelihood of failure variables. Think in terms of probability of failure or percent chance the underlying initiative will not succeed. Document your definition for each of the three variables (High, Medium, or Low) in the IT Cost Optimization Workbook (see next slides). Then, estimate the likelihood of failure to implement the related initiative, and document it in the IT Cost Optimization Workbook (see next slides).
    4. Consider the initiative's impact on performance. Would implementing the initiative hinder IT or business performance? If you are on a reactive journey, would it impede business recovery in any way, shape, or form? Document the impact (Positive Impact, No Impact, or Negative Impact) in the IT Cost Optimization Workbook (see next slides).
    5. Determine who is responsible for approving the initiative. Does it fall within your jurisdiction, responsibility, or accountability? If not, it would mean that it might be more difficult to implement the initiative. Document approval rights (within accountability or not within accountability) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    Input Output
    • Asset optimization initiatives
    • Feasibility estimates of asset optimization initiatives in the IT Cost Optimization Workbook
    Materials Participants
    • Define Variables tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT asset manager
    • IT infrastructure manager
    • Other IT management

    Template & Example

    Define your feasibility variables

    Excel Workbook: IT Cost Optimization – Define Variables Worksheet

    Refer to the example and guidelines below on how to define your feasibility variables for standardization purposes. You can adopt a different definition per optimization lever (Assets, Vendors, Project Portfolio, and Workforce), or maintain the same one across initiatives, depending on what makes sense for your organization:

    Define your feasibility variables

    Column ID Input Type Guidelines
    B, G Formula Automatic calculation, no entry required. The ID will populate automatically.
    C, H Text No entry required. Three variables identified: High, Medium, Low.
    D, E Whole Number Review and input the range of each effort required variable, based on the number of dedicated full-time employees needed to implement an initiative, as it works best for your organization.
    I, J Whole Number Review and input the range of each likelihood of failure variable, based on the probability of failure of an initiative, as it works best for your organization. This example should work for most organizations.

    Define your feasibility variables in the Excel Workbook as per guidelines:

    1. Navigate to the Define Variables tab.
    2. Review and enter the range of each effort required and likelihood of failure variable as you see fit for your organization.

    Template & Example

    Estimate your feasibility

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete feasibility estimates for each asset optimization initiative:

    Estimate your feasibility

    Column ID Input Type Guidelines
    M Dropdown Select the effort required estimate based on your defined variables. Effort required represents the number of dedicated employees needed to plan, execute, and monitor the underlying initiative, based on the level of maturity and readiness; consider complexity, scope, and resource availability.
    N Dropdown Select the likelihood of failure estimate based on your defined variables. Likelihood of failure represents the probability of failure of the underlying initiative.
    O Dropdown Select the impact on performance estimate related to the implementation of the underlying initiative. Consider the impact on IT and on business (including business recovery if on a reactive journey).
    P Dropdown Select the appropriate approval right related to the underlying initiative. Determine if the initiative's approval falls within your accountability or not.
    Q Text Write a brief description per initiative, providing an impact rationale and identifying the approver where possible.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate effort required to implement the underlying initiative.
    3. Identify the risk of each initiative: likelihood of failure and impact on performance.
    4. Choose the adequate approval right classification for each initiative.

    3.1.2 Estimate the feasibility of your vendor optimization initiatives

    1 hour

    1. Review each vendor optimization initiative to estimate feasibility implications, along with previously defined variables (see slides 64 and 65).
    2. Consider the initiative's impact on performance. Would implementing the initiative hinder IT or business performance? If you are on a reactive journey, would it impede business recovery in any way, shape, or form? Document the impact (Positive Impact, No Impact, or Negative Impact) in the IT Cost Optimization Workbook (see next slides).
    3. Determine who is responsible for approving the initiative. Does it fall within your jurisdiction, responsibility, or accountability? If not, it would mean that it might be more difficult to implement the initiative. Document approval rights (within accountability or not within accountability) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    InputOutput
    • Vendor optimization initiatives
    • Feasibility estimates of vendor optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Variables tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT vendor management lead
    • Other IT management

    Template & Example

    Estimate your feasibility

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete feasibility estimates for each vendor optimization initiative:

    Estimate your feasibility

    Column ID Input Type Guidelines
    M Dropdown Select the effort required estimate based on your defined variables. Effort required represents the number of dedicated employees needed to plan, execute, and monitor the underlying initiative, based on the level of maturity and readiness; consider complexity, scope, and resource availability.
    N Dropdown Select the likelihood of failure estimate based on your defined variables. Likelihood of failure represents the probability of failure of the underlying initiative.
    O Dropdown Select the impact on performance estimate related to the implementation of the underlying initiative. Consider the impact on IT and on business (including business recovery if on a reactive journey).
    P Dropdown Select the appropriate approval right related to the underlying initiative. Determine if the initiative's approval falls within your accountability or not.
    Q Text Write a brief description per initiative, providing an impact rationale and identifying the approver where possible.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate effort required to implement the underlying initiative.
    3. Identify the risk of each initiative: likelihood of failure and impact on performance.
    4. Choose the adequate approval right classification for each initiative.

    3.1.3 Estimate the feasibility of your project portfolio optimization initiatives

    1 hour

    1. Review each project portfolio optimization initiative to estimate feasibility implications, along with previously defined variables (see slides 64 and 65).
    2. Consider the initiative's impact on performance. Would implementing the initiative hinder IT or business performance? If you are on a reactive journey, would it impede business recovery in any way, shape, or form? Document the impact (Positive Impact, No Impact, or Negative Impact) in the IT Cost Optimization Workbook (see next slides).
    3. Determine who is responsible for approving the initiative. Does it fall within your jurisdiction, responsibility, or accountability? If not, it would mean that it might be more difficult to implement the initiative. Document approval rights (within accountability or not within accountability) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    InputOutput
    • Project portfolio optimization initiatives
    • Feasibility estimates of vendor optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Variables tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • PMO lead
    • Other IT management

    Template & Example

    Estimate your feasibility

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete feasibility estimates for each project portfolio optimization initiative:

    Estimate your feasibility

    Column ID Input Type Guidelines
    M Dropdown Select the effort required estimate based on your defined variables. Effort required represents the number of dedicated employees needed to plan, execute, and monitor the underlying initiative, based on the level of maturity and readiness; consider complexity, scope, and resource availability.
    N Dropdown Select the likelihood of failure estimate based on your defined variables. Likelihood of failure represents the probability of failure of the underlying initiative.
    O Dropdown Select the impact on performance estimate related to the implementation of the underlying initiative. Consider the impact on IT and on business (including business recovery if on a reactive journey).
    P Dropdown Select the appropriate approval right related to the underlying initiative. Determine if the initiative's approval falls within your accountability or not.
    Q Text Write a brief description per initiative, providing an impact rationale and identifying the approver where possible.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate effort required to implement the underlying initiative.
    3. Identify the risk of each initiative: likelihood of failure and impact on performance.
    4. Choose the adequate approval right classification for each initiative.

    3.1.4 Estimate the feasibility of your workforce optimization initiatives

    1 hour

    1. Review each workforce optimization initiative to estimate feasibility implications, along with previously defined variables (see slides 64 and 65).
    2. Consider the initiative's impact on performance. Would implementing the initiative hinder IT or business performance? If you are on a reactive journey, would it impede business recovery in any way, shape, or form? Document the impact (Positive Impact, No Impact, or Negative Impact) in the IT Cost Optimization Workbook (see next slides).
    3. Determine who is responsible for approving the initiative. Does it fall within your jurisdiction, responsibility, or accountability? If not, it would mean that it might be more difficult to implement the initiative. Document approval rights (within accountability or not within accountability) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    InputOutput
    • Workforce optimization initiatives
    • Feasibility estimates of workforce optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Variables tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Talent management representative
    • Other IT management

    Template & Example

    Estimate your feasibility

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete feasibility estimates for each workforce optimization initiative:

    Estimate your feasibility

    Column ID Input Type Guidelines
    M Dropdown Select the effort required estimate based on your defined variables. Effort required represents the number of dedicated employees needed to plan, execute, and monitor the underlying initiative, based on the level of maturity and readiness; consider complexity, scope, and resource availability.
    N Dropdown Select the likelihood of failure estimate based on your defined variables. Likelihood of failure represents the probability of failure of the underlying initiative.
    O Dropdown Select the impact on performance estimate related to the implementation of the underlying initiative. Consider the impact on IT and on business (including business recovery if on a reactive journey).
    P Dropdown Select the appropriate approval right related to the underlying initiative. Determine if the initiative's approval falls within your accountability or not.
    Q Text Write a brief description per initiative, providing an impact rationale and identifying the approver where possible.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate effort required to implement the underlying initiative.
    3. Identify the risk of each initiative: likelihood of failure and impact on performance.
    4. Choose the adequate approval right classification for each initiative.

    3.2 Prioritize cost optimization initiatives to create a final shortlist

    4 hours

    Now that you have your cost and feasibility for each cost optimization initiative:

    1. Review each of your cost optimization initiatives and estimate the time and priority by considering:
      1. Preliminary priority assessment based on your cost and feasibility input.
      2. Time frame: start and end date of each initiative.
      3. Current budget cycle: time remaining in the current budget cycle and potential cost savings in this fiscal year.
    2. Determine the final priority of the initiative and decide whether you want to include it in your 12-month roadmap.
    3. Document your assessment in the IT Cost Optimization Workbook.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Cost optimization initiatives
    • Time and priority estimates of cost optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Priority Threshold tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Other IT management - depending on the optimization lever (Assets, Vendors, Project Portfolio, or Workforce)

    3.2.1 Prioritize your asset optimization initiatives

    1 hour

    1. Review each asset optimization initiative to set the priority.
    2. Validate your cost and feasibility estimates and consider the automated evaluation, in the IT Cost Optimization Workbook, providing you with a preliminary priority based on your cost and feasibility estimates (see next slides).
    3. Revisit your overarching goals (step 1.4) as you will assess the time it will take you to complete your initiatives and prioritize accordingly.
    4. Determine your start and end date for each initiative based on your journey, objectives, and overarching goals. Consider the urgency of each initiative. Document the quarter and year for your start and end dates in the IT Cost Optimization Workbook (see next slides).
    5. Identify the time remaining in your current budget cycle after the completion of each initiative to get a cost savings estimate for the current fiscal year. Document the number of remaining quarters (0, 1, 2, 3, or 4) in the IT Cost Optimization Workbook (see next slides).
    6. Decide on the priority of each initiative (High, Medium, or Low), and document it in the IT Cost Optimization Workbook (see next slides).
    7. Revisit the priority decision after prioritizing all your initiatives and determine which ones to include in your 12-month roadmap; consider the number of initiatives you can tackle at the same time within a 12-month period. Document your final decision (Yes or No) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    InputOutput
    • Asset optimization initiatives
    • Time and priority estimates of cost optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Priority Threshold tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT asset manager
    • IT infrastructure manager
    • Other IT management

    Template & Example

    Understand your priority assessment

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how the preliminary priority assessment is assigned, for each asset optimization initiative, noting that columns Q to X are hidden automatic calculations and should not be touched:

    Understand your priority assessment

    Column ID Input Type Guidelines
    R Formula Hidden automatic calculation, no entry required. Rank of estimate cost savings (per year) in ascending order (higher cost savings implies a higher rank).
    S Formula Hidden automatic calculation, no entry required. Cost Savings Score on a scale of 1 to 3, where the top third in Cost Savings Rank are assigned a score of 1, the bottom third a score of 3, and in between a score of 2, noting that negative cost savings would imply a -1 score.
    T Formula Hidden automatic calculation, no entry required. Cost Score adds 1 to the Cost Savings Score if the underlying initiative is within the budget.
    U, V, W Formula Hidden automatic calculation, no entry required. A score on a scale of 1 to 3 based on input of columns M, N, and O, where Low or Positive Impact is assigned a score of 3, Medium or No Impact a score of 2, and High or Negative Impact a score of 1.
    X Formula Hidden automatic calculation, no entry required. The rounding of the average of columns U, V, and W, adding 1 to the result if the initiative's approval falls within your accountability (column P).
    Y Formula Hidden automatic calculation, no entry required. The sum of columns T and X, adding 3 for Reduce Unwarranted IT Spending, and 1 to Optimize Cost-to-value (column H).
    Z Formula Hidden automatic calculation, no entry required. Preliminary priority assessment based on the Define Priority Threshold worksheet (hidden, see next slide).

    Review the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Validate cost and feasibility estimates (columns I to P previously filled - steps 2.2 and 3.1) driving the Priority Score and Preliminary Priority Assessment.

    Template & Example

    Priority threshold rationale

    Excel Workbook: IT Cost Optimization – Define Priority Threshold Worksheet

    Refer to the screenshot of the Define Priority Threshold worksheet below to understand the rationale behind the priority score and priority level:

    Priority threshold rationale

    Template & Example

    Estimate your timeline

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete timeline estimates for each asset optimization initiative:

    Estimate your timeline

    Column ID Input Type Guidelines
    AA, AC Dropdown Select the quarter(s) in which you plan to begin and complete your initiative.
    AB, AD Dropdown Select the year(s) in which you plan to begin and complete your initiative.
    AE Dropdown Select the number of remaining quarters, in the current fiscal year, after you complete the initiative (0 to 4); based on columns AA to AD.
    AF Formula Automatic calculation, no entry required. Estimate of cost savings in the current fiscal year, based on the remaining quarters after implementation. The entry in column AE is divided by 4, and the result is multiplied by the related estimated cost savings per year (entry in column L).
    AG Dropdown Select if cost savings after the implementation of the underlying initiative will be permanent or temporary.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate quarter and year to start and complete the initiative.
    3. Identify the time remaining in your current budget cycle after the completion of the initiative.

    Template & Example

    Make your final decisions

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to assign the final priority for each asset optimization initiative, and include it in your 12-month roadmap:

    Make your final decisions

    Column ID Row ID Input Type Guidelines
    AH - Dropdown Select your final priority decision after reviewing the preliminary priority assessment (column Z) and timeline estimates (columns AA to AG).
    AI - Dropdown Select whether you want to include the initiative in your 12-month roadmap (Yes or No).
    AK, AL 5 Formula Automatic calculation, no entry required. The total number of initiatives you decided to include in your 12-month roadmap; based on column AI when Yes is selected.
    AK, AL 6 Formula Automatic calculation, no entry required. Total estimated cost savings per year after the initiative's completion; based on column L when included in the 12-month roadmap (column AI when Yes is selected)
    AK, AL 7 Formula Automatic calculation, no entry required. Total estimated cost savings in the current fiscal year; based on column AF when included in the 12-month roadmap (column AI when Yes is selected)
    • Estimated cost savings per year refer to cost savings fully realized by the end of the upcoming fiscal year, following the initiatives' implementation.
    • Estimated cost savings in the current budget cycle, refer to cost savings partially realized in the current fiscal year, after the initiatives' implementation.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the final priority of the initiative.
    3. Decide whether you want to include the initiative in your 12-month roadmap.

    3.2.2 Prioritize your vendor optimization initiatives

    1 hour

    1. Review each vendor optimization initiative to set the priority.
    2. Validate your cost and feasibility estimates and consider the automated evaluation, in the IT Cost Optimization Workbook, providing you with a preliminary priority based on your cost and feasibility estimates (see next slides).
    3. Revisit your overarching goals (step 1.4) as you will assess the time it will take you to complete your initiatives and prioritize accordingly.
    4. Determine your start and end date for each initiative based on your journey, objectives, and overarching goals. Consider the urgency of each initiative. Document the quarter and year for your start and end dates in the IT Cost Optimization Workbook (see next slides).
    5. Identify the time remaining in your current budget cycle after the completion of each initiative to get a cost savings estimate for the current fiscal year. Document the number of remaining quarters (0, 1, 2, 3, or 4) in the IT Cost Optimization Workbook (see next slides).
    6. Decide on the priority of each initiative (High, Medium, or Low), and document it in the IT Cost Optimization Workbook (see next slides).
    7. Revisit the priority decision after prioritizing all your initiatives and determine which ones to include in your 12-month roadmap; consider the number of initiatives you can tackle at the same time within a 12-month period. Document your final decision (Yes or No) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    Input Output
    • Vendor optimization initiatives
    • Time and priority estimates of cost optimization initiatives in the IT Cost Optimization Workbook
    Materials Participants
    • Define Priority Threshold tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • IT vendor management lead
    • Other IT management

    Template & Example

    Understand your priority assessment

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how the preliminary priority assessment is assigned, for each vendor optimization initiative, noting that columns Q to X are hidden automatic calculations and should not be touched:

    Understand your priority assessment

    Column ID Input Type Guidelines
    R Formula Hidden automatic calculation, no entry required. Rank of estimate cost savings (per year) in ascending order (higher cost savings implies a higher rank).
    S Formula Hidden automatic calculation, no entry required. Cost Savings Score on a scale of 1 to 3, where the top third in Cost Savings Rank are assigned a score of 1, the bottom third a score of 3, and in between a score of 2, noting that negative cost savings would imply a -1 score.
    T Formula Hidden automatic calculation, no entry required. Cost Score adds 1 to the Cost Savings Score if the underlying initiative is within the budget.
    U, V, W Formula Hidden automatic calculation, no entry required. A score on a scale of 1 to 3 based on input of columns M, N, and O, where Low or Positive Impact is assigned a score of 3, Medium or No Impact a score of 2, and High or Negative Impact a score of 1.
    X Formula Hidden automatic calculation, no entry required. The rounding of the average of columns U, V, and W, adding 1 to the result if the initiative's approval falls within your accountability (column P).
    Y Formula Hidden automatic calculation, no entry required. The sum of columns T and X, adding 3 for Reduce Unwarranted IT Spending, and 1 to Optimize Cost-to-Value (column H).
    Z Formula Hidden automatic calculation, no entry required. Preliminary priority assessment based on the Define Priority Threshold worksheet (hidden, see next slide).

    Review the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Validate cost and feasibility estimates (columns I to P previously filled - steps 2.2 and 3.1) driving the Priority Score and Preliminary Priority Assessment.

    Template & Example

    Priority Threshold Rationale

    Excel Workbook: IT Cost Optimization – Define Priority Threshold Worksheet

    Refer to the screenshot of the Define Priority Threshold worksheet below to understand the rationale behind the Priority Score and Priority Level:

    Priority Threshold Rationale

    Template & Example

    Estimate your timeline

    Excel Workbook: IT Cost Optimization – Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete timeline estimates for each vendor optimization initiative:

    Estimate your timeline

    Column ID Input Type Guidelines
    AA, AC Dropdown Select the quarter(s) in which you plan to begin and complete your initiative.
    AB, AD Dropdown Select the year(s) in which you plan to begin and complete your initiative.
    AE Dropdown Select the number of remaining quarters, in the current fiscal year, after you complete the initiative (0 to 4); based on columns AA to AD.
    AF Formula Automatic calculation, no entry required. Estimate of cost savings in the current fiscal year, based on the remaining quarters after implementation. The entry in column AE is divided by 4, and the result is multiplied by the related estimated cost savings per year (entry in column L).
    AG Dropdown Select if cost savings after the implementation of the underlying initiative will be Permanent or Temporary.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate quarter and year to start and complete the initiative.
    3. Identify the time remaining in your current budget cycle after the completion of the initiative.

    Template & Example

    Make your final decisions

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to assign the final priority for each vendor optimization initiative, and include it in your 12-month roadmap:

    Make your final decisions

    Column ID Row ID Input Type Guidelines
    AH - Dropdown Select your final priority decision after reviewing the preliminary priority assessment (column Z) and timeline estimates (columns AA to AG).
    AI - Dropdown Select whether you want to include the initiative in your 12-month roadmap (Yes or No).
    AK, AL 5 Formula Automatic calculation, no entry required. The total number of initiatives you decided to include in your 12-month roadmap; based on column AI when Yes is selected.
    AK, AL 6 Formula Automatic calculation, no entry required. Total estimated cost savings per year after the initiative's completion; based on column L when included in the 12-month roadmap (column AI when Yes is selected)
    AK, AL 7 Formula Automatic calculation, no entry required. Total estimated cost savings in the current fiscal year; based on column AF when included in the 12-month roadmap (column AI when Yes is selected)
    • Estimated cost savings per year refer to cost savings fully realized by the end of the upcoming fiscal year, following the initiatives' implementation.
    • Estimated cost savings in the current budget cycle, refer to cost savings partially realized in the current fiscal year, after the initiatives' implementation.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the final priority of the initiative.
    3. Decide whether you want to include the initiative in your 12-month roadmap.

    3.2.3 Prioritize your project portfolio optimization initiatives

    1 hour

    1. Review each project portfolio optimization initiative to set the priority.
    2. Validate your cost and feasibility estimates and consider the automated evaluation, in the IT Cost Optimization Workbook, providing you with a preliminary priority based on your cost and feasibility estimates (see next slides).
    3. Revisit your overarching goals (step 1.4) as you will assess the time it will take you to complete your initiatives and prioritize accordingly.
    4. Determine your start and end date for each initiative based on your journey, objectives, and overarching goals. Consider the urgency of each initiative. Document the quarter and year for your start and end dates in the IT Cost Optimization Workbook (see next slides).
    5. Identify the time remaining in your current budget cycle after the completion of each initiative to get a cost savings estimate for the current fiscal year. Document the number of remaining quarters (0, 1, 2, 3, or 4) in the IT Cost Optimization Workbook (see next slides).
    6. Decide on the priority of each initiative (High, Medium, or Low), and document it in the IT Cost Optimization Workbook (see next slides).
    7. Revisit the priority decision after prioritizing all your initiatives and determine which ones to include in your 12-month roadmap; consider the number of initiatives you can tackle at the same time within a 12-month period. Document your final decision (Yes or No) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    InputOutput
    • Project portfolio optimization initiatives
    • Time and priority estimates of cost optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Priority Threshold tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • PMO lead
    • Other IT management

    Template & Example

    Understand your priority assessment

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how the preliminary priority assessment is assigned, for each project portfolio optimization initiative, noting that columns Q to X are hidden automatic calculations and should not be touched:

    Understand your priority assessment

    Column ID Input Type Guidelines
    R Formula Hidden automatic calculation, no entry required. Rank of Estimate Cost Savings (per year) in ascending order (higher cost savings implies a higher rank).
    S Formula Hidden automatic calculation, no entry required. Cost Savings Score on a scale of 1 to 3, where the top third in Cost Savings Rank are assigned a score of 1, the bottom third a score of 3, and in between a score of 2, noting that negative cost savings would imply a -1 score.
    T Formula Hidden automatic calculation, no entry required. Cost Score adds 1 to the Cost Savings Score if the underlying initiative is within the budget.
    U, V, W Formula Hidden automatic calculation, no entry required. A score on a scale of 1 to 3 based on input of columns M, N, and O, where Low or Positive Impact is assigned a score of 3, Medium or No Impact a score of 2, and High or Negative Impact a score of 1.
    X Formula Hidden automatic calculation, no entry required. The rounding of the average of columns U, V, and W, adding 1 to the result if the initiative's approval falls within your accountability (column P).
    Y Formula Hidden automatic calculation, no entry required. The sum of columns T and X, adding 3 for Reduce Unwarranted IT Spending, and 1 to Optimize Cost-to-Value (column H).
    Z Formula Hidden automatic calculation, no entry required. Preliminary Priority Assessment based on the Define Priority Threshold worksheet (hidden, see next slide).

    Review the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Validate cost and feasibility estimates (columns I to P previously filled - steps 2.2 and 3.1) driving the Priority Score and Preliminary Priority Assessment.

    Template & Example

    Priority Threshold Rationale

    Excel Workbook: IT Cost Optimization - Define Priority Threshold Worksheet

    Refer to the screenshot of the Define Priority Threshold worksheet below to understand the rationale behind the Priority Score and Priority Level:

    Priority threshold rationale

    Template & Example

    Estimate your timeline

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete timeline estimates for each project portfolio optimization initiative:

    Estimate your timeline

    Column ID Input Type Guidelines
    AA, AC Dropdown Select the quarter(s) in which you plan to begin and complete your initiative.
    AB, AD Dropdown Select the year(s) in which you plan to begin and complete your initiative.
    AE Dropdown Select the number of remaining quarters, in the current fiscal year, after you complete the initiative (0 to 4); based on columns AA to AD.
    AF Formula Automatic calculation, no entry required. Estimate of cost savings in the current fiscal year, based on the remaining quarters after implementation. The entry in column AE is divided by 4, and the result is multiplied by the related estimated cost savings per year (entry in column L).
    AG Dropdown Select if cost savings after the implementation of the underlying initiative will be Permanent or Temporary.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate quarter and year to start and complete the initiative.
    3. Identify the time remaining in your current budget cycle after the completion of the initiative.

    Template & Example

    Make your final decisions

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to assign the final priority for each project portfolio optimization initiative and include it in your 12-month roadmap:

    Make your final decisions

    Column ID Row ID Input Type Guidelines
    AH - Dropdown Select your final priority decision after reviewing the preliminary priority assessment (column Z) and timeline estimates (columns AA to AG).
    AI - Dropdown Select whether you want to include the initiative in your 12-month roadmap (Yes or No).
    AK, AL 5 Formula Automatic calculation, no entry required. The total number of initiatives you decided to include in your 12-month roadmap; based on column AI when Yes is selected.
    AK, AL 6 Formula Automatic calculation, no entry required. Total estimated cost savings per year after the initiative's completion; based on column L when included in the 12-month roadmap (column AI when Yes is selected)
    AK, AL 7 Formula Automatic calculation, no entry required. Total estimated cost savings in the current fiscal year; based on column AF when included in the 12-month roadmap (column AI when Yes is selected)
    • Estimated cost savings per year refer to cost savings fully realized by the end of the upcoming fiscal year, following the initiatives' implementation.
    • Estimated cost savings in the current budget cycle, refer to cost savings partially realized in the current fiscal year, after the initiatives' implementation.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the final priority of the initiative.
    3. Decide whether you want to include the initiative in your 12-month roadmap.

    3.2.4 Prioritize your workforce optimization initiatives

    1 hour

    1. Review each workforce optimization initiative to set the priority.
    2. Validate your cost and feasibility estimates and consider the automated evaluation, in the IT Cost Optimization Workbook, providing you with a preliminary priority based on your cost and feasibility estimates (see next slides).
    3. Revisit your overarching goals (step 1.4) as you will assess the time it will take you to complete your initiatives and prioritize accordingly.
    4. Determine your start and end date for each initiative based on your journey, objectives, and overarching goals. Consider the urgency of each initiative. Document the quarter and year for your start and end dates in the IT Cost Optimization Workbook (see next slides).
    5. Identify the time remaining in your current budget cycle after the completion of each initiative to get a cost savings estimate for the current fiscal year. Document the number of remaining quarters (0, 1, 2, 3, or 4) in the IT Cost Optimization Workbook (see next slides).
    6. Decide on the priority of each initiative (High, Medium, or Low), and document it in the IT Cost Optimization Workbook (see next slides).
    7. Revisit the priority decision after prioritizing all your initiatives and determine which ones to include in your 12-month roadmap; consider the number of initiatives you can tackle at the same time within a 12-month period. Document your final decision (Yes or No) in the IT Cost Optimization Workbook (see next slides).

    Download the IT Cost Optimization Workbook

    InputOutput
    • Workforce optimization initiatives
    • Time and priority estimates of cost optimization initiatives in the IT Cost Optimization Workbook
    MaterialsParticipants
    • Define Priority Threshold tab in the IT Cost Optimization Workbook
    • Outline Initiatives tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT finance lead
    • Talent management representative
    • Other IT management

    Template & Example

    Understand your priority assessment

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how the preliminary priority assessment is assigned, for each workforce optimization initiative, noting that columns Q to X are hidden automatic calculations and should not be touched:

    Understand your priority assessment

    Column ID Input Type Guidelines
    R Formula Hidden automatic calculation, no entry required. Rank of Estimate Cost Savings (per year) in ascending order (higher cost savings implies a higher rank).
    S Formula Hidden automatic calculation, no entry required. Cost Savings Score on a scale of 1 to 3, where the top third in Cost Savings Rank are assigned a score of 1, the bottom third a score of 3, and in between a score of 2, noting that negative cost savings would imply a -1 score.
    T Formula Hidden automatic calculation, no entry required. Cost Score adds 1 to the Cost Savings Score if the underlying initiative is within the budget.
    U, V, W Formula Hidden automatic calculation, no entry required. A score on a scale of 1 to 3 based on input of columns M, N, and O, where Low or Positive Impact is assigned a score of 3, Medium or No Impact a score of 2, and High or Negative Impact a score of 1.
    X Formula Hidden automatic calculation, no entry required. The rounding of the average of columns U, V, and W, adding 1 to the result if the initiative's approval falls within your accountability (column P).
    Y Formula Hidden automatic calculation, no entry required. The sum of columns T and X, adding 3 for Reduce Unwarranted IT Spending, and 1 to Optimize Cost-to-Value (column H).
    Z Formula Hidden automatic calculation, no entry required. Preliminary Priority Assessment based on the Define Priority Threshold worksheet (hidden, see next slide).

    Review the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Validate cost and feasibility estimates (columns I to P previously filled - steps 2.2 and 3.1) driving the Priority Score and Preliminary Priority Assessment.

    Template & Example

    Priority Threshold Rationale

    Excel Workbook: IT Cost Optimization - Define Priority Threshold

    Refer to the screenshot of the Define Priority Threshold worksheet below to understand the rationale behind the Priority Score and Priority Level:

    Priority Threshold Rationale

    Template & Example

    Estimate your timeline

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to complete timeline estimates for each workforce optimization initiative:

    Estimate your timeline

    Column ID Input Type Guidelines
    AA, AC Dropdown Select the quarter(s) in which you plan to begin and complete your initiative.
    AB, AD Dropdown Select the year(s) in which you plan to begin and complete your initiative.
    AE Dropdown Select the number of remaining quarters, in the current fiscal year, after you complete the initiative (0 to 4); based on columns AA to AD.
    AF Formula Automatic calculation, no entry required. Estimate of cost savings in the current fiscal year, based on the remaining quarters after implementation. The entry in column AE is divided by 4, and the result is multiplied by the related estimated cost savings per year (entry in column L).
    AG Dropdown Select if cost savings after the implementation of the underlying initiative will be Permanent or Temporary.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the appropriate quarter and year to start and complete the initiative.
    3. Identify the time remaining in your current budget cycle after the completion of the initiative.

    Template & Example

    Make your final decisions

    Excel Workbook: IT Cost Optimization - Outline Initiatives Worksheet

    Refer to the example and guidelines below on how to assign the final priority for each workforce optimization initiative, and include it in your 12-month roadmap:

    Make your final decisions

    Column ID Row ID Input Type Guidelines
    AH - Dropdown Select your final priority decision after reviewing the preliminary priority assessment (column Z) and timeline estimates (columns AA to AG).
    AI - Dropdown Select whether you want to include the initiative in your 12-month roadmap (Yes or No).
    AK, AL 5 Formula Automatic calculation, no entry required. The total number of initiatives you decided to include in your 12-month roadmap; based on column AI when Yes is selected.
    AK, AL 6 Formula Automatic calculation, no entry required. Total estimated cost savings per year after the initiative's completion; based on column L when included in the 12-month roadmap (column AI when Yes is selected)
    AK, AL 7 Formula Automatic calculation, no entry required. Total estimated cost savings in the current fiscal year; based on column AF when included in the 12-month roadmap (column AI when Yes is selected)
    • Estimated cost savings per year refer to cost savings fully realized by the end of the upcoming fiscal year, following the initiatives' implementation.
    • Estimated cost savings in the current budget cycle, refer to cost savings partially realized in the current fiscal year, after the initiatives' implementation.

    Complete the following fields for each initiative in the Excel Workbook as per guidelines:

    1. Navigate to the Outline Initiatives tab.
    2. Determine the final priority of the initiative.
    3. Decide whether you want to include the initiative in your 12-month roadmap.

    3.3 Develop your cost optimization roadmap

    1 hour

    1. Conduct a final evaluation of your timeline, priority decision, and initiatives you wish to include in your 12-month roadmap. Do they make sense, are they achievable, and do they all contribute individually and collectively to reaching your cost optimization goals?
    2. Review your 12-month roadmap outputs in the IT Cost Optimization Workbook (see next slides).
    3. Make adjustments to your 12-month roadmap by adding or removing initiatives as you deem necessary (step 3.2).
    4. Document your final roadmap - including initiatives and relative time frames for execution - in the IT Cost Optimization Roadmap templates provided (see slide 97). The 12-month roadmap outputs from the IT Cost Optimization Workbook (see next slide) can facilitate this task.

    Download the IT Cost Optimization Workbook

    Input Output
    • Outline Initiatives tab in the IT Cost Optimization Workbook, output from previous steps
    • IT Cost Optimization Roadmap
    Materials Participants
    • Outline Initiatives Charts tab in the IT Cost Optimization Workbook
    • Diagram Results tab in the IT Cost Optimization Workbook
    • List Results tab in the IT Cost Optimization Workbook
    • Timeline Result tab in the IT Cost Optimization Workbook
    • CIO/IT director
    • IT financial lead
    • Other IT management

    Template & Example

    Potential Cost Savings Per Year

    Excel Workbook: IT Cost Optimization - Outline Initiatives Charts Worksheet

    Refer to the example below on charts depicting different views of estimated cost savings per year across the four optimization levers (Assets, Vendors, Project Portfolio, and Workforce) that could help you in your assessment and decision making.

    Potential cost savings per year

    From the Excel Workbook, after completing your potential initiatives and filling all related entries in the Outline Initiatives tab:

    1. Navigate to the Outline Initiatives Charts tab.
    2. Review each of the charts.
    3. Navigate back to the Outline Initiatives tab to examine, drill down, and amend individual initiative entries or final decisions as you deem necessary.

    Template & Example

    12-month Roadmap Outputs

    Excel Workbook: IT Cost Optimization - Diagram Results, List Results, and Timeline Result Worksheets

    Refer to the example below depicting different roadmap output that could help you in presentations, assessment, and decision making.

    12-month Roadmap Outputs

    From the Excel Workbook:

    1. Navigate to the Diagram Results tab. This bubble diagram represent cost optimization initiatives by objective where each bubble size is determined by its estimated cost saving per year.
    2. Navigate to the List Results tab. You will find a list of the cost optimizations initiatives you've chosen to include in your roadmap and related charts.
    3. Navigate to the Timeline Result tab. This Gantt chart is a timeline view of the cost optimizations initiatives you've chosen to include in your roadmap.

    Download the IT Cost Optimization Workbook

    IT cost optimization roadmap

    Phase 4

    Communicate and Execute

    Phase 1
    Understand Your Mandate and Objectives

    Phase 2
    Outline Your Cost Optimization Initiatives

    Phase 3
    Develop Your IT Cost Optimization Roadmap

    Phase 4
    Communicate and Execute

    This phase will walk you through the following activities:

    • Cost optimization communication plan
    • Cost optimization executive presentation

    This phase involves the following participants:

    • CIO/IT director
    • IT finance lead
    • PMO lead
    • Other IT management

    Build Your IT Cost Optimization Roadmap

    4.1 Build the communication plan

    45 to 60 minutes

    1. Use the Cost Optimization Communication Plan templates and guidance on the following slides.
    2. Complete the template to develop your communication plan for your cost optimization proposal and initiatives. At a minimum, it should include:
      1. Steps for preparing and presenting your proposal to decision-makers, sponsors, and other stakeholders, including named presenters and points of contact in IT.
      2. Checkpoints for communication throughout the execution of each initiative and the cost optimization roadmap overall, including target audiences, accountabilities, modes and methods of communication, type/scope of information to be communicated at each checkpoint, and any decision/approval steps.

    Download the IT Cost Optimization Workbook

    InputOutput
    • Cost optimization roadmap
    • Completed draft of the Cost Optimization Communication Plan
    MaterialsParticipants
    • IT Cost Optimization Workbook
    • IT Cost Optimization Roadmap
    • Info-Tech's Cost Optimization Communication Plan template
    • CIO/IT director
    • IT financial lead
    • Other IT management

    Understand a communication strategy's purpose

    Put as much effort into developing your communication strategy as you would into planning and executing the cost optimization initiatives themselves. Don't skip this part.

    Your communication strategy has two major components ...

    1. A tactical plan for how and when you'll communicate with stakeholders about your proposals, activities, and progress toward meeting cost optimization goals.
    2. An executive or board presentation that outlines your final proposed cost optimization initiatives, their respective business cases, and resources/support required with the goal of gaining approval to execute.

    Your communication strategy will need to ...

    • Provide answers to the "What's in it for me?" question from all impacted stakeholders.
    • Roles, responsibilities, and accountabilities before, during, and after initiatives are completed.
    • Descriptions and high-level information about dates, deliverables, and impacts of the specific changes being made.

    You will also develop more detailed operational and project plans for each initiative. IT will use these plans to manage and track the execution of individual initiatives when the time comes.

    Template & Example

    Document the overall what and why of your planned communications

    Component Purpose Context Key Messages Intended Outcomes
    Definition Description of the topic and why you're communicating with this specific audience right now. Background information about the broader situation and how you got to where you are today. The main points you want your target audience to hear/read, absorb, and remember. What you hope you and your audience will get at the end of the communication or effort.
    Our Language
    • IT is proposing an organization-wide array of initiatives in order to reduce IT costs. We are seeking your approval and support to carry out these initiatives.
    • [Purpose]
    • The economy is in active downturn and may become a full recession.
    • IT is anticipating mandatory cost reductions and has opted to take a proactive position.
    • We used an analytical framework to look at all areas of the organization to identify and prioritize IT cost-reduction opportunities.
    • [Context]
    • IT is being proactive.
    • IT is sensitive to the business.
    • IT needs your support.
    • IT is committed to keeping you informed at every step.
    • IT wants to position the organization for rapid recovery when the economy improves.
    • [Message]
    • Buy-in, approval, and ongoing support for cost optimization initiatives proposed.
    • Update on the status of specific initiatives, including what's happened, progress, and what's coming next.
    • [Outcome]

    Template & Example

    Next, note the who, how, and when of your communication plan

    Stakeholder/Approver Initiatives Impact Format Time frame Messenger
    CEO
    • Reduce number of Minitab licenses
    • Defer hiring of new data architecture position
    • Cancel VR simulation project
    Indefinitely delays current strategic projects Monthly meeting discussion Last Wednesday of every month starting Oct. 26, FY1 CIO, IT data analytics project lead, IT VR project lead
    IT Steering Committee
    • Adjust service level framework and level assignments
    • Postpone purchases for network modernization
    • Postpone workstation/laptop upgrades for non-production functions
    • Outsource data analytics project
    Nearly all of these initiatives are enterprise-wide or affect multiple departments. Varying direct and indirect impacts will need to be independently communicated for each initiative if approved by the ITS.

    Formal presentation at quarterly ITS meetings

    Monthly progress updates via email bulletin

    Approval presentation: Oct. 31, FY1

    Quarterly updates: Jan. 31, Apr. 28, and Jul. 28, FY2

    CIO, IT service director, IT infrastructure director, IT data analytics project lead
    VP of Sales
    • Pause Salesforce view redesign project
    Delays new sales tool efficiency improvement. Meeting discussion Nov. FY1 CIO, IT Salesforce view redesign project lead
    [Name/Title/Group]
    • [Initiative]
    • [Initiative]
    [Impact statement] [Format] [Date/Period] [Name/Title]
    [Name/Title/Group]
    • [Initiative]
    • [Initiative]
    [Impact statement] [Format] [Date/Period] [Name/Title]
    [Name/Title/Group]
    • [Initiative]
    • [Initiative]
    [Impact statement] [Format] [Date/Period] [Name/Title]

    4.2 Build the executive presentation

    45-60 minutes

    1. Download Info-Tech's IT Cost Optimization Roadmap Samples and Templates.
    2. Update the content with the outputs of your cost optimization roadmap and data/graph elements from the IT Cost Optimization Workbook. Refer to your organization's standards and norms for executive-level presentations and adapt accordingly.

    Download IT Cost Optimization Roadmap Samples and Templates

    Input Output
    • IT Cost Optimization Roadmap
    • IT Cost Optimization Workbook
    • Completed draft of the IT Cost Optimization Executive Presentation
    Materials Participants
    • IT Cost Optimization Workbook
    • IT Cost Optimization Roadmap Samples and Templates
    • CIO/IT directors
    • IT financial lead
    • Other IT management

    Summary of Accomplishment

    Congratulations! You now have an IT cost optimization strategy and a communication plan.

    Throughout this blueprint, you have:

    1. Identified your IT mandate and cost optimization journey.
    2. Outlined your initiatives across the four levers (assets, vendors, project portfolio, and workforce).
    3. Put together a 12-month IT cost optimization roadmap.
    4. Developed a communication strategy and crafted an executive presentation - your initial step to communicate and discuss IT cost optimization initiatives with your key stakeholders.

    What's next?

    Communicate with your stakeholders, then follow your internal project policies and procedures to get the necessary approvals as required. Once obtained, you can start the execution and implementation of your IT cost optimization strategy.

    If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

    Contact your account representative for more information.

    workshops@infotech.com
    1-888-670-8889

    Research Contributors and Experts

    Jennifer Perrier, Principal Research Director, IT Financial Management

    Jennifer Perrier
    Principal Research Director, IT Financial Management
    Info-Tech Research Group

    Jack Hakimian, Senior Vice President, Research Development

    Jack Hakimian
    Senior Vice President, Research Development
    Info-Tech Research Group

    Graham Price, Senior Executive Counselor, Executive Services

    Graham Price
    Senior Executive Counselor, Executive Services
    Info-Tech Research Group

    Travis Duncan, Research Director, Project & Portfolio Management

    Travis Duncan
    Research Director, Project & Portfolio Management
    Info-Tech Research Group

    Dave Kish, Practice Lead, IT Financial Management

    Dave Kish
    Practice Lead, IT Financial Management
    Info-Tech Research Group

    Baird Miller, PhD, Senior Executive Advisor, Executive Services

    Baird Miller, PhD
    Senior Executive Advisor, Executive Services
    Info-Tech Research Group

    Other Research Contributors and Experts

    Monica Braun
    Research Director, IT Financial Management
    Info-Tech Research Group

    Sandi Conrad
    Principal Advisory Director, Infrastructure & Operations
    Info-Tech Research Group

    Phil Bode
    Principal Advisory Director, Vendor Management
    Info-Tech Research Group

    Donna Glidden
    Advisory Director, Vendor Management
    Info-Tech Research Group

    Barry Cousins
    Distinguished Analyst & Research Fellow
    Info-Tech Research Group

    Andrew Sharp
    Research Director, Infrastructure & Operations Practice
    Info-Tech Research Group

    Frank Sewell
    Advisory Director, Vendor Management
    Info-Tech Research Group

    Related Info-Tech Research

    Achieve IT Spend & Staffing Transparency
    Most CIOs, CFOs, and business function leaders don't enjoy a shared vocabulary when it comes to talking about technology spend. As a result, truly meaningful conversations about where and how to spend technology funds in support of business goals are rare. Enable these important conversations by transparently mapping your IT spend data against four key stakeholder views.

    Reduce Shadow IT With a Service Request Catalog
    As the business gets more innovative to solve its problems, IT finds itself in reactive mode, dealing with software bloat, managing surprise SaaS renewals, and having to integrate products that they didn't know were purchased. To solve this, IT needs to focus on service and visibility to counter Shadow IT.

    Bibliography

    "A Short Guide to Structured Cost Reduction." National Audit Office, 18 June 2010. Web.

    "IT Cost Savings: A Guide to Application Rationalization." LeanIX, 2021. Web.

    Jouravlev, Roman. "Service Financial Management: ITIL 4 Practice Guide." Axelos, 30 April 2020. Web.

    Leinwand, Paul, and Vinay Couto. "How to Cut Costs More Strategically." Harvard Business Review, March 2017. Web.

    "Role & Influence of the Technology Decision-Maker 2022." Foundry, 2022. Web.

    "State of the CIO 2022." CIO, 2022. Web.

    "The Definitive Guide to IT Cost Optimization." LeanIX, n.d. Web.

    "Understand the Principles of Cost Optimization." Google Cloud, n.d. Web.

    The ESG Imperative and Its Impact on Organizations

    • Buy Link or Shortcode: {j2store}196|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: IT Governance, Risk & Compliance
    • Parent Category Link: /it-governance-risk-and-compliance
    • Global regulatory climate disclosure requirements are still evolving and are not consistent.
    • Sustainability is becoming a corporate imperative, but IT’s role is not fully clear.
    • The environmental, social, and governance (ESG) data challenge is large and continually expanding in scope.
    • Collecting the necessary data and managing ethical issues across supply chains is a daunting task.
    • Communicating long-term value is difficult when customer and employee expectations are shifting.

    Our Advice

    Critical Insight

    • An organization's approach to ESG cannot be static or tactical. It is a moving landscape that requires a flexible, holistic approach across the organization. Cross-functional coordination is essential in order to be ready to respond to changing conditions.
    • Even though the ESG data requirements are large and continually expanding in scope, many organizations have well-established data frameworks and governance practices in place to meet regulatory obligations such as Sarbanes–Oxley that should used as a starting point.

    Impact and Result

    • Organizations will have greater success if they focus their ESG program efforts on the ESG factors that will have a material impact on their company performance and their key stakeholders.
    • Continually evaluating the evolving ESG landscape and its impact on key stakeholders will enable organizations to react quickly to changing conditions.
    • A successful ESG program requires a collaborative and integrated approach across key business stakeholders.
    • Delivering high-quality metrics and performance indicators requires a flexible and digital data approach, where possible, to enable data interoperability.

    The ESG Imperative and Its Impact on Organizations Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. The ESG Imperative and Its Impact on Organizations Deck – Learn why sustainability is becoming a key measurement of corporate performance and how to set your organization up for success.

    Understand the foundational components and drivers of the broader concept of sustainability: environmental, social, and governance (ESG) and IT’s roles within an organization’s ESG program. Learn about the functional business areas involved, the roles they play and how they interact with each other to drive program success.

    • The ESG Imperative and Its Impact on Organizations Storyboard

    Infographic

    Further reading

    The ESG Imperative and Its Impact on Organizations

    Design to enable an active response to changing conditions.

    Analyst Perspective

    Environmental, social, and governance (ESG) is a corporate imperative that is tied to long-term value creation. An organization's social license to operate and future corporate performance depends on managing ESG factors well.

    Central to an ESG program is having a good understanding of the ESG factors that may have a material impact on enterprise value and key internal and external stakeholders. A comprehensive ESG strategy supported by strong governance and risk management is also essential to success.

    Capturing relevant data and applying it within risk models, metrics, and internal and external reports is necessary for sharing your ESG story and measuring your progress toward meeting ESG commitments. Consequently, the data challenges have received a lot of attention, and IT leaders have a role to play as strategic partner and enabler to help address these challenges. However, ESG is more than a data challenge, and IT leaders need to consider the wider implications in managing third parties, selecting tools, developing supporting IT architecture, and ensuring ethical design.

    For many organizations, the ESG program journey has just begun, and collaboration between IT and risk, procurement, and compliance will be critical in shaping program success.

    This is a picture of Donna Bales, Principal Research Director, Info-Tech Research Group

    Donna Bales
    Principal Research Director
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    • Global regulatory climate disclosure requirements are still evolving and are not consistent.
    • Sustainability is becoming a corporate imperative, but IT's role is not fully clear.
    • The ESG data challenge is large and continually expanding in scope.
    • Collecting the necessary data and managing ethical issues across supply chains is a daunting task.
    • Communicating long-term value is difficult when customer and employee expectations are shifting.

    Common Obstacles

    • The data necessary for data-driven insights and accurate disclosure is often hampered by inaccurate and incomplete primary data.
    • Other challenges include:
      • Approaching ESG holistically and embedding it into existing governance, risk, and IT capabilities.
      • Building knowledge and adapting culture throughout all levels of the organization.
      • Monitoring stakeholder sentiment and keeping strategy aligned to expectations.

    Info-Tech's Approach

    • Use this blueprint to educate yourself on ESG factors and the broader concept of sustainability.
    • Learn about Info-Tech's ESG program approach and use it as a framework to begin your ESG program journey.
    • Identify changes that may be needed in your organizational operating model, strategy, governance, and risk management approach.
    • Discover areas of IT that may need to be prioritized and resourced.

    Info-Tech Insight

    An organization's approach to ESG cannot be static or tactical. ESG is a moving landscape that requires a flexible, holistic approach across the organization. It must become part of the way you work and enable an active response to changing conditions.

    This is an image of Info-Tech's thoughtmap for eight steps of the ESG Program Journey

    Putting ESG in context

    ESG has moved beyond the tipping point to corporate table stakes

    • In recent years, ESG issues have moved from voluntary initiatives driven by corporate responsibility teams to an enterprise-wide strategic imperative.
    • Organizations are no longer being measured by financial performance but by how they contribute to a sustainable and equitable future, such as how they support sustainable innovation through their business models and their focus on collaboration and inclusion.
    • A corporation's efforts toward sustainability is measured by three components: environmental, social, and governance.

    Sustainability

    The ability of a corporation and broader society to endure and survive over the long term by managing adverse impacts well and promoting positive opportunities.

    This is an image of the United Nation's 17 sustainable goals.

    Source: United Nations

    Putting "E," "S," and "G" in context

    Corporate sustainability depends on managing ESG factors well

    • Environmental, social, and governance are the component pieces of a sustainability framework that is used to understand and measure how an organization impacts or is affected by society as a whole.
    • Human activities, particularly fossil fuel burning since the mid twentieth century, have increased greenhouse gas concentration, resulting in observable changes to the atmosphere, ocean, cryosphere, and biosphere.
    • The E in ESG relates to the positive and negative impacts an organization may have on the environment, such as the energy it takes in and the waste it discharges.
    • The S in ESG is the most ambiguous component in the framework, as social impact relates not only to risks but also prosocial behaviour. It's the most difficult to measure but can have significant financial and reputational impact on corporations if material and poorly managed.
    • The G in ESG is foundational to the realization of S and E. It encompasses how well an organization integrates these considerations into the business and how well the organization engages with key stakeholders, receives feedback, and is transparent with its intentions.

    Common examples of ESG issues include: Environmental: Climate change, greenhouse gas emissions (CHG), deforestation, biodiversity, pollution, water, waste, extended producer responsibility, etc. Social: Customer relations, employee relations, labor, human rights, occupational health and safety, community relations, supply chains, etc. Governance: Board management practices, succession planning, compensation, diversity, equity and inclusion, regulatory compliance, corruption, fraud, data hygiene and security, etc. Source: Getting started with ESG - Sustainalytics

    Understanding the drivers behind ESG

    $30 trillion is expected to be transferred from the baby boomers to Generation Z and millennials over the next decade
    – Accenture

    Drivers

    • The rapid rise of ESG investing
    • The visibility of climate change is driving governments, society, and corporations to act and to initiate and support net zero goals.
    • A younger demographic that has strong convictions and financial influence
    • A growing trend toward mandatory climate and diversity, equity, and inclusion (DEI) disclosures required by global regulators
    • Recent emphasis by regulators on board accountability and fiduciary duty
    • Greater societal awareness of social issues and sustainability
    • A new generation of corporate leadership that is focused on sustainable innovation

    The evolving regulatory landscape

    Global regulators are mobilizing toward mandatory regulatory climate disclosure

    Canada

    • Canadian Securities Administrators (CSA) NI 51-107 Disclosure of Climate-related Matters

    Europe

    • European Commission, Sustainable Finance Disclosure Regulation (SFDR)
    • European Commission, EU Supply Chain Act
    • Germany – The German Supply Chain Act (GSCA)
    • Financial Conduct Authority UK, Proposal (DP 21/4) Sustainability Disclosure Requirements and investment labels
    • UK Modern Slavery Act, 2015

    United States

    • Securities and Exchange Commission (SEC) 33-11042– The Enhancement and Standardization of Climate-Related Disclosures for Investors
    • SEC 33-11038 Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
    • Nasdaq Board Diversity Rule (5605(f))

    New Zealand

    • New Zealand, The Financial Sector (Climate-related Disclosures and Other Matters) Amendment Act 2021

    Begin by setting your purpose

    Consider your role as a corporation in society and your impact on key stakeholders

    • The impact of a corporation can no longer be solely measured by financial impact but also its impact on social good. Corporations have become real-world actors that impact and are affected by the environment, people, and society.
    • An ESG program should start with defining your organization's purpose in terms of corporate responsibility, the role it will play, and how it will endure over time through managing adverse impacts and promoting positive impacts.
    • Corporations should look inward and outward to assess the material impact of ESG factors on their organization and key internal and external stakeholders.
    • Once stakeholders are identified, consider how the ESG factors might be perceived by delving into what matters to stakeholders and what drives their behavior.

    Understanding your stakeholder landscape is essential to achieving ESG goals

    Internal Stakeholders: Board; Management; Employees. External Stakeholders: Activists; Regulators; Customers; Lenders; Government; Investors; Stakeholders; Community; Suppliers

    Assess ESG impact

    Materiality assessments help to prioritize your ESG strategy and enable effective reporting

    • The concept of materiality as it relates to ESG is the process of gaining different perspectives on ESG issues and risks that may have significant impact (both positive and negative) on or relevance to company performance.
    • The objective of a materiality assessment is to identify material ESG issues most critical to your organization by looking a broad range of social and environmental factors. Its purpose is to narrow strategic focus and enable an organization to assess the impact of financial and non-financial risks aggregately.
    • It helps to make the case for ESG action and strategy, assess financial impact, get ahead of long-term risks, and inform communication strategies.
    • Organizations can leverage assessment tools from Sustainalytics or SASB Standards to help assess ESG risks or use guidance or benchmarking information from industry associations.

    Info-Tech Insight

    Survey key stakeholders to obtain a more holistic viewpoint of expectations and the industry landscape and gain credibility through the process.

    Use a materiality matrix to understand ESG exposure

    This is an image of a materiality matrix used to understand ESG exposure.

    Example: Beverage Company

    Follow a holistic approach

    To deliver on your purpose, sustainability must be integrated throughout the organization

    • An ESG program cannot be implemented in a silo. It must be anchored on its purpose and supported by a strong governance structure that is intertwined with other functional areas.
    • Effective governance is essential to instill trust, support sound decision making, and manage ESG.
    • Governance extends beyond shareholder rights to include many other factors, such as companies' interactions with competitors, suppliers, and governments. More transparency is sought on:
      • Corporate behavior, executive pay, and oversight of controls.
      • Board diversity, compensation, and skill set.
      • Oversight of risk management, particularly risks related to fraud, product, data, and cybersecurity

    "If ESG is the framework of non-financial risks that may have a material impact on the company's stakeholders, corporate governance is the process by which the company's directors and officers manage those risks."
    – Zurich Insurance

    A pyramid is depicted. The top of the pyramid is labeled Continual Improvement, and the following terms are inside this box. Governance: Strategy; Risk Management; Metrics & Targets. At the bottom of the pyramid is a box with right facing arrows, labeled Transparency and Disclosure. This is Informed by the TCFD Framework

    Governance and organization approach

    There is no one-size-fits-all approach

    47% of companies reported that the full board most commonly oversees climate related risks and opportunities while 20% delegate to an existing board governance committee (EY Research, 2021).

    • The organizational approach to ESG will differ across industry segments and corporations depending on material risks and their upstream and downstream value change. However, the accountability for ESG sits squarely at the CEO and board level.
    • Some organizations have taken the approach of hiring a Chief Sustainability Officer to work alongside the CEO on execution of ESG goals and stakeholder communication, while others use other members of the strategic leadership to drive the desired outcomes.
    Governance Layer Responsibilities
    Board
    • Overall accountability lies with the full board. Some responsibilities may be delegated to newly formed dedicated ESG governance committee.
    Oversight
    Executive leadership
    • Accountable for sustainability program success and will work with CEO to set ESG purpose and goals.
    Oversight and strategic direction
    Management
    • Senior management drives execution; sometimes led by a cross-functional committee.
    Execution

    Strategy alignment

    "74% of finance leaders say that investors increasingly use nonfinancial information in their decision-making."

    – "Aligning nonfinancial reporting..." EY, 2020

    • Like any journey, the ESG journey requires knowing where you are starting from and where you are heading to.
    • Once your purpose is crystalized, identify and surface gaps between where you want to go as an organization (your purpose and goals) and what you need to deliver as an organization to meet the expectations of your internal and external stakeholders (your output).
    • Using the results of the materiality assessment, weigh the risk, opportunities, and financial impact to help prioritize and determine vulnerabilities and where you might excel.
    • Finally, evaluate and make changes to areas of your business that need development to be successful (culture, accountability and board structure, ethics committee, etc.)

    Gap analysis example for delivering reporting requirements

    Organizational Goals

    • Regulatory Disclosure
      • Climate
      • DEI
      • Cyber governance
    • Performance Tracking/Annual Reporting
      • Corporate transparency on ESG performance via social, annual circular
    • Evidence-Based Business Reporting
      • Risk
      • Board
      • Suppliers

    Risk-size your ESG goals

    When integrating ESG risks, stick with a proven approach

    • Managing ESG risks is central to making sound organizational decisions regarding sustainability but also to anticipating future risks.
    • Like any new risk type, ESG risk should be interwoven into your current risk management and control framework via a risk-based approach.
    • Yet ESG presents some new risk challenges, and some risk areas may need new control processes or enhancements.
    NET NEW ENHANCEMENT
    Climate disclosure Data quality management
    Assurance specific to ESG reporting Risk sensing and assessment
    Supply chain transparency tied back to ESG Managing interconnections
    Scenario analysis
    Third-party ratings and monitoring

    Info-Tech Insight

    Integrate ESG risks early, embrace uncertainty by staying flexible, and strive for continual improvement.

    A funnel chart is depicted. The inputs to the funnel are: Strategy - Derive ESG risks from strategy, and Enterprise Risk Appetite. Inside the funnel, are the following terms: ESG; Data; Cyber. The output of the funnel is: Evidence based reporting ESG Insights & Performance metrics

    Managing supplier risks

    Suppliers are a critical input into an organization's ESG footprint

    "The typical consumer company's supply chain ... [accounts] for more than 80% of greenhouse-gas emissions and more than 90% of the impact on air, land, water, biodiversity, and geological resources."
    – McKinsey & Company, 2016

    • Although companies are accustomed to managing third parties via procurement processes, voluntary due-diligence, and contractual provisions, COVID-19 surfaced fragility across global supply chains.
    • The mismanagement of upstream and downstream risks of supply chains can harm the reputation, operations, and financial performance of businesses.
    • To build resiliency to and visibility of supply chain risk, organizations need to adapt current risk management programs, procurement practices, and risk assessment tools and techniques.
    • Procurement departments have an enhanced function, effectively acting as gatekeepers by performing due diligence, evaluating performance, and strengthening the supplier relationship through continual feedback and dialogue.
    • Technologies such as blockchain and IoT are starting to play a more dominant role in supply chain transparency.

    Raw materials are upstream and consumers are downstream.

    "Forty-five percent of survey respondents say that they either have no visibility into their upstream supply chain or that they can see only as far as their first-tier suppliers."
    – "Taking the pulse of shifting supply chains," McKinsey & Company, 2022

    Metrics and targets

    Metrics are key to stakeholder transparency, measuring performance against goals, and surfacing organizational blind spots

    • ESG metrics are qualitative or quantitative insights that measure organizations' performance against ESG goals. Along with traditional business metrics, they assist investors with assessing the long-term performance of companies based on non-financial ESG risks and opportunities.
    • Metrics, key performance indicators (KPIs), and key risk indicators (KRIs) are used to measure how ESG factors affect an organization and how an organization may impact any of the underlying issues related to each ESG factor.
    • There are several reporting standards that offer specific ESG performance metrics, such as the Global Reporting Institute (GRI), Sustainability Accounting Standards Board (SASB), and World Economic Forum (WEF).
    • For climate-related disclosures, global regulators are converging on the Task Force for Climate-related Disclosures (TCFD) and the International Sustainability Standards Board (ISSB).

    Example metrics for ESG factors

    Example metrics for environment include greenhouse gas emissions, water footprint, renewable energy share, and % of recycled material. Example social metrics include rates of injury, proportion of spend on local supplies, and percentage of gender or ethnic groups in management roles. Example governance metrics include annual CEO compensation compared to median, number of PII data breaches, and completed number of supplier assessments.

    The impact of ESG on IT

    IT plays a critical role in achieving ESG goals

    • IT groups have a critical role to play in helping organizations develop strategic plans to meet ESG goals, measure performance, monitor risks, and deliver on disclosure requirements.
    • IT's involvement extends from the CIO providing input at a strategic level to leading the charge within IT to instill new goals and adapt the culture toward one focused on sustainability.
    • To set the tone, CIOs should begin by updating their IT governance structure and setting ESG goals for IT.
    • IT leaders will need to think about resource use and efficiency and incorporate this into their IT strategy.

    Info-Tech Insight

    IT leaders need to work collaboratively with risk management to optimize decision making and continually improve ESG performance and disclosure.

    "A great strategy meeting is a meeting of the minds."
    – Max McKeown

    The data challenge

    The ESG data requirement is large and continually expanding in scope

    • To meet ESG objectives, corporations are challenged with collecting non-financial data from across functional business and geographical locations and from their supplier base and supply chains.
    • One of the biggest impediments to ESG implementation is the lack of high-quality data and of mature processes and tools to support data collection.
    • The data challenge is compounded by the availability and usability of data, immature and fragmented standards that hinder comparability, and workflow integration.

    Info-Tech Insight

    Keep your data model flexible and digital where possible to enable data interoperability.

    A flow chart is depicted. the top box is labeled ESG Program. Below that are Boxes labeled Tactical and Strategic. Below the Tactical Box, is a large X showing a lack of connection to the following points: Duplicative; Inefficient/Costly. Below the box labeled Strategic are the following terms: Data-Driven; Reusable; Digital.

    "You can have data without information, but you cannot have information without data."
    – Daniel Keys Moran

    It's more than a data challenge

    Organizations will rely on IT for execution, and IT leaders will need to be ready

    Data Management: Aggregated Reporting; Supplier Management; Cyber Management; Operational Management; Ethical Design(AI, Blockchain); IT Architecture; Resource Efficiency; Processing & Tooling; Supplier Assessment.

    Top impacts on IT departments

    1. ESG requires corporations to keep track of ESG-related risks of third parties. This will mean more robust assessments and monitoring.
    2. Many areas of ESG are new and will require new processes and tools.
    3. The SEC has upped the ante recently, requiring more rigorous accountability and reporting on cyber incidents.
    4. New IT systems and architecture may be needed to support ESG programs.
    5. Current reporting frameworks may need updating as regulators move to digital.
    6. Ethical design will need to be considered when AI is used to support risk/data management and when it is used as part of product solutions.

    Key takeaways

    • It's critical for organizations to look inward and outward to assess the material impact of ESG factors on their organization and key internal and external stakeholders.
    • ESG requires a flexible, holistic approach across the organization. It must become part of the way you work and enable an active response to changing conditions.
    • ESG introduces new risks that should not be viewed in isolation but interwoven into your current risk management and control framework via a risk-based approach.
    • Identify and integrate risks early, embrace uncertainty by staying flexible, and strive for continual improvement.
    • Metrics are key to telling your ESG story. Place the appropriate importance on the information that will be reported.
    • Recognize that the data challenge is complex and evolving and design your data model to be flexible, interoperable, and digital.
    • IT's role is far reaching, and IT will have a critical part in managing third parties, selecting tools, developing supporting IT architecture, and using ethical design.

    Definitions

    TERM DEFINITON
    Corporate Social Responsibility Management concept whereby organizations integrate social and environmental concerns in their operations and interactions with their stakeholders.
    Chief Sustainability Officer Steers sustainability commitments, helps with compliance, and helps ensure internal commitments are met. Responsibilities may extend to acting as a liaison with government and public affairs, fostering an internal culture, acting as a change agent, and leading delivery.
    ESG An acronym that stands for environment, social, and governance. These are the three components of a sustainability program.
    ESG Standard Contains detailed disclosure criteria including performance measures or metrics. Standards provide clear, consistent criteria and specifications for reporting. Typically created through consultation process.
    ESG Framework A broad contextual model for information that provides guidance and shapes the understanding of a certain topic. It sets direction but does not typically delve into the methodology. Frameworks are often used in conjunction with standards.
    ESG Factors The factors or issues that fall under the three ESG components. Measures the sustainability performance of an organization.
    ESG Rating An aggregated score based on the magnitude of an organization's unmanaged ESG risk. Ratings are provided by third-party rating agencies and are increasingly being used for financing, transparency to investors, etc.
    ESG Questionnaire ESG surveys or questionnaires are administered by third parties and used to assess an organization's sustainability performance. Participation is voluntary.
    Key Risk Indicator (KRI) A measure to indicate the potential presence, level, or trend of a risk.
    Key Performance Indicator (KPI) A measure of deviation from expected outcomes to help a firm see how it is performing.
    Materiality Material topics are topics that have a direct or indirect impact on an organization's ability to create, preserve, or erode economic, environment and social impact for itself and its stakeholder and society as a whole
    Materiality Assessment A materiality assessment is a tool to identify and prioritize the ESG issues most critical to the organization.
    Risk Sensing The range of activities carried out to identify and understand evolving sources of risk that could have a significant impact on the organization (e.g. social listening).
    Sustainability The ability of an organization and broader society to endure and survive over the long term by managing adverse impacts well and promoting positive opportunities.
    Sustainalytics Now part of Morningstar. Sustainalytics provides ESG research, ratings, and data to institutional investors and companies.
    UN Guiding Principles on Business and Human Rights (UNGPs) UN Guiding Principles on Business and Human Rights (UNGPs) provide an essential methodological foundation for how impacts across all dimensions should be assessed.

    Reporting & standard frameworks

    STANDARD DEFINITION AND FOCUS
    CDP CDP has created standards and metrics for comparing sustainability impact. Focuses on environmental data (e.g. carbon, water, and forests) and on data disclosure and benchmarking.
    (Formally Carbon Disclosure Project) Audience: All stakeholders
    Dow Jones Sustainability Indices (DJSI) Heavy on corporate governance and company performance. Equal balance of economic, environmental, and social.
    Audience: All stakeholders
    Global Reporting Initiative (GRI) International standards organization that has a set of standards to help organizations understand and communicate their impacts on climate change and social responsibility. The standard has a strong emphasis on transparency and materiality, especially on social issues.
    Audience: All stakeholders
    International Sustainability Standards Board (ISSB) Standard-setting board that sits within the International Financial Reporting Standards (IFRS) Foundation. The IFRS Foundation is a not-for-profit, public-interest organization established to develop high-quality, understandable, enforceable, and globally accepted accounting and sustainability disclosure standards.
    Audience: Investor-focused
    United Nations Sustainable Development Goals (UNSDG) Global partnership across sectors and industries to achieve sustainable development for all (17 Global Goals)
    Audience: All stakeholders
    Sustainability Accounting Standards Board (SASB) Industry-specific standards to help corporations select topics that may impact their financial performance. Focus on material impacts on financial condition or operating performance.
    Audience: Investor-focused
    Task Force Of Climate-related Disclosures (TCFD; created by the Financial Stability Board) Standards framework focused on the impact of climate risk on financial and operating performance. More broadly the disclosures inform investors of positive and negative measures taken to build climate resilience and make transparent the exposure to climate-related risk.
    Audience: Investors, financial stakeholders

    Bibliography

    Anne-Titia Bove and Steven Swartz, McKinsey, "Starting at the source: Sustainability in supply chains", 11 November 2016

    Accenture, "The Greater Wealth Transfer – Capitalizing on the intergenerational shift in wealth", 2012

    Beth Kaplan, Deloitte, "Preparing for the ESG Landscape, Readiness and reporting ESG strategies through controllership playbook", 15 February 2022

    Bjorn Nilsson et al, McKinsey & Company, "Financial institutions and nonfinancial risk: How corporates build resilience," 28 February 2022

    Bolden, Kyle, Ernst and Young, "Aligning nonfinancial reporting with your ESG strategy to communicate long-term value", 18 Dec. 2020

    Canadian Securities Administrators, "Canadian securities regulators seek comment on climate-related disclosure requirements", 18 October 2021

    Carol A. Adams et al., Global Risk Institute, "The double-materiality concept, Application and issues", May 2021

    Dunstan Allison-Hope et al, BSR, "Impact-Based Materiality, Why Companies Should-Focus Their Assessments on Impacts Rather than Perception", 3 February 2022

    EcoVadis, "The World's Most Trusted Business Sustainability Ratings",

    Ernst and Young, "Four opportunities for enhancing ESG oversight", 29 June 2021

    Federal Ministry of Labour and Social Affairs, The Act on Corporate Due Diligence Obligations in Supply Chains (Gesetz über die unternehmerischen Sorgfaltspflichten in Lieferketten)", Published into Federal Law Gazette, 22, July 2021

    "What Every Company Needs to Know", Sustainalytics

    Global Risk Institute, The GRI Perspective, "The materiality madness: why definitions matter", 22 February 2022

    John P Angkaw "Applying ERM to ESG Risk Management", 1 August 2022

    Hillary Flynn et al., Wellington Management, "A guide to ESG materiality assessments", June 2022

    Katie Kummer and Kyle Lawless, Ernst and Young, "Five priorities to build trust in ESG", 14 July 2022

    Knut Alicke et al., McKinsey & Company, "Taking the pulse of shifting supply chains", 26 August 2022

    Kosmas Papadopoulos and Rodolfo Arauj. The Harvard School Forum on Corporate Governance, "The Seven Sins of ESG Management", 23 September 2020

    KPMG, Sustainable Insight, "The essentials of materiality assessment", 2014

    Lorraine Waters, The Stack, "ESG is not an environmental issue, it's a data one", 20 May 2021

    Marcel Meyer, Deloitte, "What is TCFD and why does it matter? Understanding the various layers and implications of the recommendations",

    Michael W Peregnne et al., "The Harvard Law School Forum on Corporate Governance, The Important Legacy of the Sarbanes Oxley Act," 30 August 2022

    Michael Posner, Forbes, "Business and Human Rights: Looking Ahead To The Challenges Of 2022", 15 December 2021

    Myles Corson and Tony Kilmas, Ernst and Young, "How the CFO can balance competing demands and drive future growth", 3 November 2020

    Novisto, "Navigating Climate Data Disclosure", 2022

    Novisto, "XBRL is coming to corporate sustainability reporting", 17 April 2022

    "Official Journal of the European Union, Regulation (EU) 2019/2088 of the European Parliament and of the Council of 27 November 2019 on sustainability-related disclosures in the financial services sector", 9 December 2019

    Osler, "ESG and the future of sustainability", Podcast, 01 June 2022

    Osler, "The Rapidly Evolving World of ESG Disclosure: ISSB draft standards for sustainability and climate related disclosures", 19 May 2022

    Sarwar Choudhury and Zach Johnston, Ernst and Young "Preparing for Sox-Like ESG Regulation", 7 June 2022

    Securities and Exchange Commission, "The Enhancement and Standardization of Climate-related Disclosures for Investors", 12 May 2022

    "Securities and Exchange Commission, SEC Proposes Rules on Cybersecurity, Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies, 9 May 2022

    Sean Brown and Robin Nuttall, McKinsey & Company, "The role of ESG and purpose", 4 January 2022

    Statement by Chair Gary Gensler, "Statement on ESG Disclosure Proposal", 25 May 2022

    Svetlana Zenkin and Peter Hennig, Forbes, "Managing Supply Chain Risk, Reap ESG Rewards", 22 June 2022

    Task Force on Climate Related Financial Disclosures, "Final Report, Recommendations of the Task Force on Climate-related Financial Disclosures", June 2017

    World Economic Forum, "Why sustainable governance and corporate integrity are crucial for ESG", 29 July 2022

    World Economic Forum (in collaboration with PwC) "How to Set Up Effective Climate Governance on Corporate Boards, Guiding Principles and questions", January 2019

    World Economic Forum, "Defining the "G" in ESG Governance Factors at the Heart of Sustainable Business", June 2022

    World Economic Forum, "The Risk and Role of the Chief Integrity Officer: Leadership Imperatives in and ESG-Driven World", December 2021

    World Economic Forum, "How to Set Up Effective Climate Governance on Corporate Boards Guiding principles and questions", January 2019

    Zurich Insurance, "ESG and the new mandate for corporate governance", 2022

    Develop a COVID-19 Pandemic Response Plan

    • Buy Link or Shortcode: {j2store}420|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: DR and Business Continuity
    • Parent Category Link: /business-continuity
    • IT departments are being asked to rapidly ramp up work-from-home capabilities and other business process workarounds.
    • Crisis managers are experiencing a pandemic more severe than what they’ve managed in the past.
    • Organizations are scrambling to determine how they can keep their businesses running through this pandemic.

    Our Advice

    Critical Insight

    • Obstacles to working from home go beyond internet speed and needing a laptop. Business input is critical to uncover unexpected obstacles.
    • IT needs to address a range of issues from security risk to increased service desk demand from users who don’t normally work from home.
    • Resist the temptation to bypass IT processes – your future-self will thank you for tracking all those assets about to go out the door.

    Impact and Result

    • Start with crisis management fundamentals – identify crisis management roles and exercise appropriate crisis communication.
    • Prioritize business processes and work-from-home requirements. Not everyone can be set up on day one.
    • Don’t over-complicate your work-from-home deployment plan. A simple spreadsheet (see the Work-from-Home Requirements Tool) to track requirements can be very effective.

    Develop a COVID-19 Pandemic Response Plan Research & Tools

    Start here

    Stay up to date on COVID-19 and the resources available to you.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    • Develop a COVID-19 Pandemic Response Plan Storyboard

    1. Manage the pandemic crisis

    Identify key roles and immediate steps to manage this crisis.

    • Pandemic Response Plan Example

    2. Create IT’s plan to support the pandemic response plan

    Plan the deployment of a work-from-home initiative.

    • Work-From-Home Requirements Tool
    [infographic]

    Initiate Digital Accessibility for IT

    • Buy Link or Shortcode: {j2store}520|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Lead
    • Parent Category Link: /lead
    • Determining IT requirements (legal and business needs) is overwhelming.
    • Prioritizing people in the process is often overlooked.
    • Mandating changes instead of motivating change isn’t sustainable.

    Our Advice

    Critical Insight

    • Compliance is the minimum; the people and behavior changes are the harder part and have the largest impact on accessibility. Preparing for and building awareness of the reasons for accessibility makes the necessary behavior changes easier. Communicate, communicate, and communicate some more.
    • Accessibility is a practice, not a project. Therefore, accessibility is an organizational initiative, however, IT support is critical. Use change management theory to guide the new behaviors, processes, and thinking to adopt accessibility beyond compliance. Determining where to start is challenging, the tendency is to start with tech or compliance, however, starting with the people is key. It must be culture.
    • Think about accessibility like you think about IT security. Use IT security concepts that you and your team are already familiar with to initiate the accessibility program.

    Impact and Result

    • Take away the overwhelm that many feel when they hear ‘accessibility’ and make the steps for your organization approachable.
    • Clearly communicate why accessibility is critical and how it supports the organization’s key objectives and initiatives.
    • Understand your current state related to accessibility and identify areas for key initiatives to become part of the IT strategic roadmap.
    • Build your accessibility plan while prioritizing the necessary culture change
    • Use change management and communication practices to elicit the behavior shift needed to sustain accessibility.

    Initiate Digital Accessibility for IT Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Initiate Digital Accessibility for IT – Use this blueprint to narrow down the requirements for your organization and team while also clearly communicating why accessibility is critical and how it supports the organization’s key objectives and initiatives.

    A step-by-step approach to walk you through understanding the IT accessibility compliance requirements, building your roadmap, and communicating with your department. This storyboard will help you figure out what’s needed from IT to support the business and launch accessibility with your team.

    • Initiate Digital Accessibility for IT – Phases 1-2

    2. IT Manager Meeting Template – A clear, concise, and compelling communication to introduce accessibility for your organization to IT managers and to facilitate their participation in building the roadmap.

    Accessibility compliance can be overwhelming at first. Use this template to simplify the requirements for the IT managers and build out a roadmap.

    • IT Manager Meeting Template

    3. Accessibility Compliance Tracking Tool – This tool helps to decrease the overwhelm of accessibility compliance. Narrow down the list of controls needed to the ones that apply to your organization and to IT.

    Using the EN 301 549 V3.2.1 (2021-03) as a basis for digital accessibility conformance. Use this tool to build a priorities list of requirements that are applicable to your organization.

    • Accessibility Compliance Tracking Tool

    4. Departmental Meeting Template – Cascade your communication down to the IT department with this facilitation guide for introducing accessibility and the roadmap to the entire IT team.

    Use this pre-built slide deck to customize your accessibility communication to the IT department. It will help you build a shared vision for accessibility, a current state picture, and plans to build to the target future state.

    • Departmental Meeting Template
    • Accessibility Quick Cards

    Infographic

    Further reading

    Initiate Digital Accessibility For IT

    Make accessibility accessible.

    EXECUTIVE BRIEF

    Analyst Perspective

    Accessibility is a practice, not a project.

    Accessibility is an organizational directive; however, IT plays a fundamental role in its success. As business partners require support and expertise to assist with their accessibility requirements IT needs to be ready to respond. Even if your organization hasn't fully committed to an accessibility standard, you can proactively get ready by planting the seeds to change the culture. By building understanding and awareness of the significant impact technology has on accessibility, you can start to change behaviors.

    Implementing an accessibility program requires many considerations: legal requirements; international guidelines, such as Web Content Accessibility Guidelines (WCAG); training for staff; ongoing improvement; and collaborating with accessibility experts and people with disabilities. It can be overwhelming to know where to start. The tendency is to start with compliance, which is a fantastic first step. For a sustained program use, change management practices are needed to change behaviors and build inclusion for people with disabilities.

    15% of the world's population identify as having some form of a disability (not including others that are impacted, e.g. caretakers, family). Why would anyone want to alienate over 1.1 billion people?

    This is a picture of Heather Leier-Murray

    Heather Leier-Murray
    Senior Research Analyst, People & Leadership
    Info-Tech Research Group

    Disability is part of being human

    Merriam-Webster defines disability as a "physical, mental, cognitive, or developmental condition that impairs, interferes with, or limits a person's ability to engage in certain tasks or actions or participate in typical daily activities and interactions."(1)

    The World Health Organization points out that a crucial part of the definition of disability is that it's not just a health problem, but the environment impacts the experience and extent of disability. Inaccessibility creates barriers for full participation in society.(2)

    The likelihood of you experiencing a disability at some point in your life is very high, whether a physical or mental disability, seen or unseen, temporary or permanent, severe or mild.(2)

    Many people acquire disabilities as they age yet may not identify as "a person with a disability."3 Where life expectancies are over 70 years of age, 11.5% of life is spent living with a disability. (4)

    "Extreme personalization is becoming the primary difference in business success, and everyone wants to be a stakeholder in a company that provides processes, products, and services to employees and customers with equitable, person-centered experiences and allows for full participation where no one is left out."
    – Paudie Healy, CEO, Universal Access

    (1.) Merriam-Webster
    (2.) World Health Organization, 2022
    (3.) Digital Leaders, as cited in WAI, 2018
    (4.) Disabled World, as cited in WAI, 2018

    Executive Summary

    Your Challenge

    You know the push for accessibility is coming in your organization. You might even have a program started or approval to build one. But you're not sure if you and your team are ready to support and enable the organization on its accessibility journey.

    Common Obstacles

    Understanding where to start, where accessibility lives, and if or when you're done can be overwhelmingly difficult. Accessibility is an organizational initiative that IT enables; being able to support the organization requires a level of understanding of common obstacles.

    • Determining IT requirements (legal and business needs) is overwhelming.
    • Prioritizing people in the process is often overlooked.
    • Mandating changes instead of motivating change isn't sustainable.

    Info-Tech's Approach

    Prepare your people for accessibility and inclusion, even if your organization doesn't have a formal standard yet. Take your accessibility from mandate to movement, i.e. from Phase 1 - focused on compliance to Phase 2 - driven by experience for sustained change.

    • Use this blueprint to build your accessibility plan while prioritizing the necessary culture change.
    • Use change management and communication practices to elicit the behavior shift needed to sustain accessibility.

    Info-Tech Insight

    Accessibility is a practice, not a project. Therefore, accessibility is an organizational initiative; however, IT support is critical. Use change management theory to guide the new behaviors, processes, and thinking to adopt accessibility beyond compliance. Determining where to start is challenging because the tendency is to start with tech or compliance; however, starting with the people is key. It must be a change in organizational culture.

    Your challenge

    This research is designed to help IT leaders who are looking to:

    • Determine accessibility requirements of IT based on the business' needs and priorities, and the existing standards and regulations.
    • Prepare the IT leaders to implement and sustain accessibility and prepare for the behavior shift that is necessary.
    • Build the plan for IT as it pertains to accessibility, including a list of business needs and priorities, and prioritization of accessibility initiatives that IT is responsible for.
    • Ensure that accessibility is sustained in the IT department by following phase 2 of this blueprint on using change management and communication to impact behavior and change the culture.

    90% of companies claim to prioritize diversity.
    Source: Harvard Business Review, 2020

    Over 30% of those that claim to prioritize diversity are focused on compliance.
    Source: Harvard Business Review, 2022

    Accessibility is an organizational initiative

    Is IT ready and capable to enable it?

    • With increasing rates of lawsuits related to digital accessibility, more organizations are prioritizing initiatives to support increased accessibility. About 68% of Applause's survey respondents indicated that digital accessibility is a higher priority for their organization than it was last year.
    • This increase in priority will trickle into IT's tasks – get ahead and start working toward accessibility proactively so you're ready when business requests start coming in.

    A survey of nearly 1,800 respondents conducted by Applause found that:

    • 79% of respondents rated digital accessibility either a top priority or important for their organizations.
    • 42% of respondents indicated they have limited or no in-house expertise or resources to test accessibility.
      Source: Business Wire, May 2022

    How organizations prioritize digital accessibility

    • 43% rated accessibility as a top priority.
    • 36% rated accessibility as important.
    • Fewer than 5% rated accessibility as either low priority or not even on the radar.
    • More than 65% agreed or strongly agreed that accessibility is a higher priority than last year.

    Source: Angel Business Communications, 2022

    Why organizations address accessibility

    Top three reasons:

    1. 61% To comply with laws
    2. 62% To provide the best user experience
    3. 78% To include people with disabilities
      Source: Level Access, 2022

    Still, most businesses aren't meeting compliance standards. Even though legislation has been in place for over 30 years, a 2022 study by WebAIM of 1,000,000 homepages returned a 96.8% WCAG 2.0 failure rate.

    Source: Institute for Disability Research, Policy, and Practice, 2022

    Info-Tech's approach to Initiate Digital Accessibility

    An image of the Business Case for Accessibility

    The Info-Tech difference:

    1. Phase 1 of this blueprint gets you started and helps you build a plan to get you to the initial compliance driven maturity level. It's focused more on standards and regulations than on the user and employee experience.
    2. Phase 2 takes you further in maturity and helps you become experience driven in your efforts. It focuses on building your accessibility maturity into the developing, defined, and managed levels, as well as balancing mandate and movement of the accessibility maturity continuum.

    Determining conformance seems overwhelming

    Unfortunately, it's the easier part.

    • Focus on local regulations and what corporate leaders are setting as accessibility standards for the organization. This will narrow down the scope of what compliance looks like for your team.
    • Look to best practices like WCAG guidelines to ensure digital assets are accessible and usable for all users. WCAG's international guideline outlines principles that can also aid in scoping.
    • In phase 1 of this blueprint, use the Accessibility Compliance Tracking Toolto prioritize criteria and legislation for which IT is responsible.
    • Engage with business partners and other areas of the organization to figure out what is needed from IT. Accessibility is an organizational initiative; it shouldn't be on IT to figure it all out. Determine what your team is specifically responsible for before tackling it all.

    Motivating behavior change

    This is the hard part.

    Changing behaviors and mindsets is necessary to be experience driven and sustain accessibility.

    • Compliance is the minimum when it comes to accessibility, much like employment or labor regulations.
    • Making accessibility an organizational imperative is an iterative process. Managing the change is hard. People, culture, and behavior change matures accessibility from compliance driven to experience driven, increasing the benefits of accessibility.
    • Focus accessibility initiatives on improving the experience of everyone and improving engagement (customer and employee).
    • Being people focused and experience driven enables the organization to provide the best user experience and realize the benefits of accessibility.

    A picture of Jordyn Zimmerman

    "Compliance is the minimum. And when we look at web tech, people are still arguing about their positioning on the standards that need to be enforced in order to comply, forgetting that it isn't enough to comply."
    -- Jordyn Zimmerman, M.Ed., Director of Professional Development, The Nora Project, and Appointee, President's Committee for People with Intellectual Disabilities.

    This is an image of the Info-Tech Accessibility Maturity Framework Table.

    To see more on the Info-Tech Accessibility Maturity Framework:

    The Accessibility Business Case for IT

    Think of accessibility like you think of IT security

    Use IT security concepts to build your accessibility program.

    • Risk management: identify and prioritize accessibility risks and implement controls to mitigate those risks.
    • Compliance: use an IT security-style compliance approach to ensure that the accessibility program is compliant with the many accessibility regulations and standards.
    • Defense in depth: implement multiple layers of accessibility controls to address different types of accessibility risks and issues.
    • Response and recovery: quickly and effectively respond to accessibility issues, minimizing the potential impact on the organization and its users.
    • End-user education: educate end users about accessibility best practices, such as how to use assistive technologies and how to report accessibility issues.
    • Monitor and audit: use monitoring and auditing tools to ensure that accessibility remains over time and to identify and address issues that arise.
    • Collaboration: ensure the accessibility program is effective and addresses the needs of all users by collaborating with accessibility experts and people with disabilities.

    "As an organization matures, the impact of accessibility shifts. A good company will think of security at the very beginning. The same needs to be applied to accessibility thinking. At the peak of accessibility maturity an organization will have people with disabilities involved at the outset."
    -- Cam Beaudoin, Owner, Accelerated Accessibility

    This is a picture of Cam Beaudoin

    Info-Tech's methodology for Initiate Digital Accessibility for IT

    1. Planning IT's accessibility requirements

    2. Change enablement of accessibility

    Phase Steps

    1. Determine accessibility requirements of IT
    2. Build the IT accessibility plan
    1. Build awareness
    2. Support new behaviors
    3. Continuous reinforcement

    Phase Outcomes

    List of business needs and priorities related to accessibility

    IT accessibility requirements for conformance

    Assessment of state of accessibility conformance

    Prioritization of accessibility initiatives for IT

    Remediation plan for IT related to accessibility conformance

    Accessibility commitment statement

    Team understanding of what, why, and how

    Accessibility Quick Cards

    Sustainment plan

    Insight summary

    Overarching insight

    Accessibility is a practice, not a project. Therefore, accessibility is an organizational initiative; however, IT support is critical. Use change management theory to guide the new behaviors, processes, and thinking to adopt accessibility beyond compliance. Determining where to start is challenging. The tendency is to start with tech or compliance; however, starting with the people is key. It must be a change in organizational culture.

    Insight 1

    Compliance is the minimum; people and behavior changes are the hardest part and have the largest impact on accessibility. Preparing for and building awareness of the reasons for accessibility makes the necessary behavior changes easier. Communicate, communicate, and communicate some more.

    Insight 2

    Think about accessibility like you think about IT security. Use IT security concepts that you and your team are already familiar with to initiate the accessibility program.

    Insight 3

    People are learning a new way to behave and think; this can be an unsettling period. Patience, education, communication, support, and time are keys for success of the implementation of accessibility. There is a transition period needed; people will gradually change their practices and attitudes. Celebrate small successes as they arise.

    Insight 4

    Accessibility isn't a project as there is no end. Effective planning and continuous reinforcement of "the new way of doing things" is necessary to enable accessibility as the new status quo.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.

    IT Manager Meeting Template

    IT Manager Meeting Template
    Use this meeting slide deck to work with IT managers to build out the accessibility remediation plan and commitment statement.

    Departmental Meeting Template

    Departmental Meeting Template
    Use this meeting slide deck to introduce the concept of accessibility and communicate IT goals and objectives.

    Accessibility Quick Cards

    Accessibility Quick Cards
    Using the Info-Tech IT Management and Governance Framework to identify key activities to help improve and maintain the accessibility of your organization and your core IT processes.

    Key deliverable:

    Accessibility Compliance Tracking Tool

    Accessibility Compliance Tracking Tool
    This tool will assist you in identifying remediation priorities applicable to your organization.

    Blueprint benefits

    IT Benefits

    Business Benefits

    • Know and understand your role and responsibility in accessibility implementation within the organization.
    • Provide effective support and excellent business service experience to internal stakeholders related to accessibility.
    • You will be set up to effectively support your team through the necessary behavior, process, and thinking changes.
    • Proactively prepare for accessibility requests that will be coming in.
    • Move beyond compliance to support your organization's sustainment of accessibility.
    • Don't lose out on a trillion-dollar market.
    • Don't miss opportunities to work with organizations because you're not accessible.
    • Enable and empower current employees with disabilities.
    • Minimize potential for negative brand reputation due to a lack of consideration for people with disabilities.
    • Decrease the risk of legal action being brought upon the organization.

    Measure the value of this blueprint

    Improve IT effectiveness and employee buy-in to change.

    Measuring the effectiveness of your program helps contribute to a culture of continuous improvement. Having consistent measures in place helps to inform decisions and enables your plan to be iterative to take advantage of emerging opportunities.

    Monitor employee engagement, overall stakeholder satisfaction with IT, and the overall end-customer satisfaction.

    Remember, accessibility is not a project – just because measures are positive does not mean your work is done.

    In phase 1 of this blueprint, we will help you establish metrics for your organization.
    In phase 2, we will help you develop a sustainment for achieving those metrics.

    A screenshot of the slide titled Establish Baseline Metrics.

    Suggested Metrics
    • Overall end-customer satisfaction
    • Requests for accommodation or assistive technology fulfilled
    • Employee engagement
    • Overall compliance status

    Info-Tech's IT Metrics Library

    Executive brief case study

    INDUSTRY: Technology


    SOURCE: Microsoft.com
    https://blogs.microsoft.com/accessibility/accessib...

    Microsoft

    Microsoft's accessibility journey starts with the goal of building a culture of accessibility and disability inclusion. They recognize that the starting point for the magnitude of organizational change is People.

    "Accessibility in Action Badge"

    Every employee at Microsoft is trained on accessibility to build understanding of why and how to be inclusive using accessibility. The program entails 90 minutes of virtual content.

    Microsoft treats accessibility and inclusion like a business, managing and measuring it to ensure sustained growth and success. They have worked over the years to bust systemic bias company-wide and to build a program with accessibility criteria that works for their business.

    Results

    The program Microsoft has built allows them to shift the accessibility lens earlier in their processes and listen to its users' needs. This allows them to continuously mature their accessibility program, which means continuously improving its users' experience.

    Info-Tech offers various levels of support to best suit your needs

    DIY Toolkit

    “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

    Guided Implementation

    “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

    Workshop

    “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

    Consulting

    “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

    Diagnostics and consistent frameworks used throughout all four options

    Guided implementation

    What does a typical guided implementation (GI) on this topic look like?

    Phase 1 Phase 2

    Call #1: Discuss motivation for the initiative and foundational knowledge requirements.
    Call #2: Discuss stakeholder analysis and business needs of IT.

    Call #3: Identify current maturity and IT accountabilities.
    Call #4: Discuss introduction to senior IT leaders and drivers.
    Call #5: Discuss manager meeting outline and slides.

    Call #6: Review key messages and next steps to prepare for departmental meeting.
    Call #7: Discuss post-meetings next steps and timelines.

    Call #8: Review sustainment plan and plan next steps.

    A GI is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

    A typical GI is eight to ten calls over the course of four to six months.

    Workshop overview

    Contact your account representative for more information.
    workshops@infotech.com 1-888-670-8889

    Pre-Work

    Day 1

    Day 2

    Day 3

    Day 4

    Day 5

    Understand Your Legislative Environment

    Understand Your Current State

    Define the
    IT Target State

    Build the IT Accessibility Plan

    Prepare for Change Enablement

    Next Steps and
    Wrap-Up

    Activities

    0.1 Make a list of the legislation you need to comply with
    0.2 Seek legal counsel or and/or professional services' input on compliance
    0.3 Complete the Accessibility Maturity Assessment
    0.4 Conduct stakeholder analysis

    1.1 Define the risks of inaction
    1.2 Review maturity assessment
    1.3 Conduct stakeholder focus group

    2.1 Define IT compliance accountabilities
    2.2 Define IT accessibility goals/objectives/ metrics
    2.3 Indicate the target-state maturity

    3.1 Assess current accessibility compliance and mitigation
    3.2 Decide on priorities
    3.3 Write an IT accessibility commitment statement

    4.1 Prepare the roadmap
    4.2 Prepare the communication plan

    5.1 Complete in-progress deliverables from previous four days
    5.2 Set up review time for workshop deliverables and to discuss next steps

    Deliverables

    1. Legislative requirements for your organization
    2. List of stakeholders
    3. Completed maturity assessment.
    1. Defined risks of inaction
    2. Stakeholder analysis completed with business needs identified
    1. IT accessibility goals/objectives
    2. Target maturity
    1. Accessibility Compliance Tracking Tool completed
    2. Accessibility commitment statement
    3. Current compliance and mitigation assessed
    1. IT accessibility roadmap
    2. Communication plan
    1. IT accessibility roadmap
    2. Communication plan

    Phase 1

    Planning IT's Accessibility Requirements.

    Phase 1

    Phase 2

    1.1 Determine accessibility requirements of IT

    1.2 Build IT accessibility plan

    2.1 Build awareness

    2.2 Support new behaviors

    2.3 Continuous reinforcement

    Initiate Digital Accessibility For IT

    This phase will walk you through the following activities:

    • Analyzing stakeholders to determine accessibility needs of business for IT.
    • Determining accessibility compliance requirements of IT.
    • Build a manager communication deck.
    • Assess current accessibility compliance and mitigation.
    • Prioritize and assign timelines.
    • Build a sunrise diagram to visualize your accessibility roadmap.
    • Write an IT accessibility commitment statement.

    This phase involves the following participants:

    • CIO
    • IT leadership team
    • Business partners in other areas of the organization (e.g., HR, finance, communications)

    Step 1.1

    Determine the accessibility requirements of IT.

    Activities

    1.1.1 Determine what the business needs from IT
    1.1.2 Complete the Accessibility Maturity Assessment (optional)
    1.1.3 Determine IT compliance requirements
    1.1.4 Define target state
    1.1.5 Create a list of goals and objectives
    1.1.6 Finalize key metrics
    1.1.7 Prepare a meeting for IT managers

    Prepare to support the organization with accessibility

    This step involves the following participants:

    • CIO
    • IT senior leaders
    • IT managers
    • Business partners in other areas of the organization (e.g., HR, finance, communications)

    Outcomes of this step

    • Stakeholder analysis with business needs listed
    • Defined target future state
    • List of goals and objectives
    • Key metrics
    • Communication deck for IT management rollout meeting

    While defining future state, consider your drivers

    The Info-Tech Accessibility Maturity Framework identifies three key strategic drivers: compliance, experience, and incorporation.

    • Over 30% of organizations are focused on compliance, according to a 2022 survey by Harvard Business Review and Slack's Future Forum. The survey asked more than 10,000 workers in six countries about their organizations' approach to diversity, equity, and inclusion (DEI).(2)
    • Even though 90% of companies claim to prioritize diversity, over 30% are focused on compliance.(1)

    1. Harvard Business Review, 2020
    2. Harvard Business Review, 2022

    31.6% of companies remain in the compliant stage where they are focused on DEI compliance and not on integrating DEI throughout the organization or on creating continual improvement, from Harvard Business Review 2022.

    Info-Tech accessibility maturity framework

    This is an image of Info-Tech's accessibility maturity framework

    Info-Tech Insight

    IT typically works through maturity frameworks from the bottom to the top, progressing at each level until they reach the end. When it comes to IT accessibility initiatives, being especially thorough, thoughtful, and collaborative is critical to success. This will mean spending more time in the Developing, Defined, and Managed levels of maturity rather than trying to reach Optimized as quickly as you can. This may feel contrary to what IT historically considers as a successful implementation.

    After initially ensuring your organization is compliant with regulations and standards, you will progress to building disciplined process and consistent standardized processes. Eventually you will build the ability for predictable process, and lastly, you'll optimize by continuously improving.

    Depending on the level of maturity you are trying to achieve, it could take months or even years to implement. The important thing to understand, however, is that accessibility work is never done.

    At all levels of the maturity framework, you must consider the interconnected aspects of people, process, and technology. However, as the organization progresses, the impact will shift from largely being focused on process and technology improvement to being focused on people.

    Align the benefits of program drivers to organizational goals or outcomes

    Although there will be various motivating factors, aligning the drivers of your accessibility program provides direction to the program. Connecting the advantages of program drivers to organizational goals builds the confidence of senior leaders and decision makers, increasing the continued commitment to invest in accessibility programming.

    This is an image of a table describing the maturity level; Description; Advantages, and Disadvantages for the three drivers: Compliance; Experience; and Incorporation.

    Accessibility maturity levels

    Driver Description Benefits
    Initial Compliance
    • Accessibility processes are mostly undocumented.
    • Accessibility happens mostly on a reactive or ad hoc basis.
    • No one is aware of who is responsible for accessibility or what role they play.
    • Heavily focused on complying with regulations and standards to decrease legal risk.
    • The organization is aware of the need for accessibility.
    • Legal risk is decreased.
    Developing Experience
    • The organization is starting to take steps to increase accessibility beyond compliance.
    • Lots of opportunity for improvement.
    • Defining and refining processes.
    • Working toward building a library of assistive tools.
    • Awareness of the need for accessibility is growing.
    • Process review for accessibility increases process efficiency through avoiding rework.
    Defined Experience
    • Accessibility processes are repeatable.
    • There is a tendency to resort to old habits under stress.
    • Tools are in place to facilitate accommodation.
    • Employees know accommodations are available to them.
    • Accessibility is becoming part of daily work.
    Managed Experience
    • Defined by effective accessibility controls, processes, and metrics.
    • Mostly anticipating preferences.
    • Roles and responsibilities are defined.
    • Disability is included as part of DEI.
    • Employees understand their role in accessibility.
    • Engagement is positively impacted.
    • Attraction and retention are positively impacted.
    Optimized Incorporation
    • Not the goal for every organization.
    • Characterized by a dramatic shift in organizational culture and a feeling of belonging.
    • Ongoing continuous improvement.
    • Seamless interactions with the organization for everyone.
    • Using feedback to inform future initiatives.
    • More likely to be innovative and inclusive, reach more people positively, and meet emerging global legal requirements.
    • Better equipped for success.

    Cheat sheet: Identify stakeholders

    Ask stakeholders, "Who else should I be talking to?" to discover additional stakeholders and ensure you don't miss anyone.

    Identify stakeholders through the following questions:

    Take a 360-degree view of potential internal and external stakeholders who might be impacted by the initiative.

    • Who in areas of influence will be adversely affected by potential environmental and social impacts of what you are doing?
    • At which stage will stakeholders be most affected (e.g. procurement, implementation, operations, decommissioning)?
    • Will other stakeholders emerge as the phases are started and completed?
    • Who is sponsoring the initiative?
    • Who benefits from the initiative?
    • Who is negatively impacted by the initiative?
    • Who can make approvals?
    • Who controls resources?
    • Who has specialist skills?
    • Who implements the changes?
    • Who are the owners, governors, customers, and suppliers of impacted capabilities or functions?
    • Executives
    • Peers
    • Direct reports
    • Partners
    • Customers
    • Subcontractors
    • Suppliers
    • Contractors
    • Lobby groups
    • Regulatory agencies

    Categorize your stakeholders with a stakeholder prioritization map

    A stakeholder prioritization map help teams categorize their stakeholders by their level of influence and ownership.

    There are four areas in the map, and the stakeholders within each area should be treated differently.

    This is an image of a quadrant analysis for mediators; players; spectators; and noisemakers.
    • Players – Players have a high interest in the initiative and high influence to affect change over the initiative. Their support is critical, and a lack of support can cause significant impediment to the objectives.
    • Mediators – Mediators have a low interest but significant influence over the initiative. They can help to provide balance and objective opinions to issues that arise.
    • Noisemakers – Noisemakers have low influence but high interest. They tend to be very vocal and engaged, either positively or negatively, but have little ability to enact their wishes.
    • Spectators – Generally, spectators are apathetic and have little influence over or interest in the initiative.

    Strategize to engage stakeholders by type

    Each group of stakeholders draws attention and resources away from critical tasks.

    By properly identifying your stakeholder groups, you can develop corresponding actions to manage stakeholders in each group. This can dramatically reduce wasted effort trying to satisfy spectators and noisemakers while ensuring the needs of the mediators and players are met.

    Type Quadrant Actions
    Players High influence, high interest Actively Engage
    Keep them engaged through continuous involvement. Maintain their interest by demonstrating their value to its success.
    Mediators High influence, low interest Keep Satisfied
    They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust, and include them in important decision-making steps. In turn, they can help you influence other stakeholders.
    Noisemakers Low influence, high interest Keep InformedTry to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using mediators to help them.
    Spectators Low influence, low interest MonitorThey are followers. Keep them in the loop by providing clarity on objectives and status updates.

    1.1.1 Determine what the business needs from IT (stakeholder analysis)

    1.5 hours

    1. Consider all the potential individuals or groups of individuals who will be impacted or influence the accessibility needs of IT.
    2. List each of the stakeholders you identify. If in person, use sticky notes to define the target audiences. The individuals or group of individuals that potentially have needs from IT related to accessibility before, during, or after the initiative.
    3. As you list each stakeholder, consider how they perceive IT. This perception could impact how you choose to interact with them.
    4. For each stakeholder identified as potentially having a business need requirement for IT related to accessibility, conduct an analysis to understand their degree of influence or impact.
    5. Based on the stakeholder, the influence or impact of the business need can inform the interaction and prioritization of IT requirements.
    6. Update slide 9 of the IT Manager Meeting Template.

    Input

    • The change
    • Why the change is needed
    • Key stakeholder map from activity 2.1.1 of The Accessibility Business Case for IT (optional)

    Output

    • The degree of influence or impact each stakeholder has on accessibility needs from IT

    Materials

    • Stakeholder Management Analysis Tool (optional)

    Participants

    • CIO/ head of IT/ initiative lead
    • Business partners

    Proactively consider how accessibility could be received

    Think about the positive and negative reactions you could face about implementing accessibility.

    It's likely individuals will have an emotional reaction to change and may have different emotions at different times during the change process.
    Plan for how to leverage support and deal with resistance to change by assessing people's emotional responses:

    • What are possible questions, objections, suggestions, and concerns that might arise.
    • How will you respond to the possible questions and concerns.
    • Include proactive messaging in your communications that address possible objections.
    • Express an understanding for others point of views by re-positioning objections and suggestions as questions.

    This is an image of the 10 change chakras

    Determine your level of maturity

    Use Info-Tech's Accessibility Maturity Assessment.

    On the accessibility questionnaire, tab 2, choose the amount you agree or disagree with each statement. Answer the questions based on your knowledge of your current state organizationally.

    Once you've answered all the questions, see the results on the tab 3, Accessibility Results. You can see your overall maturity level and the maturity level for each of six dimensions that are necessary to increase the success of an accessibility program.

    Click through to tab 4, Recommendations, to see specific recommendations based on your results and proven research to progress through the maturity levels. Keep in mind that not all organizations will or should aspire to the "Optimize" maturity level.

    A series of three screenshots from the Accessibility Maturity Assessment

    Download the Accessibility Maturity Assessment

    1.1.2 Complete the Accessibility Maturity Assessment (optional)

    1. Download the Accessibility Maturity Assessment and save it with the date so that as you work on your accessibility program, you can reassess later and track your progress.
    2. Once you have saved the assessment, select the appropriate answer for each statement on tab 2, Accessibility Questions, based on your knowledge of the organization's approach.
    3. After reviewing all the accessibility statements, see your maturity level results on tab 3, Accessibility Results. Then see tab 4, Recommendations, for suggestions based on your answers.
    4. Document your accessibility maturity results on slides 12 and 13 of the IT Manager Meeting Template and slide 17 of the Departmental Meeting Template.
    5. Use the maturity assessment results in activity 1.1.3.

    Input

    • Assess your current state of accessibility by choosing all the statements that apply to your organization

    Output

    • Identified accessibility maturity level

    Materials

    • Accessibility Maturity Assessment
    • Accessibility Business Case Template

    Participants

    • Project leader/sponsor
    • IT leadership team

    1.1.3 Determine IT compliance responsibilities

    1-3 hours

    Before you start this activity, you may need to discuss with your organization's legal counsel to determine the legislation that applies to your organization.

    1. Determine which controls apply to your organization based on your knowledge of the organization goals, stakeholders, and accessibility maturity target. If you haven't determined your current and future state maturity model, use the Info-Tech resource from the Accessibility Business Case for IT(see previous two slides).
    2. Using the drop down in column J – Applies to My Org., select "Yes" or "No" for each control on each of the data entry tabs of the Accessibility Compliance Tracking Tool.
    3. For each control you have selected "Yes" for in column J, identify the control owner in column I.
    4. Update slide 10 in the IT Manager Meeting Template and slide 13 in the IT Departmental Meeting Template.

    Input

    • Local, regional, and/or global legislation and guidelines applicable to your organization
    • Organizational accessibility standard
    • Business needs list
    • Completed Accessibility Maturity Assessment (optional)

    Output

    • List of legislation and standards requirements that are narrowed based on organization need

    Materials

    • Accessibility Maturity Assessment
    • Accessibility Business Case Template

    Participants

    • CIO/ head of IT/ CAO/ initiative leader
    • Legal counsel

    Download the Accessibility Compliance Tracking Tool

    1.1.4 Conduct future-state analysis*

    Identify your target state of maturity.

      1. Provide the group with the accessibility maturity levels to review as well as the slides on the framework and drivers (slides 27-29).
      2. Ask the group to brainstorm pain points created by inaccessibility (e.g. challenges related to stakeholders, process issues).
      3. Next, discuss opportunities to be gained from improving these practices.
      4. Then, have everyone look at the accessibility maturity levels and, based on the descriptions, determine as a group the current maturity level of accessibility in your organization .
      5. Next, review the benefits listed on the accessibility maturity levels slide to those that you named in step 3 and determine which maturity level best describes your target state. Discuss as a group and agree on one desired maturity level to reach.
      6. Document your current and target states on slide 14 of the IT Manager Meeting Template.

    *Note: If you've completed the Accessibility Business Case for IT blueprint you may already have this information compiled. Refer to activities 2.1.2 and 2.1.3.

    Input

    • Accessibility maturity levels chart, framework, and drivers slides
    • Maturity level assessment results (optional)

    Output

    • Target maturity level documented

    Materials

    • Paper and pens
    • Handouts of maturity levels

    Participants

    • CIO
    • IT senior leaders

    What does a good goal look like?

    SMART is a common framework for setting effective goals. Make sure your goals satisfy these criteria to ensure you can achieve real results.

    Use the SMART framework to build effective goals.

    S

    Specific: Is the goal clear, concrete, and well defined?

    M

    Measurable: How will you know when the goal is met?

    A

    Achievable: Is the goal possible to achieve in a reasonable time?

    R

    Relevant: Does this goal align with your responsibilities and with departmental and organizational goals?

    T

    Time-based: Have you specified a time frame in which you aim to achieve the goal?

    1.1.5 Create a list of goals and objectives*

    Use the outcomes from activity 1.2.1.

    1. Using the information from activity 1.2.1, develop goals.
    2. Remember to use the SMART goal framework to build out each goal (see the previous slide for more information on SMART goals).
    3. Ensure each goal supports departmental and organizational goals to ensure it is meaningful.
    4. Document your goals and objectives on slides 6 and 9 in your IT Manager Meeting Template.

    *Note: If you've completed the Accessibility Business Case for IT blueprint you may already have this information compiled. Refer to activity 2.2.1.

    Input

    • Outcomes of activity 1.2.1
    • Organizational and departmental goals

    Output

    • Accessibility goals and objectives identified

    Materials

    • n/a

    Participants

    • CIO/ head of IT/ initiative lead
    • IT senior leaders

    Establish baseline metrics

    Baseline metrics will be improved through:

    1. Progressing through the accessibility maturity model.
    2. Addressing accessibility earlier in processes with input from people with disabilities.
    3. Motivating behavior changes and culture that supports accessibility and disability inclusion.
    4. Ensuring compliance with regulations and standards.
    5. Focusing on experience and building a disability inclusive culture.
    Metric Definition Calculation
    Overall end-customer satisfaction The percentage of end customers who are satisfied with the IT department. Number of end customers who are satisfied / Total number of end customers
    Requests for accommodation or assistive technology fulfilled The percentage of accommodation/assistive technology requests fulfilled by the IT department. Number of requests fulfilled / Total number of requests
    Employee engagement The percentage of employees who are engaged within an organization. Number of employees who are engaged / Total number of employees
    Overall compliance status The percentage of accessibility controls in place in the IT department. The number of compliance controls in place / Total number of applicable accessibility controls

    1.1.6 Finalize key metrics*

    Finalize key metrics the organization will use to measure accessibility success.

    1. Brainstorm how you will measure the success of each goal you identified in the previous activity, based on the benefits, challenges, and risks you previously identified.
    2. Write each of the metric ideas down and finalize three to five key metrics which you will track. The metrics you choose should relate to the key challenges or risks you have identified and match your desired maturity level and driver.
    3. Document your key metrics on slide 15 of your IT Manager Meeting Templateand slide 23 of the Departmental Meeting Template.

    Input

    • Accessibility challenges and benefits
    • Goals from activity 1.2.2

    Output

    • Three to five key metrics to track

    Materials

    • n/a

    Participants

    • IT leadership team
    • Project lead/sponsor

    *Note: If you've completed the Accessibility Business Case for IT blueprint you may already have this information compiled. Refer to activity 2.2.2.

    Use Info-Tech's template to communicate with IT managers

    Cascade messages down to IT managers next. This ensures they will have time to internalize the change before communicating it to others.

    Communicate with and build the accessibility plan with IT managers by customizing Info-Tech's IT Manager Meeting Template, which is designed to effectively convey your key messages. Tailor the template to suit your needs.

    It includes:

    • Project scope and objectives
    • Current state analysis
    • Compliance planning
    • Commitment statement drafting

    IT Manager Meeting Template

    Download the IT Manager Meeting Template

    Info-Tech Insight

    Preparing for and building awareness of the reasons for accessibility make the necessary behavior changes easier.

    1.1.7 Prepare a meeting for IT managers

    Now that you understand your current and desired accessibility maturity, the next step is to communicate with IT managers and begin planning your initiatives.

    Know your audience:

    1. Consider who will be included in your presentation audience.
    2. You want your presentation to be succinct and hard-hitting. Managers are under huge demands and time is tight, they will lose interest if you drag out the delivery.
    3. Contain the presentation and planning activities to no more than an afternoon. You want to ensure adequate time for questions and answers, as well as the planning activities necessary to inform the roll out to the larger IT department later.
    4. Schedule a meeting with the IT managers.

    Download the IT Manager Meeting Template

    Input

    • Activity results

    Output

    • A completed presentation to communicate your accessibility initiatives to IT managers

    Materials

    • IT Manager Meeting Template

    Participants

    • CIO/ head of IT/ initiative lead
    • IT senior leaders
    • IT managers

    Step 1.2

    Build the IT accessibility action plan.

    Activities

    1.2.1 Assess current accessibility compliance and mitigation

    1.2.2 Decide on your priorities

    1.2.3 Add priorities to the roadmap

    1.2.4 Write an IT accessibility commitment statement

    Planning IT's accessibility requirements

    This step involves the following participants:

    • CIO/ head of IT/ initiative lead
    • IT senior leaders
    • IT managers

    Outcomes of this step

    • Priority controls and mitigation list with identified control owners.
    • IT accessibility commitment statement.
    • Draft visualization of roadmap/sunrise diagram.

    Involve managers in assessing current compliance

    To know what work needs to happen you need to know what's already happening.

    Use the spreadsheet from activity 1.1.3 where you identified which controls apply to your organization.

    Have managers work in groups to identify which controls (of the applicable ones) are currently being met and which ones have an existing mitigation plan.

    Info-Tech Insight

    Based on EN 301 549 V3.2.1 (2021-03) as a basis for digital accessibility conformance. This tool is designed to assist you in building a priorities list of requirements that are applicable to your organization. EN 301 549 is currently the most robust accessibility regulation and encompasses other regulations within it. Although EN 301 549 is the European Standard, other countries are leaning on it as the standard they aspire to as well.

    This is an image of the Compliance Tracing Tool, with a green box drawn around the columns for Current Compliance, and Mitigation.

    1.2.1 Assess current accessibility compliance and mitigation

    1-3 hours

    1. Share the Accessibility Compliance Tracking Tool with the IT leaders and managers during the meeting with IT management that you scheduled in activity 1.1.7.
    2. Break into smaller groups (or if too small, continue as a single group):
      1. Divide up the controls between the small groups to work on assessing current compliance and mitigation plans.
      2. For each control that is identified as applying to your organization, identify if there currently is compliance by selecting "yes" from the drop-down. For controls where the organization is not compliant, select "no" and identify if there is a mitigation plan in place by selecting "yes" or "no" in column L.
      3. Use the comments column to add any pertinent information regarding the control.

    Input

    • List of IT compliance requirements applicable to the org. from activities 1.1.2 and 1.1.3

    Output

    • List of IT compliance requirements that have current compliance or mitigation plans

    Materials

    • Accessibility Compliance Tracking Tool

    Participants

    • CIO
    • IT senior leaders
    • IT managers

    Download the Accessibility Compliance Tracking Tool

    Involve managers in building accountability into the accessibility plan

    Building accountability into your compliance tracking will help ensure accessibility is prioritized.

    Use the spreadsheet from activity 1.3.1.

    Have managers work in the same groups to prioritize controls by assigning a quarterly timeline for compliance.

    An image of the Compliance Tracking tool, with the timeline column highlighted in green.

    1.2.2 Decide on your priorities

    1-3 hours

    1. In the same groups used in activity 1.2.1, prioritize the list of controls that have no compliance and no mitigation plan.
    2. As you work through the spreadsheet again, assign a timeline using the drop-down menu in column M for each control that applies to the organization and has no current compliance. Consider the following in your prioritization:
      1. Does the control impact customers or is it public-facing?
      2. What are the business needs related to accessibility?
      3. Does the team currently have the skills and knowledge needed to address the control?
      4. What future state accessibility maturity are you targeting?
    3. Be prepared to review with the larger group.

    Input

    • List from activity 1.2.1
    • Business needs from activity 1.1.1

    Output

    • List of IT compliance requirements with accountability timelines

    Materials

    • Accessibility Compliance Tracking Tool

    Participants

    • CIO
    • IT senior leaders
    • IT managers

    Download the Accessibility Compliance Tracking Tool

    Review your timeline

    Don't overload your team. Make sure the timelines assigned in the breakout groups make sense and are realistic.

    A screenshot of the Accessibility Compliance Dashboard.

    Download the Accessibility Compliance Tracking Tool

    Empty roadmap template

    An image of an empty Roadmap Template.

    1.2.3 Add priorities to the roadmap

    1 hour

    1. Using the information entered in the compliance tracking spreadsheet during activities 1.2.1 and 1.2.2, build a visual representation to capture your strategic initiatives over time, using themes and timelines. Consider group initiatives in four categories, technology, people, process, and other.
    2. Copy and paste the controls onto the roadmap from the Accessibility Compliance Tracking Toolto the desired time quadrant on the roadmap.
    3. Set your desired timelines by changing the Q1-Q4 blocks (set the timelines that make sense for your situation).

    Input

    • Output of activity 1.2.2
    • Roadmap template
    • Other departmental project plans and timelines

    Output

    • Visual roadmap of accessibility compliance controls

    Materials

    • n/a

    Participants

    • CIO
    • IT senior leaders
    • IT managers

    Communicate commitment

    Support people leaders in leading by example with an accessibility commitment statement.

    A commitment statement communicates why accessibility and disability inclusion are important and guides behaviors toward the ideal state. The statement will guide and align work, build accountability, and acknowledge the dedication of the leadership team to accessibility and disability inclusion. The statement will:

    • Publicly commit the team to fostering disability inclusivity.
    • Highlight related values and goals of the team or organization.
    • Set expectations.
    • Help build trust and increase feelings of belonging.
    • Connect the necessary changes (people, process, and technology related) to organization strategy.

    Take action! Writing the statement is only the first step. It takes more than words to build accessibility and make your work environment more disability inclusive.

    Info-Tech Insight

    Preparing for and building awareness of the reasons for accessibility make the necessary behavior changes easier.

    Sample accessibility commitment statements

    theScore

    "theScore strives to provide products and services in a way that respects the dignity and independence of persons with disabilities. We are committed to giving persons with disabilities the same opportunity to access our products and services and allowing them to benefit from the same services, in the same place and in a similar way as other clients. We are also committed to meeting the needs of persons with disabilities in a timely manner, and we will meet applicable legislative requirements for preventing and removing barriers."(1)

    Apple Canada

    "Apple Canada is committed to ensuring equal access and participation for people with disabilities. Apple Canada is committed to treating people with disabilities in a way that allows them to maintain their dignity and independence. Apple Canada believes in integration and is committed to meeting the needs of people with disabilities in a timely manner. Apple Canada will do so by removing and preventing barriers to accessibility and meeting accessibility requirements under the AODA and provincial and federal laws across Canada." (2)

    Google Canada

    "We are committed to meeting the accessibility needs of people with disabilities in a timely manner, and will do so by identifying, preventing and removing barriers to accessibility, and by meeting the accessibility requirements under the AODA." (3)

    Source 1: theScore
    Source 2: Apple Canada
    Source 3: Google Canada.

    1.2.4 Write an IT accessibility commitment statement

    45 minutes

    1. As a group, brainstorm the key reasons and necessity for disability inclusion and accessibility for your organization, and the drivers and behaviors required. Record the ideas brainstormed by the group.
    2. Break into smaller groups or pairs (or if too small, continue as a single group):
      • Each group uses the brainstormed ideas to draft an accessibility commitment statement.
    3. Each smaller group shares their statement with the larger group and receives feedback. Smaller groups redraft their statements based on the feedback.
    4. Post each redrafted statement and provide each person two dot stickers to place on the two statements that resonate the most with them.
    5. Using the two statements with the highest number of dot votes, write the final accessibility commitment statement.
    6. Add the commitment statement to slide 18 of the Departmental Meeting Template.

    Input

    • Business objectives
    • Risks related to accessibility
    • Target future accessibility maturity

    Output

    • IT accessibility commitment statement

    Materials

    • Whiteboard/flip charts
    • Dot stickers or other voting mechanism

    Participants

    • CIO
    • IT senior leaders
    • IT managers

    Phase 2

    Change Enablement for Accessibility.

    Phase 1

    Phase 2

    1.1 Determine accessibility requirements of IT

    1.2 Build IT accessibility plan

    2.1 Build awareness

    2.2 Support new behaviors

    2.3 Continuous reinforcement

    This phase will walk you through the following activities:

    • Clarifying key messages
    • IT department accessibility presentation
    • Establishing a frequency and timeframe for communications
    • Obtaining feedback
    • Sustainment plan

    This phase involves the following participants:

    • CIO
    • IT senior leaders
    • IT managers
    • Other key business stakeholders
    • Marketing and communications team

    Be experience driven

    Building awareness and focusing on experience helps move along the accessibility maturity framework. Shifting from mandate to movement.

    In this phase, start to move beyond compliance. Build the IT team's understanding of accessibility, disability inclusion, and their role.
    Communicate the following messages to your team:

    • The motivation behind the change.
    • The reasons for the change.
    • And encourage feedback.

    Info-Tech Accessibility Maturity Framework

    an image of the Info-Tech Accessibility Maturity Framework

    Info-Tech Insight

    Compliance is the minimum; the people and behavior changes are the harder part and have the largest impact on accessibility. Preparing for and building awareness of the reasons for accessibility make the necessary behavior changes easier. Communicate, communicate, and communicate some more.

    What is an organizational change?

    Before communicating, understand the degree of change.

    Incremental Change:

    • Changes made to improve current processes or systems (e.g. optimizing current technology).

    Transitional Change:

    • Changes that involve dismantling old systems and/or processes in favor of new ones (e.g. new product or services added).

    Transformational Change:

    • Significant change in organizational strategy or culture resulting in substantial shift in direction.

    Examples:

    • New or changed policy
    • Switching from on-premises to cloud-first infrastructure
    • Implementing ransomware risk controls
    • Implementing a Learning and Development Plan

    Examples:

    • Moving to an insourced or outsourced service desk
    • Developing a BI and analytics function
    • Integrating risk into organization risk
    • Developing a strategy (technology, architecture, security, data, service, infrastructure, application)

    Examples:

    • Organizational redesign
    • Acquisition or merger of another organization
    • Implementing a digital strategy
    • A new CEO or board taking over the organization's direction

    Consider the various impacts of the change

    Invest time at the start to develop a detailed understanding of the impact of the change. This will help to create a plan that will simplify the change and save time. Evaluate the impact from a people, process, and technology perspective.

    Leverage a design thinking principle: Empathize with the stakeholder – what will change?

    People

    Process Technology
    • Team structure
    • Reporting structure
    • Career paths
    • Job skills
    • Responsibilities
    • Company vision/mission
    • Number of FTE
    • Culture
    • Training required
    • Budget
    • Work location
    • Daily workflow
    • Working conditions
    • Work hours
    • Reward structure
    • Required number of completed tasks
    • Training required
    • Required tools
    • Required policies
    • Required systems
    • Training required

    Change depends on how well people understand it

    Help people internalize what they can do to make the organization more inclusive.

    Anticipate responses to change:

    1. Emotional reaction – different people require different styles of management to guide them through the change. Individual's may have different emotions at different times during the change process. The more easily you can identify persona characteristics, the better you can manage them.
    2. Level of impact – the higher level of change on an individual's day-to-day, the more difficult it will be to adjust to the change. The more impactful the change, the more time focused on people management.

    an image showing staff personas at different stages through the change process.

    Quickly assess the size of change by answering these questions:

    1. Will the change affect your staff's daily work?
    2. Is the change high urgency?
    3. Is there a change in reporting relationships?
    4. Is there a change in skills required for staff to be successful?
    5. Will the change modify entrenched cultural practices?
    6. Is there a change in the mission or vision of the role?

    If you answered "Yes" to two or more questions, the change is bigger than you think. Your staff will feel the impact.

    Ensure effective communication by focusing on four key elements

    1. Audience
    • Stakeholders (either groups or individuals) who will receive the communication.
  • Message
    • Information communicated to impacted stakeholders. Must be rooted in a purpose or intent.
  • Messenger
    • Person who delivers the communication to the audience. The communicator and owner are two different things.
  • Channel
    • Method or channel used to communicate to the audience.
  • Step 2.1

    Build awareness and define key messages for IT.

    This step involves the following participants:

    • IT leadership team
    • Marketing/communications (optional)

    Outcomes of this step

    • Key accessibility messages

    Determine the desired outcome of communicating within IT

    This phase is focused on communicating within IT. All communication has an overall goal. This outcome or purpose of communicating is often dependent on the type of influence the stakeholder wields within the organization as well as the type of impact the change will have on them. Consider each of the communication outcomes listed below.

    Communicating within IT

    • Obtain buy-in
    • Inform about the IT change
    • Create a training plan
    • Inform about department changes
    • Inform about organization changes
    • Inform about a crisis
    • Obtain adoption related to the change
    • Distribute key messages to change agents

    Departmental Meeting Template

    Departmental Meeting Template

    Accessibility Quick Cards

    Accessibility Quick Cards

    Establish and define key messages based on organizational objectives

    What are key messages?

    1. Key messages guide all internal communications to ensure they are consistent, unified, and straightforward.
    2. Distill key messages down from organizational objectives and use them to reinforce the organization's strategic direction. Key messages should inspire employees to act in a way that will help the organization reach its objectives.

    How to establish key messages

    Ground key messages in organizational strategy and culture. These should be the first places you look to determine the organization's key messages:

    • Refer to organizational strategy documents. What needs to be reinforced in internal communications to ensure the organization can achieve its strategy? This is a key message.
    • Look at the organization's values. How do values guide how work should be done? Do employees need to behave in a certain way or keep a certain value top of mind? This is a key message.

    The intent of key messages is to convey important information in a way that is relatable and memorable, to promote reinforcement, and ultimately, to drive action.

    Info-Tech Insight

    Empathizing with the audience is key to anticipating and addressing objections as well as identifying benefits. Customize messaging based on audience attributes such as work model (e.g. hybrid), anticipated objections, what's in it for me?, and specific expectations.

    2.1.1 Clarify the key messages

    30 minutes

    1. Brainstorm the key stakeholders and target audiences you will likely need to communicate with to sustain the accessibility initiative (depending on the size of your group, you might break into pairs or smaller groups and each work on one target audience).
    2. Based on the outcome expected from engaging the target audience in communications, define one to five key messages that should be expressed about accessibility.
    3. The key messages should highlight benefits anticipated, concerns anticipated, details about the change, plan of action, or next steps. The goal here is to ensure the target audience is included in the communication process.
    4. The key messages should be focused on how the target audience receives a consistent message, especially if different communication messengers are involved.
    5. Document the key messages on Tab 3 of the Communications Planner Tool.

    Download the Communications Planner Tool

    Input

    • The change
    • Target audience
    • Communication outcomes

    Output

    • Key messages to support a consistent approach

    Materials

    • Communications Planner Tool
    • Sticky notes
    • Whiteboard

    Participants

    • IT leadership team
    • Marketing/communications partner (optional)

    Step 2.2

    Support new behaviors.

    Activities

    2.2.1 Prepare for IT department meeting

    2.2.2 Practice delivery of your presentation

    2.2.3 Hold department meeting

    This step involves the following participants:

    • Entire IT department

    Outcomes of this step

    • IT departmental meeting slides
    • Accessibility quick cards
    • Task list of how each IT team will support the accessibility roadmap

    Key questions to answer with change communication

    To effectively communicate change, answer questions before they're asked, whenever possible. To do this, outline at each stage of the change process what's happening next for the audience, as well as answer other anticipated questions. Pair key questions with core messages.

    Examples of key questions by change stage include:

    The outline for each stage of the change process, showing what happens next.

    2.2.1 Prepare for the IT departmental meeting

    2 hours

    1. Download the IT Department Presentation Template and follow the instructions on each slide to update for your organization.
    2. Insert information on the current accessibility maturity level. If you haven't determined your current and future state maturity level, use the Info-Tech resource from The Accessibility Business Case for IT.
    3. Review the presentation with the information added.
    4. Consider what could be done to make the presentation better:
      1. Concise: Identify opportunities to remove unnecessary information.
      2. Clear: It uses only terms or language the target audience would understand.
      3. Relevant: It matters to the target audience and the problems they face.
      4. Consistent: The message could be repeated across audiences.
    5. Schedule a departmental meeting or add the presentation to an existing departmental meeting.

    Download the Departmental Presentation Template

    Input

    • Organizational accessibility risks
    • Accessibility maturity current state
    • Outputs from manager presentation
    • Key messages

    Output

    • Prepared presentation to introduce accessibility to the entire IT department

    Materials

    • Departmental Presentation Template

    Participants

    • CIO/ head of IT/ CAO/ initiative leader

    Hone presentation skills before meeting with key stakeholders

    Using voice and body

    Think about the message you are trying to convey and how your body can support that delivery. Hands, stance, frame – all have an impact on what might be conveyed.

    If you want your audience to lean in and be eager about your next point, consider using a pause or softer voice and volume.

    Be professional and confident

    State the main points of your presentation confidently. While this should be obvious, it is essential. Your audience should be able to clearly see that you believe the points you are stating.

    Present in a way that is genuine to you and your voice. Whether you have an energetic personality or calm and composed personality, the presentation should be authentic to you.

    Connect with your audience

    Look each member of the audience in the eye at least once during your presentation. Avoid looking at the ceiling, the back wall, or the floor. Your audience should feel engaged – this is essential to keeping their attention.

    Avoid reading from your slides. If there is text on a slide, paraphrase it while maintaining eye contact.

    Info-Tech Insight

    You are responsible for the response of your audience. If they aren't engaged, it is on you as the communicator.

    2.2.2 Practice delivery of your presentation and schedule department meeting

    45 minutes

    1. Take ten minutes to think about how to deliver your presentation. Where will you emphasize words, speak louder, softer, lean in, stand tall, make eye contact, etc.?
    2. Set a timer on your phone or watch. Record yourself if possible.
    3. Take a few seconds to center yourself and prepare to deliver your pitch.
    4. Practice delivery of your presentation out loud. Don't forget to use your body language and your voice to deliver.
    5. Listen to the recording. Are the ideas communicated correctly? Are you convinced?
    6. Review and repeat.

    Input

    • Presentation deck from activity 2.2.1
    • Best practices for delivering

    Output

    • An ability to deliver the presentation in a clear and concise manner that creates understanding

    Materials

    • Recorder
    • Timer

    Participants

    • CIO/ head of IT/ initiative leader

    2.2.3 Lead the IT department meeting

    1–2 hours

    1. Gather the IT department in a manner appropriate for your organization and facilitate the meeting prepared in activity 2.2.1.
    2. Within the meeting, capture all key action items and outcomes from the Quick Cards Development and Roadmap Planning.
    3. Following the meeting, review the quick cards that everyone built and share these with all IT participants.
    4. Update your sunrise diagram to include any initiatives that came up in the team meetings to support moving to experiential.

    Input

    • Presentation deck from activity 2.2.1

    Output

    • A shared understanding of accessibility at your organization and everyone's role
    • Area task list (including behavior change needs)
    • Accessibility quick cards

    Materials

    Participants

    • CIO/ head of IT/ initiative leader

    Download the Accessibility Quick Cards template

    Step 2.3

    Continuous reinforcement – keep the conversation going – sustain the change.

    Activities

    2.3.1 Establish a frequency and timeframe for communications

    2.3.2 Obtain feedback and improve

    2.3.3 Sustainment plan

    This step involves the following participants:

    • CIO/ head of IT/ initiative lead
    • IT leadership team

    Outcomes of this step

    • Assigned roles for ongoing program monitoring
    • Communication plan
    • Accessibility maturity monitoring plan
    • Program evaluation

    Communication is ongoing before, during, and after implementing a change initiative

    Just because you've rolled out the plan doesn't mean you can stop talking about it.

    An image of the five steps, with steps four and five highlighted in a green box. The five headings are: Identify and Prioritize; Prepare for initiative; Create a communication plan; Implement change; Sustain the desired outcome

    Don't forget: Cascade messages down through the organization to ensure those who need to deliver messages have time to internalize the change before communicating it to others. Include a mix of personal and organizational messages, but where possible, separate personal and organizational content into different communications.

    2.3.1 Establish a frequency and timeframe

    30 minutes

    1. For each row in Tab 3, determine how frequently that communication needs to take place and when that communication needs to be completed by.
      • Frequency: How often the communication will be delivered to the audience (e.g. one-time, monthly, as needed).
      • Timeframe: When the communication will be delivered to the audience (e.g. a planned period or a specific date).
    2. When selecting the timeframe, consider what dependencies need to take place prior to that communication. For example, IT employees should not be communicated with on anything that has not yet been approved by the CEO. Also consider when other communications might be taking place so that the message is not lost in the noise.
    3. For frequency, the only time that a communication needs to take place once is when presenting up to senior leaders of the organizations. And even then, it will sometimes require more than one conversation. Be mindful of this.

    Input

    • The change
    • Target audience
    • Communication outcome
    • Communication channel

    Output

    • Frequency and timeframe of the communication

    Materials

    • Communications Planner Tool
    • Sticky notes
    • Whiteboard

    Participants

    • Changes based on those who would be relevant to your initiative

    Download the Communications Planner Tool

    Ensure feedback mechanisms are in place

    Soliciting and acting on feedback involves employees in the decision-making process and demonstrates to them that their contributions matter.

    Make sure you have established feedback mechanisms to collect feedback on both the messages delivered and how they were delivered. Some ways to collect feedback include:

    • Evaluating intranet comments and interactions (e.g. likes, etc.) if this function is enabled.
    • Measuring comprehension and satisfaction through surveys and polls.
    • Looking for themes in the feedback and questions employees bring forward to managers during in-person briefings.

    Feedback Mechanisms:

    • CIO business vision survey
    • Engagement surveys
    • Focus groups
    • Suggestion boxes
    • Team meetings
    • Random sampling
    • Informal feedback
    • Direct feedback
    • Audience body language
    • Repeating the message back

    Gather feedback on plan and iterate

    Who

    The project team gathers feedback from:

    • As many members of impacted groups as possible, as it helps build broad buy-in for the plan.
    • All levels (e.g. frontline employees, managers, directors).

    What

    Gather feedback on:

    • How to implement tactics successfully.
    • The timing of implementation (helps inform the next slide).
    • The resources required (helps inform the next slide).
    • Potential unforeseen impacts, questions, and concerns.

    How

    • Use focus groups to gather feedback.
    • Adjust sustainment plan based on feedback.

    Use Info-Tech's Standard Focus Group Guide

    2.3.2 Obtain feedback and improve

    20 minutes

    1. Evenly distribute the number of rows in the communication plan to all those involved. Consider a metric that would help inform whether the communication outcome was achieved.
    2. For each row, identify a feedback mechanism (slide 75) that could be used to enable the collection and confirm a successful outcome.
    3. Come back as a group and validate the feedback mechanisms selected.
    4. The important aspect here is not just to measure if the desired outcome was achieved. If the desired outcome is not achieved, consider what you might do to change or enable better communication to that target audience.
    5. Every communication can be better. Feedback, whether it be tactical or strategic, will help inform methods to improve future communication activities.

    Input

    • Communication outcome
    • Target audience
    • Communication channel

    Output

    • A mechanism to measure communication feedback and adjust future communications when necessary

    Materials

    • Communications Planner Tool
    • Sticky notes
    • Whiteboard

    Participants

    • Changes based on those who would be relevant to your initiative

    Download the Communications Planner Tool

    Identify owners and assign other roles

    • Eventually there needs to be a hand off to leaders to sustain accessibility. Senior leaders continue to play the role of guide and facilitator, helping the team identify owners and transfer ownership.
    • Guide the team to work with owners to assign roles to other stakeholders. Spread responsibility across multiple people to avoid overload.

    R

    Responsible
    Carries out the work to implement the component (e.g. payroll manager).

    A

    Accountable
    Owner of the component and held accountable for its implementation (e.g. VP of finance).

    C

    Consulted
    Asked for feedback and input to modify sustainment tactics (e.g. sustainment planning team).

    I

    Informed
    Told about progress of implementation (senior leadership team, impacted staff).

    Identify required resources and secure budget

    Sustainment is critical to success of accessibility

    • This step (i.e. sustainment) often gets overlooked because leaders are focused on the implementation. It takes resources and budget to sustain a plan and change as well.
    • Resorting to the old way is more likely to occur when you don't plan to support sustainment with ongoing resources and budget that's required.

    Resources

    Identify resources required for sustainment components using metrics and input from implementation owners, subject matter experts, and frontline managers.

    For example:

    • Inventory
    • Collateral for communications
    • Technology
    • Physical space
    • People resources (FTE)

    Budget

    Estimate the budget required for resources based on past projects that used similar resources, and then estimate the time it will take until the change evolves into "business as usual" (e.g. 6 months, 12 months).

    Monitor accessibility maturity

    If you haven't already performed the Accessibility Maturity Assessment, complete it in the wake of the accessibility initiative to assess improvements and progress toward target future accessibility maturity.
    As your accessibility program starts to scale out over a range of projects, revisit the assessment on a quarterly or bi-annual basis to help focus your improvement efforts across the six accessibility categories.

    • Vendor relations
    • Products and services
    • Policy and process
    • Support and accommodation
    • Communication
    • People and culture

    Info-Tech Insight

    To drive continual improvement of your organizational accessibility and disability inclusion, continue to share progress, wins, challenges, feedback, and other accessibility related concerns with stakeholders. At the end of the day, IT's efforts to become a change leader and support organizational accessibility will come down to stakeholder perceptions based upon employee morale and benefits realized.

    Download the Accessibility Maturity Assessment

    An image of the maturity level bar graph.

    Evaluate and iterate the program on an ongoing basis

    1. Continually monitor the results of project metrics.
      • Track progress toward goals and metrics set at the beginning of the initiative to gauge the success of the program.
      • Analyze metrics at the work-unit level to highlight successes and challenges in accessibility and disability inclusion and the parameters around it for each impacted unit.
    2. Regularly gather feedback on program effectiveness using questions such as:
      • Has the desired culture been effectively communicated and leveraged, or has the culture changed?
      • Collect feedback through regular channels (e.g. manager check-ins) and set up a cadence to survey employees on the program (e.g. three months after rollout and then annually).
    3. Determine if changes to the program structure are needed.
      • Revisit the accessibility maturity framework and the compliance requirements of IT. Understand what is being experienced; it may be necessary to select a different target or adjust the parameters to mitigate the common challenges.
      • Evaluate the effectiveness of current internal processes to determine if the program would benefit from a dedicated resource.

    2.3.3 Sustain the change

    1. Identify who will own what pieces of the program going forward and assign roles to transition the initiative from implementation to the new normal.
    2. Continue to communicate with stakeholders about accessibility and disability inclusion initiatives, controls, and requirements.
    3. Identify required resources and secure any budget that will be needed to support the accessibility program. Think about employee training, consulting needs, assistive technology requirements, human resources (FTE), etc.
    4. Continue to monitor your accessibility maturity. Use the Accessibility Maturity Assessment tool to periodically evaluate progress on goals and targets. Also, use this tool to communicate progress with senior leaders and executives.
    5. Strive for continuous improvement by evaluating and iterating the program on an ongoing basis.

    Input

    • Activity outputs from this blueprint

    Output

    • Ongoing continuous improvement and progress related to accessibility
    • Demonstrable results

    Materials

    • n/a

    Participants

    • CIO/ head of IT/ initiative Lead
    • IT senior leaders
    • IT managers

    Related Info-Tech Research

    The Accessibility Business Case for IT

    • Take away the overwhelm that many feel when they hear "accessibility" and make the steps for your organization approachable.
    • Clearly communicate why accessibility is critical and how it supports the organization's key objectives and initiatives.
    • Understand your current state related to accessibility and identify areas for key initiatives to become part of the IT strategic roadmap.

    Lead Staff through Change

    • Anticipate and respond to staff questions about the change in order to keep messages consistent, organized, and clear.
    • Manage staff based on their specific concerns and change personas to get the best out of your team during the transition through change.
    • Maintain a feedback loop between staff, executives, and other departments in order to maintain the change momentum and reduce angst throughout the process.

    IT Diversity and Inclusion Tactics

    • Although inclusion is key to the success of a diversity and inclusion (D&I) strategy, the complexity of the concept makes it a daunting pursuit.
    • This is further complicated by the fact that creating inclusion is not a one-and-done exercise. Rather, it requires the ongoing commitment of employees and managers to reassess their own behaviors and to drive a cultural shift.

    Implement and Mature Your User Experience Design Practice

    • Create a practice that is focused on human outcomes; it starts and ends with the people you are designing for. This includes:
      • Establishing a practice with a common vision.
      • Enhancing the practice through four design factors.
      • Communicating a roadmap to improve your business through design.

    Works cited

    "2021 State of Digital Accessibility." Level Access, n.d. Accessed 10 Aug. 2022
    "Apple Canada Accessibility Policy & Plan." Apple Canada, 11 March 2019. .
    Casey, Caroline. "Do Your D&I Efforts Include People With Disabilities?" Harvard Business Review, 19 March 2020. Accessed 28 July 2022.
    Digitalisation World. "Organisations failing to meet digital accessibility standards." Angel Business Communications, 19 May 2022. Accessed Oct. 2022.
    "disability." Merriam-Webster.com Dictionary, Merriam-Webster, . Accessed 10 Aug. 2022.
    "Disability." World Health Organization, 2022. Accessed 10 Aug 2022.
    "Google Canada Corporation Accessibility Policy and Multi Year Plan." Google Canada, June 2020. .
    Hypercontext. "The State of High Performing Teams in Tech 2022." Hypercontext. 2022..
    Lay-Flurrie, Jenny. "Accessibility Evolution Model: Creating Clarity in your Accessibility Journey." Microsoft, 2023. <https://blogs.microsoft.com/accessibility/accessibility-evolution-model/>.
    Maguire, Jennifer. "Applause 2022 Global Accessibility Survey Reveals Organizations Prioritize Digital Accessibility but Fall Short of Conformance with WCAG 2.1 Standards." Business Wire, 19 May 2022. . Accessed 2 January 2023.
    "The Business Case for Digital Accessibility." W3C Web Accessibility Initiative (WAI), 9 Nov. 2018. Accessed 4 Aug. 2022.
    "THESCORE's Commitment to Accessibility." theScore, May 2021. .
    "The WebAIM Million." Web AIM, 31 March 2022. Accessed 28 Jul. 2022.
    Washington, Ella F. "The Five Stages of DEI Maturity." Harvard Business Review, November - December 2022. Accessed 7 Nov. 2022.
    Web AIM. "The WebAIM Million." Institute for Disability Research, Policy, and Practice, 31 March 2022. Accessed 28 Jul. 2022.

    Optimize the Current Testing Process for Enterprise Mobile Applications

    • Buy Link or Shortcode: {j2store}404|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Testing, Deployment & QA
    • Parent Category Link: /testing-deployment-and-qa
    • Your team has little or no experience in mobile testing.
    • You need to optimize current testing processes to include mobile.
    • You need to conduct an RFP for mobile testing tools.

    Our Advice

    Critical Insight

    • One-size-fits-all testing won’t work for mobile. The testing tools are fragmented.
    • Mobile offers many new test cases, so organizations can expect to spend more time testing.

    Impact and Result

    • Identify and address gaps between your current testing process and a target state that includes mobile testing.
    • Establish project value metrics to ensure business and technical requirements are met.

    Optimize the Current Testing Process for Enterprise Mobile Applications Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess the current testing state

    Determine a starting point for architecture and discuss pain points that will drive reusability.

    • Storyboard: Optimize the Current Testing Process for Enterprise Mobile Applications
    • Mobile Testing Project Charter Template
    • Visual SOP Template for Application Testing

    2. Determine the target state testing framework

    Document a preliminary list of test requirements and create vendor RFP and scoring.

    • Test Requirements Tool
    • Request for Proposal (RFP) Template

    3. Implement testing tools to support the testing SOP

    Create an implementation rollout plan.

    • Project Planning and Monitoring Tool

    Infographic

    Workshop: Optimize the Current Testing Process for Enterprise Mobile Applications

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess the Fit for Test Process Optimization

    The Purpose

    Understand mobile testing pain points.

    Evaluate current statistics and challenges around mobile testing and compare with your organization.

    Realize the benefits of mobile testing.

    Understand the differences of mobile testing.

    Assess your readiness for optimizing testing to include mobile.

    Key Benefits Achieved

    Preliminary understanding of how mobile testing is different from conventional approaches to testing apps.

    Understanding of how mobile testing can optimize your current testing process.

    Activities

    1.1 Understand the pain points experienced with mobile testing

    1.2 Evaluate current statistics and challenges of mobile testing and compare your organization

    1.3 Realize the benefits that come from mobile testing

    1.4 Understand the differences between mobile app testing and conventional app testing

    1.5 Assess your readiness for optimizing the testing process to include mobile

    Outputs

    Organizational state assessment for mobile testing

    2 Structure & Launch the Project

    The Purpose

    Identify stakeholders for testing requirements gathering.

    Create a project charter to obtain project approval.

    Present and obtain project charter sign-off.

    Key Benefits Achieved

    Well documented project charter.

    Approval to launch the project.

    Activities

    2.1 Identify stakeholders for testing requirements gathering

    2.2 Create a project charter to obtain project approval

    2.3 Present & obtain project charter sign-off

    Outputs

    Project objectives and scope

    Project roles and responsibilities

    3 Assess Current Testing State

    The Purpose

    Document your current non-mobile testing processes.

    Create a current testing visual SOP.

    Determine current testing pain points.

    Key Benefits Achieved

    Thorough understanding of current testing processes and pain points.

    Activities

    3.1 Document your current non-mobile testing processes

    3.2 Create a current state visual SOP

    3.3 Determine current testing pain points

    Outputs

    Documented current testing processes in the form of a visual SOP

    List of current testing pain points

    4 Determine Target State Testing Framework

    The Purpose

    Determine your target state for mobile testing.

    Choose vendors for the RFP process.

    Evaluate selected vendor(s) against testing requirements.

    Design mobile testing visual SOP(s).

    Key Benefits Achieved

    Prioritized list of testing requirements for mobile.

    Vendor selection for mobile testing solutions through an RFP process.

    New SOP designed to include both current testing and mobile testing processes.

    Activities

    4.1 Determine your target state for mobile testing by following Info-Tech’s framework as a starting point

    4.2 Design new SOP to include testing for mobile apps

    4.3 Translate all considered visual SOP mobile injections into requirements

    4.4 Document the preliminary list of test requirements in the RFP

    4.5 Determine which vendors to include for the RFP process

    4.6 Reach out to vendors for a request for proposal

    4.7 Objectively evaluate vendors against testing requirements

    4.8 Identify and assess the expected costs and impacts from determining your target state

    Outputs

    List of testing requirements for mobile

    Request for Proposal

    5 Implement Testing Tools to Support Your Testing SOP

    The Purpose

    Develop an implementation roadmap to integrate new testing initiatives.

    Anticipate potential roadblocks during implementation rollout.

    Operationalize mobile testing and ensure a smooth hand-off to IT operations.

    Key Benefits Achieved

    Creation of implementation project plan.

    List of approaches to mitigate potential implementation roadblocks.

    Achieving clean hand-off to IT ops team.

    Activities

    5.1 Develop a project plan to codify your current understanding of the scope of work

    5.2 Anticipate potential roadblocks during your tool’s implementation

    5.3 Operationalize your testing tools and ensure a smooth hand-off from the project team

    Outputs

    Mobile testing metrics implementation plan

    6 Conduct Your Retrospectives

    The Purpose

    Conduct regular retrospectives to consider areas for improvement.

    Adjust your processes, systems, and testing tools to improve performance and usability.

    Revisit implementation metrics to communicate project benefits.

    Leverage the lessons learned and apply them to other projects.

    Key Benefits Achieved

    Project specific metrics.

    Discovery of areas to improve.

    Activities

    6.1 Conduct regular retrospectives to consider areas for improvement

    6.2 Revisit your implementation metrics to communicate project benefits to business stakeholders

    6.3 Adjust your processes, systems, and testing tools to improve performance and usability

    6.4 Leverage the lessons learned and apply them to other IT projects

    Outputs

    Steps to improve your mobile testing

    Assess Infrastructure Readiness for Digital Transformation

    • Buy Link or Shortcode: {j2store}300|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Strategy and Organizational Design
    • Parent Category Link: /strategy-and-organizational-design

    There are many challenges for I&O when it comes to digital transformation, including:

    • Legacy infrastructure technical debt
    • Skills and talent in the IT team
    • A culture that resists change
    • Fear of job loss

    These and many more will hinder your progress, which demonstrates the need to invest in modernizing your infrastructure, investing in training and hiring talent, and cultivating a culture that supports digital transformation.

    Our Advice

    Critical Insight

    By using the framework of culture, competencies, collaboration and capabilities, organizations can create dimensions in their I&O structure in order to shift from traditional infrastructure management to becoming a strategic enabler, driving agility, innovation, and operational excellence though the effective integration of people, process, and technology.

    Impact and Result

    By driving a customer-centric approach, delivering a successful transformation can be tailored to the business goals and drive adoption and engagement. Refining your roadmap through data and analytics will drive this change. Use third-party expertise to guide your transformation and help build that vision of the future.

    Assess Infrastructure Readiness for Digital Transformation Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess Infrastructure Readiness for Digital Transformation – Unlock the full potential of your infrastructure with a digital transformation strategy and clear the barriers for success.

  • Be customer centric as opposed to being technology driven.
  • Understanding business needs and pain points is key to delivering solutions.
  • Approach infrastructure digital transformation in iterations and look at this as a journey.
    • Assess Infrastructure Readiness for Digital Transformation Storyboard
    • I&O Digital Transformation Maturity Assessment Tool

    Infographic

    Further reading

    Assess Infrastructure Readiness for Digital Transformation

    Unlock the full potential of your infrastructure with a digital transformation strategy and clear the barriers to success.

    Analyst Perspective

    It’s not just about the technology!

    Many businesses fail in their endeavors to complete a digital transformation, but the reasons are complex, and there are many ways to fail, whether it is people, process, or technology. In fact, according to many surveys, 70% of digital transformations fail, and it’s mainly down to strategy – or the lack thereof.

    A lot of organizations think of digital transformation as just an investment in technology, with no vision of what they are trying to achieve or transform. So, out of the gate, many organizations fail to undergo a meaningful transformation, change their business model, or bring about a culture of digital transformation needed to be seriously competitive in their given market.

    When it comes to I&O leaders who have been given a mandate to drive digital transformation projects, they still must align to the vision and mission of the organization; they must still train and hire staff that will be experts in their field; they must still drive process improvements and align the right technology to meet the needs of a digital transformation.

    John Donovan

    John Donovan

    Principal Research Director, I&O
    Info-Tech Research Group

    Insight summary

    Overarching insight

    Digital transformation requires I&O teams to shift from traditional infrastructure management to becoming a strategic enabler, driving agility, innovation, and operational excellence through effective integration of people, process, and technology.

    Insight 1

    Collaboration is a key component of I&O – Promote strong collaboration between I&O and other business functions. When doing a digital transformation, it is clear that this is a cross-functional effort. Business leaders and IT teams need to align their objectives, prioritize initiatives, and ensure that you are seamlessly integrating technologies with the new business functions.

    Insight 2

    Embrace agility and adaptability as core principles – As the digital landscape continues to evolve, it is paramount that I&O leaders are agile and adaptable to changing business needs, adopting new technology and implementing new innovative solutions. The culture of continuous improvement and openness to experimentation and learning will assist the I&O leaders in their journey.

    Insight 3

    Future-proof your infrastructure and operations – By anticipating emerging technologies and trends, you can proactively plan and organize your team for future needs. By investing in scalable, flexible infrastructure such as cloud services, automation, AI technologies, and continuously upskilling the IT staff, you can stay relevant and forward-looking in the digital space.

    Tactical insight

    An IT infrastructure maturity assessment is a foundational step in the journey of digital transformation. The demand will be on performance, resilience, and scalability. IT infrastructure must be able to support innovation and rapid deployment of services.

    Tactical insight

    Having a clear strategy, with leadership commitment along with hiring and training the right people, monitoring and measuring your progress, and ensuring it is a business-led journey will increase your chances of success.

    Executive Summary

    Your Challenge

    There are a lot of challenges for I&O when it comes to digital transformation, including:

    • Legacy infrastructure technical debt.
    • Skills and talent in the IT team.
    • A culture that resists change.
    • Fear of job loss.

    These and many more will hinder your progress, which demonstrates the need to invest in modernizing your infrastructure, investing in training and hiring talent, and cultivating a culture that supports digital transformation.

    Common Obstacles

    Many obstacles to digital transformation begin with non-I&O activities, including:

    • Lack of a clear vision and strategy.
    • Siloed organizational structure.
    • Lack of governance and data management.
    • Limited budget and resources.

    By addressing these obstacles, I&O will have a better chance of a successful transformation and delivering the full potential of digital technologies.

    Info-Tech's Approach

    Building a culture of innovation by developing clear goals and creating a vision will be key.

    • Be customer centric as opposed to being technology driven.
    • Understand the business needs and pain points in order to effectively deliver solutions.
    • Approach infrastructure digital transformation in iterations and look at it as a journey.

    By completing the Info-Tech digital readiness questionnaire, you will see where you are in terms of maturity and areas you need to concentrate on.

    Info-Tech Insight

    By driving a customer-centric approach, delivering a successful transformation can be tailored to the business goals and drive adoption and engagement. Refining your roadmap through data and analytics will drive this change. Use third-party expertise to guide your transformation and help build that vision of the future.

    The cost of digital transformation

    The challenges that stand in the way of your success, and what is needed to reverse the risk

    What CIOs are saying about their challenges

    26% of those CIOs surveyed cite resistance to change, with entrenched viewpoints demonstrating a real need for a cultural shift to enhance the digital transformation journey.

    Source: Prophet, 2019.

    70% of digital transformation projects fall short of their objectives – even when their leadership is aligned, often with serious consequences.

    Source: BCG, 2020.

    Having a clear strategy and commitment from leadership, hiring and training the right people, monitoring and measuring your progress, and ensuring it is a business-led journey will increase your chances of success.

    Info-Tech Insight

    Cultural change, business alignment, skills training, and setting a clear strategy with KPIs to demonstrate success are all key to being successful in your digital journey.

    Small and medium-sized enterprises

    What business owners and CEOs are saying about their digital transformation

    57% of small business owners feel they must improve their IT infrastructure to optimize their operations.

    Source: SMB Story, 2023.

    64% of CEOs believe driving digital transformation at a rapid pace is critical to attracting and retaining talent and customers.

    Source: KPMG, 2022.

    Info-Tech Insight

    An IT infrastructure maturity assessment is a foundational step in the journey of digital transformation. The demand will be on performance, resilience, and scalability. IT infrastructure must be able to support innovation and rapid deployments.

    Understand Common IT Contract Provisions to Negotiate More Effectively

    • Buy Link or Shortcode: {j2store}234|cart{/j2store}
    • member rating overall impact: 9.5/10 Overall Impact
    • member rating average dollars saved: $31,716 Average $ Saved
    • member rating average days saved: 10 Average Days Saved
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management
    • Contract reviews are tedious, and reviewers may lack the skills and experience to effectively complete the process.
    • Vendors have a repository of contract terms and conditions that are road-tested and often biased in their favor.
    • Vendors change their contracts frequently through hyperlinked documents without notifying customers, and the onus is on you to stay compliant.

    Our Advice

    Critical Insight

    • Focus on the terms and conditions, not just the price. Too often, organizations focus on the price contained within their contracts, neglecting to address core terms and conditions that can end up costing multiples of the initial price.
    • Lawyers can’t ensure you get the best business deal. Lawyers tend to look at general terms and conditions for legal risk and may not understand IT-specific components and business needs.

    Impact and Result

    • Align contract language to meet IT and business needs.
    • Communicate more effectively with Legal and the vendors.
    • Identify and reduce contractual and performance risk.
    • Understand the relationship between contract provisions.
    • Negotiate more effectively.

    Understand Common IT Contract Provisions to Negotiate More Effectively Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should employ a systematic process for reviewing contracts, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess contract terms and conditions

    Review and assess your IT contracts for vendor-biased terms and conditions, and gain tips for getting vendors to take on their fair share of risk and become more accountable.

    • Contract Review Tool
    • Contract Playbook
    [infographic]

    Workshop: Understand Common IT Contract Provisions to Negotiate More Effectively

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess Contract Terms and Conditions

    The Purpose

    Understand IT contract clauses, improve risk identification, and be more effective at negotiating contract terms.

    Key Benefits Achieved

    Increased awareness of how contract provisions relate to each other.

    Demystification of legalese and legal concepts.

    Increased ability to seek assistance from internal parties (e.g. Legal, Risk, and Procurement).

    Activities

    1.1 Review the Contract Review Tool.

    1.2 Review the Contract Playbook template.

    1.3 Review 35 contract provisions and reinforce key learnings with exercises (spread across three days)

    Outputs

    Partial completion of the template

    Exercise results and debrief

    Run Better Meetings

    • Buy Link or Shortcode: {j2store}287|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Voice & Video Management
    • Parent Category Link: /voice-video-management

    Your newly hybrid workplace will include virtual, hybrid, and physical meetings, presenting several challenges:

    • The experience for onsite and remote attendees is not equal.
    • Employees are experiencing meeting and video fatigue.
    • Meeting rooms are not optimized for hybrid meetings.
    • The fact is that many people have not successfully run hybrid meetings before.

    Our Advice

    Critical Insight

    • Successful hybrid workplace plans must include planning around hybrid meetings. Seamless hybrid meetings are the result of thoughtful planning and documented best practices.

    Impact and Result

    • Identify your current state and the root cause of unsatisfactory meetings.
    • Review and identify meetings best practices around meeting roles, delivery models, and training.
    • Improve the technology that supports meetings.
    • Use Info-Tech’s quick checklists and decision flowchart to accelerate meeting planning and cover your bases.

    Run Better Meetings Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should run better meetings, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify the current state of meetings

    Understand the problem before you try to fix it. Before you can improve meetings, you need to understand what your norms and challenges currently are.

    • Checklist: Run a Virtual or Hybrid Meeting

    2. Publish best practices for how meetings should run

    Document meeting roles, expectations, and how meetings should run. Decide what kind of meeting delivery model to use and develop a training program.

    • Meeting Challenges and Best Practices
    • Meeting Type Decision Flowchart (Visio)
    • Meeting Type Decision Flowchart (PDF)

    3. Improve meeting technology

    Always be consulting with users: early in the process to set a benchmark, during and after every meeting to address immediate concerns, and quarterly to identify trends and deeper issues.

    • Team Charter
    • Communications Guide Poster Template
    [infographic]

    Workshop: Run Better Meetings

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Current State of Meetings

    The Purpose

    Understand the current state of meetings in your organization.

    Key Benefits Achieved

    What you need to keep doing and what you need to change

    Activities

    1.1 Brainstorm meeting types.

    1.2 Document meeting norms.

    1.3 Document and categorize meeting challenges.

    Outputs

    Documented challenges with meetings

    Meeting norms

    Desired changes to meeting norms

    2 Review and Identify Best Practices

    The Purpose

    Review and implement meeting best practices.

    Key Benefits Achieved

    Defined meeting best practices for your organization

    Activities

    2.1 Document meeting roles and expectations.

    2.2 Review common meeting challenges and identify best practices.

    2.3 Document when to use a hybrid meeting, virtual meeting, or an in-person meeting.

    2.4 Develop a training program.

    Outputs

    Meeting roles and expectations

    List of meeting best practices

    Guidelines to help workers choose between a hybrid, virtual, or in-person meeting

    Training plan for meetings

    3 Improve Meeting Technology

    The Purpose

    Identify opportunities to improve meeting technology.

    Key Benefits Achieved

    A strategy for improving the underlying technologies and meeting spaces

    Activities

    3.1 Empower virtual meeting attendees.

    3.2 Optimize spaces for hybrid meetings.

    3.3 Build a team of meeting champions.

    3.4 Iterate to build and improve meeting technology.

    3.5 Guide users toward each technology.

    Outputs

    Desired improvements to meeting rooms and meeting technology

    Charter for the team of meeting champions

    Communications Guide Poster

    Do you believe in absolute efficiency?

    Weekend read. Hence I post this a bit later on Friday.
    Lately, I've been fascinated by infinity. And in infinity, some weird algebra pops up. Yet that weirdness is very much akin to what our business stakeholders want, driven by what our clients demand, and hence our KPIs drive us. Do more with less. And that is what absolute efficiency means.

    Register to read more …

    Build a Data Warehouse

    • Buy Link or Shortcode: {j2store}200|cart{/j2store}
    • member rating overall impact: 8.7/10 Overall Impact
    • member rating average dollars saved: $94,499 Average $ Saved
    • member rating average days saved: 30 Average Days Saved
    • Parent Category Name: Big Data
    • Parent Category Link: /big-data
    • Relational data warehouses, although reliable, centralized repositories for corporate data, were not built to handle the speed and volume of data and analytics today.
    • IT is under immense pressure from business units to provide technology that will yield greater agility and insight.
    • While some organizations are benefitting from modernization technologies, the majority of IT departments are unfamiliar with the technologies and have not yet defined clear use cases.

    Our Advice

    Critical Insight

    • The vast majority of your corporate data is not being properly leveraged. Modernize the data warehouse to get value from the 80% of unstructured data that goes unused.
    • Avoid rip and replace. Develop a future state that complements your existing data warehouse with emerging technologies.
    • Be flexible in your roadmap. Create an implementation roadmap that’s incremental and adapts to changing business priorities.

    Impact and Result

    • Establish both the business and IT perspectives of today’s data warehouse environment.
    • Explore the art-of-the-possible. Don’t get stuck trying to gather technical requirements from business users who don’t know what they don’t know. Use Info-Tech’s interview guide to discuss the pains of the current environment, and more importantly, where stakeholders want to be in the future.
    • Build an internal knowledgebase with respect to emerging technologies. The technology landscape is constantly shifting and often difficult for IT staff to keep track of. Use Info-Tech’s Data Warehouse Modernization Technology Education Deck to ensure that IT is able to appropriately match the right tools to the business’ use cases.
    • Create a compelling business case to secure investment and support.

    Build a Data Warehouse Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should be looking to modernize the relational data warehouse, review Info-Tech’s framework for identifying modernization opportunities, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Assess the current data warehouse environment

    Review the business’ perception and architecture of the current data warehouse environment.

    • Drive Business Innovation With a Modernized Data Warehouse Environment – Phase 1: Assess the Current Data Warehouse Environment
    • Data Warehouse Maturity Assessment Tool

    2. Define modernization drivers

    Collaborate with business users to identify the strongest motivations for data warehouse modernization.

    • Drive Business Innovation With a Modernized Data Warehouse Environment – Phase 2: Define Modernization Drivers
    • Data Warehouse Modernization Stakeholder Interview Guide
    • Data Warehouse Modernization Technology Education Deck
    • Data Warehouse Modernization Initiative Building Tool

    3. Create the modernization future state

    Combine business ideas with modernization initiatives and create a roadmap.

    • Drive Business Innovation With a Modernized Data Warehouse Environment – Phase 3: Create the Modernization Future State
    • Data Warehouse Modernization Technology Architectural Template
    • Data Warehouse Modernization Deployment Plan
    [infographic]

    Workshop: Build a Data Warehouse

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Assess the Current Data Warehouse Environment

    The Purpose

    Discuss the general project overview for data warehouse modernization.

    Establish the business and IT perspectives of the current state.

    Key Benefits Achieved

    Holistic understanding of the current data warehouse.

    Business user engagement from the start of the project.

    Activities

    1.1 Review data warehouse project history.

    1.2 Evaluate data warehouse maturity.

    1.3 Draw architecture diagrams.

    1.4 Review supporting data management practices.

    Outputs

    Data warehouse maturity assessment

    Data architecture diagrams

    2 Explore Business Opportunities

    The Purpose

    Conduct a user workshop session to elicit the most pressing needs of business stakeholders.

    Key Benefits Achieved

    Modernization technology selection is directly informed by business drivers.

    In-depth IT understanding of the business pains and opportunities.

    Activities

    2.1 Review general trends and drivers in your industry.

    2.2 Identify primary business frustrations, opportunities, and risks.

    2.3 Identify business processes to target for modernization.

    2.4 Capture business ideas for the future state.

    Outputs

    Business ideas for modernization

    Defined strategic direction for data warehouse modernization

    3 Review the Technology Landscape

    The Purpose

    Educate IT staff on the most common technologies for data warehouse modernization.

    Key Benefits Achieved

    Improved ability for IT to match technology with business ideas.

    Activities

    3.1 Appoint Modernization Advisors.

    3.2 Hold an open education and discussion forum for modernization technologies.

    Outputs

    Modernization Advisors identified

    Modernization technology education deck

    4 Define Modernization Solutions

    The Purpose

    Consolidate business ideas into modernization initiatives.

    Key Benefits Achieved

    Refinement of the strategic direction for data warehouse modernization.

    Activities

    4.1 Match business ideas to technology solutions.

    4.2 Group similar ideas to create modernization initiatives.

    4.3 Create future-state architecture diagrams.

    Outputs

    Identified strategic direction for data warehouse modernization

    Defined modernization initiatives

    Future-state architecture for data warehouse

    5 Establish a Modernization Roadmap

    The Purpose

    Validate and build out initiatives with business users.

    Define benefits and costs to establish ROI.

    Identify enablers and barriers to modernization.

    Key Benefits Achieved

    Completion of materials for a compelling business case and roadmap.

    Activities

    5.1 Validate use cases with business users.

    5.2 Define initiative benefits.

    5.3 Identify enablers and barriers to modernization.

    5.4 Define preliminary activities for initiatives.

    5.5 Evaluate initiative costs.

    5.6 Determine overall ROI.

    Outputs

    Validated modernization initiatives

    Data warehouse modernization roadmap

    Optimize Software Pricing in a Volatile Competitive Market

    • Buy Link or Shortcode: {j2store}566|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Marketing Solutions
    • Parent Category Link: /marketing-solutions

    Your challenge:

    • Rising supplier costs and inflation are eroding margins and impacting customers' budgets.
    • There is pressure from management to make a gut-feeling decision because of time, lack of skills, and process limitations.
    • You must navigate competing pricing-related priorities among product, sales, and finance teams.
    • Product price increases fail because discovery lacks understanding of costs, price/value equation, and competitive price points.
    • Customers can react negatively, and results are seen much later (more than 12 months) after the price decision.

    Our Advice

    Critical Insight

    Product leaders will price products based on a deep understanding of the buyer price/value equation and alignment with financial and competitive pricing strategies, and make ongoing adjustments based on an ability to monitor buyer, competitor, and product cost changes.

    Impact and Result

    • Success for many SaaS product managers requires a reorganization and modernization of pricing tools, techniques, and assumptions. Leaders will develop the science of tailored price changes versus across-the-board price actions and account for inflation exposure and the customers’ willingness to pay.
    • This will build skills on how to price new products or adjust pricing for existing products. The disciplines using our pricing strategy methodology will strengthen efforts to develop repeatable pricing models and processes and build credibility with senior management.

    Optimize Software Pricing in a Volatile Competitive Market Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Optimize Software Pricing in a Volatile Competitive Market Executive Brief - A deck to build your skills on how to price new products or adjust pricing for existing products.

    This Executive Brief will build your skills on how to price new products or adjust pricing for existing products.

    • Optimize Software Pricing in a Volatile Competitive Market Executive Brief

    2. Optimize Software Pricing in a Volatile Competitive Market Storyboard – A deck that provides key steps to complete the project.

    This blueprint will build your skills on how to price new products or adjust pricing for existing products with documented key steps to complete the pricing project and use the Excel workbook and customer presentation.

    • Optimize Software Pricing in a Volatile Competitive Market – Phases 1-3

    3. Optimize Software Pricing in a Volatile Competitive Market Workbook – A tool that enables product managers to simplify the organization and collection of customer and competitor information for pricing decisions.

    These five organizational workbooks for product pricing priorities, interview tracking, sample questions, and critical competitive information will enable the price team to validate price change data through researching the three pricing schemes (competitor, customer, and cost-based).

    • Optimize Software Pricing in a Volatile Competitive Market Workbook

    4. Optimize Software Pricing in a Volatile Competitive Market Presentation Template – A template that serves as a guide to communicating the Optimize Pricing Strategy team's results for a product or product line.

    This template includes the business case to justify product repricing, contract modifications, and packaging rebuild or removal for launch. This template calls for the critical summarized results from the Optimize Software Pricing in a Volatile Competitive Market blueprint and the Optimize Software Pricing in a Volatile Competitive Market Workbook to complete.

    • Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Infographic

    Further reading

    SoftwareReviews — A Division of INFO~TECH RESEARCH GROUP

    Optimize Software Pricing in a Volatile Competitive Market

    Leading SaaS product managers align pricing strategy to company financial goals and refresh the customer price/value equation to avoid leaving revenues uncaptured.

    Table of Contents

    Section Title Section Title
    1 Executive Brief 2 Key Steps
    3 Concluding Slides

    Optimize Software Pricing in a Volatile Competitive Market

    Leading SaaS product managers align pricing strategy to company financial goals and refresh the customer price/value equation to avoid leaving revenues uncaptured.

    EXECUTIVE BRIEF

    Analyst Perspective

    Optimized Pricing Strategy

    Product managers without well-documented and repeatable pricing management processes often experience pressure from “Agile” management to make gut-feel pricing decisions, resulting in poor product revenue results. When combined with a lack of customer, competitor, and internal cost understanding, these process and timing limitations drive most product managers into suboptimal software pricing decisions. And, adding insult to injury, the poor financial results from bad pricing decisions aren’t fully measured for months, which further compounds the negative effects of poor decision making.

    A successful product pricing strategy aligns finance, marketing, product management, and sales to optimize pricing using a solid understanding of the customer perception of price/value, competitive pricing, and software production costs.

    Success for many SaaS product managers requires a reorganization and modernization of pricing tools, techniques, and data. Leaders will develop the science of tailored price changes versus across-the-board price actions and account for inflation exposure and the customers’ willingness to pay.

    This blueprint will build your skills on how to price new products or adjust pricing for existing products. The discipline you build using our pricing strategy methodology will strengthen your team’s ability to develop repeatable pricing and will build credibility with senior management and colleagues in marketing and sales.

    Photo of Joanne Morin Correia, Principal Research Director, SoftwareReviews.

    Joanne Morin Correia
    Principal Research Director
    SoftwareReviews

    Executive Summary

    Organizations struggle to build repeatable pricing processes:
    • A lack of alignment and collaboration among finance, marketing, product development, and sales.
    • A lack of understanding of customers, competitors, and market pricing.
    • Inability to stay ahead of complex and shifting software pricing models.
    • Time is wasted without a deep understanding of pricing issues and opportunities, and revenue opportunities go unrealized.
    Obstacles add friction to the pricing management process:
    • Pressure from management to make quick decisions results in a gut-driven approach to pricing.
    • A lack of pricing skills and management processes limits sound decision making.
    • Price changes fail because discovery often lacks competitive intelligence and buyer value to price point understanding. Customers’ reactions are often observed much later, after the decision is made.
    • Economic disruptions, supplier price hikes, and higher employee salaries/benefits are driving costs higher.
    Use SoftwareReviews’ approach for more successful pricing:
    • Organize for a more effective pricing project including roles & responsibilities as well as an aligned pricing approach.
    • Work with CFO/finance partner to establish target price based on margins and key factors affecting costs.
    • Perform a competitive price assessment and understand the buyer price/value equation.
    • Arrive at a target price based on the above and seek buy-in and approvals.

    SoftwareReviews Insight

    Product leaders will price products based on a deep understanding of the buyer price/value equation and alignment with financial and competitive pricing strategies, and they will make ongoing adjustments based on an ability to monitor buyers, competitors, and product cost changes.

    What is an optimized price strategy?

    “Customer discovery interviews help reduce the chance of failure by testing your hypotheses. Quality customer interviews go beyond answering product development and pricing questions.” (Pricing Strategies, Growth Ramp, March 2022)

    Most product managers just research their direct competitors when launching a new SaaS product. While this is essential, competitive pricing intel is insufficient to create a long-term optimized pricing strategy. Leaders will also understand buyer TCO.

    Your customers are constantly comparing prices and weighing the total cost of ownership as they consider your competition. Why?

    Implementing a SaaS solution creates a significant time burden as buyers spend days learning new software, making sure tools communicate with each other, configuring settings, contacting support, etc. It is not just the cost of the product or service.

    Optimized Price Strategy Is…
    • An integral part of any product plan and business strategy.
    • Essential to improving and maintaining high levels of margins and customer satisfaction.
    • Focused on delivering the product price to your customer’s business value.
    • Understanding customer price-value for your software segment.
    • Monitoring your product pricing with real-time data to ensure support for competitive strategy.
    Price Strategy Is Not…
    • Increasing or decreasing price on a gut feeling.
    • Changing price for short-term gain.
    • Being wary of asking customers pricing-related questions.
    • Haphazardly focusing entirely on profit.
    • Just covering product costs.
    • Only researching direct competitors.
    • Focusing on yourself or company satisfaction but your target customers.
    • Picking the first strategy you see.

    SoftwareReviews Insight

    An optimized pricing strategy establishes the “best” price for a product or service that maximizes profits and shareholder value while considering customer business value vs. the cost to purchase and implement – the total cost of ownership (TCO).

    Challenging environment

    Product managers are currently experiencing the following:
    • Supplier costs and inflation are rising, eroding product margins and impacting customers’ budgets.
    • Pressure from management to make a gut-feeling decision because of time, lack of skills, and process limitations.
    • Navigating competing pricing-related priorities among product, sales, and finance.
    • Product price increases that fail because discovery lacks understanding of costs, price/value equation, and competitive price points.
    • Slowing customer demand due to poorly priced offerings may not be fully measured for many months following the price decision.
    Doing nothing is NOT an option!
    Offense Double Down

    Benefit: Leverage long-term financial and market assets

    Risk: Market may not value those assets in the future
    Fight Back

    Benefit: Move quickly

    Risk: Hard to execute and easy to get pricing wrong
    Defense Retrench

    Benefit: Reduce threats from new entrants through scale and marketing

    Risk: Causes managed decline and is hard to sell to leadership
    Move Away

    Benefit: Seize opportunities for new revenue sources

    Risk: Diversification is challenging to pull off
    Existing Markets and Customers New Markets and Customers

    Pricing skills are declining

    Among product managers, limited pricing skills are big obstacles that make pricing difficult and under-optimized.

    Visual of a bar chart with descending values, each bar has written on it: 'Limited - Limits in understanding of engineering, marketing, and sales expectations or few processes for pricing and/or cost', 'Inexperienced - Inexperience in pricing project skills and corporate training', 'Lagging - Financial lag indicators (marketing ROI, revenue, profitability, COGs)', 'Lacking - Lack of relevant competitive pricing/packaging information', 'Shifting - Shift to cloud subscription-based revenue models is challenging'.

    The top three weakest product management skills have remained constant over the past five years:
    • Competitive analysis
    • Pricing
    • End of life
    Pricing is the weakest skill and has been declining the most among surveyed product professionals every year. (Adapted from 280 Group, 2022)

    Key considerations for more effective pricing decisions

    Pricing teams can improve software product profitability by:
    • Optimizing software profit with four critical elements: properly pricing your product, giving complete and accurate quotations, choosing the terms of the sale, and selecting the payment method.
    • Implementing tailored price changes (versus across-the-board price actions) to help account for inflation exposure, customer willingness to pay, and product attribute changes.
    • Accelerating ongoing pricing decision-making with a dedicated cross-functional team ready to act quickly.
    • Resetting discounting and promotion, and revisiting service-level agreements.
    Software pricing leaders will regularly assess:

    Has it been over a year since prices were updated?

    Have customers told you to raise your prices?

    Do you have the right mix of customers in each pricing plan?

    Do 40% of your customers say they would be very disappointed if your product disappeared? (Adapted from Growth Ramp, 2021)

    Case Study

    Middleware Vendor

    INDUSTRY
    Technology Middleware
    SOURCE
    SoftwareReviews Custom Pricing Strategy Project
    A large middleware vendor, who is running on Microsoft Azure, known for quality development and website tools, needed to react strategically to the March 2022 Microsoft price increase.

    Key Initiative: Optimize New Pricing Strategy

    The program’s core objective was to determine if the vendor should implement a price increase and how the product should be packaged within the new pricing model.

    For this initiative, the company interviewed buyers using three key questions: What are the core capabilities to focus on building/selling? What are the optimal features and capabilities valued by customers that should be sold together? And should they be charging more for their products?

    Results
    This middleware vendor saw buyer support for a 10% price increase to their product line and restructuring of vertical contract terms. This enabled them to retain customers over multi-year subscription contracts, and the price increase enabled them to protect margins after the Microsoft price increase.

    The Optimize New Pricing Strategy included the following components:

    Components: 'Product Feature Importance & Satisfaction', 'Correlation of Features and Value Drivers', 'Fair Cost to Value Average for Category', 'Average Discounting for Category', 'Customer Value Is an Acceptable Multiple of Price'. First four: 'Component fails into the scope of optimizing price strategy to value'; last one: 'They are optimizing their price strategy decisions'.

    New product price approach

    As a collaborative team across product management, marketing, and finance, we see leaders taking a simple yet well-researched approach when setting product pricing.

    Iterating to a final price point is best done with research into how product pricing:

    • Delivers target margins.
    • Is positioned vs. key competitors.
    • Delivers customer value at a fair price/value ratio.
    To arrive at our new product price, we suggest iterating among 3 different views:

    New Target Price:

    • Buyer Price vs. Value
    • Cost - Plus
    • Vs. Key Competitors
    We analyzed:
    • Customer price/value equation interviews
    • Impacts of Supplier cost increases
    • Competitive pricing research
    • How product pricing delivers target margins

    Who should care about optimized pricing?

    Product managers and marketers who:

    • Support the mandate for optimizing pricing and revenue generation.
    • Need a more scientific way to plan and implement new pricing processes and methods to optimize revenues and profits.
    • Want a way to better apply customer and competitive insights to product pricing.
    • Are evaluating current pricing and cost control to support a refreshed pricing strategy.

    Finance, sales, and marketing professionals who are pricing stakeholders in:

    • Finding alternatives to current pricing and packaging approaches.
    • Looking for ways to optimize price within the shifting market momentum.

    How will they benefit from this research?

    • Refine the ability to effectively target pricing to specific market demands and customer segments.
    • Strengthen product team’s reputation for reliable and repeatable price-management capabilities among senior leadership.
    • Recognize and plan for new revenue opportunities or cost increases.
    • Allow for faster, more accurate intake of customer and competitive data. 
    • Improve pricing skills for professional development and business outcomes.
    • Create new product price, packaging, or market opportunities. 
    • Reduce financial costs and mistakes associated with manual efforts and uneducated guessing.
    • Price software products that better achieve financial goals optimizing revenue, margins, or market share.
    • Enhance the product development and sales processes with real competitive and customer expectations.

    Is Your Pricing Strategy Optimized?

    With the right pricing strategy, you can invest more money into your product, service, or growth. A 1% price increase will improv revenues by:

    Three bars: 'Customer acquisition, 3.32%', 'Customer retention, 6.71%', 'Price monetization, 12.7%'.

    Price monetization will almost double the revenue increases over customer acquisition and retention. (Pricing Strategies, Growth Ramp, March 2022)

    DIAGNOSE PRICE CHALLENGES

    Prices of today's cloud-based services/products are often misaligned against competition and customers' perceived value, leaving more revenues on the table.
    • Do you struggle to price new products with confidence?
    • Do you really know your SaaS product's costs?
    • Have you lost pricing power to stronger competitors?
    • Has cost focus eclipsed customer value focus?
    If so, you are likely skipping steps and missing key outputs in your pricing strategy.

    OPTIMIZE THESE STEPS

    ALIGNMENT
    1. Assign Team Responsibilities
    2. Set Timing for Project Deliverables
    3. Clarify Financial Expectations
    4. Collect Customer Contacts
    5. Determine Competitors
    6. BEFORE RESEARCH, HAVE YOU
      Documented your executive's financial expectations? If "No," return.

    RESEARCH & VALIDATE
    1. Research Competitors
    2. Interview Customers
    3. Test Pricing vs. Financials
    4. Create Pricing Presentation
    5. BEFORE PRESENTING, HAVE YOU:
      Clarified your customer and competitive positioning to validate pricing? If "No," return.

    BUY-IN
    1. Executive Pricing Presentation
    2. Post-Mortem of Presentation
    3. Document New Processes
    4. Monitor the Pricing Changes
    5. BEFORE RESEARCH, HAVE YOU:
      Documented your executive's financial expectations? If "No," return.

    DELIVER KEY OUTPUTS

    Sponsoring executive(s) signs-offs require a well-articulated pricing plan and business case for investment that includes:
    • Competitive features and pricing financial templates
    • Customer validation of price value
    • Optimized price presentation
    • Repeatable pricing processes to monitor changes

    REAP THE REWARDS

    • Product pricing is better aligned to achieve financial goals
    • Improved pricing skills or professional development
    • Stronger team reputation for reliable price management

    Key Insights

    1. Gain a competitive edge by using market and customer information to optimize product financials, refine pricing, and speed up decisions.
    2. Product leaders will best set software product price based on a deep understanding of buyer/price value equation, alignment with financial strategy, and an ongoing ability to monitor buyer, competitor, and product costs.

    SoftwareReviews’ methodology for optimizing your pricing strategy

    Steps

    1.1 Establish the Team and Responsibilities
    1.2 Educate/Align Team on Pricing Strategy
    1.2 Document Portfolio & Target Product(s) for Pricing Updates
    1.3 Clarify Product Target Margins
    1.4 Establish Customer Price/Value
    1.5 Identify Competitive Pricing
    1.6 Establish New Price and Gain Buy-In

    Outcomes

    1. Well-organized project
    2. Clarified product pricing strategy
    3. Customer value vs. price equation
    4. Competitive price points
    5. Approvals

    Insight summary

    Modernize your price planning

    Product leaders will price products based on a deep understanding of the buyer price/value equation and alignment with financial and competitive pricing strategies, and make ongoing adjustments based on an ability to monitor buyer, competitor, and product cost changes.

    Ground pricing against financials

    Meet and align with financial stakeholders.
    • Give finance a heads-up that you want to work with them.
    • Find out the CFO’s expectations for pricing and margins.
    • Ask for a dedicated finance team member.

    Align on pricing strategy

    Lead stakeholders in SaaS product pricing decisions to optimize pricing based on four drivers:
    • Customer’s price/value
    • Competitive strategy
    • Reflective of costs
    • Alignment with financial goals

    Decrease time for approval

    Drive price decisions, with the support of the CFO, to the business value of the suggested change:
    • Reference current product pricing guidelines
    • Compare to the competition and our strategy and weigh results against our customer’s price/value
    • Compare against the equation to business value for the suggested change
    Develop the skill of pricing products

    Increase product revenues and margins by enhancing modern processes and data monetization. Shift from intuitive to information-based pricing decisions.

    Look at other options for revenue

    Adjust product design, features, packaging, and contract terms while maintaining the functionality customers find valuable to their business.

    Blueprint deliverables

    Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:
    Key deliverable:

    New Pricing Strategy Presentation Template

    Capture key findings for your price strategy with the Optimize Your Pricing in a Volatile Competitive Market Strategy Presentation Template

    Sample of the 'Acme Corp New Product Pricing' blueprint.

    Optimize Software Pricing in a Volatile Competitive Market Executive Brief

    This executive brief will build your knowledge on how to price new products or adjust pricing for existing products.

    Sample of the 'Optimize Software Pricing in a Volatile Competitive Market' blueprint.

    Optimize Software Pricing in a Volatile Competitive Market Workbook

    This workbook will help you prioritize which products require repricing, hold customer interviews, and capture competitive insights.

    Sample of the 'Optimize Software Pricing in a Volatile Competitive Market' workbook.

    Guided Implementation

    A Guided Implementation (GI) is a series of calls with a SoftwareReviews analyst to help implement our best practices in your organization.

    A typical GI is 4 to 8 calls over the course of 2 to 4 months.

    What does a typical GI on optimizing software pricing look like?

    Alignment

    Research & Reprice

    Buy-in

    Call #1: Share the pricing team vision and outline activities for the pricing strategy process. Plan next call – 1 week.

    Call #2: Outline products that require a new pricing approach and steps with finance. Plan next call – 1 week.

    Call #3: Discuss the customer interview process. Plan next call – 1 week.

    Call #4 Outline competitive analysis. Plan next call – 1 week.

    Call #5: Review customer and competitive results for initial new pricing business case with finance for alignment. Plan next call – 3 weeks.

    Call #6: Review the initial business case against financial plans across marketing, sales, and product development. Plan next call – 1 week.

    Call #7 Review the draft executive pricing presentation. Plan next call – 1 week.

    Call #8: Discuss gaps in executive presentation. Plan next call – 3 days.

    SoftwareReviews Offers Various Levels of Support to Meet Your Needs

    Included in Advisory Membership Optional add-ons

    DIY Toolkit

    Guided Implementation

    Workshop

    Consulting

    "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

    Desire a Guided Implementation?

    • A GI is where your SoftwareReviews engagement manager and executive advisor/counselor will work with SoftwareReviews research team members to craft with you a Custom Key Initiative Plan (CKIP).
    • A CKIP guides your team through each of the major steps, outlines responsibilities between members of your team and SoftwareReviews, describes expected outcomes, and captures actual value delivered.
    • A CKIP also provides you and your team with analyst/advisor/counselor feedback on project outputs, helps you communicate key principles and concepts to your team, and helps you stay on project timelines.
    • If Guided Implementation assistance is desired, contact your engagement manager.

    Workshop overview

    Contact your account representative for more information.
    workshops@infotech.com1-888-670-8889
    Day 1 Day 2 Day 3 Day 4 Day 5
    Align Team, Identify Customers, and Document Current Knowledge
    Validate Initial Insights and Identify Competitors and Market View
    Schedule and Hold Buyer Interviews
    Summarize Findings and Provide Actionable Guidance to Stakeholders
    Present, Go Forward, and Measure Impact and Results
    Activities

    1.1 Identify Team Members, roles, and responsibilities

    1.2 Establish timelines and project workflow

    1.3 Gather current product and future financial margin expectations

    1.4 Review the Optimize Software Executive Brief and Workbook Templates

    1.4 Build prioritized pricing candidates hypothesis

    2.1 Identify customer interviewee types by segment, region, etc.

    2.2 Hear from industry analysts their perspectives on the competitors, buyer expectations, and price trends

    2.3 Research competitors for pricing, contract type, and product attributes

    3.2 Review pricing and attributes survey and interview questionnaires

    3.2 Hold interviews and use interview guides (over four weeks)

    A gap of up to 4 weeks for scheduling of interviews.

    3.3 Hold review session after initial 3-4 interviews to make adjustments

    4.1 Review all draft price findings against the market view

    4.2 Review Draft Executive Presentation

    5.1 Review finalized pricing strategy plan with analyst for market view

    5.2 Review for comments on the final implementation plan

    Deliverables
    1. Documented steering committee and working team
    2. Current and initial new pricing targets for strategy
    3. Documented team knowledge
    1. Understanding of market and potential target interviewee types
    2. Objective competitive research
    1. Initial review – “Are we going in the right direction with surveys?”
    2. Validate or adjust the pricing surveys to what you hear in the market
    1. Complete findings and compare to the market
    2. Review and finish drafting the Optimize Software Pricing Strategy presentation
    1. Final impute on strategy
    2. Review of suggested next steps and implementation plan

    Our process

    Align team, perform research, and gain executive buy-in on updated price points

    1. Establish the team and responsibilities
    2. Educate/align team on pricing strategy
    3. Document portfolio & target product(s) for pricing updates
    4. Clarify product target margins
    5. Establish customer price/value
    6. Identify competitive pricing
    7. Establish new price and gain buy-in

    Optimize Software Pricing in a Volatile Competitive Market

    Our process will help you deliver the following outcomes:

    • Well-organized project
    • Clarified product pricing strategy
    • Customer value vs. price equation
    • Competitive price points
    • Approvals

    This project involves the following participants:

    • Product management
    • Program leadership
    • Product marketing
    • CFO or finance representative/partner
    • Others
    • Representative(s) from Sales

    1.0 Assign team responsibilities

    Input: Steering committee roles and responsibilities, Steering committee interest and role

    Output: List of new pricing strategy steering committee and workstream members, roles, and timelines, Updated Software Pricing Strategy presentation

    Materials: Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: CFO, sponsoring executive, Functional leads – development, product marketing, product management, marketing, sales, customer success/support

    1-2 hours
    1. The product manager/member running this pricing/repricing program should review the entire Optimize Software Pricing in a Volatile Competitive Market blueprint and each blueprint attachment.
    2. The product manager should also refer to slide 19 of the Optimize Software Pricing in a Volatile Competitive Market blueprint and decide if help via a Guided Implementation (GI) is of value. If desired, alert your SoftwareReviews engagement manager.
    1-2 hours
    1. The product manager should meet with the chief product officer/CPO and functional leaders, and set the meeting agenda to:
      1. Nominate steering committee members.
      2. Nominate work-stream leads.
      3. Establish key pricing project milestones.
      4. Schedule both the steering committee (suggest monthly) and workstream lead meetings (suggest weekly) through the duration of the project.
      5. Ask the CPO to craft, outside this meeting, his/her version of the "Message from the chief product officer.”
      6. If a Guided Implementation is selected, inform the meeting attendees that a SoftwareReviews analyst will join the next meeting to share his/her Executive Brief on Pricing Strategy.
    2. Record all above findings in the Optimize Software Pricing in a Volatile Competitive Market Presentation Template.

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    SoftwareReviews Advisory Insight:

    Pricing steering committees are needed to steer overall product, pricing, and packaging decisions. Some companies include the CEO and CFO on this committee and designate it as a permanent body that meets monthly to give go/no-go decisions to “all things product and pricing related” across all products and business units.

    2.0 Educate the team

    1 hour

    Input: Typically, a joint recognition that pricing strategies need upgrading and have not been fully documented, Steering committee and working team members

    Output: Communication of team members involved and the makeup of the steering committee and working team, Alignment of team members on a shared vision of “why a new price strategy is critical” and what key attributes define both the need and impact on business

    Materials: Optimize Your Software Strategy Executive Brief PowerPoint presentation

    Participants: Initiative manager – individual leading the new pricing strategy, CFO/sponsoring executive, Working team – typically representatives in product marketing, product management, and sales, SoftwareReviews marketing analyst (optional)

    1. Walk the team through the Optimize Software Pricing in a Volatile Competitive Market Executive Brief PowerPoint presentation.
    2. Optional – Have the SoftwareReviews Advisory (SRA) analyst walk the team through the Optimize Software Pricing in a Volatile Competitive Market Executive Brief PowerPoint presentation as part of your session. Contact your engagement manager to schedule.
    3. Walk the team through the current version of the Optimize Software Pricing in a Volatile Competitive Market Presentation Template outlining project goals, steering committee and workstream make-up and responsibilities, project timeline and key milestones, and approach to arriving at new product pricing.
    4. Set expectations among team members of their specific roles and responsibilities for this project, review the frequency of steering committee and workstream meetings to set expectations of key milestones and deliverable due dates.

    Download the Optimize Software Pricing in a Volatile Competitive Market Executive Brief

    3.0 Document portfolio and target products for pricing update

    1-3 Hours

    Input: List of entire product portfolio

    Output: Prioritized list of product candidates that should be repriced

    Materials: Optimize Software Pricing in a Volatile Competitive Market Executive Brief presentation, Optimize Software Pricing in a Volatile Competitive Market Workbook

    Participants: Initiative manager – individual leading the new pricing strategy, CFO/sponsoring executive, Working team – typically representatives in product marketing, product management, and sales

    1. Walk the team through the current version of Optimize Software Pricing in a Volatile Competitive Market workbook, tab 2: “Product Portfolio Organizer.” Modify sample attributes to match your product line where necessary.
    2. As a group, record the product attributes for your entire portfolio.
    3. Prioritize the product price optimization candidates for repricing with the understanding that it might change after meeting with finance.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    4.0 Clarify product target margins

    2-3 sessions of 1 Hour each

    Input: Finance partner/CFO knowledge of target product current and future margins, Finance partner/CFO who has information on underlying costs with details that illustrate supplier contributions

    Output: Product finance markup target percentage margins and revenues

    Materials: Finance data on the product family, Optimize Software Pricing in a Volatile Competitive Market Workbook, Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Finance partner/CFO

    1. Schedule a meeting with your finance partner/CFO to validate expectations for product margins. The goal is to understand the detail of underlying costs/margins and if the impacts of supplier costs affect the product family. The information will be placed into the Optimize Software Pricing in a Volatile Competitive Market Workbook on tab 2, Product Portfolio Organizer under the “Unit Margins” heading.
    2. Arrive at a final “Cost-Plus New Price” based on underlying costs and target margins for each of the products. Record results in the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 2, under the “Cost-Plus New Price” heading.
    3. Record product target finance markup price under “Cost-Plus” in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9, and details in Appendix, “Cost-Plus Analysis,” slide 11.
    4. Repeat this process for any other products to be repriced.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    5.0 Establish customer price to value

    1-4 weeks

    Input: Identify segments within which you require price-to-value information, Understand your persona insight gaps, Review Sample Interview Guide using the Optimize Software Pricing in a Volatile, Competitive Market Workbook, Tab 4. Interview Guide.

    Output: List of interviewees, Updated Interview Guide

    Materials: Optimize Software Pricing in a Volatile Competitive Market Workbook, Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Customer success to help identify interviewees, Customers, prospects

    1. Identify a list of customers and prospects that best represent your target persona when interviewed. Choose interviewees who will inform key differences among key segments (geographies, company size, a mix of customers and prospects, etc.) and who are decision makers and can best inform insights on price/value and competitors.
    2. Recruit interviewees and schedule 30-minute interviews.
    3. Keep track of interviewees using the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 3: “Interviewee Tracking.”
    4. Review the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 4: “Interview Guide,” and modify/update it where appropriate.
    5. Record interviewee perspectives on the “price they are willing to pay for the value received” (price/value equation) using the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 4: “Interview Guide.”
    6. Summarize findings to result in an average “customer’s value price.” Record product target ”customer’s value price” in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9 and supporting details in Appendix, “Customer Pricing Analysis,” slide 12.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    6.0 Identify competitive pricing

    1-2 weeks

    Input: Identify price candidate competitors, Your product pricing, contract type, and product attribute information to compare against, Knowledge of existing competitor information, websites, and technology research sites to guide questions

    Output: Competitive product average pricing

    Materials: Optimize Software Pricing in a Volatile Competitive Market Workbook, Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Customers, prospects

    1. Identify the top 3-5 competitors’ products that you most frequently compete against with your selected product.
    2. Perform competitive intelligence research on deals won or lost that contain competitive pricing insights by speaking with your sales force.
    3. Use the interviews with key customers to also inform competitive pricing insights. Include companies which you may have lost to a competitor in your customer interviewee list.
    4. Modify and add key competitive pricing, contract, or product attributes in the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 5: “Competitive Information.”
    5. Place your product’s information into the Optimize Software Pricing in a Volatile Competitive Market Workbook, tab 5: “Competitive Information.”
    6. Research your competitors’ summarized pricing and product attribute insights into the workbook.
    7. Record research in the Summarize research on competitors to arrive at an average “Competitors Avg. Price”. Record in ”Customer’s Value Price” in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9, and details in Appendix, “Competitor Pricing Analysis,” slide 13.

    Download the Optimize Software Pricing in a Volatile Competitive Market Workbook

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    7.0 Establish new price and gain buy-in

    2-3 hours

    Input: Findings from competitive, cost-plus, and customer price/value analysis

    Output: Approvals for price change

    Materials: Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Participants: Initiative manager, Steering committee, Working team – typically representatives in product marketing, product management, sales

    1. Using prior recorded findings of Customer’s Value Price, Competitors’ Avg. Price, and Finance Markup Price, arrive at a recommended “New Price” and record in Optimize Software Pricing in a Volatile Competitive Market Presentation Template, slide 9 and the Appendix for Project Analysis Details.
    2. Present findings to steering committee. Be prepared to show customer interviews and competitive analysis results to support your recommendation.
    3. Plan internal and external communications and discuss the timing of when to “go live” with new pricing. Discuss issues related to migration to a new price, how to handle currently low-priced customers, and how to migrate them over time to the new pricing.
    4. Identify if it makes sense to target a date to launch the new pricing in the future, so customers can be alerted in advance and therefore take advantage of “current pricing” to drive added revenues.
    5. Confer with IT to assess times required to implement within CPQ systems and with product marketing for time to change sales proposals, slide decks, and any other affected assets and systems.

    Download the Optimize Software Pricing in a Volatile Competitive Market Presentation Template

    Summary of Accomplishment

    Problem Solved

    With the help of this blueprint, you have deepened your and your company’s understanding of how to look at new pricing opportunities and what the market and the buyer will pay for your product. You are among the minority of product and marketing leaders that have thoroughly documented their new pricing strategy and processes – congratulations!

    The benefits of having led your team through the process are significant and include the following:

    • Allow for faster, more accurate intake of customer and competitive data 
    • Refine the ability to effectively target pricing to specific market demands and customer segments 
    • Understand the association between the value proposition of products and services
    • Reduce financial costs and mistakes associated with manual efforts & uneducated guessing
    • Recognize and plan for new revenue opportunities or cost increases
    • Create new market or product packaging opportunities
    And finally, by bringing your team along with you in this process, you have also led your team to become more customer-focused while pricing your products – a strategic shift that all organizations should pursue.

    If you would like additional support, contact us and we’ll make sure you get the professional expertise you need.

    Contact your account representative for more information.

    info@softwarereviews.com
    1-888-670-8889

    Bibliography

    “Chapter 4 Reasons for Project Failure.” Kissflow's Guide to Project Management. Kissflow, n.d. Web.

    Edie, Naomi. “Microsoft Is Raising SaaS Prices, and Other Vendors Will, Too.” CIO Dive, 8 December 2021. Web.

    Gruman, Galen, Alan S. Morrison, and Terril A. Retter. “Software Pricing Trends.” PricewaterhouseCoopers, 2018. Web.

    Hargrave, Marshall. “Example of Economic Exposure.” Investopedia, 12 April 2022. Web.

    Heaslip, Emily. “7 Smart Pricing Strategies to Attract Customers.” CO—, 17 November 2021. Web.

    Higgins, Sean. “How to Price a Product That Your Sales Team Can Sell.” HubSpot, 4 April 2022. Web.

    “Pricing Strategies.” Growth Ramp, March 2022. Web.

    “Product Management Skills Benchmark Report 2021.” 280 Group, 9 November 2021. Web.

    Quey, Jason. “Price Increase: How to Do a SaaS Pricing Change in 8 Steps.” Growth Ramp, 22 March 2021. Web.

    Steenburg, Thomas, and Jill Avery. “Marketing Analysis Toolkit: Pricing and Profitability Analysis.” Harvard Business School, 16 July 2010. Web.

    “2021 State of Competitive Intelligence.” Crayon and SCIO, n.d. Web.

    Valchev, Konstantin. “Cost of Goods Sold (COGS) for Software-as-a-Service (SaaS) Business.” OpenView Venture Partners, OV Blog, 20 April 2020. Web.

    “What Is Price Elasticity?” Market Business News, n.d. Web.

    z-Series Modernization and Migration

    • Buy Link or Shortcode: {j2store}114|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Strategy and Organizational Design
    • Parent Category Link: /strategy-and-organizational-design

    Under the best of circumstances, mainframe systems are complex, expensive, and difficult to scale. In today’s world, applications written for mainframe legacy systems also present significant operational challenges to customers compounded by the dwindling pool of engineers who specialize in these outdated technologies. Many organizations want to migrate their legacy applications to the cloud but to do so they need to go through a lengthy migration process that is made more challenging by the complexity of mainframe applications.

    Our Advice

    Critical Insight

    The most common tactic is for the organization to better realize their z/Series options and adopt a strategy built on complexity and workload understanding. To make the evident, obvious, the options here for the non-commodity are not as broad as with commodity server platforms and the mainframe is arguably the most widely used and complex non-commodity platform on the market.

    Impact and Result

    This research will help you:

    • Evaluate the future viability of this platform.
    • Assess the fit and purpose, and determine TCO
    • Develop strategies for overcoming potential challenges.
    • Determine the future of this platform for your organization.

    z/Series Modernization and Migration Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. z/Series Modernization and Migration Guide – A brief deck that outlines key migration options and considerations for the z/Series platform.

    This blueprint will help you assess the fit, purpose, and price; develop strategies for overcoming potential challenges; and determine the future of z/Series for your organization.

    • z/Series Modernization and Migration Storyboard

    2. Scale Up vs. Scale Out TCO Tool – A tool that provides organizations with a framework for TCO.

    Use this tool to play with the pre-populated values or insert your own amounts to compare possible database decisions, and determine the TCO of each. Note that common assumptions can often be false; for example, open-source Cassandra running on many inexpensive commodity servers can actually have a higher TCO over six years than a Cassandra environment running on a larger single expensive piece of hardware. Therefore, calculating TCO is an essential part of the database decision process.

    • Scale Up vs. Scale Out TCO Tool
    [infographic]

    Further reading

    z/Series Modernization and Migration

    The biggest migration is yet to come.

    Executive Summary

    Info-Tech Insight

    “A number of market conditions have coalesced in a way that is increasingly driving existing mainframe customers to consider running their application workloads on alternative platforms. In 2020, the World Economic Forum noted that 42% of core skills required to perform existing jobs are expected to change by 2022, and that more than 1 billion workers need to be reskilled by 2030.” – Dale Vecchio

    Your Challenge

    It seems like anytime there’s a new CIO who is not from the mainframe world there is immediate pressure to get off this platform. However, just as there is a high financial commitment required to stay on System Z, moving off is risky and potentially more costly. You need to truly understand the scale and complexity ahead of the organization.

    Common Obstacles

    Under the best of circumstances, mainframe systems are complex, expensive, and difficult to scale. In today’s world, applications written for mainframe legacy systems also present significant operational challenges to customers compounded by the dwindling pool of engineers who specialize in these outdated technologies. Many organizations want to migrate their legacy applications to the cloud, but to do so they need to go through a lengthy migration process that is made more challenging by the complexity of mainframe applications.

    Info-Tech Approach

    The most common tactic is for the organization to better realize its z/Series options and adopt a strategy built on complexity and workload understanding. To make the evident, obvious: the options here for the non-commodity are not as broad as with commodity server platforms and the mainframe is arguably the most widely used and complex non-commodity platform on the market.

    Review

    We help IT leaders make the most of their z/Series environment

    Problem statement:

    The z/Series remains a vital platform for many businesses and continues to deliver exceptional reliability and performance and play a key role in the enterprise. With the limited and aging resources at hand, CIOs and the like must continually review and understand their migration path with the same regard as any other distributed system roadmap.

    This research is designed for:

    IT strategic direction decision makers.

    IT managers responsible for an existing z/Series platform.

    Organizations evaluating platforms for mission critical applications.

    This research will help you:

    1. Evaluate the future viability of this platform.
    2. Assess the fit and purpose, and determine TCO.
    3. Develop strategies for overcoming potential challenges.
    4. Determine the future of this platform for your organization.

    Analyst Perspective

    Good Luck.

    Darin Stahl.

    Modernize the mainframe … here we go again.

    Prior to 2020, most organizations were muddling around in “year eleven of the four-year plan” to exit the mainframe platform where a medium-term commitment to the platform existed. Since 2020, it appears the appetite for the mainframe platform changed. Again. Discussions mostly seem to be about what the options are beyond hardware outsourcing or re-platforming to “cloud” migration of workloads – mostly planning and strategy topics. A word of caution: it would appear unwise to stand in front of the exit door for fear of being trampled.

    Hardware expirations between now and 2025 are motivating hosting deployments. Others are in migration activities, and some have already decommissioned and migrated but now are trying to rehab the operations team now lacking direction and/or structure.

    There is little doubt that modernization and “digital transformation” trends will drive more exit traffic, so IT leaders who are still under pressure to get off the platform need to assess their options and decide. Being in a state of perpetually planning to get off the mainframe handcuffs your ability to invest in the mainframe, address deficiencies, and improve cost-effectiveness.

    Darin Stahl
    Principal Research Advisor, Infrastructure & Operations Research
    Info-Tech Research Group

    The mainframe “fidget spinner”

    Thinking of modernizing your mainframe can cause you angst so grab a fidget spinner and relax because we have you covered!

    External Business Pressures:

    • Digital transformation
    • Modernization programs
    • Compliance and regulations
    • TCO

    Internal Considerations:

    • Reinvest
    • Migrate to a new platform
    • Evaluate public and vendor cloud alternatives
    • Hosting versus infrastructure outsourcing

    Info-Tech Insight

    With multiple control points to be addressed, care must be taken to simplify your options while addressing all concerns to ease operational load.

    The analyst call review

    “Who has Darin talked with?” – Troy Cheeseman

    Dating back to 2011, Darin Stahl has been the primary z/Series subject matter expert within the Infrastructure & Operations Research team. Below represents the percentage of calls, per industry, where z/Series advisory has been provided by Darin*:

    37% - State Government

    19% - Insurance

    11% - Municipality

    8% - Federal Government

    8% - Financial Services

    5% - Higher Education

    3% - Retail

    3% - Hospitality/Resort

    3% - Logistics and Transportation

    3% - Utility

    Based on the Info-Tech call history, there is a consistent cross section of industry members who not only rely upon the mainframe but are also considering migration options.

    Note:

    Of course, this only represents industries who are Info-Tech members and who called for advisory services about the mainframe.

    There may well be more Info-Tech members with mainframes who have no topic to discuss with us about the mainframe specifically. Why do we mention this?

    We caution against suggesting things like, ”somewhat less than 50% of mainframes live in state data centers” or any other extrapolated inference from this data.

    Our viewpoint and discussion is based on the cases and the calls that we have taken over the years.

    *37+ enterprise calls were reviewed and sampled.

    Scale out versus scale up

    For most workloads “scale out" (e.g. virtualized cloud or IaaS ) is going to provide obvious and quantifiable benefits.

    However, with some workloads (extremely large analytics or batch processing ) a "scale up" approach is more optimal. But the scale up is really limited to very specific workloads. Despite some assumptions, the gains made when moving from scale up to scale out are not linear.

    Obviously, when you scale out from a performance perspective you experience a drop in what a single unit of compute can do. Additionally, there will be latency introduced in the form of network overhead, transactions, and replication into operations that were previously done just bypassing object references within a single frame.

    Some applications or use cases will have to be architected or written differently (thinking about the high-demand analytic workloads at large scale). Remember the “grid computing” craze that hit us during the early part of this century? It was advantageous for many to distribute work across a grid of computing devices for applications but the advantage gained was contingent on the workload able to be parsed out as work units and then pulled back together through the application.

    There can be some interesting and negative consequences for analytics or batch operations in a large scale as mentioned above. Bottom line, as experienced previously with Microfocus mainframe ports to x86, the batch operations simply take much longer to complete.

    Big Data Considerations*:

    • Value: Data has no inherent value until it’s used to solve a business problem.
    • Variety: The type of data being produced is increasingly diverse and ranges from email and social media to geo-spatial and photographic data. This data may be difficult to process using a structured data model.
    • Volume: The sheer size of the datasets is growing exponentially, often ranging from terabytes to petabytes. This is complicating traditional data management strategies.
    • Velocity: The increasing speed at which data is being collected and processed is also causing complications. Big data is often time sensitive and needs to be captured in real time as it is streaming into the enterprise.

    *Build a Strategy for Big Data Platforms

    Consider your resourcing

    Below is a summary of concerns regarding core mainframe skills:

    1. System Management (System Programmers): This is the most critical and hard-to-replace skill since it requires in-depth low-level knowledge of the mainframe (e.g. at the MVS level). These are skills that are generally not taught anymore, so there is a limited pool of experienced system programmers.
    2. Information Management System (IMS) Specialists: Requires a combination of mainframe knowledge and data analysis skills, which makes this a rare skill set. This is becoming more critical as business intelligence takes on an ever-increasing focus in most organizations.
    3. Application Development: The primary concern here is a shortage of developers skilled in older languages such as COBOL. It should be noted that this is an application issue; for example, this is not solved by migrating off mainframes.
    4. Mainframe Operators: This is an easier skill set to learn, and there are several courses and training programs available. An IT person new to mainframes could learn this position in about six weeks of on-the-job training.
    5. DB2 Administration: Advances in database technology have simplified administration (not just for DB2 but also other database products). As a result, as with mainframe operators, this is a skill set that can be learned in a short period of time on the job.

    The Challenge

    An aging workforce, specialized skills, and high salary expectations

    • Mainframe specialists, such as system programmers and IMS specialists, are typically over 50, have a unique skill set, and are tasked with running mission-critical systems.

    The In-House Solution:

    Build your mentorship program to create a viable succession plan

    • Get your money’s worth out of your experienced staff by having them train others.
    • Operator skills take about six weeks to learn. However, it takes about two years before a system programmer trainee can become fully independent. This is similar to the learning curve for other platforms; however, this is a more critical issue for mainframes since organizations have far fewer mainframe specialists to fall back on when senior staff retire or move on.

    Understand your options

    Migrate to another platform

    Use a hosting provider

    Outsource

    Re-platform (cloud/vendors)

    Reinvest

    There are several challenges to overcome in a migration project, from finding an appropriate alternative platform to rewriting legacy code. Many organizations have incurred huge costs in the attempt, only to be unsuccessful in the end, so make this decision carefully.

    Organizations often have highly sensitive data on their mainframes (e.g. financial data), so many of these organizations are reluctant to have this data live outside of their four walls. However, the convenience of using a hosting provider makes this an attractive option to consider.

    The most common tactic is for the organization to adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house.

    A customer can “re-platform” the non-commodity workload into public cloud offerings or in a few offerings
    “re-host.”

    If you’re staying with the mainframe and keeping it in-house, it’s important to continue to invest in this platform, keep it current, and look for opportunities to optimize its value.

    Migrate

    Having perpetual plans to migrate handcuffs your ability to invest in your mainframe, extend its value, and improve cost effectiveness.

    If this sounds like your organization, it’s time to do the analysis so you can decide and get clarity on the future of the mainframe in your organization.

    1. Identify current performance, availability, and security requirements. Assess alternatives based on this criteria.
    2. Review and use Info-Tech’s Mainframe TCO Comparison Tool to compare mainframe costs to the potential alternative platform.
    3. Assess the business risks and benefits. Can the alternative deliver the same performance, reliability, and security? If not, what are the risks? What do you gain by migrating?
    4. If migration is still a go, evaluate the following:
    • Do you have the expertise or a reliable third party to perform the migration, including code rewrites?
    • How long will the migration take? Can the business function effectively during this transition period?
    • How much will the migration cost? Is the value you expect to gain worth the expense?

    *3 of the top 4 challenges related to shortfalls of alternative platforms

    The image contains a bar graph that demonstrates challenges related to shortfalls of alternative platforms.

    *Source: Maximize the Value of IBM Mainframes in My Business

    Hosting

    Using a hosting provider is typically more cost-effective than running your mainframe in-house.

    Potential for reduced costs

    • Hosting enables you to reduce or eliminate your mainframe staff.
    • Economies of scale enable hosting providers to reduce software licensing costs. They also have more buying power to negotiate better terms.
    • Power and cooling costs are also transferred to the hosting provider.

    Reliable infrastructure and experienced staff

    • A quality hosting provider will have 24/7 monitoring, full redundancy, and proven disaster recovery capabilities.
    • The hosting provider will also have a larger mainframe staff, so they don’t have the same risk of suddenly being without those advanced critical skills.

    So, what are the risks?

    • A transition to a hosting provider usually means eliminating or significantly reducing your in-house mainframe staff. With that loss of in-house expertise, it will be next to impossible to bring the mainframe back in-house, and you become highly dependent on your hosting provider.

    Outsourcing

    The most common tactic is for the organization to adopt some level of outsourcing for the non-commodity platform, retaining the application support/development in-house.

    The options here for the non-commodity (z/Series, IBM Power platforms, for example) are not as broad as with commodity server platforms. More confusingly, the term “outsourcing” for these can include:

    Traditional/Colocation – A customer transitions their hardware environment to a provider’s data center. The provider can then manage the hardware and “system.”

    Onsite Outsourcing – Here a provider will support the hardware/system environment at the client’s site. The provider may acquire the customer’s hardware and provide software licenses. This could also include hiring or “rebadging” staff supporting the platform. This type of arrangement is typically part of a larger services or application transformation. While low risk, it is not as cost-effective as other deployment models.

    Managed Hosting – A customer transitions their legacy application environment to an off-prem hosted multi-tenanted environment. It will provide the most cost savings following the transition, stabilization, and disposal of existing environment. Some providers will provide software licensing, and some will also support “Bring Your Own,” as permitted by IBM terms for example.

    Info-Tech Insight

    Technical debt for non-commodity platforms isn’t only hardware based. Moving an application written for the mainframe onto a “cheaper” hardware platform (or outsourced deployment) leaves the more critical problems and frequently introduces a raft of new ones.

    Re-platform – z/Series COBOL Cloud

    Re-platforming is not trivial.

    While the majority of the coded functionality (JCLs, programs, etc.) migrate easily, there will be a need to re-code or re-write objects – especially if any object, code, or location references are not exactly the same in the new environment.

    Micro Focus has solid experience in this but if consider it within the context of an 80/20 rule (the actual metrics might be much better than that), meaning that some level of rework would have to be accomplished as an overhead to the exercise.

    Build that thought into your thinking and business case.

    AWS Cloud

    • Astadia (an AWS Partner) is re-platforming mainframe workloads to AWS. With its approach you reuse the original application source code and data to AWS services. Consider reviewing Amazon’s “Migrating a Mainframe to AWS in 5 Steps.”

    Azure Cloud

    Micro Focus COBOL (Visual COBOL)

    • Micro Focus' Visual COBOL also supports running COBOL in Docker containers and managing and orchestrating the containers with Kubernetes. I personally cannot imagine what sort of drunken bender decision would lead me to move COBOL into Docker and then use Kubernetes to run in GCP but there you are...if that's your Jam you can do it.

    Re-platform – z/Series (Non-COBOL)

    But what if it's not COBOL?

    Yeah, a complication for this situation is the legacy code.

    While re-platforming/re-hosting non-COBOL code is not new, we have not had many member observations compared to the re-platforming/re-hosting of COBOL functionality initiatives.

    That being said, there are a couple of interesting opportunities to explore.

    NTT Data Services (GLOBAL)

    • Most intriguing is the re-hosting of a mainframe environment into AWS. Not sure if the AWS target supports NATURAL codebase; it does reference Adabas however (Re-Hosting Mainframe Applications to AWS with NTT DATA Services). Nevertheless, NTT has supported re-platforming and NATURAL codebase environments previously.

    ModernSystems (or ModSys) has relevant experience.

    • ModSys is the resulting entity following a merger between BluePhoenix and ATERAS a number of years ago. ATERAS is the entity I find references to within my “wayback machine” for member discussions. There are also a number of published case studies still searchable about ATERAS’ successful re-platforming engagements, including the California Public Employees Retirement System (CalPERS) most famously after the Accenture project to rewrite it failed.

    ATOS, as a hosting vendor mostly referenced by customers with global locations in a short-term transition posture, could be an option.

    Lastly, the other Managed Services vendors with NATURAL and Adabas capabilities:

    Reinvest

    By contrast, reducing the use of your mainframe makes it less cost-effective and more challenging to retain in-house expertise.

    • For organizations that have migrated applications off the mainframe (at least partly to reduce dependency on the platform), inevitably there remains a core set of mission critical applications that cannot be moved off for reasons described on the “Migrate” slide. This is when the mainframe becomes a costly burden:
      • TCO is relatively high due to low utilization.
      • In-house expertise declines as workload declines and current staffing allocations become harder to justify.
    • Organizations that are instead adding capacity and finding new ways to use this platform have lower cost concerns and resourcing challenges. The charts below illustrate this correlation. While some capacity growth is due to normal business growth, some is also due to new workloads, and it reflects an ongoing commitment to the platform.

    *92% of organizations that added capacity said TCO is lower than for commodity servers (compared to 50% of those who did not add capacity)

    *63% of organizations that added capacity said finding resources is not very difficult (compared to 42% of those who did not add capacity)

    The image contains a bar graph as described in the above text. The image contains a bar graph as described in the above text.

    *Maximize the Value of IBM Mainframes in My Business

    An important thought about data migration

    Mainframe data migrations – “VSAM, IMS, etc.”

    • While the application will be replaced and re-platformed, there is the historical VIN data remaining in the VSAM files and access via the application. The challenge is that a bulk conversion can add upfront costs and delay the re-platforming of the application functionality. Some shops will break the historical data migration into a couple of phases.
    • While there are technical solutions to accessing VSAM data stores, what I have observed with other members facing a similar scenario is a need to “shrink” the data store over time. The technical accesses to historical VSAM records would also have a lifespan, and rather than kicking the can down the road indefinitely, many have turned to a process-based solution allowing them to shrink the historical data store over time. I have observed three approaches to the handling or digitization of historical records like this:

    Temporary workaround. This would align with a technical solution allowing the VASM files to be accessed using platforms other than on mainframe hardware (Micro Focus or other file store trickery). This can be accomplished relatively quickly but does run the risk of technology obsolesce for the workaround at some point in the future.

    Bulk conversion. This method would involve the extract/transform/load of the historical records into the new application platform. Often the order of the conversion is completed on work newest to oldest (the idea is that the newest historical records would have the highest likelihood of an access need), but all files would be converted to the new application and the old data store destroyed.

    Forward convert, which would have files undergo the extract/transform/load conversion into the new application as they are accessed or reopened. This method would keep historical records indefinitely or until they are converted – or the legal retention schedule allows for their destruction (hopefully no file must be kept forever). This could be a cost-efficient approach since the historical files remaining on the VSAM platform would be shrunk over time based on demand from the district attorney process. The conversion process could be automated and scripted, with a QR step allowing for the records to be deleted from the old platform.

    Info-Tech Insight

    It is not usual for organizations to leverage options #2 and #3 above to move the functionality forward while containing the scope creep and costs for the data conversions.

    Enterprise class job scheduling

    Job scheduling or data center automation?

    • Enterprise class job scheduling solutions enable complex unattended batched programmatically conditioned task/job scheduling.
    • Data center automation (DCIM) software automates and orchestrates the processes and workflow for infrastructure operations including provisioning, configuring, patching of physical, virtual, and cloud servers, and monitoring of tasks involved in maintaining the operations of a data center or Infrastructure environment.
    • While there maybe some overlap and or confusion between data center automation and enterprise class job scheduling solutions, data center automation (DCIM) software solutions are least likely to have support for non-commodity server platforms and lack robust scheduling functionality.

    Note: Enterprise job scheduling is a topic with low member interest or demand. Since our published research is driven by members’ interest and needs, the lack of activity or member demand would obviously be a significant influence into our ability to aggregate shared member insight, trends, or best practices in our published agenda.

    Data Center Automation (DCIM) Software

    Orchestration/Provisioning Software

    Enterprise class job scheduling features

    The feature set for these tools is long and comprehensive. The feature list below is not exhaustive as specific tools may have additional product capabilities. At a minimum, the solutions offered by the vendors in the list below will have the following capabilities:

    • Automatic restart and recovery
    • File management
    • Integration with security systems such as AD
    • Operator alerts
    • Ability to control spooling devices
    • Cross-platform support
    • Cyclical scheduling
    • Deadline scheduling
    • Event-based scheduling / triggers
    • Inter-dependent jobs
    • External task monitoring (e.g. under other sub-systems)
    • Multiple calendars and time-zones
    • Scheduling of packaged applications (such as SAP, Oracle, JD Edwards)
    • The ability to schedule web applications (e.g. .net, java-based)
    • Workload analysis
    • Conditional dependencies
    • Critical process monitoring
    • Event-based automation (“self-healing” processes in response to common defined error conditions)
    • Graphical job stream/workflow visualization
    • Alerts (job failure notifications, task thresholds (too long, too quickly, missed windows, too short, etc.) via multiple channels
    • API’s supporting programmable scheduler needs
    • Virtualization support
    • Workload forecasting and workload planning
    • Logging and message data supporting auditing capabilities likely to be informed by or compliant with regulatory needs such as Sarbanes, Gramme-Leach
    • Historical reporting
    • Auditing reports and summaries

    Understand your vendors and tools

    List and compare the job scheduling features of each vendor.

    • This is not presented as an exhaustive list.
    • The list relies on observations aggregated from analyst engagements with Info-Tech Research Group members. Those member discussions tend to be heavily tilted toward solutions supporting non-commodity platforms.
    • Nothing is implied about a solution suitability or capability by the order of presentation or inclusion or absence in this list.

    ✓ Advanced Systems Concepts

    ✓ BMC

    ✓ Broadcom

    ✓ HCL

    ✓ Fortra

    ✓ Redwood

    ✓ SMA Technologies

    ✓ StoneBranch

    ✓ Tidal Software

    ✓ Vinzant Software

    Info-Tech Insight

    Creating vendor profiles will help quickly filter the solution providers that directly meet your z/Series needs.

    Advanced Systems Concepts

    ActiveBatch

    Workload Management:

    Summary

    Founded in 1981, ASCs ActiveBatch “provides a central automation hub for scheduling and monitoring so that business-critical systems, like CRM, ERP, Big Data, BI, ETL tools, work order management, project management, and consulting systems, work together seamlessly with minimal human intervention.”*

    URL

    advsyscon.com

    Coverage:

    Global

    Amazon EC2

    Hadoop Ecosystem

    IBM Cognos

    DataStage

    IBM PureData (Netezza)

    Informatica Cloud

    Microsoft Azure

    Microsoft Dynamics AX

    Microsoft SharePoint

    Microsoft Team Foundation Server

    Oracle EBS

    Oracle PeopleSoft

    SAP

    BusinessObjects

    ServiceNow

    Teradata

    VMware

    Windows

    Linux

    Unix

    IBM i

    *Advanced Systems Concepts, Inc.


    BMC

    Control-M

    Workload Management:

    Summary

    Founded in 1980, BMCs Control-M product “simplifies application and data workflow orchestration on premises or as a service. It makes it easy to build, define, schedule, manage, and monitor production workflows, ensuring visibility, reliability, and improving SLAs.”*

    URL

    bmc.com/it-solutions/control-m.html

    Coverage:

    Global

    AWS

    Azure

    Google Cloud Platform

    Cognos

    IBM InfoSphere

    DataStage

    SAP HANA

    Oracle EBS

    Oracle PeopleSoft

    BusinessObjects

    ServiceNow

    Teradata

    VMware

    Windows

    Linux

    Unix

    IBM i

    IBM z/OS

    zLinux

    *BMC

    Broadcom

    Atomic Automation

    Autosys Workload Automation

    Workload Management:

    Summary

    Broadcom offers Atomic Automation and Autosys Workload Automation which ”gives you the agility, speed and reliability required for effective digital business automation. From a single unified platform, Atomic centrally provides the orchestration and automation capabilities needed accelerate your digital transformation and support the growth of your company.”*

    URL

    broadcom.com/products/software/automation/automic-automation

    broadcom.com/products/software/automation/autosys

    Coverage:

    Global


    Windows

    MacOS

    Linux

    UNIX

    AWS

    Azure

    Google Cloud Platform

    VMware

    z/OS

    zLinux

    System i

    OpenVMS

    Banner

    Ecometry

    Hadoop

    Oracle EBS

    Oracle PeopleSoft

    SAP

    BusinessObjects

    ServiceNow

    Teradata

    VMware

    Windows

    Linux

    Unix

    IBM i

    *Broadcom

    HCL

    Workload Automation

    Workload Management:

    Summary

    “HCL Workload Automation streamlined modelling, advanced AI and open integration for observability. Accelerate the digital transformation of modern enterprises, ensuring business agility and resilience with our latest version of one stop automation platform. Orchestrate unattended and event-driven tasks for IT and business processes from legacy to cloud and kubernetes systems.”*

    URL

    hcltechsw.com/workload-automation

    Coverage:

    Global


    Windows

    MacOS

    Linux

    UNIX

    AWS

    Azure

    Google Cloud Platform

    VMware

    z/OS

    zLinux

    System i

    OpenVMS

    IBM SoftLayer

    IBM BigInsights

    IBM Cognos

    Hadoop

    Microsoft Dynamics 365

    Microsoft Dynamics AX

    Microsoft SQL Server

    Oracle E-Business Suite

    PeopleSoft

    SAP

    ServiceNow

    Apache Oozie

    Informatica PowerCenter

    IBM InfoSphere DataStage

    Salesforce

    BusinessObjects BI

    IBM Sterling Connect:Direct

    IBM WebSphere MQ

    IBM Cloudant

    Apache Spark

    *HCL Software

    Fortra

    JAMS Scheduler

    Workload Management:

    Summary

    Fortra’s “JAMS is a centralized workload automation and job scheduling solution that runs, monitors, and manages jobs and workflows that support critical business processes.

    JAMS reliably orchestrates the critical IT processes that run your business. Our comprehensive workload automation and job scheduling solution provides a single pane of glass to manage, execute, and monitor jobs—regardless of platforms or applications.”*

    URL

    jamsscheduler.com

    Coverage:

    Global


    OpenVMS

    OS/400

    Unix

    Windows

    z/OS

    SAP

    Oracle

    Microsoft

    Infor

    Workday

    AWS

    Azure

    Google Cloud Compute

    ServiceNow

    Salesforce

    Micro Focus

    Microsoft Dynamics 365

    Microsoft Dynamics AX

    Microsoft SQL Server

    MySQL

    NeoBatch

    Netezza

    Oracle PL/SQL

    Oracle E-Business Suite

    PeopleSoft

    SAP

    SAS

    Symitar

    *JAMS

    Redwood

    Redwood SaaS

    Workload Management:

    Summary

    Founded in 1993 and delivered as a SaaS solution, ”Redwood lets you orchestrate securely and reliably across any application, service or server, in the cloud or on-premises, all inside a single platform. Automation solutions are at the core of critical business operations such as forecasting, replenishment, reconciliation, financial close, order to cash, billing, reporting, and more. Enterprises in every industry — from manufacturing, utility, retail, and biotech to healthcare, banking, and aerospace.”*

    URL

    redwood.com

    Coverage:

    Global


    OpenVMS

    OS/400

    Unix

    Windows

    z/OS

    SAP

    Oracle

    Microsoft

    Infor

    Workday

    AWS

    Azure

    Google Cloud Compute

    ServiceNow

    Salesforce

    Github

    Office 365

    Slack

    Dropbox

    Tableau

    Informatica

    SAP BusinessObjects

    Cognos

    Microsoft Power BI

    Amazon QuickSight

    VMware

    Xen

    Kubernetes

    *Redwood

    Fortra

    Robot Scheduler

    Workload Management:

    Summary

    “Robot Schedule’s workload automation capabilities allow users to automate everything from simple jobs to complex, event-driven processes on multiple platforms and centralize management from your most reliable system: IBM i. Just create a calendar of when and how jobs should run, and the software will do the rest.”*

    URL

    fortra.com/products/job-scheduling-software-ibm-i

    Coverage:

    Global


    IBM i (System i, iSeries, AS/400)

    AIX/UNIX

    Linux

    Windows

    SQL/Server

    Domino

    JD Edwards EnterpriseOne

    SAP

    Automate Schedule (formerly Skybot Scheduler)

    *Fortra

    SMA Technologies

    OpCon

    Workload Management:

    Summary

    Founded in1980, SMA offers to “save time, reduce error, and free your IT staff to work on more strategic contributions with OpCon from SMA Technologies. OpCon offers powerful, easy-to-use workload automation and orchestration to eliminate manual tasks and manage workloads across business-critical operations. It's the perfect fit for financial institutions, insurance companies, and other transactional businesses.”*

    URL

    smatechnologies.com

    Coverage:

    Global

    Windows

    Linux

    Unix

    z/Series

    IBM i

    Unisys

    Oracle

    SAP

    Microsoft Dynamics AX

    Infor M3

    Sage

    Cegid

    Temenos

    FICS

    Microsoft Azure Data Management

    Microsoft Azure VM

    Amazon EC2/AWS

    Web Services RESTful

    Docker

    Google Cloud

    VMware

    ServiceNow

    Commvault

    Microsoft WSUS

    Microsoft Orchestrator

    Java

    JBoss

    Asysco AMT

    Tuxedo ART

    Nutanix

    Corelation

    Symitar

    Fiserv DNA

    Fiserv XP2

    *SMA Technologies

    StoneBranch

    Universal Automation Center (UAC)

    Workload Management:

    Summary

    Founded in 1999, ”the Stonebranch Universal Automation Center (UAC) is an enterprise-grade business automation solution that goes beyond traditional job scheduling. UAC's event-based workload automation solution is designed to automate and orchestrate system jobs and tasks across all mainframe, on-prem, and hybrid IT environments. IT operations teams gain complete visibility and advanced control with a single web-based controller, while removing the need to run individual job schedulers across platforms.”*

    URL

    stonebranch.com/it-automation-solutions/enterprise-job-scheduling

    Coverage:

    Global

    Windows

    Linux

    Unix

    z/Series

    Apache Kafka

    AWS

    Databricks

    Docker

    GitHub

    Google Cloud

    Informatica

    Jenkins

    Jscape

    Kubernetes

    Microsoft Azure

    Microsoft SQL

    Microsoft Teams

    PagerDuty

    PeopleSoft

    Petnaho

    RedHat Ansible

    Salesforce

    SAP

    ServiceNow

    Slack

    SMTP and IMAP

    Snowflake

    Tableau

    VMware

    *Stonebranch

    Tidal Software

    Workload Automation

    Workload Management:

    Summary

    Founded in 1979, Tidal’s Workload Automation will “simplify management and execution of end-to-end business processes with our unified automation platform. Orchestrate workflows whether they're running on-prem, in the cloud or hybrid environments.”*

    URL

    tidalsoftware.com

    Coverage:

    Global

    CentOS

    Linux

    Microsoft Windows Server

    Open VMS

    Oracle Cloud

    Oracle Enterprise Linux

    Red Hat Enterprise Server

    Suse Enterprise

    Tandem NSK

    Ubuntu

    UNIX

    HPUX (PA-RISC, Itanium)

    Solaris (Sparc, X86)

    AIX, iSeries

    z/Linux

    z/OS

    Amazon AWS

    Microsoft Azure

    Oracle OCI

    Google Cloud

    ServiceNow

    Kubernetes

    VMware

    Cisco UCS

    SAP R/3 & SAP S/4HANA

    Oracle E-Business

    Oracle ERP Cloud

    PeopleSoft

    JD Edwards

    Hadoop

    Oracle DB

    Microsoft SQL

    SAP BusinessObjects

    IBM Cognos

    FTP/FTPS/SFTP

    Informatica

    *Tidal

    Vinzant Software

    Global ECS

    Workload Management:

    Summary

    Founded in 1987, Global ECS can “simplify operations in all areas of production with the GECS automation framework. Use a single solution to schedule, coordinate and monitor file transfers, database operations, scripts, web services, executables and SAP jobs. Maximize efficiency for all operations across multiple business units intelligently and automatically.”*

    URL

    vinzantsoftware.com

    Coverage:

    Global

    Windows

    Linux

    Unix

    iSeries

    SAP R/3 & SAP S/4HANA

    Oracle, SQL/Server

    *Vizant Software

    Activity

    Scale Out or Scale Up

    Activities:

    1. Complete the Scale Up vs. Scale Out TCO Tool.
    2. Compare total lifecycle costs to determine TCO.

    This activity involves the following participants:

    IT strategic direction decision makers

    IT managers responsible for an existing z/Series platform

    Organizations evaluating platforms for mission critical applications

    Outcomes of this step:

    • Completed Scale Up vs. Scale Out TCO Tool

    Info-Tech Insight

    This checkpoint process creates transparency around agreement costs with the business and gives the business an opportunity to re-evaluate its requirements for a potentially leaner agreement.

    Scale out versus scale up activity

    The Scale Up vs. Scale Out TCO Tool provides organizations with a framework for estimating the costs associated with purchasing and licensing for a scale-up and scale-out environment over a multi-year period.

    Use this tool to:

    • Compare the pre-populated values.
    • Insert your own amounts to contrast possible database decisions and determine the TCO of each.
    The image contains screenshots of the Scale Up vs. Scale Out TCO Tool.

    Info-Tech Insight

    Watch out for inaccurate financial information. Ensure that the financials for cost match your maintenance and contract terms.

    Use the Scale Up vs. Scale Out TCO Tool to determine your TCO options.

    Related Info-Tech Research

    Effectively Acquire Infrastructure Services

    Acquiring a service is like buying an experience. Don’t confuse the simplicity of buying hardware with buying an experience.

    Outsource IT Infrastructure to Improve System Availability, Reliability, and Recovery

    There are very few IT infrastructure components you should be housing internally – outsource everything else.

    Build Your Infrastructure Roadmap

    Move beyond alignment: Put yourself in the driver’s seat for true business value.

    Define Your Cloud Vision

    Make the most of cloud for your organization.

    Document Your Cloud Strategy

    Drive consensus by outlining how your organization will use the cloud.

    Build a Strategy for Big Data Platforms

    Know where to start and where to focus attention in the implementation of a big data strategy.

    Create a Better RFP Process

    Improve your RFPs to gain leverage and get better results.

    Research Authors

    Darin Stahl.

    Darin Stahl, Principal Research Advisor, Info-Tech Research Group

    Darin is a Principal Research Advisor within the Infrastructure Practice, and leveraging 38+ years of experience, his areas of focus include: IT Operations Management, Service Desk, Infrastructure Outsourcing, Managed Services, Cloud Infrastructure, DRP/BCP, Printer Management, Managed Print Services, Application Performance Monitoring/ APM, Managed FTP, non-commodity servers (z/Series, mainframe, IBM i, AIX, Power PC).

    Troy Cheeseman.

    Troy Cheeseman, Practice Lead, Info-Tech Research Group

    Troy has over 25 years of IT management experience and has championed large enterprise-wide technology transformation programs, remote/home office collaboration and remote work strategies, BCP, IT DRP, IT Operations and expense management programs, international right placement initiatives, and large technology transformation initiatives (M&A). Additionally, he has deep experience working with IT solution providers and technology (cloud) start-ups.

    Bibliography

    “AWS Announces AWS Mainframe Modernization.” Business Wire, 30 Nov. 2021.
    de Valence, Phil. “Migrating a Mainframe to AWS in 5 Steps with Astadia?” AWS, 23 Mar. 2018.
    Graham, Nyela. “New study shows mainframes still popular despite the rise of cloud—though times are changing…fast?” WatersTechnology, 12 Sept. 2022.
    “Legacy applications can be revitalized with API.” MuleSoft, 2022.
    Vecchio, Dale. “The Benefits of Running Mainframe Applications on LzLabs Software Defined Mainframe® & Microsoft Azure.” LzLabs Sites, Mar. 2021.

    Kick-Start IT-Led Business Innovation

    • Buy Link or Shortcode: {j2store}87|cart{/j2store}
    • member rating overall impact: 9.2/10 Overall Impact
    • member rating average dollars saved: $38,844 Average $ Saved
    • member rating average days saved: 8 Average Days Saved
    • Parent Category Name: Innovation
    • Parent Category Link: /innovation
    • The CIO is not considered a strategic partner. The business may be satisfied with IT services, but no one is looking to IT to solve business problems or drive the enterprise forward.
    • Even if IT staff do generate ideas that will improve operational efficiency or enable the business, few are ever assessed or executed upon.

    Our Advice

    Critical Insight

    • Business demand for new technology is creating added pressure to innovate and executive stakeholders expect more from IT. If IT is not viewed as a source of innovation, its perceived value will decrease and the threat of shadow IT will grow. Do not wait to start finding and capitalizing on opportunities for IT-led innovation.

    Impact and Result

    • Start innovating right away. All you need are business pains and people willing to ideate around them.
    • Assemble a small team and arm them with proven techniques for identifying unique opportunities for innovation, developing impactful solutions, and prototyping quickly and effectively. Incubate a reservoir of ideas, both big and small, so that you are ready to execute on innovative projects when the timing is right.
    • Once you have demonstrated IT’s ability to innovate, mature your capability with a permanent innovation process and program.

    Kick-Start IT-Led Business Innovation Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should create innovation processes, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Launch innovation

    Sponsor a mandate for innovation and assemble a small team to start sourcing ideas with IT staff.

    • Kick-Start IT-Led Business Innovation – Phase 1: Launch Innovation
    • Innovation Working Group Charter

    2. Ideate

    Identify critical opportunities for innovation and brainstorm effective solutions.

    • Kick-Start IT-Led Business Innovation – Phase 2: Ideate
    • Idea Document
    • Idea Reservoir Tool

    3. Prototype

    Prototype ideas rapidly to gain user feedback, refine solutions, and make a compelling case for project investment.

    • Kick-Start IT-Led Business Innovation – Phase 3: Prototype
    • Prototyping Workbook
    • Prototype Assessment

    4. Mature innovation capability

    Formalize the innovation process and implement a program to create a strong culture of innovation in IT.

    • Kick-Start IT-Led Business Innovation – Phase 4: Mature Innovation Capability

    Infographic

    Workshop: Kick-Start IT-Led Business Innovation

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Launch Innovation

    The Purpose

    Introduce innovation.

    Assess overall IT maturity to understand what you want to achieve with innovation.

    Define the innovation mandate.

    Introduce ideation.

    Key Benefits Achieved

    A set of shared objectives for innovation will be defined.

    A mandate will be created to help focus innovation efforts on what is most critical to the advancement of IT's maturity.

    The group will be introduced to ideation and prepared to begin addressing critical IT or business pains.

    Activities

    1.1 Define workshop goals and objectives.

    1.2 Introduce innovation.

    1.3 Assess IT maturity.

    1.4 Define the innovation mandate.

    1.5 Introduce ideation.

    Outputs

    Workshop goals and objectives.

    An understanding of innovation.

    IT maturity assessment.

    Sponsored innovation mandate.

    An understanding of ideation.

    2 Ideate, Part I

    The Purpose

    Identify and prioritize opportunities for IT-led innovation.

    Map critical processes to identify the pains that should be ideated around.

    Brainstorm potential solutions.

    Assess, pitch, and prioritize ideas that should be investigated further.

    Key Benefits Achieved

    The team will learn best practices for ideation.

    Critical pain points that might be addressed through innovation will be identified and well understood.

    A number of ideas will be generated that can solve identified pains and potentially feed the project pipeline.

    The team will prioritize the ideas that should be investigated further and prototyped after the workshop.

    Activities

    2.1 Identify processes that present opportunities for IT-led innovation.

    2.2 Map selected processes.

    2.3 Finalize problem statements.

    2.4 Generate ideas.

    2.5 Assess ideas.

    2.6 Pitch and prioritize ideas.

    Outputs

    A list of processes with high opportunity for IT-enablement.

    Detailed process maps that highlight pain points and stakeholder needs.

    Problem statements to ideate around.

    A long list of ideas to address pain points.

    Detailed idea documents.

    A shortlist of prioritized ideas to investigate further.

    3 Ideate, Part II

    The Purpose

    Ideate around a more complex problem that presents opportunity for IT-led innovation.

    Map the associated process to define pain points and stakeholder needs in detail.

    Brainstorm potential solutions.

    Assess, pitch, and prioritize ideas that should be investigated further.

    Introduce prototyping.

    Map the user journey for prioritized ideas.

    Key Benefits Achieved

    The team will be ready to facilitate ideation independently with other staff after the workshop.

    A critical problem that might be addressed through innovation will be defined and well understood.

    A number of innovative ideas will be generated that can solve this problem and help IT position itself as a source of innovative projects.

    Ideas will be assessed and prioritized for further investigation and prototyping after the workshop.

    The team will learn best practices for prototyping.

    The team will identify the assumptions that need to be tested when top ideas are prototyped.

    Activities

    3.1 Select an urgent opportunity for IT-led innovation.

    3.2 Map the associated process.

    3.3 Finalize the problem statement.

    3.4 Generate ideas.

    3.5 Assess ideas.

    3.6 Pitch and prioritize ideas.

    3.7 Introduce prototyping.

    3.8 Map the user journey for top ideas.

    Outputs

    Selection of a process which presents a critical opportunity for IT-enablement.

    Detailed process map that highlights pain points and stakeholder needs.

    Problem statement to ideate around.

    A long list of ideas to solve the problem.

    Detailed idea documents.

    A shortlist of prioritized ideas to investigate further.

    An understanding of effective prototyping techniques.

    A user journey for at least one of the top ideas.

    4 Implement an Innovation Process and Program

    The Purpose

    Establish a process for generating, managing, prototyping, prioritizing, and approving new ideas.

    Create an action plan to operationalize your new process.

    Develop a program to help support the innovation process and nurture your innovators.

    Create an action plan to implement your innovation program.

    Decide how innovation success will be measured.

    Key Benefits Achieved

    The team will learn best practices for managing innovation.

    The team will be ready to operationalize an effective process for IT-led innovation. You can start scheduling ideation sessions as soon as the workshop is complete.

    The team will understand the current innovation ecosystem: drivers, barriers, and enablers.

    The team will be ready to roll out an innovation program that will help generate wider engagement with IT-led innovation.

    You will be ready to measure and report on the success of your program.

    Activities

    4.1 Design an IT-led innovation process.

    4.2 Assign roles and responsibilities.

    4.3 Generate an action plan to roll out the process.

    4.4 Determine critical process metrics to track.

    4.5 Identify innovation drivers, enablers, and barriers.

    4.6 Develop a program to nurture a culture of innovation.

    4.7 Create an action plan to jumpstart each of your program components.

    4.8 Determine critical metrics to track.

    4.9 Summarize findings and gather feedback.

    Outputs

    A process for IT-led innovation.

    Defined process roles and responsibilities.

    An action plan for operationalizing the process.

    Critical process metrics to measure success.

    A list of innovation drivers, enablers, and barriers.

    A program for innovation that will leverage enablers and minimize barriers.

    An action plan to roll out your innovation program.

    Critical program metrics to track.

    Overview of workshop results and feedback.

    Effectively Manage CxO Relations

    • Buy Link or Shortcode: {j2store}384|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Manage Business Relationships
    • Parent Category Link: /manage-business-relationships

    With the exponential pace of technological change, an organization's success will depend largely on how well CIOs can evolve from technology evangelists to strategic business partners. This will require CIOs to effectively broker relationships to improve IT's effectiveness and create business value. A confidential journal can help you stay committed to fostering productive relationships while building trust to expand your sphere of influence.

    Our Advice

    Critical Insight

    Highly effective executives have in common the ability to successfully balance three things: time, personal capabilities, and relationships. Whether you are a new CIO or an experienced leader, the relentless demands on your time and unpredictable shifts in the organization’s strategy require a personal game plan to deliver business value. Rather than managing stakeholders one IT project at a time, you need an action plan that is tailored for unique work styles.

    Impact and Result

    A personal relationship journal will help you:

    • Understand the context in which key stakeholders operate.
    • Identify the best communication approach to engage with different workstyles.
    • Stay committed to fostering relationships through difficult periods.

    Effectively Manage CxO Relations Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Effectively Manage CxO Relations Storyboard – A guide to creating a personal action plan to help effectively manage relationships across key stakeholders.

    Use this research to create a personal relationship journal in four steps:

    • Effectively Manage CxO Relations Storyboard

    2. Personal Relationship Management Journal Template – An exemplar to help you build your personal relationship journal.

    Use this exemplar to build a journal that is readily accessible, flexible, and easy to maintain.

    • Personal Relationship Management Journal Template

    Infographic

    Further reading

    Effectively Manage CxO Relations

    Make relationship management a daily habit with a personalized action plan.

    Analyst Perspective

    "Technology does not run an enterprise, relationships do." – Patricia Fripp

    As technology becomes increasingly important, an organization's success depends on the evolution of the modern CIO from a technology evangelist to a strategic business leader. The modern CIO will need to leverage their expansive partnerships to demonstrate the value of technology to the business while safeguarding their time and effort on activities that support their strategic priorities. CIOs struggling to transition risk obsolescence with the emergence of new C-suite roles like the Digital Transformation Officer, Chief Digital Officer, Chief Data Officer, and so on.

    CIOs will need to flex new social skills to accommodate diverse styles of work and better predict dynamic situations. This means expanding beyond their comfort level to acquire new social skills. Having a clear understanding of one's own work style (preferences, natural tendencies, motivations, and blind spots) is critical to identify effective communication and engagement tactics.

    Building trust is an art. Striking a balance between fulfilling your own goals and supporting others will require a carefully curated approach to navigate the myriad of personalities and work styles. A personal relationship journal will help you stay committed through these peaks and troughs to foster productive partnerships and expand your sphere of influence over the long term.

    Photo of Joanne Lee
    Joanne Lee
    Principal, Research Director, CIO Advisory
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    In today's unpredictable markets and rapid pace of technological disruptions, CIOs need to create business value by effectively brokering relationships to improve IT's performance. Challenges they face:

    • Operate in silos to run the IT factory.
    • Lack insights into their stakeholders and the context in which they operate.
    • Competing priorities and limited time to spend on fostering relationships.
    • Relationship management programs are narrowly focused on associated change management in IT project delivery.

    Common Obstacles

    Limited span of influence.

    Mistaking formal roles in organizations for influence.

    Understanding what key individuals want and, more importantly, what they don't want.

    Lack of situational awareness to adapt communication styles to individual preferences and context.

    Leveraging different work styles to create a tangible action plan.

    Perceiving relationships as "one and done."

    Info-Tech's Approach

    A personal relationship journal will help you stay committed to fostering productive relationships while building trust to expand your sphere of influence.

    • Identify your key stakeholders.
    • Understand the context in which they operate to define a profile of their mandate, priorities, commitments, and situation.
    • Choose the most effective engagement and communication strategies for different work styles.
    • Create an action plan to monitor and measure your progress.

    Info-Tech Insight

    Highly effective executives have in common the ability to balance three things: time, personal capabilities, and relationships. Whether you are a new CIO or an experienced leader, the relentless demand on your time and unpredictable shifts in the organization's strategy will require a personal game plan to deliver business value. This will require more than managing stakeholders one IT project at a time: It requires an action plan that fosters relationships over the long term.

    Key Concepts

    Stakeholder Management
    A common term used in project management to describe the successful delivery of any project, program, or activity that is associated with organizational change management. The goal of stakeholder management is intricately tied to the goals of the project or activity with a finite end. Not the focus of this advisory research.

    Relationship Management
    A broad term used to describe the relationship between two parties (individuals and/or stakeholder groups) that exists to create connection, inclusion, and influence. The goals are typically associated with the individual's personal objectives and the nature of the interaction is seen as ongoing and long-term.

    Continuum of Commitment
    Info-Tech's framework that illustrates the different levels of commitment in a relationship. It spans from active resistance to those who are committed to actively supporting your personal priorities and objectives. This can be used to baseline where you are today and where you want the relationship to be in the future.

    Work Style
    A reference to an individual's natural tendencies and expectations that manifest itself in their communication, motivations, and leadership skills. This is not a behavior assessment nor a commentary on different personalities but observable behaviors that can indicate different ways people communicate, interact, and lead.

    Glossary
    CDxO: Chief Digital Officer
    CDO: Chief Data Officer
    CxO: C-Suite Executives

    The C-suite is getting crowded, and CIOs need to foster relationships to remain relevant

    The span of influence and authority for CIOs is diminishing with the emergence of Chief Digital Officers and Chief Data Officers.

    63% of CDxOs report directly to the CEO ("Rise of the Chief Digital Officer," CIO.com)

    44% of organizations with a dedicated CDxO in place have a clear digital strategy versus 22% of those without a CDxO (KPMG/Harvey Nash CIO Survey)

    The "good news": CIOs tend to have a longer tenure than CDxOs.

    A diagram that shows the average tenure of C-Suites in years.
    Source: "Age and Tenure of C-Suites," Korn Ferry

    The "bad news": The c-suite is getting overcrowded with other roles like Chief Data Officer.

    A diagram that shows the number of CDOs hired from 2017 to 2021.
    Source: "Chief Data Officer Study," PwC, 2022

    An image of 7 lies technology executives tell ourselves.

    Info-Tech Insight

    The digital evolution has created the emergence of new roles like the Chief Digital Officer and Chief Data Officer. They are a response to bridge the skill gap that exists between the business and technology. CIOs need to focus on building effective partnerships to better communicate the business value generated by technology or they risk becoming obsolete.

    Create a relationship journal to effectively manage your stakeholders

    A diagram of relationship journal

    Info-Tech's approach

    From managing relationships with friends to key business partners, your success will come from having the right game plan. Productive relationships are more than managing stakeholders to support IT initiatives. You need to effectively influence those who have the potential to champion or derail your strategic priorities. Understanding differences in work styles is fundamental to adapting your communication approach to various personalities and situations.

    A diagram that shows from 1.1 to 4.1

    A diagram of business archetypes

    Summary of Insights

    Insight 1: Expand your sphere of influence
    It's not just about gaining a volume of acquaintances. Figure out where you want to spend your limited time, energy, and effort to develop a network of professional allies who will support and help you achieve your strategic priorities.

    Insight 2: Know thyself first and foremost
    Healthy relationships start with understanding your own working style, preferences, and underlying motivations that drive your behavior and ultimately your expectations of others. A win/win scenario emerges when both parties' needs for inclusion, influence, and connection are met or mutually conceded.

    Insight 3: Walk a mile in their shoes
    If you want to build successful partnerships, you need to understand the context in which your stakeholder operates: their motivations, desires, priorities, commitments, and challenges. This will help you adapt as their needs shift and, moreover, leverage empathy to identify the best tactics for different working styles.

    Insight 4: Nurturing relationships is a daily commitment
    Building, fostering, and maintaining professional relationships requires a daily commitment to a plan to get through tough times, competing priorities, and conflicts to build trust, respect, and a shared sense of purpose.

    Related Info-Tech Research

    Supplement your CIO journey with these related blueprints.

    Photo of First 100 Days as CIO

    First 100 Days as CIO

    Photo of Become a Strategic CIO

    Become a Strategic CIO

    Photo of Improve IT Team Effectiveness

    Improve IT Team Effectiveness

    Photo of Become a Transformational CIO

    Become a Transformational CIO

    Executive Brief Case Study

    Logo of Multicap Limited

    • Industry: Community Services
    • Source: Scott Lawry, Head of Digital

    Conversation From Down Under

    What are the hallmarks of a healthy relationship with your key stakeholders?
    "In my view, I work with partners like they are an extension of my team, as we rely on each other to achieve mutual success. Partnerships involve a deeper, more intimate relationship, where both parties are invested in the long-term success of the business."

    Why is it important to understand your stakeholder's situation?
    "It's crucial to remember that every IT project is a business project, and vice versa. As technology leaders, our role is to demystify technology by focusing on its business value. Empathy is a critical trait in this endeavor, as it allows us to see a stakeholder's situation from a business perspective, align better with the business vision and goals, and ultimately connect with people, rather than just technology."

    How do you stay committed during tough times?
    "I strive to leave emotions at the door and avoid taking a defensive stance. It's important to remain neutral and not personalize the issue. Instead, stay focused on the bigger picture and goals, and try to find a common purpose. To build credibility, it's also essential to fact-check assumptions regularly. By following these principles, I approach situations with a clear mind and better perspective, which ultimately helps achieve success."

    Photo of Scott Lawry, Head Of Digital at Multicap Limited

    Key Takeaways

    In a recent conversation with a business executive about the evolving role of CIOs, she expressed: "It's the worst time to be perceived as a technology evangelist and even worse to be perceived as an average CIO who can't communicate the business value of technology."

    This highlights the immense pressure many CIOs face when evolving beyond just managing the IT factory.

    The modern CIO is a business leader who can forge relationships and expand their influence to transform IT into a core driver of business value.

    Stakeholder Sentiment

    Identify key stakeholders and their perception of IT's effectiveness

    1.1 Identify Key Stakeholders

    A diagram of Identify Key Stakeholders

    Identify and prioritize your key stakeholders. Be diligent with stakeholder identification. Use a broad view to identify stakeholders who are known versus those who are "hidden." If stakeholders are missed, then so are opportunities to expand your sphere of influence.

    1.2 Understand Stakeholder's Perception of IT

    A diagram that shows Info-Tech's Diagnostic Reports and Hospital Authority XYZ

    Assess stakeholder sentiments from Info-Tech's diagnostic reports and/or your organization's satisfaction surveys to help identify individuals who may have the greatest influence to support or detract IT's performance and those who are passive observers that can become your greatest allies. Determine where best to focus your limited time amid competing priorities by focusing on the long-term goals that support the organization's vision.

    Info-Tech Insight

    Understand which individuals can directly or indirectly influence your ability to achieve your priorities. Look inside and out, as you may find influencers beyond the obvious peers or executives in an organization. Influence can result from expansive connections, power of persuasion, and trust to get things done.

    Visit Info-Tech's Diagnostic Programs

    Activity: Identify and Prioritize Stakeholders

    30-60 minutes

    1.1 Identify Key Stakeholders

    Start with the key stakeholders that are known to you. Take a 360-degree view of both internal and external connections. Leverage external professional & network platforms (e.g. LinkedIn), alumni connections, professional associations, forums, and others that can help flush out hidden stakeholders.

    1.2 Prioritize Key Stakeholders

    Use stakeholder satisfaction surveys like Info-Tech's Business Vision diagnostic as a starting point to identify those who are your allies and those who have the potential to derail IT's success, your professional brand, and your strategic priorities. Review the results of the diagnostic reports to flush out those who are:

    • Resisters: Vocal about their dissatisfaction with IT's performance and actively sabotage or disrupt
    • Skeptics: Disengaged, passive observers
    • Ambassadors: Aligned but don't proactively support
    • Champions: Actively engaged and will proactively support your success

    Consider the following:

    • Influencers may not have formal authority within an organization but have relationships with your stakeholders.
    • Influencers may be hiding in many places, like the coach of your daughter's soccer team who rows with your CEO.
    • Prioritize, i.e. three degrees of separation due to potential diverse reach of influence.

    Key Output: Create a tab for your most critical stakeholders.

    A diagram that shows profile tabs

    Download the Personal Relationship Management Journal Template.

    Understand stakeholders' business

    Create a stakeholder profile to understand the context in which stakeholders operate.

    2.1 Create individual profile for each stakeholder

    A diagram that shows different stakeholder questions

    Collect and analyze key information to understand the context in which your stakeholders operate. Use the information to derive insights about their mandate, accountabilities, strategic goals, investment priorities, and performance metrics and challenges they may be facing.

    Stakeholder profiles can be used to help design the best approach for personal interactions with individuals as their business context changes.

    If you are short on time, use this checklist to gather information:

    • Stakeholder's business unit (BU) strategy goals
    • High-level organizational chart
    • BU operational model or capability map
    • Key performance metrics
    • Projects underway and planned
    • Financial budget (if available)
    • Milestone dates for key commitments and events
    • External platforms like LinkedIn, Facebook, Twitter, Slack, Instagram, Meetup, blogs

    Info-Tech Insight

    Understanding what stakeholders want (and more importantly, what they don't) requires knowing their business and the personal and social circumstances underlying their priorities and behaviors.

    Activity: Create a stakeholder profile

    30-60 minutes

    2.1.0 Understand stakeholder's business context

    Create a profile for each of your priority stakeholders to document their business context. Review all the information collected to understand their mandate, core accountability, and business capabilities. The context in which individuals operate is a window into the motivations, pressures, and vested interests that will influence the intersectionality between their expectations and yours.

    2.1.1 Document Observable Challenges as Private Notes

    Crushing demands and competing priorities can lead to tension and stress as people jockey to safeguard their time. Identify some observable challenges to create greater situational awareness. Possible underlying factors:

    • Sudden shifts/changes in mandate
    • Performance (operations, projects)
    • Finance
    • Resource and talent gaps
    • Politics
    • Personal circumstances
    • Capability gaps/limitations
    • Capacity challenges

    A diagram that shows considerations of this activity.

    Analyze Stakeholder's Work Style

    Adapt communication styles to the situational context in which your stakeholders operate

    2.2 Determine the ideal approach for engaging each stakeholder

    Each stakeholder has a preferred modality of working which is further influenced by dynamic situations. Some prefer to meet frequently to collaborate on solutions while others prefer to analyze data in solitude before presenting information to substantiate recommendations. However, fostering trust requires:

    1. Understanding your preferred default when engaging others.
    2. Knowing where you need to expand your skills.
    3. Identifying which skills to activate for different professional scenarios.

    Adapting your communication style to create productive interactions will require a diverse arsenal of interpersonal skills that you can draw upon as situations shift. The ability to adapt your work style to dial any specific trait up or down will help to increase your powers of persuasion and influence.

    "There are only two ways to influence human behavior: you can manipulate it, or you can inspire it." – Simon Sinek

    Activity: Identify Engagement Strategies

    30 minutes

    2.2.0 Establish work styles

    Every individual has a preferred style of working. Determine work styles starting with self-awareness:

    • Express myself - How you communicate and interact with others
    • Expression by others - How you want others to communicate and interact with you

    Through observation and situational awareness, we can make inferences about people's work style.

    • Observations - Observable traits of other people's work style
    • Situations - Personal and professional circumstances that influence how we communicate and interact with one another

    Where appropriate and when opportunities arise, ask individuals directly about their preferred work styles and method for communication. What is their preferred method of communication? During a normal course of interaction vs. for urgent priorities?

    2.2.1 Brainstorm possible engagement strategies

    Consider the following when brainstorming engagement strategies for different work styles.

    A table of involvement, influence, and connection.

    Think engagement strategies in different professional scenarios:

    • Meetings - Where and how you connect
    • Communicating - How and what you communicate to create connection
    • Collaborating - What degree of involved in shared activities
    • Persuading - How you influence or direct others to get things done

    Expand New Interpersonal Skills

    Use the Business Archetypes to brainstorm possible approaches for engaging with different work styles. Additional communication and engagement tactics may need to be considered based on circumstances and changing situations.

    A diagram that shows business archetypes and engagement strategies.

    Communicate Effectively

    Productive communication is a dialogue that requires active listening, tailoring messages to fluid situations, and seeking feedback to adapt.

    A diagram of elements that contributes to better align intention and impact

    Be Relevant

    • Understand why you need to communicate
    • Determine what you need to convey
    • Tailor your message to what matters to the audience and their context
    • Identify the most appropriate medium based on the situation

    Be Consistent and Accurate

    • Say what you mean and mean what you say to avoid duplicity
    • Information should be accurate and complete
    • Communicate truthfully; do not make false promises or hide bad news
    • Don't gossip

    Be Clear and Concise

    • Keep it simple and avoid excessive jargon
    • State asks upfront to set intention and transparency
    • Avoid ambiguity and focus on outcomes over details
    • Be brief and to the point or risk losing stakeholder's attention

    Be Attentive and Authentic

    • Stay engaged and listen actively
    • Be curious and inquire for clarification or explanation
    • Be flexible to adapt to both verbal and non-verbal cues
    • Be authentic in your approach to sharing yourself
    • Avoid "canned" approaches

    A diagram of listen, observe, reflect.


    "Good communication is the bridge between confusion and clarity."– Nat Turner (LinkedIn, 2020)

    Exemplar: Engaging With Jane

    A diagram that shows Exemplar: Engaging With Jane

    Exemplar: Engaging With Ali

    A diagram that shows Exemplar: Engaging With Ali

    Develop an Action Plan

    Moving from intent to action requires a plan to ensure you stay committed through the peaks and troughs.

    Create Your 120-Day Plan

    An action plan example

    Key elements of the action plan:

    • Strategic priorities – Your top focus
    • Objective – Your goals
    • 30-60-90-120 Day Topics – Key agenda items
    • Meeting Progress Notes – Key takeaways from meetings
    • Private Notes – Confidential observations

    Investing in relationships is a long-term process. You need to accumulate enough trust to trade or establish coalitions to expand your sphere of influence. Even the strongest of professional ties will have their bouts of discord. To remain committed to building the relationship during difficult periods, use an action plan that helps you stay grounded around:

    • Shared purpose
    • Removing emotion from the situation
    • Continuously learning from every interaction

    Photo of Angela Diop
    "Make intentional actions to set intentionality. Plans are good to keep you grounded and focused especially when relationship go through ups and down and there are changes: to new people and new relationships."
    – Angela Diop, Senior Director, Executive Services, Info-Tech & former VP of Information Services with Unity Health Care

    Activity: Design a Tailored Action Plan

    30-60 minutes

    3.1.0 Determine your personal expectations

    Establish your personal goals and expectations around what you are seeking from the relationship. Determine the strength of your current connection and identify where you want to move the relationship across the continuum of commitment.

    Use insights from your stakeholder's profile to explore their span of influence and degree of interest in supporting your strategic priorities.

    3.1.1 Determine what you want from the relationship

    Based on your personal goals, identify where you want to move the relationship across the continuum of commitment: What are you hoping to achieve from the relationship? How will this help create a win/win situation for both you and the key stakeholder?

    A diagram of Continuum of Commitment.

    3.1.2 Identify your metrics for progress

    Fostering relationships take time and commitment. Utilizing metrics or personal success criteria for each of your focus areas will help you stay on track and find opportunities to make each engagement valuable instead of being transactional.

    A graph that shows influence vs interest.

    Make your action plan impactful

    Level of Connection

    The strength of the relationship will help inform the level of time and effort needed to achieve your goals.

    • Is this a new or existing relationship?
    • How often do you connect with this individual?
    • Are the connections driven by a shared purpose or transactional as needs arise?

    Focus on Relational Value

    Cultivate your network and relationship with the goal of building emotional connection, understanding, and trust around your shared purpose and organization's vision through regular dialogue. Be mindful of transactional exchanges ("quid pro quo") to be strategic about its use. Treat every interaction as equally important regardless of agenda, duration, or channel of communication.

    Plan and Prepare

    Everyone's time is valuable, and you need to come prepared with a clear understanding of why you are engaging. Think about the intentionality of the conversation:

    • Gain buy-in
    • Create transparency
    • Specific ask
    • Build trust and respect
    • Provide information to clarify, clear, or contain a situation

    Non-Verbal Communication Matters

    Communication is built on both overt expressions and subtext. While verbal communication is the most recognizable form, non-lexical components of verbal communication (i.e. paralanguage) can alter stated vs. intended meaning. Engage with the following in mind:

    • Tone, pitch, speed, and hesitation
    • Facial expressions and gestures
    • Choice of channel for engagement

    Exemplar: Action Plan for VP, Digital

    A diagram that shows Exemplar: Action Plan for VP, Digital

    Make Relationship Management a Daily Habit

    Management plans are living documents and need to be flexible to adapt to changes in stakeholder context.

    Monitor and Adjust to Communicate Strategically

    A diagram that shows Principles for Effective Communication and Key Measures

    Building trust takes time and commitment. Treat every conversation with your key stakeholders as an investment in building the social capital to expand your span of influence when and where you need it to go. This requires making relationship management a daily habit. Action plans need to be a living document that is your personal journal to document your observations, feelings, and actions. Such a plan enables you to make constant adjustments along the relationship journey.

    "Without involvement, there is no commitment. Mark it down, asterisk it, circle it, underline it."– Stephen Convey (LinkedIn, 2016)

    Capture some simple metrics

    If you can't measure your actions, you can't manage the relationship.

    An example of measures: what, why, how - metrics, and intended outcome.

    While a personal relationship journal is not a formal performance management tool, identifying some tangible measures will improve the likelihood of aligning your intent with outcomes. Good measures will help you focus your efforts, time, and resources appropriately.

    Keep the following in mind:

    1. WHAT are you trying to measure?
      Specific to the situation or scenario
    2. WHY is this important?
      Relevant to your personal goals
    3. HOW will you measure?
      Achievable and quantifiable
    4. WHAT will the results tell you?
      Intended outcome that is directional

    Summary of accomplishments

    Knowledge Gained

    • Relationship management is critical to a CIO's success
    • A personal relationship journal will help build:
      • Customized approach to engaging stakeholders
      • New communication skills to adapt to different work styles

    New Concepts

    • Work style assessment framework and engagement strategies
    • Effective communication strategies
    • Continuum of commitment to establish personal goals

    Approach to Creating a Personal Journal

    • Step-by-step approach to create a personal journal
    • Key elements for inclusion in a journal
    • Exemplar and recommendations

    Related Info-Tech Research

    Photo of Tech Trends and Priorities Research Centre

    Tech Trends and Priorities Research Centre

    Access Info-Tech's Tech Trend reports and research center to learn about current industry trends, shifts in markets, and disruptions that are impacting your industry and sector. This is a great starting place to gain insights into how the ecosystem is changing your business and the role of IT within it.

    Photo of Embed Business Relationship Management in IT

    Embed Business Relationship Management in IT

    Create a business relationship management (BRM) function in your program to foster a more effective partnership with the business and drive IT's value to the organization.

    Photo of Become a Transformational CIO

    Become a Transformational CIO

    Collaborate with the business to lead transformation and leave behind a legacy of growth.

    Appendix: Framework

    Content:

    • Adaptation of DiSC profile assessment
    • DiSC Profile Assessment
    • FIRO-B Framework
    • Experience Cube

    Info-Tech's Adaption of DiSC Assessment

    A diagram of business archetypes

    Info-Tech's Business Archetypes was created based on our analysis of the DiSC Profile and Myers-Briggs FIRO-B personality assessment tools that are focused on assessing interpersonal traits to better understand personalities.

    The adaptation is due in part to Info-Tech's focus on not designing a personality assessment tool as this is neither the intent nor the expertise of our services. Instead, the primary purpose of this adaptation is to create a simple framework for our members to base their observations of behavioral cues to identify appropriate communication styles to better interact with key stakeholders.

    Cautionary note:
    Business archetypes are personas and should not be used to label, make assumptions and/or any other biased judgements about individual personalities. Every individual has all elements and aspects of traits across various spectrums. This must always remain at the forefront when utilizing any type of personality assessments or frameworks.

    Click here to learn about DiSC Profile
    Click here learn about FIRO-B
    Click here learn about Experience Cube

    DiSC Profile Assessment

    A photo of DiSC Profile Assessment

    What is DiSC?

    DisC® is a personal assessment tool that was originally developed in 1928 by psychologist William Moulton Marston, who designed it to predict job performance. The tool has evolved and is now widely used by thousands of organizations around the world, from large government agencies and Fortune 500 companies to nonprofit and small businesses, to help improve teamwork, communication, and productivity in the workplace. The tool provides a common language people can use to better understand themselves and those they interact with - and use this knowledge to reduce conflict and improve working relationships.

    What does DiSC mean?

    DiSC is an acronym that stands for the four main personality profiles described in the Everything DiSC model: (D)ominance, (i)nfluence, (S)teadiness, (C)onscientiousness

    People with (D) personalities tend to be confident and emphasize accomplishing bottom-line results.
    People with (i) personalities tend to be more open and emphasize relationships and influencing or persuading others.
    People with (S) personalities tend to be dependable and emphasize cooperation and sincerity.
    People with (C) personalities tend to emphasize quality, accuracy, expertise, and competency.

    Go to this link to explore the DiSC styles

    FIRO-B® – Interpersonal Assessment

    A diagram of FIRO framework

    What is FIRO workplace relations?

    The Fundamental Interpersonal Relations Orientation Behavior (FIRO-B®) tool has been around for forty years. The tool assesses your interpersonal needs and the impact of your behavior in the workplace. The framework reveals how individuals can shape and adapt their individual behaviors, influence others effectively, and build trust among colleagues. It has been an excellent resource for coaching individuals and teams about the underlying drivers behind their interactions with others to effectively build successful working relationships.

    What does the FIRO framework measure?

    The FIRO framework addresses five key questions that revolve around three interpersonal needs. Fundamentally, the framework focuses on how you want to express yourself toward others and how you want others to behave toward you. This interaction will ultimately result in the universal needs for (a) inclusion, (b) control, and (c) affection. The insights from the results are intended to help individuals adjust their behavior in relationships to get what they need while also building trust with others. This will allow you to better predict and adapt to different situations in the workplace.

    How can FIRO influence individual and team performance in the workplace?

    FIRO helps people recognize where they may be giving out mixed messages and prompts them to adapt their exhibited behaviors to build trust in their relationships. It also reveals ways of improving relationships by showing individuals how they are seen by others, and how this external view may differ from how they see themselves. Using this lens empowers people to adjust their behavior, enabling them to effectively influence others to achieve high performance.

    In team settings, it is a rich source of information to explore motivations, underlying tensions, inconsistent behaviors, and the mixed messages that can lead to mistrust and derailment. It demonstrates how people may approach teamwork differently and explains the potential for inefficiencies and delays in delivery. Through the concept of behavioral flexibility, it helps defuse cultural stereotypes and streamline cross-cultural teams within organizations.

    Go to this link to explore FIRO-B for Business

    Experience Cube

    A diagram of experience cube model.

    What is an experience cube?

    The Experience Cube model was developed by Gervase Bushe, a professor of Leadership and Organization at the Simon Fraser University's school of Business and a thought leader in the field of organizational behavior. The experience cube is intended as a tool to plan and manage conversations to communicate more effectively in the moment. It does this by promoting self-awareness to better reduce anxiety and adapt to evolving and uncertain situations.

    How does the experience cube work?

    Using the four elements of the experience cube (Observations, Thoughts, Feelings, and Wants) helps you to separate your experience with the situation from your potential judgements about the situation. This approach removes blame and minimizes defensiveness, facilitating a positive discussion. The goal is to engage in a continuous internal feedback loop that allows you to walk through all four quadrants in the moment to help promote self-awareness. With heightened self-awareness, you may (1) remain curious and ask questions, (2) check-in for understanding and clarification, and (3) build consensus through agreement on shared purpose and next steps.

    Observations: Sensory data (information you take in through your senses), primarily what you see and hear. What a video camera would record.

    Thoughts: The meaning you add to your observations (i.e. the way you make sense of them, including your beliefs, expectations, assumptions, judgments, values, and principles). We call this the "story you make up."

    Feelings: Your emotional or physiological response to the thoughts and observations. Feelings words such as sad, mad, glad, scared, or a description of what is happening in your body.

    Wants: Clear description of the outcome you seek. Wants go deeper than a simple request for action. Once you clearly state what you want, there may be different ways to achieve it.

    Go to this link to explore more: Experience Cube

    Research Contributors and Experts

    Photo of Joanne Lee
    Joanne Lee
    Principal, Research Director, CIO Advisory
    Info-Tech Research Group

    Joanne is a professional executive with over twenty-five years of experience in digital technology and management consulting spanning healthcare, government, municipal, and commercial sectors across Canada and globally. She has successfully led several large, complex digital and business transformation programs. A consummate strategist, her expertise spans digital and technology strategy, organizational redesign, large complex digital and business transformation, governance, process redesign, and PPM. Prior to joining Info-Tech Research Group, Joanne was a Director with KPMG's CIO Advisory management consulting services and the Digital Health practice lead for Western Canada. She brings a practical and evidence-based approach to complex problems enabled by technology.

    Joanne holds a Master's degree in Business and Health Policy from the University of Toronto and a Bachelor of Science (Nursing) from the University of British Columbia.



    Photo of Gord Harrison
    Gord Harrison
    Senior Vice President, Research and Advisory
    Info-Tech Research Group

    Gord Harrison, SVP, Research and Consulting, has been with Info-Tech Research Group since 2002. In that time, Gord leveraged his experience as the company's CIO, VP Research Operations, and SVP Research to bring the consulting and research teams together under his current role, and to further develop Info-Tech's practical, tactical, and value-oriented research product to the benefit of both organizations.

    Prior to Info-Tech, Gord was an IT consultant for many years with a focus on business analysis, software development, technical architecture, and project management. His background of educational game software development, and later, insurance industry application development gave him a well-rounded foundation in many IT topics. Gord prides himself on bringing order out of chaos and his customer-first, early value agile philosophy keeps him focused on delivering exceptional experiences to our customers.



    Photo of Angela Diop
    Angela Diop
    Senior Director, Executive Services
    Info-Tech Research Group

    Angela has over twenty-five years of experience in healthcare, as both a healthcare provider and IT professional. She has spent over fifteen years leading technology departments and implementing, integrating, managing, and optimizing patient-facing and clinical information systems. She believes that a key to a healthcare organization's ability to optimize health information systems and infrastructure is to break the silos that exist in healthcare organizations.

    Prior to joining Info-Tech, Angela was the Vice President of Information Services with Unity Health Care. She has demonstrated leadership and success in this area by fostering environments where business and IT collaborate to create systems and governance that are critical to providing patient care and sustaining organizational health.

    Angela has a Bachelor of Science in Systems Engineering and Design from the University of Illinois and a Doctorate of Naturopathic Medicine from Bastyr University. She is a Certified CIO with the College of Healthcare Information Management Executives. She is a two-time Health Information Systems Society (HIMSS) Davies winner.



    Photo of Edison Barreto
    Edison Barreto
    Senior Director, Executive Services
    Info-Tech Research Group

    Edison is a dynamic technology leader with experience growing different enterprises and changing IT through creating fast-paced organizations with cultural, modernization, and digital transformation initiatives. He is well versed in creating IT and business cross-functional leadership teams to align business goals with IT modernization and revenue growth. Over twenty-five years of Gaming, Hospitality, Retail, and F&B experience has given him a unique perspective on guiding and coaching the creation of IT department roadmaps to focus on business needs and execute successful changes.

    Edison has broad business sector experience, including:
    Hospitality, Gaming, Sports and Entertainment, IT policy and oversight, IT modernization, Cloud first programs, R&D, PCI, GRDP, Regulatory oversight, Mergers acquisitions and divestitures.



    Photo of Mike Tweedie
    Mike Tweedie
    Practice Lead, CIO Strategy
    Info-Tech Research Group

    Michael Tweedie is the Practice Lead, CIO – IT Strategy at Info-Tech Research Group, specializing in creating and delivering client-driven, project-based, practical research, and advisory. He brings more than twenty-five years of experience in technology and IT services as well as success in large enterprise digital transformations.

    Prior to joining Info-Tech, Mike was responsible for technology at ADP Canada. In that role, Mike led several large transformation projects that covered core infrastructure, applications, and services and worked closely with and aligned vendors and partners. The results were seamless and transparent migrations to current services, like public cloud, and a completely revamped end-user landscape that allowed for and supported a fully remote workforce.

    Prior to ADP, Mike was the North American Head of Engineering and Service Offerings for a large French IT services firm, with a focus on cloud adoption and complex ERP deployment and management; he managed large, diverse global teams and had responsibilities for end-to-end P&L management.

    Mike holds a Bachelor's degree in Architecture from Ryerson University.



    Photo of Carlene McCubbin
    Carlene McCubbin
    Practice Lead, People and Leadership
    Info-Tech Research Group

    Carlene McCubbin is a Research Lead for the CIO Advisory Practice at Info-Tech Research Group covering key topics in operating models & design, governance, and human capital development.

    During her tenure at Info-Tech, Carlene has led the development of Info-Tech's Organization and Leadership practice and worked with multiple clients to leverage the methodologies by creating custom programs to fit each organization's needs.

    Before joining Info-Tech, Carlene received her Master of Communications Management from McGill University, where she studied development of internal and external communications, government relations, and change management. Her education honed her abilities in rigorous research, data analysis, writing, and understanding the organization holistically, which has served her well in the business IT world.



    Photo of Anubhav Sharma
    Anubhav Sharma
    Research Director, CIO Strategy
    Info-Tech Research Group

    Anubhav is a digital strategy and execution professional with extensive experience in leading large-scale transformation mandates for organizations both in North America and globally, including defining digital strategies for leading banks and spearheading a large-scale transformation project for a global logistics pioneer across ten countries. Prior to joining Info-Tech Research Group, he held several industry and consulting positions in Fortune 500 companies driving their business and technology strategies. In 2023, he was recognized as a "Top 50 Digital Innovator in Banking" by industry peers.

    Anubhav holds an MBA in Strategy from HEC Paris, a Master's degree in Finance from IIT-Delhi, and a Bachelor's degree in Engineering.



    Photo of Kim Osborne-Rodriguez
    Kim Osborne-Rodriguez
    Research Director, CIO Strategy
    Info-Tech Research Group

    Kim is a professional engineer and Registered Communications Distribution Designer (RCDD) with over a decade of experience in management and engineering consulting spanning healthcare, higher education, and commercial sectors. She has worked on some of the largest hospital construction projects in Canada, from early visioning and IT strategy through to design, specifications, and construction administration. She brings a practical and evidence-based approach to digital transformation, with a track record of supporting successful implementations.

    Kim holds a Bachelor's degree in Mechatronics Engineering from University of Waterloo.



    Photo of Amanda Mathieson
    Amanda Mathieson
    Research Director, People and Leadership
    Info-Tech Research Group

    Amanda joined Info-Tech Research Group in 2019 and brings twenty years of expertise working in Canada, the US, and globally. Her expertise in leadership development, organizational change management, and performance and talent management comes from her experience in various industries spanning pharmaceutical, retail insurance, and financial services. She takes a practical, experiential approach to people and leadership development that is grounded in adult learning methodologies and leadership theory. She is passionate about identifying and developing potential talent, as well as ensuring the success of leaders as they transition into more senior roles.

    Amanda has a Bachelor of Commerce degree and Master of Arts in Organization and Leadership Development from Fielding Graduate University, as well as a post-graduate diploma in Adult Learning Methodologies from St. Francis Xavier University. She also has certifications in Emotional Intelligence – EQ-i 2.0 & 360, Prosci ADKAR® Change Management, and Myers-Briggs Type Indicator Step I and II.

    Bibliography

    Bacey, Christopher. "KPMG/Harvey Nash CIO Survey finds most organizations lack enterprise-wide digital strategy." Harvey Nash/KPMG CIO Survey. Accessed Jan. 6, 2023. KPMG News Perspective - KPMG.us.com

    Calvert, Wu-Pong Susanna. "The Importance of Rapport. Five tips for creating conversational reciprocity." Psychology Today Magazine. June 30, 2022. Accessed Feb. 10, 2023. psychologytoday.com/blog

    Coaches Council. "14 Ways to Build More Meaningful Professional Relationships." Forbes Magazine. September 16, 2020. Accessed Feb. 20, 2023. forbes.com/forbescoachescouncil

    Council members. "How to Build Authentic Business Relationships." Forbes Magazine. June 15, 2021. Accessed Jan. 15, 2023. Forbes.com/business council

    Deloitte. "Chief Information Officer (CIO) Labs. Transform and advance the role of the CIO." The CIO program. Accessed Feb. 5, 2021.

    Dharsarathy, Anusha et al. "The CIO challenge: Modern business needs a new kind of tech leader." McKinsey and Company. January 27, 2020. Accessed Feb 2023. Mckinsey.com

    DiSC profile. "What is DiSC?" DiSC Profile Website. Accessed Feb. 5, 2023. discprofile.com

    FIRO Assessment. "Better working relationships". Myers Brigg Website. Resource document downloaded Feb. 10, 2023. myersbriggs.com/article

    Fripp, Patricia. "Frippicisms." Website. Accessed Feb. 25, 2023. fripp.com

    Grossman, Rhys. "The Rise of the Chief Digital Officer." Russell Reynolds Insights, January 1, 2012. Accessed Jan. 5, 2023. Rise of the Chief Digital Officer - russellreynolds.com

    Kambil, Ajit. "Influencing stakeholders: Persuade, trade, or compel." Deloitte Article. August 9, 2017. Accessed Feb. 19, 2023. www2.deloitte.com/insights

    Kambil, Ajit. "Navigating the C-suite: Managing Stakeholder Relationships." Deloitte Article. March 8, 2017. Accessed Feb. 19, 2023. www2.deloitte.com/insights

    Korn Ferry. "Age and tenure in the C-suite." Kornferry.com. Accessed Jan. 6, 2023. Korn Ferry Study Reveals Trends by Title and Industry

    Kumthekar, Uday. "Communication Channels in Project". Linkedin.com, 3 March 2020. Accessed April 27, 2023. Linkedin.com/Pulse/Communication Channels

    McWilliams, Allison. "Why You Need Effective Relationships at Work." Psychology Today Magazine. May 5, 2022. Accessed Feb. 11, 2023. psychologytoday.com/blog

    McKinsey & Company. "Why do most transformations fail? A conversation with Harry Robinson." Transformation Practice. July 2019. Accessed Jan. 10, 2023. Mckinsey.com

    Mind Tools Content Team. "Building Good Work Relationships." MindTools Article. Accessed Feb. 11, 2023. mindtools.com/building good work relationships

    Pratt, Mary. "Why the CIO-CFO relationship is key to digital success." TechTarget Magazine. November 11, 2021. Accessed Feb. 2023. Techtarget.com

    LaMountain, Dennis. "Quote of the Week: No Involvement, No Commitment". Linkedin.com, 3 April 2016. Accessed April 27, 2023. Linkedin.com/pulse/quote-week-involvement

    PwC Pulse Survey. "Managing Business Risks". PwC Library. 2022. Accessed Jan. 30, 2023. pwc.com/pulse-survey

    Rowell, Darin. "3 Traits of a Strong Professional Relationship." Harvard Business Review. August 8, 2019. Accessed Feb. 20, 2023. hbr.org/2019/Traits of a strong professional relationship

    Sinek, Simon. "The Optimism Company from Simon Sinek." Website. Image Source. Accessed, Feb. 21, 2023. simonsinek.com

    Sinek, Simon. "There are only two ways to influence human behavior: you can manipulate it or you can inspire it." Twitter. Dec 9, 2022. Accessed Feb. 20, 2023. twitter.com/simonsinek

    Whitbourne, Susan Krauss. "10 Ways to Measure the Health of Relationship." Psychology Today Magazine. Aug. 7, 2021. Accessed Jan. 30, 2023. psychologytoday.com/blog

    Identify and Manage Reputational Risk Impacts on Your Organization

    • Buy Link or Shortcode: {j2store}220|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Vendor Management
    • Parent Category Link: /vendor-management

    Access to information about companies is more available to consumers than ever. Organizations must implement mechanisms to monitor and manage how information is perceived to avoid potentially disastrous consequences to their brand reputation.

    A negative event could impact your organization's reputation at any given time. Make sure you understand where such events may come from and have a plan to manage the inevitable consequences.

    Our Advice

    Critical Insight

    • Identifying and managing a vendor’s potential impact on your organization’s reputation requires efforts from multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how social media can affect your brand.
    • Organizational leadership is often caught unaware during crises, and their response plans lack the flexibility to adjust to significant market upheavals.

    Impact and Result

    • Vendor management practices educate organizations on the different potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.
    • Prioritize and classify your vendors with quantifiable, standardized rankings.
    • Prioritize focus on your high-risk vendors.
    • Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

    Identify and Manage Reputational Risk Impacts on Your Organization Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Identify and Manage Reputational Risk Impacts on Your Organization Deck – Use the research to better understand the negative impacts of vendor actions on your brand reputation.

    Use this research to identify and quantify the potential reputational impacts caused by vendors. Use Info-Tech's approach to look at the reputational impact from various perspectives to better prepare for issues that may arise.

    • Identify and Manage Reputational Risk Impacts on Your Organization Storyboard

    2. Reputational Risk Impact Tool – Use this tool to help identify and quantify the reputational impacts of negative vendor actions.

    By playing the “what if” game and asking probing questions to draw out – or eliminate - possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    • Reputational Risk Impact Tool
    [infographic]

    Further reading

    Identify and Manage Reputational Risk Impacts on Your Organization

    Brand reputation is the most valuable asset an organization can protect.

    Analyst Perspective

    Organizations must diligently assess and protect their reputations, both in the market and internally.

    Social media, unprecedented access to good and bad information, and consumer reliance on others’ online opinions force organizations to dedicate more resources to protecting their brand reputation than ever before. Perceptions matter, and you should monitor and protect the perception of your organization with as much rigor as possible to ensure your brand remains recognizable and trusted.

    Photo of Frank Sewell, Research Director, Vendor Management, Info-Tech Research Group.

    Frank Sewell
    Research Director, Vendor Management
    Info-Tech Research Group

    Executive Summary

    Your Challenge

    Access to information about companies is more available to consumers than ever. A negative event could impact your organizational reputation at any time. As a result, organizations must implement mechanisms to monitor and manage how information is perceived to avoid potentially disastrous consequences to their brand reputation.

    Make sure you understand where negative events may come from and have a plan to manage the inevitable consequences.

    Common Obstacles

    Identifying and managing a vendor’s potential impact on your organization’s reputation requires efforts from multiple people in the organization across several functions. Those people all need coaching on the potential changes in the market and how social media can affect your brand.

    Organizational leadership is often caught unaware during crises, and their response plans lack the flexibility to adjust to significant market upheavals.

    Info-Tech’s Approach

    Vendor management practices educate organizations on the different potential risks to vendors in your market and suggest creative and alternative ways to avoid and help manage them.

    Prioritize and classify your vendors with quantifiable, standardized rankings.

    Prioritize focus on your high-risk vendors.

    Standardize your processes for identifying and monitoring vendor risks to manage potential impacts on your reputation and brand with our Reputational Risk Impact Tool.

    Info-Tech Insight

    Organizations must evolve their risk assessments to be more adaptive to respond to rapid changes in online media. Ongoing monitoring of social media and the vendors tied to their company is imperative to achieving success and avoiding reputational disasters.

    Info-Tech’s multi-blueprint series on vendor risk assessment

    There are many individual components of vendor risk beyond cybersecurity.

    Cube with each multiple colors on each face, similar to a Rubix cube, and individual components of vendor risk branching off of it: 'Financial', 'Reputational', 'Operational', 'Strategic', 'Security', and 'Regulatory & Compliance'.

    This series will focus on the individual components of vendor risk and how vendor management practices can facilitate organizations’ understanding of those risks.

    Out of scope:
    This series will not tackle risk governance, determining overall risk tolerance and appetite, or quantifying inherent risk.

    Reputational risk impacts

    Potential losses to the organization due to risks to its reputation and brand

    In this blueprint, we’ll explore reputational risks (risks to the brand reputation of the organization) and their impacts.

    Identify potentially negative events to assess the overall impact on your organization and implement adaptive measures to respond and correct.

    Cube with each multiple colors on each face, similar to a Rubix cube, and the vendor risk component 'Reputational' highlighted.

    Protect your most valuable asset: your brand

    25%

    of a company’s market value is due to reputation (Transmission Private, 2021)

    94%

    of consumers say that a bad review has convinced them to avoid a business (ReviewTrackers, 2022)

    14 hours

    is the average time it takes for a false claim to be corrected on social media (Risk Analysis, 2018)
    Image of an umbrella covering the word 'BRAND' and three arrows approaching from above.

    What is brand recognition?

    And the cost of rebranding

    Brand recognition is the ability of consumers to recognize an identifying characteristic of one company versus a competitor.” (Investopedia)

    Most trademark valuation is based directly on its projected future earning power, based on income history. For a new brand with no history, evaluators must apply experience and common sense to predict the brand's earning potential. They can also use feedback from industry experts, market surveys, and other studies.” (UpCounsel)

    The cost of rebranding for small to medium businesses is about 10 to 20% of the recommended overall marketing budget and can take six to eight months (Ignyte).

    Stock image of a house with a money sign chimney.

    "All we are at our core is our reputation and our brand, and they are intertwined." (Phil Bode, Principal Research Director, Info-Tech Research Group)

    What your vendor associations say about you

    Arrows of multiple colors coalescing in an Earth labelled 'Your Brand', and then a red arrow that reads 'Reputation' points to the terms on the right.

    Bad Customer Reviews

    Breach of Data

    Poor Security Posture

    Negative News Articles

    Public Lawsuits

    Poor Performance

    How a major vendor protects its brand

    An ideal state
    • There is a dedicated brand protection department.
    • All employees are educated annually on brand protection policies and procedures.
    • Brand protection is tied to cybersecurity.
    • The organization actively monitors its brand and reputation through various media formats.
    • The organization has criteria for assessing x-party vendors and holds them accountable through ongoing monitoring and validation of their activities.

    Brand Protection
    Done Right

    Sticker for a '5 Star Rating'.

    Never underestimate the power of local media on your profits

    Info-Tech Insight

    Keep in mind that too much exposure to media can be a negative in that it heightens the awareness of your organization to outside actors. If you do go through a period of increased exposure, make sure to advance your monitoring practices and vigilance.

    Story: Restaurant data breach

    Losing customer faith

    A popular local restaurant’s point of service (POS) machines were breached and the credit card data of their customers over a two-week period was stolen. The restaurant did the right thing: they privately notified the affected people, helped them set up credit monitoring services, and replaced their compromised POS system.

    Unfortunately, the local newspaper got wind of the breach. It published the story, leaving out that the restaurant had already notified affected customers and had replaced their POS machines.

    In response, the restaurant launched a campaign in the local paper and on social media to repair their reputation in the community and reassure people that they could safely transact at their business.

    For at least a month, the restaurant experienced a drastic decrease in revenue as customers either refused to come in to eat or paid only in cash. During this same period the restaurant was spending outside their budget on the advertising.
    Broken trust.

    Story: Monitor your subcontractors

    Trust but verify

    A successful general contractor with a reputation for fairness in their dealings needed a specialist to perform some expert carpentry work for a few of their clients.

    The contractor gave the specialist the clients’ contact information and trusted them to arrange the work.

    Weeks later, the contractor checked in with the clients and received a ton of negative feedback:

    • The specialist called them once and never called back.
    • The specialist refused to do the work as described and wanted to charge extra.
    • The specialist performed work to “fix” the issue but cut corners to lessen their costs.

    As a result, the contractor took extreme measures to regain the clients’ confidence and trust and lost other opportunities in the process.

    Stock image of a sad construction site supervisor.

    You work hard for your reputation. Don’t let others ruin it.

    Don’t forget to look within as well as without

    Stock image of a frustrated desk worker.

    Story: Internal reputation is vital

    Trust works both ways

    An organization’s relatively new IT and InfoSec department leadership have been upgrading the organization's systems and policies as fast as resources allow when the organization encounters a major breach of security.

    Trust in the developing IT and InfoSec departments' leadership wanes throughout the organization as people search for the root cause and blame the systems. This degradation of trust limits the effectiveness of the newly implemented process, procedures, and tools of the departments.

    The new leaders' abilities are called into question, and they must now rigorously defend and justify their decisions and positions to the executives and board.

    It will be some time before the two departments gain their prior trust and respect, and the new leaders face some tough times ahead regaining the organization's confidence.

    How could the new leaders approach the situation to mend their reputations in the wake of this (perhaps unfair) reputational hit?

    It is not enough to identify the potential risks; there must also be adequate controls in place to monitor and manage them

    Stock image of a fingerprint on a computer chip under a blacklight.

    Identify, manage, and monitor reputational risks

    Global markets
    • Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
    • Now more than ever, organizations need to be mindful of the larger global landscape and how their interactions within various regions can impact their reputation.
    Social media
    • Understanding how to monitor social media activity and online content will give you an edge in the current environment.
    • Changes in social media generally happen faster than companies can recognize them. If you are not actively monitoring those risks, the damage could set in before you even have a chance to respond.
    Global shortages
    • Organizations need to accept that shortages will recur periodically and that preparing for them will significantly increase the success potential of long-term plans.
    • Customers don’t always understand what is happening in the global supply chain and may blame you for poor service if you cannot meet demands as you have in the past.

    Which way is your reputation heading?

    • Do you understand and track items that might affect your reputation?
    • Do you understand the impact they may have on your business?

    Visualization of a Newton's Cradle perpetual motion device, aka clacky balls. The lifted ball is colored green with a smiley face and is labelled 'Your Brand Reputation'. The other four balls are red with a frowny face and are labelled 'Data Breach/ Lawsuit', 'Service Disruption', 'Customer Complaint', and 'Poor Delivery'.

    Identifying and understanding potential risks is essential to adapting to the ever-changing online landscape

    Info-Tech Insight

    Few organizations are good at identifying risks. As a result, almost none realistically plan to monitor, manage, and adapt their plans to mitigate those risks.

    Reputational risks

    Not protecting your brand can have disastrous consequences to your organization

    • Data breaches & lawsuits
    • Poor vendor performance
    • Service disruptions
    • Negative reviews

    Stock image of a smiling person on their phone rating something five stars.

    What to look for in vendors

    Identify potential reputational risk impacts
    • Check online reviews from both customers and employees.
    • Check news sites:
      • Has the vendor been affected by a breach?
      • Is the vendor frequently in the news – good or bad? Greater exposure can cause an uptick in hostile attacks, so make sure the vendor has adequate protections in line with its exposure.
    • Review its financials. Is it prime for an acquisition/bankruptcy or other significant change?
    • Review your contractual protections to ensure that you are made whole in the event something goes wrong. Has anything changed with the vendor that requires you to increase your protections?
    • Has anything changed in the vendor’s market? Is a competitor taking its business, or are its resources stretched on multiple projects due to increased demand?
    Illustration of business people in a city above various icons.

    Assessing Reputational Risk Impacts

    Zigzagging icons and numbers one through 7 alternating sides downward. Review Organizational Strategy
    Understand the organizational strategy to prepare for the “what if” game exercise.
    Identify & Understand Potential Risks
    Play the “what if” game with the right people at the table.
    Create a Risk Profile Packet for Leadership
    Pull all the information together in a presentation document.
    Validate the Risks
    Work with leadership to ensure that the proposed risks are in line with their thoughts.
    Plan to Manage the Risks
    Lower the overall risk potential by putting mitigations in place.
    Communicate the Plan
    It is important not only to have a plan but also to socialize it in the organization for awareness.
    Enact the Plan
    Once the plan is finalized and socialized put it in place with continued monitoring for success.
    (Adapted from Harvard Law School Forum on Corporate Governance)

    Insight Summary

    Reputational risk impacts are often unanticipated, causing catastrophic downstream effects. Continuously monitoring your vendors’ actions in the market can help organizations head off brand disasters before they occur.

    Insight 1

    Understanding how to monitor social media activity and online content will give you an edge in the current environment.

    Do you have dedicated individuals or teams to monitor your organization's online presence? Most organizations review and approve the online content, but many forget the need to have analysts reviewing what others are saying about them.

    Insight 2

    Organizations need to learn how to assess the likelihood of potential risks in the rapidly changing online environments and recognize how their partnerships and subcontractors’ actions can affect their brand.

    For example, do you understand how a simple news article raises your profile for short-term and long-term adverse events?

    Insight 3

    Socialize the risk management process throughout the organization to heighten awareness and enable employees to help protect the company’s reputation.

    Do you include a social media and brand protection policy in your annual education?

    Identify reputational risk

    Who should be included in the discussion?
    • While it is true that executive-level leadership defines the strategy for an organization, it is vital for those making decisions to make INFORMED decisions.
    • Getting input from your organization's marketing experts will enhance your brand's long-term protection.
    • Involving those who directly manage vendors and understand the market will aid in determining the forward path for relationships with your current vendors and identifying new emerging potential partners.
    • Organizations have a wealth of experience in their marketing departments that can help identify real-world negative scenarios.
    • Include vendor relationship managers to help track what is happening in the media for those vendors.
    Keep in mind: (R=L*I)
    Risk = Likelihood x Impact

    Impact tends to remain the same, while likelihood is a very flexible variable.

    Stock image of a flowchart asking 'Risk?', 'Yes', 'No'.

    Manage and monitor reputational risk impacts

    What can we realistically do about the risks?
    • Re-evaluate corporate policies frequently.
    • Ensure proper protections in contracts:
      • Limit the use of your brand name in the publicity and trademark clauses.
      • Make sure to include security protections for your data in the event of a breach; understand that reputation can rarely be made whole again once trust is breached.
    • Introduce continual risk assessment to monitor the relevant vendor markets.
    • Be adaptable and allow for innovations that arise from the current needs.
      • Capture lessons learned from prior incidents to improve over time and adjust your strategy based on the lessons.
    • Monitor your company’s and associated vendors’ online presence.
    • Track similar companies’ brand reputations to see how yours compares in the market.

    Social media is driving the need for perpetual diligence.

    Organizations need to monitor their brand reputation considering the pace of incidents in the modern age.

    Stock image of a person on a phone that is connected to other people.

    The “what if” game

    1-3 hours

    Input: List of identified potential risk scenarios scored by likelihood and financial impact, List of potential management of the scenarios to reduce the risk

    Output: Comprehensive reputational risk profile on the specific vendor solution

    Materials: Whiteboard/flip charts, Reputational Risk Impact Tool to help drive discussion

    Participants: Vendor Management Coordinator, Organizational Leadership, Operations Experts (SMEs), Legal/Compliance/Risk Manager, Marketing

    Vendor management professionals are in an excellent position to help senior leadership identify and pull together resources across the organization to determine potential risks. By playing the "what if" game and asking probing questions to draw out – or eliminate – possible negative outcomes, everyone involved adds their insight into parts of the organization to gather a comprehensive picture of potential impacts.

    1. Break into smaller groups (or if too small, continue as a single group).
    2. Use the Reputational Risk Impact Tool to prompt discussion on potential risks. Keep this discussion flowing organically to explore all potential risk but manage the overall process to keep the discussion on track.
    3. Collect the outputs and ask the subject matter experts for management options for each one in order to present a comprehensive risk strategy. You will use this to educate senior leadership so that they can make an informed decision to accept or reject the solution.

    Download the Reputational Risk Impact Tool

    Example: Low reputational risk

    We can see clearly in this example that the contractor suffered minimal impact from the specialist's behavior. Though they did take a hit to their overall reputation with a few customers, they should be able to course-correct with a minimal outlay of effort and almost no loss of revenue.

    Stock image of construction workers.

    Sample table of 'Sample Questions to Ask to Identify Reputational Impacts'. Column headers are 'Score', 'Weight', 'Question', and 'Comments or Notes'. At the bottom the 'Reputational Score' row has a low average score of '1.3' and '%100' total weight in their respective columns.

    Example: High reputational risk

    Note in the example how the tool can represent different weights for each of the criteria depending on your needs.

    Stock image of an older person looking out a window.

    Sample table of 'Sample Questions to Ask to Identify Reputational Impacts'. Column headers are 'Score', 'Weight', 'Question', and 'Comments or Notes'. At the bottom the 'Reputational Score' row has a high average score of '3.1' and '%100' total weight in their respective columns.

    Summary

    Be vigilant and adaptable to change
    • Organizations need to learn how to assess the likelihood of potential risks in the changing global markets and recognize how their partnerships and subcontracts affect their brand.
    • Understanding how to monitor social media activity and online content will give you an edge in the current environment.
    • Bring the right people to the table to outline potential risks to your organization’s brand reputation.
    • Socialize the risk management process throughout the organization to heighten awareness and enable employees to help protect the company’s reputation.
    • Incorporate lessons learned from incidents into your risk management process to build better plans for future issues.
    Stock image of a person's face overlaid with many different images.

    Organizations must evolve their risk assessments to be more adaptive to respond to global factors in the market.

    Ongoing monitoring of online media and the vendors tied to company visibility is imperative to avoiding disaster.

    Bibliography

    "The CEO Reputation Premium: Gaining Advantage in the Engagement Era." Weber Shandwick, March 2015. Accessed June 2022.

    Glidden, Donna. "Don't Underestimate the Need to Protect Your Brand in Publicity Clauses." Info-Tech Research Group, June 2022.

    Greenaway, Jordan. "Managing Reputation Risk: A start-to-finish guide." Transmission Private, July 2020. Accessed June 2022.

    Jagiello, Robert D., and Thomas T. Hills. “Bad News Has Wings: Dread Risk Mediates Social Amplification in Risk Communication.” Risk Analysis, vol. 38, no. 10, 2018, pp. 2193-2207.

    Kenton, Will. "Brand Recognition.” Investopedia, Aug. 2021. Accessed June 2022.

    Lischer, Brian. "How Much Does it Cost to Rebrand Your Company?" Ignyte, October 2017. Accessed June 2022.

    "Powerful Examples of How to Respond to Negative Reviews." ReviewTrackers, 16 Feb. 2022. Accessed June 2022.

    Tonello, Matteo. “Strategic Risk Management: A Primer for Directors.” Harvard Law School Forum on Corporate Governance, 23 Aug. 2012. Web.

    "Valuation of Trademarks: Everything You Need to Know." UpCounsel, 2022. Accessed June 2022.

    Related Info-Tech Research

    Sample of 'Assessing Financial Risk Management'. Identify and Manage Financial Risk Impacts on Your Organization
    • Identifying and managing a vendor’s potential financial impact requires multiple people in the organization across several functions – and those people all need educating on the potential risks.
    • Organizational leadership is often unaware of decisions on organizational risk appetite and tolerance, and they assume there are more protections in place against risk impact than there truly are.
    Sample of 'How to Assess Strategic Risk'. Identify and Manage Strategic Risk Impacts on Your Organization
    • Identifying and managing a vendor’s potential strategic impact requires multiple people in the organization across several functions – and those people all need coaching on the potential changes in the market and how these changes affect strategic plans.
    • Organizational leadership is often caught unaware during crises, and their plans lack the flexibility needed to adjust to significant market upheavals.
    Research coming soon. Jump Start Your Vendor Management Initiative
    • Vendor management is not “plug and play” – each organization’s vendor management initiative (VMI) needs to fit its culture, environment, and goals. The key is to adapt vendor management principles to fit your needs…not the other way around.
    • All vendors are not of equal importance to an organization. Classifying or segmenting your vendors allows you to focus your efforts on the most important vendors first, allowing your VMI to have the greatest impact possible.

    Research Contributors and Experts

    Frank Sewell

    Research Director
    Info-Tech Research Group

    Donna Glidden

    Research Director
    Info-Tech Research Group

    Steven Jeffery

    Principal Research Director
    Info-Tech Research Group

    Mark Roman

    Managing Partner
    Info-Tech Research Group

    Phil Bode

    Principal Research Director
    Info-Tech Research Group

    Sarah Pletcher

    Executive Advisor
    Info-Tech Research Group

    Scott Bickley

    Practice Lead
    Info-Tech Research Group

    Find Value With Cloud Asset Management

    • Buy Link or Shortcode: {j2store}61|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Asset Management
    • Parent Category Link: /asset-management
    • Spending on cloud platforms and software-as-a-service (SaaS) is growing, and with spending comes waste.
    • The barriers are drastically lower for purchasing SaaS and cloud services as compared to traditional IT components.
    • Skills gap: IT asset managers tend not to have the skills to optimize spending on cloud platforms.
    • New space, new tools: The IT asset management market space is still developing cloud asset management and SaaS management capabilities. Practitioners must rely on cloud optimization tools in the meantime.

    Our Advice

    Critical Insight

    • IT asset managers are uniquely suited to provide value here. They already optimize costs and manage assets.
    • Scope creep is a killer. Focus first on your highest value, highest risk cloud instances.
    • Don’t completely centralize. Central oversight is powerful, but outsource some responsibility to the business.

    Impact and Result

    • Introduce governance: Work with developers, power business users, and infrastructure groups to define a governance approach to cloud assets and to SaaS.
    • Standardize high-impact, low-effort cloud services: Focus your efforts where they will have the most value and in places where you can provide early value.
    • Update your processes: Ensure that your asset registers and your configuration management database is up to date when cloud assets are provisioned and quiesced.

    Find Value With Cloud Asset Management Research & Tools

    Start here – read the Executive Brief

    Read our concise Executive Brief to find out why you should implement IT asset management for cloud instances and SaaS, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Define cloud asset management

    Define when a cloud instance is an asset, and what it means for the asset to be managed.

    • Find Value With Cloud Asset Management – Phase 1: Define Cloud Asset Management
    • Cloud Asset Management Standard Operating Procedures
    • Cloud Instance Provisioning Standards Checklist

    2. Build cloud asset management practices

    Develop an approach to auditing and optimizing cloud assets.

    • Find Value With Cloud Asset Management – Phase 2: Build Cloud Asset Management Practices
    • Cloud Asset Management Policy
    • Monthly Cloud Asset Optimization Checklist
    • Strategic Infrastructure Roadmap Tool
    [infographic]

    Cost and Budget Management

    • Buy Link or Shortcode: {j2store}8|cart{/j2store}
    • Related Products: {j2store}8|crosssells{/j2store}
    • Up-Sell: {j2store}8|upsells{/j2store}
    • member rating overall impact: 9.5/10
    • member rating average dollars saved: $2,000
    • member rating average days saved: 5
    • Parent Category Name: Financial Management
    • Parent Category Link: /financial-management

    The challenge

    • IT is seen as a cost center in most organizations. Your IT spend is fuelled by negative sentiment instead of contributing to business value.

    • Budgetary approval is difficult, and in many cases, the starting point is lowering the cost-income ratio without looking at the benefits.
    • Provide the right amount of detail in your budgets to tell your investment and spending story. Align it with the business story. Too much detail only increases confusion, too little suspicion.

    Our advice

    Insight

    An effective IT budget complements the business story with how you will achieve the expected business targets.

    • Partner with the business to understand the strategic direction of the company and its future needs.
    • Know your costs and the value you will deliver.
    • Present your numbers and story clearly and credibly. Excellent delivery is part of good communication.
    • Guide your company by clearly explaining the implications of different choices they can make.

    Impact and results 

    • Get a head-start on your IT forecasting exercise by knowing the business strategy and what initiatives they will launch.
    • The coffee corner works! Pre-sell your ideas in quick chats.
    • Do not make innovation budgets bigger than they need to be. It undermines your credibility.
    • You must know your history to accurately forecast your IT operations cost and how it will evolve based on expected business changes.
    • Anticipate questions. IT discretionary proposals are often challenged. Think ahead of time about what areas your business partners will focus on and be ready with researched and credible responses.
    • When you have an optimized budget, tie further cost reductions to consequences in service delivery or deferred projects, or a changed operating model.

    The roadmap

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    Get started

    Our concise executive brief shows you why you should develop a budget based on value delivery. We'll show you our methodology and the ways we can help you in completing this.

    Plan for budget success

    • Build an IT Budget That Demonstrates Value Delivery – Phase 1: Plan (ppt)
    • IT Budget Interview Guide (doc)

    Build your budget.

    • Build an IT Budget That Demonstrates Value Delivery – Phase 2: Build (ppt)
    • IT Cost Forecasting Tool (xls)

    Sell your budget

    • Build an IT Budget That Demonstrates Value Delivery – Phase 3: Sell (ppt)
    • IT Budget Presentation (ppt)

     

    Tactics to Retain IT Talent

    • Buy Link or Shortcode: {j2store}549|cart{/j2store}
    • member rating overall impact: N/A
    • member rating average dollars saved: N/A
    • member rating average days saved: N/A
    • Parent Category Name: Engage
    • Parent Category Link: /engage
    • Regrettable turnover is impacting organizational productivity and leading to significant costs associated with employee departures and the recruitment required to replace them.
    • Many organizations focus on increasing engagement to improve retention, but this approach doesn’t address the entire problem.

    Our Advice

    Critical Insight

    • Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    Impact and Result

    • Build the case for creating retention plans by leveraging employee data and feedback to identify the key reasons for turnover that need to be addressed.
    • Target employee segments and work with management to develop solutions to retain top talent.

    Tactics to Retain IT Talent Research & Tools

    Besides the small introduction, subscribers and consulting clients within this management domain have access to:

    1. Tactics to Retain IT Talent Storyboard – Use this storyboard to develop a targeted talent retention plan to retain top and core talent in the organization.

    Integrate data from exit surveys and interviews, engagement surveys, and stay interviews to understand the most commonly cited reasons for employee departure in order to select and prioritize tactics that improve retention. This blueprint will help you identify reasons for regrettable turnover, select solutions, and create an action plan.

    • Tactics to Retain IT Talent Storyboard

    2. Retention Plan Workbook – Capture key information in one place as you work through the process to assess and prioritize solutions.

    Use this tool to document and analyze turnover data to find suitable retention solutions.

    • Retention Plan Workbook

    3. Stay Interview Guide – Managers will use this guide to conduct regular stay interviews with employees to anticipate and address turnover triggers.

    The Stay Interview Guide helps managers conduct interviews with current employees, enabling the manager to understand the employee's current engagement level, satisfaction with current role and responsibilities, suggestions for potential improvements, and intent to stay with the organization.

    • Stay Interview Guide

    4. IT Retention Solutions Catalog – Use this catalog to select and prioritize retention solutions across the employee lifecycle.

    Review best-practice solutions to identify those that are most suitable to your organizational culture and employee needs. Use the IT Retention Solutions Catalog to explore a variety of methods to improve retention, understand their use cases, and determine stakeholder responsibilities.

    • IT Retention Solutions Catalog
    [infographic]

    Workshop: Tactics to Retain IT Talent

    Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

    1 Identify Reasons for Regrettable Turnover

    The Purpose

    Identify the main drivers of turnover at the organization.

    Key Benefits Achieved

    Find out what to explore during focus groups.

    Activities

    1.1 Review data to determine why employees join, stay, and leave.

    1.2 Identify common themes.

    1.3 Prepare for focus groups.

    Outputs

    List of common themes/pain points recorded in the Retention Plan Workbook.

    2 Conduct Focus Groups

    The Purpose

    Conduct focus groups to explore retention drivers.

    Key Benefits Achieved

    Explore identified themes.

    Activities

    2.1 Conduct four 1-hour focus groups with the employee segment(s) identified in the pre-workshop activities.

    2.2 Info-Tech facilitators independently analyze results of focus groups and group results by theme.

    Outputs

    Focus group feedback.

    Focus group feedback analyzed and organized by themes.

    3 Identify Needs and Retention Initiatives

    The Purpose

    Home in on employee needs that are a priority.

    Key Benefits Achieved

    A list of initiatives to address the identified needs

    Activities

    3.1 Create an empathy map to identify needs.

    3.2 Shortlist retention initiatives.

    Outputs

    Employee needs and shortlist of initiatives to address them.

    4 Prepare to Communicate and Launch

    The Purpose

    Prepare to launch your retention initiatives.

    Key Benefits Achieved

    A clear action plan for implementing your retention initiatives.

    Activities

    4.1 Select retention initiatives.

    4.2 Determine goals and metrics.

    4.3 Plan stakeholder communication.

    4.4 Build a high-level action plan.

    Outputs

    Finalized list of retention initiatives.

    Goals and associated metrics recorded in the Retention Plan Workbook.

    Further reading

    Tactics to Retain IT Talent

    Keep talent from walking out the door by discovering and addressing moments that matter and turnover triggers.

    Executive Summary

    Your Challenge

    Many organizations are facing an increase in voluntary turnover as low unemployment, a lack of skilled labor, and a rise in the number of vacant roles have given employees more employment choices.

    Common Obstacles

    Regrettable turnover is impacting organizational productivity and leading to significant costs associated with employee departures and the recruitment required to replace them.

    Many organizations tackle retention from an engagement perspective: Increase engagement to improve retention. This approach doesn't consider the whole problem.

    Info-Tech's Approach

    Build the case for creating retention plans by leveraging employee data and feedback to identify the key reasons for turnover that need to be addressed.

    Target employee segments and work with management to develop solutions to retain top talent.

    Info-Tech Insight

    Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    This research addresses regrettable turnover

    This is an image of a flow chart with three levels. The top level has only one box, labeled Turnover.  the Second level has 2 boxes, labeled Voluntary, and Involuntary.  The third level has two boxes under Voluntary, labeled Non-regrettable: The loss of employees that the organization did not wish to keep, e.g. low performers, and Regrettable:  The loss of employees that the organization wishes it could have kept.

    Low unemployment and rising voluntary turnover makes it critical to focus on retention

    As the economy continues to recover from the pandemic, unemployment continues to trend downward even with a looming recession. This leaves more job openings vacant, making it easier for employees to job hop.

    This image contains a graph of the US Employment rate between 2020 - 2022 from the US Bureau of Economic Analysis and Bureau of Labor Statistics (BLS), 2022, the percentage of individuals who change jobs every one to five years from 2022 Job Seeker Nation Study, Jobvite, 2022, and voluntary turnover rates from BLS, 2022

    With more employees voluntarily choosing to leave jobs, it is more important than ever for organizations to identify key employees they want to retain and put plans in place to keep them.

    Retention is a challenge for many organizations

    The number of HR professionals citing retention/turnover as a top workforce management challenge is increasing, and it is now the second highest recruiting priority ("2020 Recruiter Nation Survey," Jobvite, 2020).

    65% of employees believe they can find a better position elsewhere (Legaljobs, 2021). This is a challenge for organizations in that they need to find ways to ensure employees want to stay at the organization or they will lose them, which results in high turnover costs.

    Executives and IT are making retention and turnover – two sides of the same coin – a priority because they cost organizations money.

    • 87% of HR professionals cited retention/turnover as a critical and high priority for the next few years (TINYpulse, 2020).
    • $630B The cost of voluntary turnover in the US (Work Institute, 2020).
    • 66% of organizations consider employee retention to be important or very important to an organization (PayScale, 2019).

    Improving retention leads to broad-reaching organizational benefits

    Cost savings: the price of turnover as a percentage of salary

    • 33% Improving retention can result in significant cost savings. A recent study found turnover costs, on average, to be around a third of an employee's annual salary (SHRM, 2019).
    • 37.9% of employees leave their organization within the first year. Employees who leave within the first 90 days of being hired offer very little or no return on the investment made to hire them (Work Institute, 2020).

    Improved performance

    Employees with longer tenure have an increased understanding of an organization's policies and processes, which leads to increased productivity (Indeed, 2021).

    Prevents a ripple effect

    Turnover often ripples across a team or department, with employees following each other out of the organization (Mereo). Retaining even one individual can often have an impact across the organization.

    Transfer of knowledge

    Retaining key individuals allows them to pass it on to other employees through communities of practice, mentoring, or other knowledge-sharing activities.

    Info-Tech Insight

    Improving retention goes beyond cost savings: Employees who agree with the statement "I expect to be at this organization a year from now" are 71% more likely to put in extra hours and 32% more likely to accomplish more than what is expected of their role (McLean & Company Engagement Survey, 2021; N=77,170 and 97,326 respectively).

    However, the traditional engagement-focused approach to retention is not enough

    Employee engagement is a strong driver of retention, with only 25% of disengaged employees expecting to be at their organization a year from now compared to 92% of engaged employees (McLean & Company Engagement Survey, 2018-2021; N=117,307).

    Average employee Net Promoter Score (eNPS)

    This image contains a graph of the Average employee Net Promoter Score (eNPS)

    Individual employee Net Promoter Scores (eNPS)

    This image contains a graph of the Individual employee Net Promoter Scores (eNPS)

    However, engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave.

    This analysis of McLean & Company's engagement survey results shows that while an organization's average employee net promoter score (eNPS) stays relatively static, at an individual level there is a huge amount of volatility.

    This demonstrates the need for an approach that is more capable of responding to or identifying employees' in-the-moment needs, which an annual engagement survey doesn't support.

    Turnover triggers and moments that matter also have an impact on retention

    Retention needs to be monitored throughout the employee lifecycle. To address the variety of issues that can appear, consider three main paths to turnover:

    1. Employee engagement – areas of low engagement.
    2. Turnover triggers that can quickly lead to departures.
    3. Moments that matter in the employee experience (EX).

    Employee engagement

    Engagement drivers are strong predictors of turnover.

    Employees who are highly engaged are 3.6x more likely to believe they will be with the organization 12 months from now than disengaged employees (McLean & Company Engagement Survey, 2018-2021; N=117,307).

    Turnover triggers

    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Turnover triggers are a cause for voluntary turnover more often than accumulated issues (Lee et al.).

    Moments that matter

    Employee experience is the employee's perception of the accumulation of moments that matter within their employee lifecycle.

    Retention rates increase from 21% to 44% when employees have positive experiences in the following categories: belonging, purpose, achievement, happiness, and vigor at work. (Workhuman, 2020).

    While managers do not directly impact turnover, they do influence the three main paths to turnover

    Research shows managers do not appear as one of the common reasons for employee turnover.

    Top five most common reasons employees leave an organization (McLean & Company, Exit Survey, 2018-2021; N=107 to 141 companies,14,870 to 19,431 responses).

    Turnover factorsRank
    Opportunities for career advancement1
    Satisfaction with my role and responsibilities2
    Base pay3
    Opportunities for career-related skill development4
    The degree to which my skills were used in my job5

    However, managers can still have a huge impact on the turnover of their team through each of the three main paths to turnover:

    Employee engagement

    Employees who believe their managers care about them as a person are 3.3x more likely to be engaged than those who do not (McLean & Company, 2021; N=105,186).

    Turnover triggers

    Managers who are involved with and aware of their staff can serve as an early warning system for triggers that lead to turnover too quickly to detect with data.

    Moments that matter

    Managers have a direct connection with each individual and can tailor the employee experience to meet the needs of the individuals who report to them.

    Gallup has found that 52% of exiting employees say their manager could have done something to prevent them from leaving (Gallup, 2019). Do not discount the power of managers in anticipating and preventing regrettable turnover.

    Addressing engagement, turnover triggers, and moments that matter is the key to retention

    This is an image of a flow chart with four levels. The top level has only one box, labeled Turnover.  the Second level has 2 boxes, labeled Voluntary, and Involuntary.  The third level has two boxes under Voluntary, labeled Non-regrettable, and Regrettable.  The fourth level has three boxes under Regrettable, labeled Employee Engagement, Turnover triggers, and Moments that matter

    Info-Tech Insight

    HR traditionally seeks to examine engagement levels when faced with retention challenges, but engagement is only a part of the full picture. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

    Follow Info-Tech's two-step process to create a retention plan

    1. Identify Reasons for Regrettable Turnover

    2. Select Solutions and Create an Action Plan

    Step 1

    Identify Reasons for Regrettable Turnover

    After completing this step you will have:

    • Analyzed and documented why employees join, stay, and leave your organization.
    • Identified common themes and employee needs.
    • Conducted employee focus groups and prioritized employee needs.

    Step 1 focuses on analyzing existing data and validating it through focus groups

    Employee engagement

    Employee engagement and moments that matter are easily tracked by data. Validating employee feedback data by speaking and empathizing with employees helps to uncover moments that matter. This step focuses on analyzing existing data and validating it through focus groups.

    Engagement drivers such as compensation or working environment are strong predictors of turnover.
    Moments that matter
    Employee experience (EX) is the employee's perception of the accumulation of moments that matter with the organization.
    Turnover triggers
    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Turnover triggers

    This step will not touch on turnover triggers. Instead, they will be discussed in step 2 in the context of the role of the manager in improving retention.

    Turnover triggers are events that act as shocks or catalysts that quickly lead to an employee's departure.

    Info-Tech Insight

    IT managers often have insights into where and why retention is an issue through their day-to-day work. Gathering detailed quantitative and qualitative data provides credibility to these insights and is key to building a business case for action. Keep an open mind and allow the data to inform your gut feeling, not the other way around.

    Gather data to better understand why employees join, stay, and leave

    Start to gather and examine additional data to accurately identify the reason(s) for high turnover. Begin to uncover the story behind why these employees join, stay, and leave your organization through themes and trends that emerge.

    Look for these icons throughout step 2.

    Join

    Why do candidates join your organization?

    Stay

    Why do employees stay with your organization?

    Leave

    Why do employees leave your organization?

    For more information on analysis, visualization, and storytelling with data, see Info-Tech's Start Making Data-Driven People Decisions blueprint.

    Employee feedback data to look at includes:

    Gather insights through:

    • Focus groups
    • Verbatim comments
    • Exit interviews
    • Using the employee value proposition (EVP) as a filter (does it resonate with the lived experience of employees?)

    Prepare to draw themes and trends from employee data throughout step 1.

    Uncover employee needs and reasons for turnover by analyzing employee feedback data.

    • Look for trends (e.g. new hires join for career opportunities and leave for the same reason, or most departments have strong work-life balance scores in engagement data).
    • Review if there are recurring issues being raised that may impact turnover.
    • Group feedback to highlight themes (e.g. lack of understanding of EVP).
    • Identify which key employee needs merit further investigation or information.

    This is an image showing how you can draw out themes and trends using employee data throughout step 1.

    Classify where key employee needs fall within the employee lifecycle diagram in tab 2 of the Retention Plan Workbook. This will be used in step 2 to pinpoint and prioritize solutions.

    Info-Tech Insight

    The employee lifecycle is a valuable way to analyze and organize engagement pain points, moments that matter, and turnover triggers. It ensures that you consider the entirety of an employee's tenure and the different factors that lead to turnover.

    Examine new hire data and begin to document emerging themes

    Join

    While conducting a high-level analysis of new hire data, look for these three key themes impacting retention:

    Issues or pain points that occurred during the hiring process.

    Reasons why employees joined your organization.

    The experience of their first 90 days. This can include their satisfaction with the onboarding process and their overall experience with the organization.

    Themes will help to identify areas of strength and weakness organization-wide and within key segments. Document in tab 3 of the Retention Plan Workbook.

    1. Start by isolating the top reasons employees joined your organization. Ask:
      • Do the reasons align with the benefits you associate with working at your organization?
      • How might this impact your EVP?
      • If you use a new hire survey, look at the results for the following questions:
      • For which of the following reasons did you apply to this organization?
      • For what reasons did you accept the job offer with this organization?
    2. then, examine other potential problem areas that may not be covered by your new hire survey, such as onboarding or the candidate experience during the hiring process.
      • If you conduct a new hire survey, look at the results in the following sections:
        • Candidate Experience
        • Acclimatization
        • Training and Development
        • Defining Performance Expectations

      Analyze engagement data to identify areas of strength that drive retention

      Employees who are engaged are 3.6x more likely to believe they will be with the organization 12 months from now (McLean & Company Engagement Survey, 2018-2021; N=117,307). Given the strength of this relationship, it is essential to identify areas of strength to maintain and leverage.

      1. Look at the highest-performing drivers in your organization's employee engagement survey and drivers that fall into the "leverage" and "maintain" quadrants of the priority matrix.
        • These drivers provide insight into what prompts broader groups of employees to stay.

      This is an image of a quadrant analysis, with the following quadrants in order from left to right, top to bottom.  Improve; Leverage; Evaluate; Maintain.

      1. Look into what efforts have been made to maintain programs, policies, and practices related to these drivers and ensure they are consistent across the entire organization.
      2. Document trends and themes related to engagement strengths in tab 2 of the Retention Plan Workbook.

      If you use Info-Tech's Engagement Survey, look in detail at what are classified as "Retention Drivers": total compensation, working environment, and work-life balance.

      Identify areas of weakness that drive turnover in your engagement data

      1. Look at the lowest-performing drivers in your organization's employee engagement survey and drivers that fall into the "improve" and "evaluate" quadrants of the priority matrix.
        • These drivers provide insight into what pushes employees to leave the organization.
      2. Delve into organizational efforts that have been made to address issues with the programs, policies, and practices related to these drivers. Are there any projects underway to improve them? What are the barriers preventing improvements?
      3. Document trends and themes related to engagement weaknesses in tab 2 of the Retention Plan Workbook.

      If you use a product other than Info-Tech's Engagement Survey, your results will look different. The key is to look at areas of weakness that emerge from the data.

      This is an image of a quadrant analysis, with the following quadrants in order from left to right, top to bottom.  Improve; Leverage; Evaluate; Maintain.

      If you use Info-Tech's Engagement Survey, look in detail at what are classified as "Retention Drivers": total compensation, working environment, and work-life balance.

      Mine exit surveys to develop an integrated, holistic understanding of why employees leave

      Conduct a high-level analysis of the data from your employee exit diagnostic. While analyzing this data, consider the following:

      • What are the trends and quantitative data about why employees leave your organization that may illuminate employee needs or issues at specific points throughout the employee lifecycle?
      • What are insights around your key segments? Data on key segments is easily sliced from exit survey results and can be used as a starting point for digging deeper into retention issues for specific groups.
      • Exit surveys are an excellent starting point. However, it is valuable to validate the data gathered from an exit survey using exit interviews.
      1. Isolate results for key segments of employees to target with retention initiatives (e.g. by age group or by department).
      2. Identify data trends or patterns over time; for example, that compensation factors have been increasing in importance.
      3. Document trends and themes taken from the exit survey results in tab 2 of the Retention Plan Workbook.

      If your organization conducts exit interviews, analyze the results alongside or in lieu of exit survey data.

      Compare new hire data with exit data to identify patterns and insights

      Determine if new hire expectations weren't met, prompting employees to leave your organization, to help identify where in the employee lifecycle issues driving turnover may be occurring.

      1. Look at your new hire data for the top reasons employees joined your organization.
        • McLean & Company's New Hire Survey database shows that the top three reasons candidates accept job offers on average are:
          1. Career opportunities
          2. Nature of the job
          3. Development opportunities
      2. Next, look at your exit data and the top reasons employees left your organization.
        1. McLean & Company's Exit Survey database shows that the top three reasons employees leave on average are:
          1. Opportunities for career advancement
          2. Base pay
          3. Satisfaction with my role and responsibilities
      3. Examine the results and ask:
        • Is there a link between why employees join and leave the organization?
        • Did they cite the same reasons for joining and for leaving?
        • What do the results say about what your employees do and do not value about working at your organization?
      4. Document the resulting insights in tab 2 of the Retention Plan Workbook.

      Example:

      A result where employees are leaving for the same reason they're joining the organization could signal a disconnect between your organization's employee value proposition and the lived experience.

      Revisit your employee value proposition to uncover misalignment

      Your employee value proposition (EVP), formal or informal, communicates the value your organization can offer to prospective employees.

      If your EVP is mismatched with the lived experience of your employees, new hires will be in for a surprise when they start their new job and find out it isn't what they were expecting.

      Forty-six percent of respondents who left a job within 90 days of starting cited a mismatch of expectations about their role ("Job Seeker Nation Study 2020," Jobvite, 2020).

      1. Use the EVP as a filter through which you look at all your employee feedback data. It will help identify misalignment between the promised and the lived experience.
      2. If you have EVP documentation, start there. If not, go to your careers page and put yourself in the shoes of a candidate. Ask what the four elements of an EVP look like for candidates:
        • Compensation and benefits
        • Day-to-day job elements
        • Working conditions
        • Organizational elements
      3. Next, compare this to your own day-to-day experiences. Does it differ drastically? Are there any contradictions with the lived experience at your organization? Are there misleading statements or promises?
      4. Document any insights or patterns you uncover in tab 2 of the Retention Plan Workbook.

      Conduct focus groups to examine themes

      Through focus groups, explore the themes you have uncovered with employees to discover employee needs that are not being met. Addressing these employee needs will be a key aspect of your retention plan.

      Identify employee groups who will participate in focus groups:

      • Incorporate diverse perspectives (e.g. employees, managers, supervisors).
      • Include employees from departments and demographics with strong and weak engagement for a full picture of how engagement impacts your employees.
      • Invite boomerang employees to learn why an individual might return to your organization after leaving.

      image contains two screenshots Mclean & Company's Standard Focus Group Guide.

      Customize Info-Tech's Standard Focus Group Guide based on the themes you have identified in tab 3 of the Retention Plan Workbook.

      The goal of the focus group is to learn from employees and use this information to design or modify a process, system, or other solution that impacts retention.

      Focus questions on the employees' personal experience from their perspective.

      Key things to remember:

      • It is vital for facilitators to be objective.
      • Keep an open mind; no feelings are wrong.
      • Beware of your own biases.
      • Be open and share the reason for conducting the focus groups.

      Info-Tech Insight

      Maintaining an open dialogue with employees will help flesh out the context behind the data you've gathered and allow you to keep in mind that retention is about people first and foremost.

      Empathize with employees to identify moments that matter

      Look for discrepancies between what employees are saying and doing.

      1. Say

      "What words or quotes did the employee use?"

      3.Think

      "What might the employee be thinking?"

      Record feelings and thoughts discussed, body language observed, tone of voice, and words used.

      Look for areas of negative emotion to determine the moments that matter that drive retention.

      2. Do

      "What actions or behavior did the employee demonstrate?"

      4. Feel

      "What might the employee be feeling?"

      Record them in tab 3 of the Retention Plan Workbook.

      5. Identify Needs

      "Needs are verbs (activities or desires), not nouns (solutions)"

      Synthesize focus group findings using Info-Tech's Empathy Map Template.

      6. Identify Insights

      "Ask yourself, why?"

      (Based on Stanford d.school Empathy Map Method)

      Distill employee needs into priority issues to address first

      Take employee needs revealed by your data and focus groups and prioritize three to five needs.

      Select a limited number of employee needs to develop solutions to ensure that the scope of the project is feasible and that the resources dedicated to this project are not stretched too thin. The remaining needs should not be ignored – act on them later.

      Share the needs you identify with stakeholders so they can support prioritization and so you can confirm their buy-in and approval where necessary.

      Ask yourself the following questions to determine your priority employee needs:

      • Which needs will have the greatest impact on turnover?
      • Which needs have the potential to be an easy fix or quick win?
      • Which themes or trends came up repeatedly in different data sources?
      • Which needs evoked particularly strong or negative emotions in the focus groups?

      This image contains screenshots of two table templates found in tab 5 of the Retention Plan Workbook

      In the Retention Plan Workbook, distill employee needs on tab 2 into three to five priorities on tab 5.

      Step 2

      Select Solutions and Create an Action Plan

      After completing this step, you will have:

      • Selected and prioritized solutions to address employee needs.
      • Created a plan to launch stay interviews.
      • Built an action plan to implement solutions.

      Select IT-owned solutions and implement people leader–driven initiatives

      Solutions

      First, select and prioritize solutions to address employee needs identified in the previous step. These solutions will address reasons for turnover that influence employee engagement and moments that matter.

      • Brainstorm solutions using the Retention Solutions Catalog as a starting point. Select a longlist of solutions to address your priority needs.
      • Prioritize the longlist of solutions into a manageable number to act on.

      People leaders

      Next, create a plan to launch stay interviews to increase managers' accountability in improving retention. Managers will be critical to solving issues stemming from turnover triggers.

      • Clarify the importance of harnessing the influence of people leaders in improving retention.
      • Discover what might cause individual employees to leave through stay interviews.
      • Increase trust in managers through training.

      Action plan

      Finally, create an action plan and present to senior leadership for approval.

      Look for these icons in the top right of slides in this step.

      Select solutions to employee needs, starting with the Retention Solutions Catalog

      Based on the priority needs you have identified, use the Retention Solutions Catalog to review best-practice solutions for pain points associated with each stage of the lifecycle.

      Use this tool as a starting point, adding to it and iterating based on your own experience and organizational culture and goals.

      This image contains three screenshots from Info-Tech's Retention Solutions Catalog.

      Use Info-Tech's Retention Solutions Catalog to start the brainstorming process and produce a shortlist of potential solutions that will be prioritized on the next slide.

      Info-Tech Insight

      Unless you have the good fortune of having only a few pain points, no single initiative will completely solve your retention issues. Combine one or two of these broad solutions with people-leader initiatives to ensure employee needs are addressed on an individual and an aggregate level.

      Prioritize solutions to be implemented

      Target efforts accordingly

      Quick wins are high-impact, low-effort initiatives that will build traction and credibility within the organization.

      Long-term initiatives require more time and need to be planned for accordingly but will still deliver a large impact. Review the planning horizon to determine how early these need to begin.

      Re-evaluate low-impact and low-effort initiatives and identify ones that either support other higher impact initiatives or have the highest impact to gain traction and credibility. Look for low-hanging fruit.

      Deprioritize initiatives that will take a high degree of effort to deliver lower-value results.

      When assessing the impact of potential solutions, consider:

      • How many critical segments or employees will this solution affect?
      • Is the employee need it addresses critical, or did the solution encompass several themes in the data you analyzed?
      • Will the success of this solution help build a case for further action?
      • Will the solution address multiple employee needs?

      Info-Tech Insight

      It's better to master a few initiatives than under-deliver on many. Start with a few solutions that will have a measurable impact to build the case for further action in the future.

      Solutions

      Low ImpactMedium ImpactLarge Impact
      Large EffortThis is an image of the used to help you prioritize solutions to be implemented.
      Medium Effort
      Low Effort

      Use tab 3 of the Retention Plan Workbook to prioritize your shortlist of solutions.

      Harness the influence of people leaders to improve employee retention

      Leaders at all levels have a huge impact on employees.

      Effective people leaders:

      • Manage work distribution.
      • Create a motivating work environment.
      • Provide development opportunities.
      • Ensure work is stimulating and challenging, but not overwhelming.
      • Provide clear, actionable feedback.
      • Recognize team member contributions.
      • Develop positive relationships with their teams.
      • Create a line of sight between what the employee is doing and what the organization's objectives are.

      Support leaders in recommitting to their role as people managers through Learning & Development initiatives with particular emphasis on coaching and building trust.

      For coaching training, see Info-Tech's Build a Better Manager: Team Essentials – Feedback and Coaching training deck.

      For more information on supporting managers to become better people leaders, see Info-Tech's Build a Better Manager: Manage Your People blueprint.

      "HR can't fix turnover. But leaders on the front line can."
      – Richard P. Finnegan, CEO, C-Suite Analytics

      Equip managers to conduct regular stay interviews to address turnover triggers

      Managers often have the most visibility into their employees' personal and work lives and have a key opportunity to anticipate and address turnover triggers.

      Stay interviews are an effective way of uncovering potential retention issues and allowing managers to act as an early warning system for turnover triggers.

      Examples of common turnover triggers and potential manager responses:

      • Moving, creating a long commute to the office.
        • Through stay interviews, a manager can learn that a long commute is an issue and can help find workarounds such as flexible/remote work options.
      • Not receiving an expected promotion.
        • A trusted manager can anticipate issues stemming from this, discuss why the decision was made, and plan development opportunities for future openings.

      Stay interview best practices

      1. Conducted by an employee's direct manager.
      2. Happen regularly as a part of an ongoing process.
      3. Based on the stay interview, managers produce a turnover forecast for each direct report.
        1. The method used by stay interview expert Richard P. Finnegan is simple: red for high risk, yellow for medium, and green for low.
      4. Provide managers with training and a rough script or list of questions to follow.
        1. Use and customize Info-Tech's Stay Interview Guide to provide a guide for managers on how to conduct a stay interview.
      5. Managers use the results to create an individualized retention action plan made up of concrete actions the manager and employee will take.

      Sources: Richard P. Finnegan, CEO, C-Suite Analytics; SHRM

      Build an action plan to implement the retention plan

      For each initiative identified, map out timelines and actions that need to be taken.

      When building actions and timelines:

      • Refer to the priority needs you identified in tab 4 of the Retention Plan Workbook and ensure they are addressed first.
      • Engage internal stakeholders who will be key to the development of the initiatives to ensure they have sufficient time to complete their deliverables.
        • For example, if you conduct manager training, Learning & Development needs to be involved in the development and launch of the program.
      • Include a date to revisit your baseline retention and engagement data in your project milestones.
      • Designate process owners for new processes such as stay interviews.

      Plan for stay interviews by determining:

      • Whether stay interviews will be a requirement for all employees.
      • How much flexibility managers will have with the process.
      • How you will communicate the stay interview approach to managers.
      • If manager training is required.
      • How managers should record stay interview data and how you will collect this data from them as a way to monitor retention issues.
        • For example, managers can share their turnover forecasts and action plans for each employee.

      Be clear about manager accountabilities for initiatives they will own, such as stay interviews. Plan to communicate the goals and timelines managers will be asked to meet, such as when they must conduct interviews or their responsibility to follow up on action items that come from interviews.

      Track project success to iterate and improve your solutions

      Analyze measurements

      • Regularly remeasure your engagement and retention levels to identify themes and trends that provide insights into program improvements.
      • For example, look at the difference in manager relationship score to see if training has had an impact, or look at changes in critical segment turnover to calculate cost savings.

      Revisit employee and manager feedback

      • After three to six months, conduct additional surveys or focus groups to determine the success of your initiatives and opportunities for improvement. Tweak the program, including stay interviews, based on manager and employee feedback.

      Iterate frequently

      • Revisit your initiatives every two or three years to determine if a refresh is necessary to meet changing organizational and employee needs and to update your goals and targets.

      Key insights

      Insight 1Insight 2Insight 3

      Retention and turnover are two sides of the same coin. You can't fix retention without first understanding turnover.

      Engagement surveys mask the volatility of the employee experience and hide the reason why individual employees leave. You must also talk to employees to understand the moments that matter and engage managers to understand turnover triggers.

      Improving retention isn't just about lowering turnover, it's about discovering what healthy retention looks like for your organization.

      Insight 4Insight 5Insight 6

      HR professionals often have insights into where and why retention is an issue. Gathering detailed employee feedback data through surveys and focus groups provides credibility to these insights and is key to building a case for action. Keep an open mind and allow the data to inform your gut feeling, not the other way around.

      Successful retention plans must be owned by both IT leaders and HR.

      IT leaders often have the most visibility into their employees' personal and work lives and have a key opportunity to anticipate and address turnover triggers.

      Stay interviews help managers anticipate potential retention issues on their teams.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Info-Tech AnalystsPre-workPost-work
      Client Data Gathering and PlanningImplementation Supported Through Analyst Calls

      1.1 Discuss participants, logistics, overview of workshop activities

      1.2 Provide support to client for below activities through calls.

      2.1 Schedule follow-up calls to work through implementation of retention solutions based on identified needs.
      Client

      1.Gather results of engagement survey, new hire survey, exit survey, and any exit and stay interview feedback.

      2.Gather and analyze turnover data.

      3.Identify key employee segment(s) and identify and organize participants for focus groups.

      4.Complete cost of turnover analysis.

      5.Review turnover data and prioritize list of employee segments.

      1.Obtain senior leader approval to proceed with retention plan.

      2.Finalize and implement retention solutions.

      3.Prepare managers to conduct stay interviews.

      4.Communicate next steps to stakeholders.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      ActivitiesDay 1Day 2Day 3Day 4
      Assess Current StateConduct Focus GroupsIdentify Needs and Retention InitiativesPrepare to Communicate and Launch

      1.1 Review data to determine why employees join, stay, and leave.

      1.2 Identify common themes.

      1.3 Prepare for focus groups.

      2.1 Conduct four 1-hour focus groups with the employee segment(s) identified in the pre-workshop activities..

      2.2 Info-Tech facilitators independently analyze results of focus groups and group results by theme.

      3.1 Create an empathy map to identify needs

      3.2 Shortlist retention initiatives

      4.1 Select retention initiatives

      4.2 Determine goals and metrics

      4.3 Plan stakeholder communication4.4 Build a high-level action plan

      Deliverables

      1.List of common themes/pain points recorded in the Retention Plan Workbook

      2.Plan for focus groups documented in the Focus Group Guide

      1.Focus group feedback

      2.Focus group feedback analyzed and organized by themes

      1.Employee needs and shortlist of initiatives to address them1.Finalized list of retention initiatives

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      “Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful.”

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostics and consistent frameworks used throughout all four options

      Research Contributors and Experts

      Jeff Bonnell
      VP HR
      Info-Tech Research Group

      Phillip Kotanidis
      CHRO
      Michael Garron Hospital

      Michael McGuire
      Director, Organizational Development
      William Osler Health System

      Dr. Iris Ware
      Chief Learning Officer
      City of Detroit

      Richard P. Finnegan
      CEO
      C-Suite Analytics

      Dr. Thomas Lee
      Professor of Management
      University of Washington

      Jane Moughon
      Specialist in increasing profits, reducing turnover, and maximizing human potential in manufacturing companies

      Lisa Kaste
      Former HR Director
      Citco

      Piyush Mathur
      Head of Workforce Analytics
      Johnson & Johnson

      Gregory P. Smith
      CEO
      Chart Your Course

      Works Cited

      "17 Surprising Statistics about Employee Retention." TINYpulse, 8 Sept. 2020. Web.
      "2020 Job Seeker Nation Study." Jobvite, April 2020. Web.
      "2020 Recruiter Nation Survey." Jobvite, 2020. Web.
      "2020 Retention Report: Insights on 2019 Turnover Trends, Reasons, Costs, & Recommendations." Work Institute, 2020. Web.
      "25 Essential Productivity Statistics for 2021." TeamStage, 2021. Accessed 22 Jun. 2021.
      Agovino, Theresa. "To Have and to Hold." SHRM, 23 Feb. 2019. Web.
      "Civilian Unemployment Rate." Bureau of Labor Statistics, June 2020. Web.
      Foreman, Paul. "The domino effect of chief sales officer turnover on salespeople." Mereo, 19 July 2018. Web.
      "Gross Domestic Product." U.S. Bureau of Economic Analysis, 27 May 2021. Accessed 22 Jun. 2020.
      Kinne, Aaron. "Back to Basics: What is Employee Experience?" Workhuman, 27August 2020. Accessed 21 Jun. 2021.
      Lee, Thomas W, et al. "Managing employee retention and turnover with 21st century ideas." Organizational Dynamics, vol 47, no. 2, 2017, pp. 88-98. Web.
      Lee, Thomas W. and Terence R. Mitchell. "Control Turnover by Understanding its Causes." The Blackwell Handbook of Principles of Organizational Behaviour. 2017. Print.
      McFeely, Shane, and Ben Wigert. "This Fixable Problem Costs U.S. Businesses $1 Trillion." Gallup. 13 March 2019. Web.
      "Table 18. Annual Quit rates by Industry and Region Not Seasonally Adjusted." Bureau of Labor Statistics. June 2021. Web.
      "The 2019 Compensation Best Practices Report: Will They Stay or Will They Go? Employee Retention and Acquisition in an Uncertain Economy." PayScale. 2019. Web.
      Vuleta, Branka. "30 Troubling Employee Retention Statistics." Legaljobs. 1 Feb. 2021. Web.
      "What is a Tenured Employee? Top Benefits of Tenure and How to Stay Engaged as One." Indeed. 22 Feb. 2021. Accessed 22 Jun. 2021.

      Develop a Business Continuity Plan

      • Buy Link or Shortcode: {j2store}411|cart{/j2store}
      • member rating overall impact: 9.1/10 Overall Impact
      • member rating average dollars saved: $37,093 Average $ Saved
      • member rating average days saved: 30 Average Days Saved
      • Parent Category Name: DR and Business Continuity
      • Parent Category Link: /business-continuity
      • Recent crises have increased executive awareness and internal pressure to create a business continuity plan (BCP).
      • Industry and government-driven regulations require evidence of sound business continuity practices.
      • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.
      • IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

      Our Advice

      Critical Insight

      • BCP requires input from multiple departments with different and sometimes conflicting objectives. There are typically few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.
      • As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but ultimately business leaders need to own the BCP – they know their processes, and therefore, their requirements to resume business operations better than anyone else.
      • The traditional approach to BCP is a massive project that most organizations can’t execute without hiring a consultant. To execute BCP in-house, carve up the task into manageable pieces as outlined in this blueprint.

      Impact and Result

      • Implement a structured and repeatable process that you apply to one business unit at a time to keep BCP planning efforts manageable.
      • Use the results of the pilot to identify gaps in your recovery plans and reduce overall continuity risk while continuing to assess specific risks as you repeat the process with additional business units.
      • Enable business leaders to own the BCP going forward. Develop a template that the rest of the organization can use.
      • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

      Develop a Business Continuity Plan Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should develop a business continuity plan, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify BCP maturity and document process dependencies

      Assess current maturity, establish a team, and choose a pilot business unit. Identify business processes, dependencies, and alternatives.

      • BCP Maturity Scorecard
      • BCP Pilot Project Charter Template
      • BCP Business Process Workflows Example (Visio)
      • BCP Business Process Workflows Example (PDF)

      2. Conduct a BIA to determine acceptable RTOs and RPOs

      Define an objective impact scoring scale, estimate the impact of downtime, and set recovery targets.

      • BCP Business Impact Analysis Tool

      3. Document the recovery workflow and projects to close gaps

      Build a workflow of the current steps for business recovery. Identify gaps and risks to recovery. Brainstorm and prioritize solutions to address gaps and mitigate risks.

      • BCP Tabletop Planning Template (Visio)
      • BCP Tabletop Planning Template (PDF)
      • BCP Project Roadmap Tool
      • BCP Relocation Checklists

      4. Extend the results of the pilot BCP and implement governance

      Present pilot project results and next steps. Create BCMS teams. Update and maintain BCMS documentation.

      • BCP Pilot Results Presentation
      • BCP Summary
      • Business Continuity Teams and Roles Tool

      5. Appendix: Additional BCP tools and templates

      Use these tools and templates to assist in the creation of your BCP.

      • BCP Recovery Workflow Example (Visio)
      • BCP Recovery Workflow Example (PDF)
      • BCP Notification, Assessment, and Disaster Declaration Plan
      • BCP Business Process Workarounds and Recovery Checklists
      • Business Continuity Management Policy
      • Business Unit BCP Prioritization Tool
      • Industry-Specific BIA Guidelines
      • BCP-DRP Maintenance Checklist
      • Develop a COVID-19 Pandemic Response Plan Storyboard
      [infographic]

      Workshop: Develop a Business Continuity Plan

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Define BCP Scope, Objectives, and Stakeholders

      The Purpose

      Define BCP scope, objectives, and stakeholders.

      Key Benefits Achieved

      Prioritize BCP efforts and level-set scope with key stakeholders.

      Activities

      1.1 Assess current BCP maturity.

      1.2 Identify key business processes to include in scope.

      1.3 Flowchart key business processes to identify business processes, dependencies, and alternatives.

      Outputs

      BCP Maturity Scorecard: measure progress and identify gaps.

      Business process flowcharts: review, optimize, and allow for knowledge transfer of processes.

      Identify workarounds for common disruptions to day-to-day continuity.

      2 Define RTOs and RPOs Based on Your BIA

      The Purpose

      Define RTOs and RPOs based on your BIA.

      Key Benefits Achieved

      Set recovery targets based business impact, and illustrate the importance of BCP efforts via the impact of downtime.

      Activities

      2.1 Define an objective scoring scale to indicate different levels of impact.

      2.2 Estimate the impact of downtime.

      2.3 Determine acceptable RTO/RPO targets for business processes based on business impact.

      Outputs

      BCP Business Impact Analysis: objective scoring scale to assess cost, goodwill, compliance, and safety impacts.

      Apply the scoring scale to estimate the impact of downtime on business processes.

      Acceptable RTOs/RPOs to dictate recovery strategy.

      3 Create a Recovery Workflow

      The Purpose

      Create a recovery workflow.

      Key Benefits Achieved

      Build an actionable, high-level, recovery workflow that can be adapted to a variety of different scenarios.

      Activities

      3.1 Conduct a tabletop exercise to determine current recovery procedures.

      3.2 Identify and prioritize projects to close gaps and mitigate recovery risks.

      3.3 Evaluate options for command centers and alternate business locations (i.e. BC site).

      Outputs

      Recovery flow diagram – current and future state

      Identify gaps and recovery risks.

      Create a project roadmap to close gaps.

      Evaluate requirements for alternate business sites.

      4 Extend the Results of the Pilot BCP and Implement Governance

      The Purpose

      Extend the results of the pilot BCP and implement governance.

      Key Benefits Achieved

      Outline the actions required for the rest of your BCMS, and the required effort to complete those actions, based on the results of the pilot.

      Activities

      4.1 Summarize the accomplishments and required next steps to create an overall BCP.

      4.2 Identify required BCM roles.

      4.3 Create a plan to update and maintain your overall BCP.

      Outputs

      Pilot BCP Executive Presentation

      Business Continuity Team Roles & Responsibilities

      3. Maintenance plan and BCP templates to complete the relevant documentation (BC Policy, BCP Action Items, Recovery Workflow, etc.)

      Further reading

      Develop a Business Continuity Plan

      Streamline the traditional approach to make BCP development manageable and repeatable.

      Analyst Perspective

      A BCP touches every aspect of your organization, making it potentially the most complex project you’ll take on. Streamline this effort or you won’t get far.

      None of us needs to look very far to find a reason to have an effective business continuity plan.

      From pandemics to natural disasters to supply chain disruptions to IT outages, there’s no shortage of events that can disrupt your complex and interconnected business processes. How in the world can anyone build a plan to address all these threats?

      Don’t try to boil the ocean. Use these tactics to streamline your BCP project and stay on track:

      • Focus on one business unit at a time. Keep the effort manageable, establish a repeatable process, and produce deliverables that provide a starting point for the rest of the organization.
      • Don’t start with an extensive risk analysis. It takes too long and at the end you’ll still need a plan to resume business operations following a disruption. Rather than trying to predict what could cause a disruption, focus on how to recover.
      • Keep your BCP documentation concise. Use flowcharts, checklists, and diagrams instead of traditional manuals.

      No one can predict every possible disruption, but by following the guidance in this blueprint, you can build a flexible continuity plan that allows you to withstand the threats your organization may face.

      Frank Trovato

      Research Director,
      IT Infrastructure & Operations Practice
      Info-Tech Research Group

      Andrew Sharp

      Senior Research Analyst,
      IT Infrastructure & Operations Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Recent crises have increased executive awareness and internal pressure to create a BCP.
      • Industry- and government-driven regulations require evidence of sound business continuity practices.
      • Customers demand their vendors provide evidence of a workable BCP prior to signing a contract.

      IT leaders, because of their cross-functional view and experience with incident management and DR, are often asked to lead BCP efforts.

      Common Obstacles

      • IT managers asked to lead BCP efforts are dealing with processes and requirements beyond IT and outside of their control.
      • BCP requires input from multiple departments with different and sometimes conflicting objectives.
      • Typically there are few, if any, dedicated resources for BCP, so it can't be a full-time, resource-intensive project.

      Info-Tech’s Approach

      • Focus on implementing a structured and repeatable process that can be applied to one business unit at a time to avoid BCP from becoming an overwhelming project.
      • Enable business leaders to own the BCP going forward by establishing a template that the rest of the organization can follow.
      • Leverage BCP outcomes to refine IT DRP recovery objectives and achieve DRP-BCP alignment.

      Info-Tech Insight

      As an IT leader you have the skill set and organizational knowledge to lead a BCP project, but you must enable business leaders to own their department’s BCP practices and outputs. They know their processes and, therefore, their requirements to resume business operations better than anyone else.

      Use this research to create business unit BCPs and structure your overall BCP

      A business continuity plan (BCP) consists of separate but related sub-plans, as illustrated below. This blueprint enables you to:

      • Develop a BCP for a selected business unit (as a pilot project), and thereby establish a methodology that can be repeated for remaining business units.
      • Through the BCP process, clarify requirements for an IT disaster recovery plan (DRP). Refer to Info-Tech’s Disaster Recovery Planning workshop for instructions on how to create an IT DRP.
      • Implement ongoing business continuity management to govern BCP, DRP, and crisis management.

      Overall Business Continuity Plan

      IT Disaster Recovery Plan

      A plan to restore IT application and infrastructure services following a disruption.

      Info-Tech’s disaster recovery planning blueprint provides a methodology for creating the IT DRP. Leverage this blueprint to validate and provide inputs for your IT DRP.

      BCP for Each Business Unit

      A set of plans to resume business processes for each business unit. This includes:

      • Identifying business processes and dependencies.
      • Defining an acceptable recovery timeline based on a business impact analysis.
      • Creating a step-by-step recovery workflow.

      Crisis Management Plan

      A plan to manage a wide range of crises, from health and safety incidents to business disruptions to reputational damage.

      Info-Tech’s Implement Crisis Management Best Practices blueprint provides a framework for planning a response to any crisis, from health and safety incidents to reputational damage.

      IT leaders asked to develop a BCP should start with an IT Disaster Recovery Plan

      It’s a business continuity plan. Why should you start continuity planning with IT?

      1. IT services are a critical dependency for most business processes. Creating an IT DRP helps you mitigate a key risk to continuity quicker than it takes to complete your overall BCP, and you can then focus on other dependencies such as people, facilities, and suppliers.
      2. A BCP requires workarounds for IT failures. But it’s difficult to plan workarounds without a clear understanding of the potential IT downtime and data loss. Your DRP will answer those questions, and without a DRP, BCP discussions can get bogged down in IT discussions. Think of payroll as an example: if downtime might be 24 hours, the business might simply wait for recovery; if downtime might be a week, waiting it out is not an option.
      3. As an IT manager, you can develop an IT DRP primarily with resources within your control. That makes it an easier starting point and puts IT in a better position to shift responsibility for BCP to business leaders (where it should reside) since essentially the IT portion is done.

      Create a Right-Sized Disaster Recovery Plan today.

      Modernize the BCP

      If your BCP relies heavily on paper-based processes as workarounds, it’s time to update your plan.

      Back when transactions were recorded on paper and then keyed into the mainframe system later, it was easier to revert to deskside processes. There is very little in the way of paper-based processes anymore, and as a result, it is increasingly difficult to resume business processes without IT.

      Think about your own organization. What IT system(s) are absolutely critical to business operations? While you might be able to continue doing business without IT, this requires regular preparation and training. It’s likely a completely offline process and won’t be a viable workaround for long even if staff know how to do the work. If your data center and core systems are down, technology-enabled workarounds (such as collaboration via mobile technologies or cloud-based solutions) could help you weather the outage, and may be more flexible and adaptable for day-to-day work.

      The bottom line:

      Technology is a critical dependency for business processes. Consider the role IT systems play as process dependencies and as workarounds as part of continuity planning.

      Info-Tech’s approach

      The traditional approach to BCP takes too long and produces a plan that is difficult to use and maintain.

      The Problem: You need to create a BCP, but don’t know where to start.

      • BCP is being demanded more and more to comply with regulations, mitigate business risk, meet customer demands, and obtain insurance.
      • IT leaders are often asked to lead BCP.

      The Complication: A traditional BCP process takes longer to show value.

      • Traditional consultants don’t usually have an incentive to accelerate the process.
      • At the same time, self-directed projects with no defined process go months without producing useful deliverables.
      • The result is a dense manual that checks boxes but isn’t maintainable or usable in a crisis.

      A pie chart is separated into three segments, Internal Mandates 43%, Customer Demands 23%, and Regulatory Requirements 34%. The bottom of the image reads Source: Info-Tech Research Group.

      The Info-Tech difference:

      Use Info-Tech’s methodology to right-size and streamline the process.

      • Reduce required effort. Keep the work manageable and maintain momentum by focusing on one business unit at a time; allow that unit to own their BCP.
      • Prioritize your effort. Evaluate the current state of your BCP to identify the steps that are most in need of attention.
      • Get valuable results faster. Functional deliverables and insights from the first business unit’s BCP can be leveraged by the entire organization (e.g. communication, assessment, and BC site strategies).

      Expedite BCP development

      Info-Tech’s Approach to BCP:

      • Start with one critical business unit to manage scope, establish a repeatable process, and generate deliverables that become a template for remaining business units.
      • Resolve critical gaps as you identify them, generating early value and risk mitigation.
      • Create concise, practical documentation to support recovery.

      Embed training and awareness throughout the planning process.

      BCP for Business Unit A:

      Scope → Pilot BIA → Response Plan → Gap Analysis

      → Lessons Learned:

      • Leverage early results to establish a BCM framework.
      • Take action to resolve critical gaps as they are identified.
      • BCP for Business Units B through N.
      • Scope→BIA→Response Plan→Gap Analysis

      = Ongoing governance, testing, maintenance, improvement, awareness, and training.

      By comparison, a traditional BCP approach takes much longer to mitigate risk:

      • An extensive, upfront commitment of time and resources before defining incident response plans and mitigating risk.
      • A “big bang” approach that makes it difficult to predict the required resourcing and timelines for the project.

      Organizational Risk Assessment and Business Impact Analysis → Solution Design to Achieve Recovery Objectives → Create and Validate Response Plans

      Case Study

      Continuity Planning Supports COVID-19 Response

      Industry: Non-Profit
      Source: Info-Tech Advisory Services

      A charitable foundation for a major state university engaged Info-Tech to support the creation of their business continuity plan.

      With support from Info-Tech analysts and the tools in this blueprint, they worked with their business unit stakeholders to identify recovery objectives, confirm recovery capabilities and business process workarounds, and address gaps in their continuity plans.

      Results

      The outcome wasn’t a pandemic plan – it was a continuity plan that was applicable to pandemics. And it worked. Business processes were prioritized, gaps in work-from-home and business process workarounds had been identified and addressed, business leaders owned their plan and understood their role in it, and IT had clear requirements that they were able and ready to support.

      “The work you did here with us was beyond valuable! I wish I could actually explain how ready we really were for this…while not necessarily for a pandemic, we were ready to spring into action, set things up, the priorities were established, and most importantly some of the changes we’ve made over the past few years helped beyond words! The fact that the groups had talked about this previously almost made what we had to do easy.“ -- VP IT Infrastructure

      Download the BCP Case Study

      Project Overview: BCP

      Phases Phase 1: Identify BCP Maturity and Document Process Dependencies Phase 2: Conduct a BIA to Determine Acceptable RTOs and RPOs Phase 3: Document the Recovery Workflow and Projects to Close Gaps Phase 4: Extend the Results of the Pilot BCP and Implement Governance
      Steps 1.1 Assess current BCP maturity 2.1 Define an objective impact scoring scale 3.1 Determine current recovery procedures 4.1 Consolidate BCP pilot insights to support an overall BCP project plan
      1.2 Establish the pilot BCP team 2.2 Estimate the impact of downtime 3.2 Identify and prioritize projects to close gaps 4.2 Outline a business continuity management (BCM) program
      1.3 Identify business processes, dependencies, and alternatives 2.3 Determine acceptable RTO/RPO targets 3.3 Evaluate BC site and command center options 4.3 Test and maintain your BCP
      Tools and Templates

      BCP Business Impact Analysis Tool

      Results Presentation

      BCP Maturity Scorecard

      Tabletop Planning Template

      BCP Summary

      Pilot Project Charter

      Recovery Workflow Examples

      Business Continuity Teams and Roles

      Business Process Workflows Examples

      BCP Project Roadmap

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      BCP Business Impact Analysis Tool: Conduct and document a business impact analysis using this document.

      BCP Recovery Workflows Example: Model your own recovery workflows on this example.

      BCP Project Roadmap: Use this tool to prioritize projects that can improve BCP capabilities and mitigate gaps and risks.

      BCP Relocation Checklists: Plan for and manage a site relocation – whether to an alternate site or work from home.

      Key deliverable:

      BCP Summary Document

      Summarize your organization's continuity capabilities and objectives in a 15-page, easy-to-consume template.

      This document consolidates data from the supporting documentation and tools to the right.

      Download Info-Tech’s BCP Summary Document

      Insight summary

      Focus less on risk, and more on recovery

      Avoid focusing on risk and probability analysis to drive your continuity strategy. You never know what might disrupt your business, so develop a flexible plan to enable business resumption regardless of the event.

      Small teams = good pilots

      Choose a small team for your BCP pilot. Small teams are better at trialing new techniques and finding new ways to think about problems.

      Calculate downtime impact

      Develop and apply a scoring scale to develop a more-objective assessment of downtime impact for the organization. This will help you prioritize recovery.

      It’s not no, but rather not now…

      You can’t address all the organization’s continuity challenges at once. Prioritize high value, low effort initiatives and create a long-term roadmap for the rest.

      Show Value Now

      Get to value quickly. Start with one business unit with continuity challenges, and a small, focused project team who can rapidly learn the methodology, identify continuity gaps, and define solutions that can also be leveraged by other departments right away.

      Lightweight Testing Exercises

      Outline recovery capabilities using lightweight, low risk tabletop planning exercises. Our research shows tabletop exercises increase confidence in recovery capabilities almost as much as live exercises, which carry much higher costs and risks.

      Blueprint benefits

      Demonstrate compliance with demands from regulators and customers

      • Develop a plan that satisfies auditors, customers, and insurance providers who demand proof of a continuity plan.
      • Demonstrate commitment to resilience by identifying gaps in current capabilities and projects to overcome those gaps.
      • Empower business users to develop their plans and perform regular maintenance to ensure plans don’t go stale.
      • Establish a culture of business readiness and resilience.

      Leverage your BCP to drive value (Business Benefits)

      • Enable flexible, mobile, and adaptable business operations that can overcome disruptions large and small. This includes making it easier to work remotely in response to pandemics or facility disruptions.
      • Clarify the risk of the status quo to business leaders so they can make informed decisions on where to invest in business continuity.
      • Demonstrate to customers your ability to overcome disruptions and continue to deliver your services.

      Info-Tech Advisory Services lead to Measurable Value

      Info-Tech members told us they save an average of $44,522 and 23 days by working with an Info-Tech analyst on BCP (source: client response data from Info-Tech's Measured Value Survey).

      Why do members report value from analyst engagement?

      1. Expert advice on your specific situation to overcome obstacles and speed bumps.
      2. Structure the project and stay on track.
      3. Review project deliverables and ensure the process is applied properly.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation

      “Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track.”

      Workshop

      “We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place.”

      Consulting

      “Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project.”

      Diagnostic and consistent frameworks are used throughout all four options.

      Guided Implementation

      Your Trusted Advisor is a call away.

      A Guided Implementation (GI) is series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between eight to twelve calls over the course of four to six months.

      Scoping

      Call 1: Scope requirements, objectives, and stakeholders. Identify a pilot BCP project.

      Business Processes and Dependencies

      Calls 2 - 4: Assess current BCP maturity. Create business process workflows, dependencies, alternates, and workarounds.

      Conduct a BIA

      Calls 5 – 7: Create an impact scoring scale and conduct a BIA. Identify acceptable RTO and RPO.

      Recovery Workflow

      Calls 8 – 9: Create a recovery workflow based on tabletop planning.

      Documentation & BCP Framework

      Call 10: Summarize the pilot results and plan next steps. Define roles and responsibilities. Make the case for a wider BCP program.

      Workshop Overview

      Contact your account representative for more information.

      workshops@infotech.com | 1-888-670-8889

      Day 1 Day 2 Day 3 Day 4 Day 5
      Identify BCP Maturity, Key Processes, and Dependencies Conduct a BIA to Determine Acceptable RTOs and RPOs Document the Current Recovery Workflow and Projects to Close Gaps Identify Remaining BCP Documentation and Next Steps Next Steps and Wrap-Up (offsite)
      Activities

      1.1 Assess current BCP maturity.

      1.2 Identify key business processes to include in scope.

      1.3 Create a flowchart for key business processes to identify business processes, dependencies, and alternatives.

      2.1 Define an objective scoring scale to indicate different levels of impact.

      2.2 Estimate the impact of a business disruption on cost, goodwill, compliance, and health & safety.

      2.3 Determine acceptable RTOs/RPOs for selected business processes based on business impact.

      3.1 Review tabletop planning – what is it, how is it done?

      3.2 Walk through a business disruption scenario to determine your current recovery timeline, RTO/RPO gaps, and risks to your ability to resume business operations.

      3.3 Identify and prioritize projects to close RTO/RPO gaps and mitigate recovery risks.

      4.1 Assign business continuity management (BCM) roles to govern BCP development and maintenance, as well as roles required to execute recovery.

      4.2 Identify remaining documentation required for the pilot business unit and how to leverage the results to repeat the methodology for remaining business units.

      4.3 Workshop review and wrap-up.

      5.1 Finalize deliverables for the workshop.

      5.2 Set up review time for workshop outputs and to discuss next steps.

      Deliverables
      1. Baseline BCP maturity status
      2. Business process flowcharts
      3. Business process dependencies and alternatives recorded in the BIA tool
      1. Potential impact of a business disruption quantified for selected business processes.
      2. Business processes criticality and recovery priority defined
      3. Acceptable RTOs/RPOs defined based on business impact
      1. Current-state recovery workflow and timeline.
      2. RTO/RPO gaps identified.
      3. BCP project roadmap to close gaps
      1. BCM roles and responsibilities defined
      2. Workshop results deck; use this to communicate pilot results and next steps
      1. Finalized deliverables

      Phase 1

      Identify BCP Maturity and Document Process Dependencies

      Phase 1

      1.1 Assess Current BCP Maturity

      1.2 Establish the pilot BCP team

      1.3 Identify business processes, dependencies, and alternatives

      Insights & Outcomes

      Define the scope for the BCP project: assess the current state of the plan, create a pilot project team and pilot project charter, and map the business processes that will be the focus of the pilot.

      Participants

      • BCP Coordinator
      • BCP Executive Sponsor
      • Pilot Business Unit Manager & Process SMEs

      Step 1.1

      Assess current BCP Maturity

      This step will walk you through the following activities:

      • Complete Info-Tech’s BCP Maturity Scorecard

      This step involves the following participants:

      • Executive Sponsor
      • BCP Coordinator

      You'll use the following tools & templates:

      Outcomes & Insights

      Establish current BCP maturity using Info-Tech’s ISO 22301-aligned BCP Maturity Scorecard.

      Evaluate the current state of your continuity plan

      Use Info-Tech’s Maturity Scorecard to structure and accelerate a BCP maturity assessment.

      Conduct a maturity assessment to:

      • Create a baseline metric so you can measure progress over time. This metric can also drive buy-in from senior management to invest time and effort into your BCP.
      • Understand the scope of work to create a complete business continuity plan.
      • Measure your progress and remaining gaps by updating your assessment once you’ve completed the activities in this blueprint.

      This blueprint primarily addresses the first four sections in the scorecard, which align with the creation of the core components of your business continuity plan.

      Info-Tech’s BCP Maturity Scorecard

      Info-Tech’s maturity scorecard is aligned with ISO 22301, the international standard that describes the key elements of a functioning business continuity management system or program – the overarching set of documents, practices, and controls that support the ongoing creation and maintenance of your BCP. A fully functional BCMS goes beyond business continuity planning to include crisis management, BCP testing, and documentation management.

      Audit tools tend to treat every bullet point in ISO 22301 as a separate requirement – which means there’s almost 400 lines to assess. Info-Tech’s BCP Maturity Scorecard has synthesized key requirements, minimizing repetition to create a high-level self-assessment aligned with the standard.

      A high score is a good indicator of likely success with an audit.

      Download Info-Tech's BCP Maturity Scorecard

      Tool: BCP Maturity Scorecard

      Assess your organization’s BCP capabilities.

      Use Info-Tech’s BCP Maturity Scorecard to:

      • Assess the overall completeness of your existing BCP.
      • Track and demonstrate progress towards completion as you work through successive planning iterations with additional business units.
      1. Download a copy of the BCP Maturity Scorecard. On tab 1, indicate the percent completeness for each item using a 0-10 scale (0 = 0% complete, 10 = 100% complete).
      2. If you anticipate improvements in a certain area, make note of it in the “Comments” column.
      3. Review a visual representation of your overall scores on tab 2.

      Download Info-Tech's BCP Maturity Scorecard

      "The fact that this aligns with ISO is huge." - Dr. Bernard Jones MBCI, CBCP

      Step 1.2

      Establish the pilot BCP team

      This step will walk you through the following activities:

      • Assign accountability, responsibility, and roles.
      • Develop a project charter.
      • Identify dependencies and alternates for those dependencies.

      This step involves the following participants:

      • Executive Sponsor
      • BCP Coordinator

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Assign roles and responsibilities for the BCP pilot project. Set milestones and timelines for the pilot.

      Take a pilot approach for BCP

      Limit the scope of an initial BCP project to get to value faster.

      Pilot Project Goals

      • Establish a repeatable methodology that fits your organization and will accelerate BCP development, with tangible deliverables that provide a template for the rest of the business.
      • Identify high-priority business continuity gaps for the pilot business unit, many of which will also apply to the overall organization.
      • Identify initiatives to start addressing gaps now.
      • Enable business users to learn the BCP methodology and toolset so they can own and maintain their business unit BCPs.

      Accomplishments expected:

      • Define key business processes and process dependencies, and alternatives if dependencies are not available.
      • Classify key business processes by criticality for one business unit, using an objective impact scoring scale.
      • Set recovery objectives for these key processes.
      • Document workarounds and recovery plans.
      • Identify gaps in recovery plans and list action items to mitigate risks.
      • Develop a project plan to structure a larger continuity project.

      What not to expect from a pilot project:

      • A complete organizational BCP (the pilot is a strong starting point).
      • Implemented solutions to all BCP gaps (proposed solutions will need to be evaluated first).

      Structure IT’s role in continuity planning

      Clearly define IT’s role in the pilot BCP project to deliver a successful result that enables business units to own BCP in the future.

      Though IT is a critical dependency for most processes, IT shouldn’t own the business continuity plan. IT should be an internal BCP process consultant, and each business unit must own their plan.

      IT should be an internal BCP consultant.

      • IT departments interact with all business units, which gives IT leaders at least a high-level understanding of business operations across the organization.
      • IT leaders typically also have at least some knowledge of disaster recovery, which provides a foundation for tackling BCP.
      • By contrast, business leaders often have little or no experience with disaster recovery, and don’t have the same level of experience as IT when it comes to working with other business units.

      Why shouldn’t IT own the plan?

      • Business unit managers have the authority to direct resources in their department to participate in the BCP process.
      • Business users are the experts in their processes, and are in the best position to identify dependencies, downtime impacts, recovery objectives, and viable solutions (e.g., acceptable alternate sites or process workarounds).
      • Ultimately, business unit managers and executives must decide whether to mitigate, accept, or transfer risks.

      Info-Tech Insight

      A goal of the pilot is to seed success for further planning exercises. This is as much about demonstrating the value of continuity planning to the business unit, and enabling them to own it, as it is about implementing the methodology successfully.

      Create a RACI matrix for the pilot

      Assemble a small, focused team for the pilot project empowered to discover, report, and present possible solutions to continuity planning challenges in your organization.

      Outline roles and responsibilities on the pilot team using a “RACI” exercise. Remember, only one party can be ultimately accountable for the work being completed.

      Example Pilot BCP Project RACI

      Board Executive Team BCP Executive Sponsor BCP Team Leader BCP Coordinator Pilot Bus. Unit Manager Expert Bus. Unit Staff IT Manager
      Communicate BCP project status I I I A R C C I
      Assign resources to pilot BCP project A R C R C R
      Conduct continuity planning activities I A/R R R R R
      Create pilot BCP deliverables I A R R C C C
      Manage BCP documentation I A C R I C C
      Integrate results into BCMS I I A R R I C C
      Create overall BCP project plan I I A R C C

      R: Responsible for doing the work.

      A: Accountable to ensure the activity/work happens.

      C: Consulted prior to decision or action.

      I: Informed of the decision/action once it’s made.

      "Large teams excel at solving problems, but it is small teams that are more likely to come up with new problems for their more sizable counterparts to solve." – Wang & Evans, 2019

      Info-Tech Insight

      Small teams tend to be better at trialing new techniques and finding new ways to think about problems, both of which are needed for a BCP pilot project.

      Choose one business unit for the pilot

      Many organizations begin their BCP project with a target business unit in mind. It’s still worth establishing whether this business unit meets the criteria below.

      Good candidates for a pilot project:

      • Business processes are standardized and documented.
      • Management and staff are motivated to improve business continuity.
      • The business unit is sufficiently well resourced to spare time (e.g. a few hours a week) to dedicate to the BCP process.
      • If the business unit doesn’t meet these criteria, consider addressing shortfalls before the pilot (e.g. via stakeholder management or business process analysis) or selecting another unit.
      • Many of the decisions will ultimately require input and support from the business unit’s manager(s). It is critical that they are bought into and engaged with the project.
      • The leader of the first business unit will be a champion for BCP within the executive team.
      • Sometimes, there’s no clear place to start. If this is the case for you, consider using Info-Tech’s Business Unit BCP Prioritization Tool to determine the order in which business units should undergo BCP development.

      Create role descriptions for the pilot project

      Use these role descriptions and your RACI chart to define roles for the pilot.

      These short descriptions establish the functions, expectations, and responsibilities of each role at a more granular level.

      The Board and executives have an outsized influence on the speed at which the project can be completed. Ensure that communication with these stakeholders is clear and concise. Avoid involving them directly in activities and deliverable creation, unless it’s required by their role (e.g. as a business unit manager).

      Project Role Description
      Board & Executive Team
      • Will receive project status updates but are not directly involved in deliverable creation.
      Executive Sponsor
      • Liaison with the executive team.
      • Accountable to ensure the pilot BCP is completed.
      • Set project goals and approve resource allocation and funding.
      Pilot Business Unit Manager
      • Drive the project and assign required resources.
      • Delegate day-to-day project management tasks to the BCP Coordinator.
      BCP Coordinator
      • Function as the project manager. This includes scheduling activities, coordinating resources, reporting progress, and managing deliverables.
      • Learn and apply the BCP methodology to achieve project goals.
      Expert Business Unit Staff
      • Pilot business unit process experts to assist with BCP development for that business unit.
      IT Manager
      • Provide guidance on IT capabilities and recovery options.
      Other Business Unit Managers
      • Consulted to validate or provide input to the business impact analysis and RTOs/RPOs.

      Identify a suitable BCP Coordinator

      A skilled and committed coordinator is critical to building an effective and durable BCP.

      • Coordinating the BC planning effort requires a perspective that’s informed by IT, but goes beyond IT.
      • For example, many IT professionals only see business processes where they intersect with IT. The BCP Coordinator needs to be able to ask the right questions to help the business units think through dependencies for critical processes.
      • Business analysts can thrive in this role, which requires someone effective at dissecting business processes, working with business users, identifying requirements, and managing large projects.

      Structure the role of the BCP Coordinator

      The BCP Coordinator works with the pilot business unit as well as remaining business units to provide continuity and resolve discrepancies as they come up between business units.

      Specifically, this role includes:

      • Project management tasks (e.g. scheduling, assigning tasks, coordinating resources, and reporting progress).
      • Learning the BCP methodology (through the pilot) so that this person can lead remaining business units through their BCP process. This enables the IT leader who had been assigned to guide BCP development to step back into a more appropriate consulting role.
      • Managing the BCP workflow.

      "We found it necessary to have the same person work with each business unit to pass along lessons learned and resolve contingency planning conflicts for common dependencies." – Michelle Swessel, PM and IT Bus. Analyst, Wisconsin Compensation Rating Bureau (WCRB)

      Template: Pilot Project Charter

      Formalize participants, roles, milestones, risks for the pilot project.

      Your charter should:

      1. Define project parameters, including drivers, objectives, deliverables, and scope.
      2. Identify the pilot business unit.
      3. Assign a BCP pilot team, including a BCP Coordinator, to execute the methodology.
      4. Define before-and-after metrics to enable the team to measure pilot success.
      5. Set achievable, realistic target dates for specific project milestones.
      6. Document risks, assumptions, and constraints.

      Download Info-Tech’s BCP Pilot Project Charter Template

      Step 1.3

      Identify business processes, dependencies, and alternatives

      This step will walk you through the following activities:

      • Identify key business processes.
      • Document the process workflow.
      • Identify dependencies and alternates for those dependencies.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      You'll use the following tools & templates:

      Outcomes & Insights

      Documented workflows, process dependencies, and workarounds when dependencies are unavailable.

      Flowchart business processes

      Workflows help you visually identify process dependencies and optimization opportunities.

      • Business continuity planning is business process focused. You need to document business processes, dependencies, and downtime workarounds.
      • Process documentation is a basic BCP audit requirement, but it will also:
        • Keep discussions about business processes well-scoped and focused – by documenting the process, you also clarify for everyone what you’re actually talking about.
        • Remind participants of process dependencies and workarounds.
        • Make it easier to spot possible process breakdowns or improvements.
        • Capture your work, which can be used to create or update SOP documentation.
      • Use flowcharts to capture process workflows. Flowcharts are often quicker to create, take less time to update, and are ultimately more usable than a dense manual.

      Info-Tech Insight

      Process review often results in discovering informal processes, previously unknown workarounds or breakdowns, shadow IT, or process improvement opportunities.

      1.3.1 Prioritize pilot business unit processes

      Input

      • List of key business unit processes.

      Output

      • List of key business unit processes, now prioritized (at a high-level)

      Materials

      • Whiteboard/flip charts
      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (leads the discussion)
      • Pilot Business Unit Manager

      30 minutes

      1. Create a list of all formal and informal business processes executed by the pilot business unit.
      2. Discuss the impact of process downtime, and do a quick assessment whether impact of downtime for each process would be high, medium, or low across each of these criteria:
        • Revenue or costs (e.g. supports sales, billing, or productivity)
        • Goodwill (e.g. affects internal or external reputation)
        • Compliance (e.g. affects legal or industry requirements)
        • Health or safety (e.g. affects employee/public health & safety)

      Note: A more in-depth analysis will be conducted later to refine priorities. The goal here is a high-level order of priority for the next steps in the planning methodology (identify business processes and dependencies).

      1. In the BCP Business Impact Analysis Tool, Processes and Dependencies tab, record the following:
        • The business processes in rough order of criticality.
        • For each process, provide a brief description that focuses on purpose and impact.
        • For each process, name a process owner (i.e. accountable for process completion – could be a manager or senior staff, not necessarily those executing the process).

      1.3.2 Review process flows & identify dependencies

      Input

      • List of key business unit processes (prioritized at a high level in Activity 1.3.1).
      • Business process flowcharts.

      Output

      • Business process flowcharts

      Materials

      • Whiteboard/flip charts
      • Microsoft Visio, or other flowcharting software
      • BCP Business Impact Analysis Tool

      Download Info-Tech’s Business Process Workflows Example

      1.5 hours

      1. Use a whiteboard to flowchart process steps. Collaborate to clarify process steps and dependencies. If processes are not documented, use this as an opportunity to create standard operating procedures (SOPs) to drive consistency and process optimization, as described in the Info-Tech blueprint, Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind.
      2. Record the dependencies in tab 1 of the BCP Business Impact Analysis Tool in the appropriate columns:
        • People – Anyone involved in the process, from providing guidance to executing the steps.
        • IT Applications – Core IT services (e.g. ERP, CRM) required for this process.
        • End-user devices & equipment – End-user devices, locally-installed apps, IoT, etc.
        • Facility – Any special requirements beyond general office space.
        • Suppliers & Service Providers – Third-parties who support this process.

      Info-Tech Insight

      Policies and procedures manuals, if they exist, are often out of date or incomplete. Use these as a starting point, but don’t stop there. Identify the go-to staff members who are well versed in how a process works.

      1.3.3 Document workarounds

      Input

      • Business process flowcharts.
      • List of process dependencies.

      Output

      • Workarounds and alternatives in the event dependencies aren’t available.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the activity)
      • Pilot Business Unit Manager
      • Business Process Subject Matter Experts (SMEs)

      1.5 hours

      Identify alternatives to critical dependencies to help you create contingency plans.

      1. For each business process, identify known alternatives for each primary dependency. Ignore for the moment how long the workaround or alternate would be feasible.
      2. Record alternatives in the Business Continuity Business Impact Analysis Tool, Processes and Dependencies tab, Alternatives columns (a separate column for each category of dependency):
        • People – Can other staff execute the process steps? (Example: managers can step in if needed.)
        • IT Applications – Is there a manual workaround or other alternative while enterprise technology services are unavailable? (Example: database is down, but data is stored on physical forms.)
        • End-User Devices and Equipment – What alternatives exist to the usual end-user technologies, such as workstations and desk phones? (Example: some staff have cell phones.)
        • Facility Location and Requirements – Is there an alternate location where this work can be conducted? (Example: work from home, or from another building on the campus.)
        • Suppliers and External Services – Is there an alternative source for key suppliers or other external inputs? (Example: find alternate suppliers for key inputs.)
        • Additional Inputs or Requirements – What workarounds exist for additional artifacts that enable process steps (e.g. physical inventory records, control lists)? (Example: if hourly pay information is missing, run the same payroll as the previous run and reconcile once that information is available.)

      Phase 2

      Conduct a BIA to Determine Acceptable RTOs and RPOs

      Phase 2

      2.1 Define an objective impact scoring scale

      2.2 Estimate the impact of downtime

      2.3 Determine acceptable RTO/RPO targets

      Insights & Outcomes

      Assess the impact of business process downtime using objective, customized impact scoring scales. Sort business processes by criticality and by assigning criticality tiers, recovery time, and recovery point objectives.

      Participants

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Business Process SMEs

      Step 2.1

      Define an objective scoring scale

      This step will walk you through the following activities:

      • Identify impact criteria that are relevant to your business.
      • Create a scale that defines a range of impact for relevant criteria.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Define an impact scoring scale relevant to your business, which allows you to more-objectively assess the impact of business process downtime.

      Set appropriate recovery objectives

      Recovery time and recovery point objectives should align with business impact.

      The activities in Phase 2 will help you set appropriate, acceptable recovery objectives based on the business impact of process downtime.

      • The recovery time objective (RTO) and recovery point objective (RPO) are the recovery goals set for individual processes and dependencies to ensure your business unit meets its overall acceptable recovery timeline.

      For example:

      • An RTO of four hours means staff and other required resources must be available to support the business processes within four hours of an incident (e.g. relocate to an alternate worksite if necessary, access needed equipment, log-in to needed systems, get support for completing the process from alternate staff, etc.)
      • An RPO of four hours for a customer database means the most recent secondary copy of the data must never be more than four hours old – e.g. running a backup every four hours or less.

      Conduct a Business Impact Analysis (BIA)

      Create Impact Scoring Scales→Assess the impact of process downtime→Review overall impact of process downtime→Set Criticality Tiers→Set Recovery Time and Recovery Point Objectives

      Create financial impact scales

      Identify maximum cost and revenue impacts to build financial impact scales to measure the financial impact of process downtime.

      Work with the Business Unit Manager and Executive Sponsor to identify the maximum impact in each category to the entire business. Use a worst-case scenario to estimate the maximum for each scale. In the future, you can use this scoring scale to estimate the impact of downtime for other business units.

      • Loss of Revenue: Estimate the upper bound for this figure from the previous year, and divide that by the number of business days in the year. Note: Some organizations may choose to exclude revenue as a category where it won’t be lost (e.g. public-sector organizations).
      • Loss of Productivity: Proxy for lost workforce productivity using payroll numbers. Use the fully loaded payroll for the company, divided by the number of working days in the year as the maximum.
      • Increased Operating Costs: Isolate this to known additional costs resulting from a disruption. Does the interruption itself increase operating costs (e.g. if using timesheets for hourly/contract employees and that information is lost or unavailable, do you assume a full work week)?
      • Financial Penalties: If there are known financial penalties (e.g. due to failure to meet SLAs or other contractual obligations), include those values in your cost estimates.

      Info-Tech Insight

      Cost estimates are like hand grenades and horseshoes: you don’t need to be exact. It’s much easier to get input and validation from other stakeholders when you have estimates. Even weak estimates are far better than a blank sheet.

      Create goodwill, compliance, and safety impact scales

      Create a quantitative, more-objective scoring scale for goodwill, compliance and safety by following the guidance below.

      • Impact on Customers: By default, the customer impact scale is based on the percent of your total customer base impacted. You can also modify this scale to include severity of impact or alter it to identify the maximum number of customers that would be impacted.
      • Impact on Staff: Consider staff that are directly employed by the organization or its subsidiaries.
      • Impact on Business Partners: Which business partners would be affected by a business disruption?
      • Impact on Health & Safety: Consider the extent to which process downtime could increase the risk of the health & safety of staff, customers, and the general public. In addition, degradation of health & safety services should be noted.
      • Impact on Compliance: Set up the scale so that you can capture the impact of any critical regulatory requirements that might not be met if a particular process was down for 24 hours. Consider whether you expect to receive leeway or a grace period from the governance body that requires evidence of compliance.

      Info-Tech Best Practice

      Use just the impact scales that are relevant to your organization.

      Tool: Impact Scoring Scales

      • Define 4-point scoring scales in the BCP business impact analysis tool for a more objective assessment than gut-feel rankings.
      • You don’t need to include every category, if they aren’t relevant to your organization.
      • Refine the scoring scale as needed through the pilot project.
      • Use the same scoring scale for impact analyses with additional business units in the future.

      An image depicting the Business Impact Analysis Tool. A note pointing to the Level of Impact and Direct Cost Impact Scales columns states: Add the maximum cost impacts across each of the four impact scales to the tool. The rest of the scale will auto-populate based on the criteria outlined in the “Level of Impact” column. A note pointing to the column headers states: Change the names of the column headers in this tab. The changes to column headers will populate across the rest of the tool. Indicate exclusions from the scale here. A note pointing to the Goodwill Impact Scales columns reads: Update the Goodwill impact scales. For example, perhaps a critical impact on customers could be defined as “a significant impact on all customers using the organization’s services in a 24-hour period.” A note pointing to the Compliance, Heath and Safety Impact Scales columns reads: Review the compliance and safety impact scales, and update as required.

      Step 2.2

      Estimate the impact of downtime

      This step will walk you through the following activities:

      • Apply the scoring scale developed in step 2.1 to assess the impact of downtime for specific business processes.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Develop an objective view of the impact of downtime for key business processes.

      2.2.1 Estimate the impact of downtime

      1.5 hours

      Input

      • List of business processes, dependencies, and workarounds, all documented in the BIA tool.

      Output

      • Impact of downtime scores for key business unit processes.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the discussion)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. Print a copy of the Scoring Criteria tab to use as a reference, or have it open on another screen. In tab 3 of the BCP Business Impact Analysis Tool use the drop-down menu to assign a score of 0 to 4 based on levels of impact defined in the Scoring Criteria tab.
      2. Work horizontally across all categories for a single process. This will set a benchmark, familiarize you with the scoring system, and allow you to modify any scoring scales if needed. In general, begin with the process that you know to be most critical.
        • For example, if call center sales operations are down:
          • Loss of Revenue would be the portion of sales revenue generated through the call center. This might score a 2 or 3 depending on the proportion of sales generated through the call center.
          • The Impact on Customers might be a 1 or 2 depending on the extent that existing customers might be using the call center to purchase new products or services.
          • The Legal/Regulatory Compliance and Health or Safety Risk might be a 0.
      3. Next, work vertically across all processes within a single category. This will allow you to compare scores within the category as you create them.

      Tool: Impact Analysis

      • The goal of the exercise is to arrive at a defensible ranking of process criticality, based on the impact of downtime.
      • Make sure participants can see the scores you’re assigning during the exercise (e.g. by writing out the scores on a whiteboard, or displaying the tool on a projector or screen) and can reference the scoring scales tab to understand what the scores mean.
      • Take notes to record the rationale behind the impact scores. Consider assigning note-taking duties to one of the participants.

      An image of the Impact Analysis Tool. A note pointing to the column headings states: Any customized column headings from tab 2, Scoring Criteria are automatically ported to this tab. A note pointing to the Impact on Goodwill columns reads: Score each application across each scoring scale from 0 to 4. Be sure to refer back to the scoring scale defined in tab 2. Have the scoring scale printed out, written on a whiteboard, or displayed on a separate screen. A note pointing to the tool's dropdown boxes states: Score categories using the drop-down boxes. A note pointing to the centre columns reads: Ignore scoring for categories you choose to exclude. You can hide these columns to clean up the tool if needed.

      2.2.2 Sort processes into Criticality Tiers

      30 minutes

      Input

      • Processes, with assigned impact scores (financial impact, goodwill impact, compliance and safety impact).

      Output

      • Business processes sorted into criticality tiers, based on the impact of downtime.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the discussion)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. In general, consider the Total Impact on Goodwill, Compliance, and Safety first.
        • An effective tactic to start the process is to assign a tier 1 rating to all processes with a Goodwill, Compliance, and Safety score that’s 50% or more of the highest total score, tier 2 where scores are between 25% and 50%, and tier 3 where scores are below 25% (see table below for an example).
        • In step 2.3, you’ll align recovery time objectives with the criticality tiers. So, Tier 1 processes will target recovery before Tier 2 processes, and Tier 2 processes will target recovery before Tier 3 processes.
      2. Next, consider the Total Cost of Downtime.
      • The Total Cost is calculated by the tool based on the Scoring Criteria in tab 2 and the estimates in the BIA.
      • Consider whether the total cost impact justifies changing the criticality rating. “Smoke test” categorization with participants. Are there any surprises (processes more or less critical than expected)?
    • If the categorization doesn’t seem right, check that the scoring scale was applied consistently.
    • Example: Highest total Goodwill, Compliance, and Safety impact score is 18.

      Tier Score Range % of high score
      Tier 1 - Gold 9-18 50-100%
      Tier 2 - Silver 5 to 9 25-50%
      Tier 3 - Bronze 0 to 5 0-25%

      Step 2.3

      Determine acceptable RTO and RPO targets

      This step will walk you through the following activities:

      • Identify acceptable Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for business processes.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes and Insights

      Right-size recovery objectives based on business impact.

      Right-size recovery objectives

      Acceptable RTOs and RPOs must be right-sized to the impact of downtime.

      Rapid recovery typically requires more investment.

      The impact of downtime for most business processes tends to look something like the increasing impact curve in the image to the right.

      In the moments after a disruption, impact tends to be minimal. Imagine, for example, that your organization was suddenly unable to pay its suppliers (don’t worry about the reason for the disruption, for the moment). Chances are, this disruption wouldn’t affect many payees if it lasted just a few minutes, or even a few hours. But if the disruption were to continue for days, or weeks, the impact of downtime would start to spiral out of control.

      In general, we want to target recovery somewhere between the point where impact begins, and the point where impact is intolerable. We want to balance the impact of downtime with the investment required to make processes more resilient.

      Info-Tech Insight

      Account for hard copy files as well as electronic data. If that information is lost, is there a backup? BCP can be the driver to remove the last resistance to paperless processes, allowing IT to apply appropriate data protection.

      Set recovery time objectives and recovery point objectives in the “Debate Space”

      A graph with the X axis labelled as: Increasing downtime/data loss and the Y-axis labelled Increasing Impact. The graph shows a line rising as impact and downtime/data loss increase, with the lowest end of the line (on the left) labelled as minimal impact, and the highest point of the line (on the right) labelled maximum tolerance. The middle section of the line is labelled as the Debate Space, and a note reads: Acceptable RTO/RPO must be between Low Impact and Maximum Tolerance

      2.3.1 Define process-level recovery objectives

      1 hour

      Input

      • Processes, ranked by criticality.

      Output

      • Initial business-defined recovery objectives for each process.

      Materials

      • BCP Business Impact Analysis Tool

      Participants

      • BCP Coordinator (facilitates the discussion)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. Review the “Debate Space” diagram (shown in previous section) with all participants.
      2. Ask business participants for each process: how much downtime is tolerable, acceptable, or appropriate? How much data loss is tolerable?
        • If participants aren’t yet comfortable setting recovery objectives, identify the point at which downtime and data loss first becomes noticeable and the point at which downtime and data loss becomes intolerable.
        • Choose an RTO and RPO for each process that falls within the range set by these two extremes.

      RTOs and RPOs are business-defined, impact-aligned objectives that you may not be able to achieve today. It may require significant investments of time and capital to enable the organization to meet RTO and RPO.

      2.3.2 Align RTOs within and across criticality tiers

      1 hour

      Input

      • Results from pilot BCP impact analysis.

      Output

      • Initial business-defined recovery objectives for each process.

      Materials

      • BCP Business Impact Analysis Tool
      • Whiteboard/ flipchart

      Participants

      • BCP Coordinator
      • BCP Project Sponsor
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager (optional)

      Set a range for RTO for each Tier.

      1. Start with your least critical/Tier 3 processes. Use the filter in the “Criticality Rating” column in the Impact Analysis tab of the BIA tool to show only Tier 3 processes.
        • What range of RTOs did the group assign for processes in this Tier? Does the group agree that these targets are appropriate for these processes?
        • Record the range of RTOs on the whiteboard or flipchart.
      2. Next, look at Tier 2 processes. Use the same filter to show just Tier 2 processes.
        • Record the range of RTOs, confirm the range with the group, and ensure there’s no overlap with the Tier 3 range.
        • If the RTOs in one Tier overlap with RTOs in another, you’ll need to adjust RTOs or move processes between Tiers (if the impact analysis justifies it).
      Tier RTO
      Tier 1 4 hrs- 24 hrs
      Tier 2 24 hrs - 72 hrs
      Tier 3 72 hrs - 120 hrs

      Phase 3

      Document the Recovery Workflow and Projects to Close Gaps

      3.1 Determine current recovery procedures

      3.2 Identify and prioritize projects to close gaps

      3.3 Evaluate business continuity site and command center options

      Insights & Outcomes

      Outline business recovery processes. Highlight gaps and risks that could hinder business recovery. Brainstorm ideas to address gaps and risks. Review alternate site and business relocation options.

      Participants

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Business Process SMEs

      Step 3.1

      Determine current recovery procedures

      This step will walk you through the following activities:

      • Create a step-by-step, high-level recovery workflow.
      • Highlight gaps and risks in the recovery workflow.
      • Test the workflow against multiple scenarios.

      This step involves the following participants:

      • BCP Coordinator
      • Crisis Management Team
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Establish steps required for business recovery and current recovery timelines.

      Identify risks & gaps that could delay or obstruct an effective recovery.

      Conduct a tabletop planning exercise to draft business recovery plans

      Tabletop exercises are the most effective way to test and increase business confidence in business recovery capabilities.

      Why is tabletop planning so effective?

      • It enables you play out a wider range of scenarios than technology-based testing (e.g. full-scale, parallel) due to cost and complexity factors.
      • It is non-intrusive, so it can be executed more frequently than other testing methodologies.
      • It provides a thorough test of your recovery workflow since the exercise is, essentially, paper-based.
      • After you have a BCP in place, this exercise can continue to be a valuable testing exercise for BCP to capture changes in your recovery process.

      A graph titled: Tabletop planning had the greatest impact on respondent confidence in meeting recovery objectives. The graph shows that the relative importance of Tabletop Planning is 57%, compared to 33% for Unit Testing, 3% for Simulation Testing, 6% for Parallel Testing, and 2% for Full-Scale Testing. The source for the graph is Info-Tech Research Group.

      Step 2 - 2 hours
      Establish command center.

      Step 2: Risks

      • Command center is just 15 miles away from primary site.

      Step 2: Gaps

      • Confirm what’s required to set up the command center.
      • Who has access to the EOC?
      • Does the center have sufficient bandwidth, workstations, phones, telephone lines?

      3.1.1 Choose a scenario for your first tabletop exercise

      30 minutes

      Input

      • List of past incidents.
      • Risks to business continuity that are of high concern.

      Output

      • Scenario for the tabletop exercise.

      Materials

      • N/A

      Participant

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot business unit manager

      At the business unit level, the goal is to define a plan to resume business processes after an incident.

      A good scenario is one that helps the group focus on the goal of tabletop planning – to discuss and document the steps required to recover business processes. We suggest choosing a scenario for your first exercise that:

      • Disrupts many process dependencies (i.e. facilities, staff, IT services, suppliers).
      • Does not result in major property damage, harm, or loss of life. Business resumption is the focus of this exercise, not emergency response.
      • Has happened in the past, or is of concern to the business.

      An example: a gas leak at company HQ that requires the area to be cordoned off and power to be shut down. The business must resume processes from another location without access to materials, equipment, or IT services at the primary location.

      A plan that satisfies the gas leak scenario should meet the needs of other scenarios that affect your normal workspace. Then use BCP testing to validate that the plan meets a wider range of incidents.

      3.1.2 Define the BCP activation process

      1 hour

      Input

      • Any existing crisis management, incident response or emergency response plans.
      • BC Scenario.

      Output

      • High level incident notification, assessment, and declaration workflow.

      Materials

      • Cue cards, sticky notes, whiteboard and markers, or Visio template.

      Participants

      • BCP Coordinator
      • Crisis Management Team (if one exists)
      • Business Process SMEs
      • Pilot Business Unit Manager

      Answer the questions below to structure your notification, assessment, and BCP activation procedures.

      Notification

      How will you be notified of a disaster event? How will this be escalated to leadership? How will the team responsible for making decisions coordinate (if they can’t meet on-site)? What emergency response plans are in place to protect health and safety? What additional steps are involved if there’s a risk to health and safety?

      Assessment

      Who’s in charge of the initial assessment? Who may need to be involved in the assessment? Who will coordinate if multiple teams are required to investigate and assess the situation? Who needs to review the results of the assessment, and how will the results of the assessment be communicated (e.g. phone bridge, written memo)? What happens if your primary mode of communication is unavailable (e.g. phone service is down)?

      Declaration

      Who is responsible today for declaring a disaster and activating business continuity plans? What are the organization’s criteria for activating continuity plans, and how will BCP activation be communicated? Establish a crisis management team to guide the organization through a wide range of crises by Implementing Crisis Management Best Practices.

      3.1.3 Document the business recovery workflow

      1 hour

      Input

      • Pilot BIA.
      • Any existing crisis management, incident response, or emergency response plans.
      • BC Scenario

      Output

      • Outline of your BCP declaration and business recovery plan.

      Materials

      • Cue cards, sticky notes, whiteboard and markers, or Visio template.

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager

      Do the following:

      1. Create separate flows for facility, IT, and staff disruptions. Include additional workflows as needed.
        • We suggest you outline the recovery process at least to the point where business processes are restored to a minimum viable functional level.
      2. On white cue cards:
        1. Record the step.
        2. Indicate the task owner.
        3. Estimate how long the step will take.
      3. On yellow cue cards, document gaps in people, process, and technology requirements to complete the step.
      4. On red cue cards, indicate risks (e.g. no backup person for a key staff member).

      Info-Tech Best Practice

      Tabletop planning is most effective when you keep it simple.

      • Be focused; stay on task and on time.
      • Revisit each step and record risks and mitigation strategies.
      • Discuss each step from start to finish.
      • Revise the plan with key task owners.
      • Don’t get weighed down by tools.
      • Simple tools, like cue cards or whiteboards, can be very effective.

      Tool: BCP Recovery Workflow

      Document the steps you identified in the tabletop to create your draft recovery workflow.

      Why use a flowchart?

      • Flowcharts provide an at-a-glance view, are ideal for crisis scenarios where pressure is high and effective, and where timely communication is necessary.
      • For experienced managers and staff, a high-level reminder of process flows or key steps is sufficient.
      • Where more detail is required, include links to supporting documentation (which could include checklists, vendor documentation/contracts, other flowcharts, etc.)

      Create one recovery workflow for all scenarios.

      Traditional planning calls for separate plans for different “what-if” scenarios. This is challenging not just because it’s a lot more documentation – and maintenance – but because it’s impossible to predict every possible incident. Use the template, aligned to recovery of process dependencies, to create one recovery workflow for each business unit that can be used in and tested against different scenarios.

      Download Info-Tech’s BCP Recovery Workflow Example

      "We use flowcharts for our declaration procedures. Flowcharts are more effective when you have to explain status and next steps to upper management." – Assistant Director-IT Operations, Healthcare Industry

      "Very few business interruptions are actually major disasters. It’s usually a power outage or hardware failure, so I ensure my plans address ‘minor’ incidents as well as major disasters."- BCP Consultant

      3.1.4 Document achievable recovery metrics (RTA/RPA)

      30 minutes

      Input

      • Pilot BCP BIA.
      • Draft recovery workflow.

      Output

      • RTA and RPA for each business process.

      Materials

      • Pilot BCP BIA.

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager

      Add the following data to your copy of the BCP Business Impact Analysis Tool.

      1. Estimate the recovery time achievable (RTA) for each process based on the required time for the process to be restored to a minimum acceptable functional level. Review your recovery workflow to identify this timeline. For example, if the full process from notification, assessment, and declaration to recovery and relocation would take a full day, set the RTA to 24 hours.
      2. Estimate the recovery point achievable (RPA) for each process based on the maximum amount of data that could be lost. For example, if data on a particular system is backed up offsite once per day, and the onsite system was destroyed just before that backup began, the entire day’s data could be lost and the achievable RPO is 24 hours. Note: Enter a value of 9999 to indicate that data is unrecoverable.

      Info-Tech Insight

      Operating at a minimum acceptable functional level may not be feasible for more than a few days or weeks. Develop plans for immediate continuity first, then develop further plans for long-term continuity processes as required. Recognize that for longer term outages, you will evolve your plans in the crisis to meet the needs of the situation.

      3.1.5 Test the workflow of other scenarios

      1 hour

      Input

      • Draft recovery workflow.

      Output

      • Updated draft recovery workflow.

      Materials

      • Draft recovery workflow.
      • Projector or screen.

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager

      Work from and update the soft copy of your recovery workflow.

      1. Would any steps change if the scenario changes? If yes, capture the different flow with a decision diamond. See the example Recovery Workflow for a workflow that uses decision diamonds. Identify any new gaps or risks you encounter with red and yellow cards.
      2. Make sure the decision diamonds are as generalized as possible. For example, instead of creating a separate response plan for each scenario that would require you to relocate from your existing building, create one response plan for relocation and one response plan for remaining in place.
      3. See the next section for some examples of different types of scenarios that you may include in your recovery workflow.

      Info-Tech Insight

      Remember that health and safety risks must be dealt with first in a crisis. The business unit recovery workflow will focus on restoring business operations after employees are no longer at risk (e.g. the risk has been resolved or employees have been safely relocated). See Implement Crisis Management Best Practices for ideas on how to respond to and assess a wide range of crises.

      Not all scenarios will have full continuity plans

      Risk management is a business decision. Business continuity planning can help decision makers understand and decide on whether to accept or mitigate high impact, low probability risks.

      For some organizations, it’s not practical or possible to invest in the redundancy that would be necessary to recover in a timely manner from certain major events.

      Leverage existing risk management practices to identify key high impact events that could present major business continuity challenges that could cause catastrophic disruptions to facility, IT, staffing, suppliers, or equipment. If you don’t have a risk register, review the scenarios on the next slide and brainstorm risks with the working group.

      Work through tabletop planning to identify how you might work through an event like this, at a high level. In step 3.2, you can estimate the effort, cost, and benefit for different ideas that can help mitigate the damage to the business to help decision makers choose between investment in mitigation or accepting the risk.

      Document any scenarios that you identify as outside the scope of your continuity plans in the “Scope” section of your BCP Summary document.

      For example:

      A single location manufacturing company is creating a BCP.

      The factory is large and contains expensive equipment; it’s not possible to build a second factory for redundancy. If the factory is destroyed, operations can’t be resumed until the factory is rebuilt. In this case, the BCP outlines how to conduct an orderly business shutdown while the factory is rebuilt.

      Contingency planning to resume factory operations after less destructive events, as well as a BCP for corporate services, is still practical and necessary.

      Considerations for other BCP scenarios

      Scenario Type Considerations
      Local hazard (gas leak, chemical leak, criminal incident, etc.)
      • Systems might be accessible remotely, but hands-on maintenance will be required eventually. “Work from home” won’t be a long-term solution.
      • An alternate site is required for service continuity. Can be within normal commuting distance.
      Equipment/building damage (fire, roof collapse, etc.)
      • Equipment will need repair or replacement (vendor involvement).
      • An alternate site is required for service continuity. Can be nearby.
      Regional natural disasters
      • Utilities may be affected (power, running water, etc.).
      • Expect staff to take care of their families first before work.
      • A geographically distant alternate site is required for service continuity.
      Supplier failure (IT provider outage, disaster at supplier, etc.)
      • Service-level agreements are important to establish recovery timelines. Review contracts and master services agreements.
      Staff (lottery win, work stoppage, pandemic/quarantine)
      • Staff are suddenly unavailable. Expect that no warm handoff to alternates is possible and that time to ramp up on the process is accounted for.
      • In a pandemic scenario, work from home, remote toolsets, and digital/contactless workflows become critical.

      Step 3.2

      Identify and prioritize projects to close gaps

      This step will walk you through the following activities:

      • Brainstorm solutions to identified gaps and risks.
      • Prioritize projects and action items to close gaps and risks.
      • Assess the impact of proposed projects on the recovery workflow.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Identify and prioritize projects and action items that can improve business continuity capabilities.

      3.2.1 Brainstorm solutions to address risks and gaps

      1 hour

      Input

      • Draft recovery workflow.
      • Known continuity risks and gaps.

      Output

      • Ideas for action items and projects to improve business continuity.

      Materials

      • Flipchart

      Participants

      • BCP Coordinator (facilitates the exercise)
      • Business Process Subject Matter Experts (SMEs)
      • Pilot Business Unit Manager
      1. Review each of the risk and gap cards from the tabletop exercise.
      2. As a group, brainstorm ideas to address gaps, mitigate risks, and improve resiliency. Write the list of ideas on a whiteboard or flip chart paper. The solutions can range from quick-wins and action items to major capital investments. The following slides can help you seed ideas to support brainstorming and idea generation.

      Info-Tech Best Practice

      Try to avoid debates about feasibility at this point. The goal is to get ideas on the board.

      When you’re brainstorming solutions to problems, don’t stop with the first idea, even if the solution seems obvious. The first idea isn’t always the best or only solution – other ideas can expand on it and improve it.

      Step 4: No formal process to declare a disaster and invoke business continuity.

      Step 7: Alternate site could be affected by the same regional event as the main office.

      Step 12: Need to confirm supplier service-level agreements (SLAs).

      1. Continue to create BCP documentation.
      2. Identify a third location for regional disasters.
      3. Contact suppliers to confirm SLAs and validate alignment with RTOs/RPOs.
      4. Add BCP requirements collection to service procurement process?

      Discuss your remote work capabilities

      With COVID-19, most organizations have experience with mass work-from-home.

      Review the following case studies. Do they reflect your experience during the COVID-19 pandemic?

      Unacceptable risk

      • A small insurance company provided laptops to staff so they could work remotely.
      • Complication: Cheque and print stock is a dependency and no plan was made to store check stock offsite in a secure fashion.

      Key dependencies missing

      • A local government provided laptops to key staff so they could work remotely.
      • Complication: The organization didn’t currently own enough Citrix licenses for every user to be online concurrently.

      Unable to serve customers

      • The attestation and land services department of a local government agency provided staff with remote access to key apps.
      • Complication: Their most critical business processes were designed to be in-person – they had no plan to execute these processes from home.

      Consider where your own work-from-home plans fell short.

      • Were your collaboration and communication solutions too difficult for users to use effectively?
      • Did legacy infrastructure affect performance or limit capabilities? Were security concerns appropriately addressed?
      • What challenges did IT face supporting business users on break-fix and new requests?
      • Were there logistical needs (shipping/receiving, etc.) that weren’t met?
      • Develop an updated plan to support work-from-home using Info-Tech’s BCP Relocation Checklists and Home Office Survey template, and integrate these into your overall BCP documentation. Stakeholders can easily appreciate the value of this plan since it’s relevant to recent experience.

      Identify opportunities to improve continuity plans

      What gaps in your continuity response could be addressed with better planning?

      People

      • Alternates are not identified
      • Roles in a disaster are not formalized
      • No internal/external crisis comm. strategy

      Site & Facilities

      • No alternate place of business or command center identified
      • No formal planning or exercises to test alternate site viability

      • Identify a viable secondary site and/or work-from-home plan, and develop a schedule for testing activities. Review in Step 3.3 of the Develop a Business Continuity Plan blueprint.

      External Services & Suppliers

      • Contingency plans for a disruption not planned or formalized
      • No formal review of service-level agreements (SLAs)

      • Contact key suppliers and vendors to establish SLAs, and ensure they meet requirements.
      • Review supplier continuity plans.

      Technology & Physical Assets

      • No secondary site or redundancy for critical IT systems
      • No documented end-to-end IT DR plan

      Tool: BCP Project Roadmap

      Prioritize and visualize BCP projects to present options to decision makers.

      Not all BCP projects can be tackled at once. Enable decision makers to defer, rather than outright reject, projects that aren’t feasible at this time.

      1. Configure the tool in Tab 1. Setup. Adjust criteria and definitions for criteria. Note that shaded columns are required for reporting purposes and can’t be modified.
      2. Add projects and action items in Tab 2. Data Entry. Fields highlighted in red are all required for the dashboard to populate. All other fields are optional but will provide opportunities to track more detailed data on project ideas.
      3. To generate the dashboard in Tab 3. Roadmap, open the Data ribbon and under Queries and Connections click Refresh All. You can now use the slicers on the right of the sheet.

      Download Info-Tech’s BCP Project Roadmap Tool

      Demonstrate BCP project impacts

      Illustrate the benefits of proposed projects.

      1. Review your recovery workflow.
      2. Make updates to a second copy of the high-level outline to illustrate how the business response to a disaster scenario will change once proposed projects are complete.
      • Remove steps that have been made unnecessary.
      • Remove any risks or gaps that have been mitigated or addressed.
      • Verify that proposed projects close gaps between acceptable and achievable recovery capabilities in the BIA tool.
    • The visual impact of a shorter, less-risky recovery workflow can help communicate the benefits of proposed projects to decision makers.
    • Step 3.3

      Evaluate business continuity site and command center options

      This step will walk you through the following activities:

      • Take a deep dive on the requirements for working from an alternate location.
      • Assess different options for an alternate location.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • Expert Business Unit Staff

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Identify requirements for an alternate business site.

      Tool: Relocation Checklists

      An alternate site could be another company building, a dedicated emergency operations center, or work-from-home. Use this tool to guide and prepare for any relocation exercise.

      • Coordinate your response with the pre-populated checklists in Tabs 1 & 2, identify who’s responsible for items on the checklists, and update your recovery workflows to reflect new steps. When reviewing the checklist, consider what can be done to prepare ahead of a crisis.
        • For example, you may wish to create crisis communication templates to streamline crisis communications during a disaster.
      • Calculate the effort required to provision equipment for relocated users in Tabs 3 & 4.
      • Evaluate your options for alternate sites with the requirements matrix in Tab 5. Use your evaluation to identify how the organization could address shortcomings of viable options either ahead of time or at the time of an incident.

      Download Info-Tech’s BCP Relocation Checklists

      Create a checklist of requirements for an alternate site

      Leverage the roll-up view, in tab 3, of dependencies required to create a list of requirements for an alternate site in tab 4.

      1. The table on Tab 5 of the relocation checklists is pre-populated with some common requirements. Modify or replace requirements to suit your needs for an alternate business/office site. Be sure to consider distance, transportation, needed services, accessibility, IT infrastructure, security, and seating capacity at a minimum.
      2. Don’t assume. Verify. Confirm anything that requires permissions from the site owner. What network providers have a presence in the building? Can you access the site 24/7 and conduct training exercises? What facilities and services are available? Are you guaranteed the space if needed?

      "There are horror stories about organizations that assumed things about their alternate site that they later found out they weren’t true in practice." – Dr. Bernard Jones, MBCI CBCP

      Info-Tech Insight

      If you choose a shared location as a BCP site, a regional disaster may put you in competition with other tenants for space.

      Identify a command center

      For command center and alternate worksite selection, remember that most incidents are local and short term. Identify an onsite and an offsite command center.

      1. For events where the building is not compromised, identify an onsite location, ideally with remote conferencing capabilities and planning and collaboration tools (projectors, whiteboards, flipcharts). The onsite location can also be used for BCM and crisis management meetings. Remember, most business continuity events are not regional or massively destructive.
      2. For the offsite command center, select a location that is sufficiently far away from your normal business location to maintain separation from local incidents while minimizing commute time. However, consider a geographically distant option (e.g. more than 50 miles away) identified for those scenarios where it is a regional disaster, or plan to leverage online tools to create a virtual command center (see the Insight box below).
      3. The first members of the Emergency Response Team to be notified of the incident will determine which location to use or whether a third alternative is required.

      Info-Tech Insight

      For many organizations, a dedicated command center (TVs on the wall, maps and charts in filing cabinets) isn’t necessary. A conference bridge and collaboration tools allowing everyone to work remotely can be an acceptable offsite command center as long as digital options can meet your command center requirements.

      Create a plan for a return to normal

      Operating in continuity mode for an extended period of time tends to result in higher costs and reduced business capabilities. It’s important to restore normal operations as soon as possible.

      Advance planning can minimize risks and delays in returning to normal operations.

      Leverage the methodology and tools in this blueprint to define your return to normal (repatriation) procedures:

      1. Repeat the tabletop planning exercise to determine the repatriation steps and potential gaps. How will you return to the primary site from your alternate site? Does data need to be re-entered into core systems if IT services are down? Do you need to transfer job duties back to primary staff?
      2. What needs to be done to address the gaps in the return to normal workflow? Are there projects or action items that could make return to normal easier?

      For more on supporting a business move back to the office from the IT perspective, see Responsibly Resume IT Operations in the Office

      Potential business impacts of ongoing operations at a failover site

      • The cost of leasing alternate business worksites.
      • Inability to deliver on strategic initiatives while in emergency/interim operations mode, resulting in lost business opportunities.
      • A growing backlog of work that falls outside of emergency operations mode.
      • Travel and accommodation costs if the alternate site is geographically remote.
      • Additional vendor licensing and contract costs.

      Phase 4

      Extend the Results of the Pilot BCP and Implement Governance

      Phase 4

      4.1 Consolidate BCP pilot insights to support an overall BCP project plan

      4.2 Outline a business continuity management (BCM) program

      4.3 Test and maintain your BCP

      Insights & Outcomes

      Summarize and consolidate your initial insights and documentation. Create a project plan for overall BCP. Identify teams, responsibilities, and accountabilities, and assign documentation ownership. Integrate BCP findings in DR and crisis management practices. Set guidelines for testing, plan maintenance, training, and awareness.

      Participants

      • BCP Coordinator
      • Pilot Business Unit Manager
      • BCP Executive Sponsor

      Step 4.1

      Consolidate BCP pilot insights to support an overall BCP project plan

      This step will walk you through the following activities:

      • Summarize and consolidate outputs and key insights from the BCP pilot.
      • Identify outputs from the pilot that can be re-used for the overall BCP.
      • Create a project charter for an overall BCP.

      This step involves the following participants:

      • BCP Coordinator
      • Pilot Business Unit Manager
      • BCP Executive Sponsor

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Present results from the pilot BCP, and outline how you’ll use the pilot process with other business units to create an overall continuity program.

      Structure the overall BCP program.

      Template: BCP Pilot Results Presentation

      Highlight key findings from the BCP pilot to make the case for next steps.

      • Highlight critical gaps or risks identified, any potential process improvements, and progress made toward improving overall BCP maturity through the pilot project. Summarize the benefits of the pilot project for an executive audience.
      • Review process recovery objectives (RTO/RPO). Provide an overview of recovery capabilities (RTA/RPA). Highlight any significant gaps between objectives and capabilities.
      • Propose next steps, including an overall BCP project and program, and projects and action items to remediate gaps and risks.
      • Develop a project plan to estimate resource requirements for an overall BCP project prior to delivering this presentation. Quantifying required time and resources is a key outcome as it enables the remaining business units to properly scope and resource their BCP development activities and can help managers overcome the fear of the unknown.

      Download Info-Tech’s BCP Pilot Results Presentation

      Tool: BCP Summary

      Sum up information from completed BCP documents to create a high-level BCP overview for auditors and executives.

      The BCP Summary document is the capstone to business unit continuity planning exercises. It consolidates your findings in a short overview of your business continuity requirements, capabilities, and maintenance procedures.

      Info-Tech recommends embedding hyperlinks within the Summary to the rest of your BCP documentation to allow the reader to drill down further as needed. Leverage the following documents:

      • Business Impact Analysis
      • BCP Recovery Workflows
      • Business Process Workflows
      • BCP Project Roadmap
      • BCP Relocation Checklists
      • Business Continuity Policy

      Download Info-Tech’s BCP Summary Document

      Reuse templates for additional exercises

      The same methodology described in this blueprint can be repeated for each business unit. Also, many of the artifacts from the BCP pilot can be reused or built upon to give the remaining business units a head start. For example:

      • BCP Pilot Project Charter Template. Make a copy to use as a base for the next business unit’s BCP project charter, and update the stakeholders/roles and milestone dates. The rest of the content can remain the same in most cases.
      • BCP Reference Workbook. This tool contains information common to all business units and can be updated as needed.
      • BCP Business Impact Analysis Tool. You may need to start a separate copy for each business unit to allow enough space to capture all business processes. However, use the same scoring scale to drive consistent assessments. In addition, the scoring completed by the pilot business unit provides an example and benchmark for assessing other business processes.
      • BCP Recovery Workflow. The notification, assessment, and declaration steps can be standardized so remaining business units can focus primarily on recovery after a disaster is declared. Similarly, many of the steps related to alternate sites and IT workarounds will also apply to other business units.
      • BCP Project Roadmap Tool. Many of the projects identified by the pilot business unit will also apply to other business units – update the list as needed.
      • The Business Unit BCP Prioritization Tool, BCP Executive Presentation, and Business Continuity Policy Template do not need to be updated for each business unit.

      Info-Tech Best Practice

      You may need to create some artifacts that are site specific. For example, relocation plans or emergency plans may not be reusable from one site to another. Use your judgement to reuse as much of the templates as you can – similar templates simplify audit, oversight, and plan management.

      Create an Overall BCP Project Charter

      Modify the pilot project charter to encompass the larger BCP project.

      Adjust the pilot charter to answer the following questions:

      • How much time and effort should the rest of the project take, based on findings from the pilot? When do you expect to meet certain milestones? What outputs and outcomes are expected?
      • In what order should additional business units complete their BCP? Who needs to be involved?
      • What projects to address continuity gaps were identified during the pilot? What investments will likely be required?
      • What additional documentation is required? This section and the appendix include templates to document your BCM Policy, Teams & Contacts, your notification procedures, and more.
      • How does this integrate with the other areas of business resilience and continuity (IT disaster recovery planning and crisis management planning)?
      • What additional activities, such as testing, are required?

      Prioritize business units for further BCP activities.

      As with the pilot, choose a business unit, or business units, where BCP will have the greatest impact and where further BCP activities will have the greatest likelihood of success. Prioritize business units that are critical to many areas of the business to get key results sooner.

      Work with one business unit at a time if:

      • Required resources from the business unit are available to focus on BCP full-time over a short period (one to two weeks).
      • More hands-on guidance (less delegation) is needed.
      • The business unit is large or has complex processes.

      Work with several business units at the same time if:

      • Required resources are only available sporadically over a longer period of time.
      • Less guidance (more delegation) is possible.
      • All business units are small and have well-documented processes.

      Download Info-Tech’s Business Unit BCP Prioritization Tool

      Step 4.2

      Outline a Business Continuity Management (BCM) Program

      This step will walk you through the following activities:

      • Identify teams and roles for BCP and business continuity management.
      • Identify individuals to fill key roles.

      This step involves the following participants:

      • BCP Coordinator
      • Executive Sponsor

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Document BCP teams, roles, and responsibilities.

      Document contact information, alternates, and succession rules.

      Outline a Business Continuity Management Program

      A BCM program, also known as a BCM system, helps structure business continuity activities and practices to deliver long-term benefits to your business.

      A BCM program should:

      • Establish who is responsible and accountable for BCP practices, activities, and documentation, and set documentation management practices.
      • Define a process to improve plans. Review and update continuity requirements, suggest enhancements to recovery capabilities, and measure progress and improvements to the plan over time.
      • Coordinate disaster recovery, business continuity, and crisis management planning outputs and practices.
      • Communicate the value of the continuity program to the organization.

      Develop a Business Continuity Management Program

      Phase 4 of this blueprint will focus on the following elements of a business continuity management program:

      • BCM Roles, Responsibilities, and Accountabilities
      • BCM Document Management Practices
      • Integrate BC, IT DR, Crisis Management, and Emergency Management
      • Business Continuity Plan maintenance and testing
      • Training and awareness

      Schedule a call with an Info-Tech Analyst for help building out these core elements, and for advice on developing the rest of your BCM program.

      Create BCM teams

      Include a mix of strong leaders and strong planners on your BC management teams.

      BC management teams (including the secondary teams such as the emergency response team) have two primary roles:

      1. Preparation, Planning, and Governance: Conduct and consolidate business impact analyses. Review, and support the development of recovery workflows, including emergency response plans and business unit recovery workflows. Organize testing and training. Report on the state of the continuity plan.
      2. Leadership During a Crisis: Coordinate and support the execution of business recovery processes. To meet these goals, each team needs a mix of skill sets.

      Crisis leaders require strong crisis management skills:

      • Ability to make quick decisions under pressure with incomplete information.
      • Excellent verbal communication skills.
      • Strong leadership skills. Calm in stressful situations.
      • Team leaders are ideally, but not necessarily, those with the most senior title on each team. It’s more important that the team leader has the appropriate skill set.

      Collectively, the team must include a broad range of expertise as well as strong planning skills:

      • Diverse expertise to be able to plan for and respond to a wide range of potential incidents, from health and safety to reputational damage.
      • Excellent organizational skills and attention to detail.
      • Excellent written communication skills.

      Note: For specific BC team roles and responsibilities, including key resources such as Legal, HR, and IT SMEs required to prepare for and execute crisis management plans, see Implement Crisis Management Best Practices.

      Structure the BCM Team

      Create a hierarchy of teams to govern and coordinate business continuity planning and crisis management.

      BCM Team: Govern business continuity, DR, and crisis management planning. Support the organization’s response to a crisis, including the decision to declare a disaster or emergency.

      Emergency Response Teams: Assist staff and BC teams during a crisis, with a focus first on health and safety. There’s usually one team per location. Develop and maintain emergency response plans.

      Emergency Response Teams: Assist staff and BC teams during a crisis, with a focus first on health and safety. There’s usually one team per location. Develop and maintain emergency response plans.

      IT Disaster Recovery Team: Manage the recovery of IT services and data following an incident. Develop and maintain the IT DRP.

      Business Unit BCP Teams: Coordinate business process recovery at the business unit level. Develop and maintain business unit BCPs.

      “Planning Mode”

      Executive Team → BC Management Team ↓

      • Emergency Response Teams (ERT)
      • Crisis Management Team
      • IT DR Management Team
      • Business Unit BCP Teams

      “Crisis Mode”

      Executive Team ↔Crisis Management Team↓ ↔ Emergency Response Teams (ERT)

      • BC Management Team
      • IT DR Management Team
      • Business Unit BCP Teams

      For more details on specific roles to include on these teams, as well as more information on crisis management, review Info-Tech’s blueprint, Implement Crisis Management Best Practices.

      Tool: BCM Teams, Roles, Contacts, and Vendors

      Track teams, roles, and contacts in this template. It is pre-populated with roles and responsibilities for business continuity, crisis management, IT disaster recovery, emergency response, and vendors and suppliers critical to business operations.

      • Expect overlap across teams. For example, the BC Management Team will include representation from each secondary team to ensure plans are in sync. Similarly, both the Crisis Communication Team and BC Management Team should include a representative from your legal team to ensure legal issues are considered in communications as well as overall crisis management.
      • Clarify spending and decision authority for key members of each team during a crisis.

      Track contact information in this template only if you don’t have a more streamlined way of tracking it elsewhere.

      Download Info-Tech’s Business Continuity Teams and Roles Tool

      Manage key vendors

      Review supplier capabilities and contracts to ensure they meet your requirements.

      Suppliers and vendors might include:

      • Material shipments
      • IT/telecoms service providers
      • Integrators and business process outsourcing providers
      • Independent contractors
      • Utilities (power, water, etc.)

      Supplier RTOs and RPOs should align with the acceptable RTOs and RPOs defined in the BIA. Where they do not, explore options for improvement.

      Confirm the following:

      1. The supplier’s own BC/DR capabilities – how they would recover their own operations in a disaster scenario.
      2. Any continuity services the supplier provides – how they can help you recover your operations in a disaster scenario.
      3. Their existing contractual obligations for service availability (e.g. SLAs).

      Download Info-Tech’s BCP Supplier Evaluation Questionnaire

      Organize your BCMS documentation

      Your BCP isn’t any one document. It’s multiple documents that work together.

      Continue to work through any additional required documentation. Build a repository where master copies of each document will reside and can be updated as required. Assign ownership of document management to someone with an understanding of the process (e.g. the BCP Coordinator).

      Governance Recovery
      BCMS Policy BCP Summary Core BCP Recovery Workflows
      Business Process Workflows Action Items & Project Roadmap BCP Recovery Checklists
      BIA Teams, Roles, Contact Information BCP Business Process Workarounds and Recovery Checklists
      BCP Maturity Scorecard BCP Project Charter Additional Recovery Workflows
      Business Unit Prioritization Tool BCP Presentation

      Info-Tech Best Practice

      Recovery documentation has a different audience, purpose, and lifecycle than governance documentation, and keeping the documents separate can help with content management. Disciplined document management keeps the plan current and accessible.

      Align your IT DRP with your BCP

      Use the following BCP outputs to inform your DRP:

      • Business process technology dependencies. This includes technology not controlled by IT (e.g. cloud-based services).
      • RTOs and RPOs for business processes.
      • Technology projects identified by the business to improve resilience (e.g. improved mobility support).
      PCP Outputs DRP Activities
      Business processes defined Identify critical applications

      Dependencies identified:

      • People
      • Enterprise tech
      • Personal devices
      • Workspace and facilities
      • Services and other inputs

      Identify IT dependencies:

      • Infrastructure
      • Secondary applications

      Recovery objectives defined:

      • BIA and RTOs/RPOs
      • Recovery workflows

      Identify recovery objectives:

      • BIA and RTOs/RPOs
      • IT Recovery workflows

      Projects identified to close gaps:

      • Resourcing changes (e.g. training secondary staff)
      • Process changes (e.g. optimize processes and define interim processes)
      • Technology changes (e.g. improving mobility)

      Identify projects to close gaps:

      • Projects to improve DR capability (e.g. data replication, standby systems).
      • Projects to improve resiliency (e.g. redundant components)

      Info-Tech Insight

      Don’t think of inconsistencies between your DRP and BCP as a problem. Discrepancies between the plans are part of the discovery process, and they’re an opportunity to have a conversation that can improve alignment between IT service capabilities and business needs. You should expect that there will be discrepancies – managing discrepancies is part of the ongoing process to refine and improve both plans.

      Schedule activities to keep BC and DR in sync

      BC/DR Planning Workflow

      1. Collect BCP outputs that impact IT DRP (e.g. technology RTOs/RPOs).

      2. As BCPs are done, BCP Coordinator reviews outputs with IT DRP Management Team.

      3. Use the RTOs/RPOs from the BCPs as a starting point to determine IT recovery plans.

      4. Identify investments required to meet business-defined RTOs/RPOs, and validate with the business.

      5. Create a DR technology roadmap to meet validated RTOs/RPOs.

      6. Review and update business unit BCPs to reflect updated RTOs/RPOs.

      Find and address shadow IT

      Reviewing business processes and dependencies can identify workarounds or shadow IT solutions that weren’t visible to IT and haven’t been included in IT’s DR plan.

      • If you identify technology process dependencies that IT didn’t know about, it can be an opportunity to start a conversation about service support. This can be a “teachable moment” to highlight the risks of adopting and implementing technology solutions without consulting IT.
      • Highlight the possible impact of using technology services that aren’t supported by IT. For example:
        • RTOs and RPOs may not be in line with business requirements.
        • Costs could be higher than supported solutions.
        • Security controls may not be in line with compliance requirements.
        • IT may not be able to offer support when the service breaks or build new features or functionality that might be required in the future.
      • Make sure that if IT is expected to support shadow IT solutions, these systems are included in the IT DRP and that the risks and costs of supporting the non-core solution are clear to all parties and are compared to an alternative, IT-recommended solutions.

      Shadow IT can be a symptom of larger service support issues. There should be a process for requesting and tracking non-standard services from IT with appropriate technical, security, and management oversight.

      Review and reprioritize BC projects to create an overall BC project roadmap

      Assign the BCP Coordinator the task of creating a master list of BC projects, and then work with the BC management team to review and reprioritize this list, as described below:

      1. Build a list of BC projects as you work with each business unit.
        1. Add proposed projects to a master copy of the BCP Project Roadmap Tool
        2. For each subsequent business unit, copy project names, scoring, and timelines into the master roadmap tool.
      2. Work with the Executive Sponsor, the IT BCM representative, and the BCM team to review and reprioritize projects.
        1. In the master BCP Project Roadmap Tool, review and update project scoring, taking into account the relative importance of each project within the overall list. Rationalize the list (e.g. eliminate duplicate projects).
      3. The project roadmap is a suggested list of projects at this stage. Assign a project sponsor and project manager (from the BC management team or appropriate delegates) to each project to take it through your organization’s normal project scoping and approval process.

      Improving business continuity capabilities is a marathon, not a sprint. Change for the better is still change and introduces risk – massive changes introduce massive risk. Incremental changes help minimize disruption. Use Info-Tech research to deliver organizational change.

      "Developing a BCP can be like solving a Rubik’s Cube. It’s a complex, interdepartmental concern with multiple and sometimes conflicting objectives. When you have one side in place, another gets pushed out of alignment." – Ray Mach, BCP Expert

      Step 4.3

      Test and maintain your BCP

      This step will walk you through the following activities:

      • Create additional documentation to support your business continuity plan.
      • Create a repository for documentation, and assign ownership for BCP documentation.

      This step involves the following participants:

      • BCP Coordinator

      In this step, you’ll use these tools and templates:

      Outcomes & Insights

      Create a plan to maintain the BCP.

      Iterate on your plan

      Tend your garden, and pull the weeds.

      Mastery comes through practice and iteration. Iterating on and testing your plan will help you keep up to date with business changes, identify plan improvements, and help your organization’s employees develop a mindset of continuity readiness. Maintenance drives continued success; don’t let your plan become stagnant, messy, and unusable.

      Your BCM program should structure BCP reviews and updates by answering the following:

      1. When do we review the plan?
      2. What are the goals of a review?
      3. Who must lead reviews and update BCP documents?
      4. How do we track reviews, tests, and updates?

      Structure plan reviews

      There are more opportunities for improvements than just planned reviews.

      At a minimum, review goals should include:

      1. Identify and document changes to BCP requirements.
      2. Identify and document changes to BCP capabilities.
      3. Identify gaps and risks and ways to remediate risks and close gaps.

      Who leads reviews and updates documents?

      The BCP Coordinator is likely heavily involved in facilitating reviews and updating documentation, at least at first. Look for opportunities to hand off document ownership to the business units over time.

      How do we track reviews, tests, and updates?

      Keep track of your good work by keeping a log of document changes. If you don’t have one, you can use the last tab on the BCP-DRP Maintenance Checklist.

      When do we review the plan?

      1. Scheduled reviews: At a minimum, plan reviews once a year. Plan owners should review the documents, identify needed updates, and notify the coordinator of any changes to their plan.
      2. As-needed reviews: Project launches, major IT upgrades, office openings or moves, organizational restructuring – all of these should trigger a BCP review.
      3. Testing exercises: Schedule controlled exercises to test and improve different aspects of your continuity plan, and ensure that lessons learned become part of plan documentation.
      4. Retrospectives: Take the opportunity to learn from actual continuity events and crises by conducting retrospectives to evaluate your response and brainstorm improvements.

      Conduct a retrospective after major incidents

      Use a retrospective on your COVID-19 response as a starting point. Build on the questions below to guide the conversation.

      • If needed, how did we set up remote work for our users? What worked, and what didn’t?
      • Did we discover any long-term opportunities to improve business processes?
      • Did we use any continuity plans we have documented?
      • Did we effectively prioritize business processes for recovery?
      • Were expectations from our business users in line with our plans?
      • What parts of our plan worked, and where can we improve the plan?
      1. Gather stakeholders and team members
      2. Ask:
        1. What happened?
        2. What did we learn?
        3. What did we do well?
        4. What should we have done differently?
        5. What gaps should we take action to address?
      3. Prepare a plan to take action

      Outcomes and benefits

      • Confirm business priorities.
      • Validate that business recovery solutions and procedures are effective in meeting business requirements (i.e. RTOs and RPOs).
      • Identify gaps in continuity resources, procedures, or documentation, and options to close gaps.
      • Build confidence in the response team and recovery capabilities.

      Tool: Testing and Maintenance Schedule

      Build a light-weight maintenance schedule for your BCP and DRP plans.

      This tool helps you set a schedule for plan update activities, identify document and exercise owners, and log updates for audit and governance purposes.

      • Add the names of your documents and brainstorm update activities.
      • Activities (document updates, testing, etc.) might be scheduled regularly, as-needed, or both. If they happen “as needed,” identify the trigger for the activity.
      • Start tracking past activities and resulting changes in Tab 3. You can also track crises that tested your continuity capabilities on this tab.

      Info-Tech Insight

      Everyone gets busy. If there’s a meeting you can schedule months in advance, schedule it months in advance! Then send reminders closer to the date. As soon as you’re done the pilot BCP, set aside time in everyone’s calendar for your first review session, whether that’s three months, six months, or a year from now.

      Appendix

      Additional BCP Tools and Templates

      Template Library: Business Continuity Policy

      Create a high-level policy to govern BCP and clarify BCP requirements.

      Use this template to:

      • Outline the organizational commitment to BCM.
      • Clarify the mandate to prepare, validate, and maintain continuity plans that align with business requirements.
      • Define specific policy statements that signatories to the policy are expected to uphold.
      • Require key stakeholders to review and sign off on the template.

      Download Info-Tech’s Business Continuity Policy template

      Template Library: Workarounds & Recovery Checklists

      Capture the step-by-step details to execute workarounds and steps in the business recovery process.

      If you require more detail to support your recovery procedures, you can use this template to:

      • Record specific steps or checklists to support specific workarounds or recovery procedures.
      • Identify prerequisites for workarounds or recovery procedures.

      Download Info-Tech’s BCP Process Workarounds & Recovery Checklists Template

      Template Library: Notification, Assessment, Declaration

      Create a procedure that outlines the conditions for assessing a disaster situation and invoking the business continuity plan.

      Use this template to:

      • Guide the process whereby the business is notified of an incident, assesses the situation, and declares a disaster.
      • Set criteria for activating business continuity plans.
      • Review examples of possible events, and suggest options on how the business might proceed or react.

      Download Info-Tech’s BCP Notification, Assessment, and Disaster Declaration Plan template

      Template Library: BCP Recovery Workflow Example

      Review an example of BCP recovery workflows.

      Use this template to:

      • Generate ideas for your own recovery processes.
      • See real examples of recovery processes for warehousing, supply, and distribution operations.
      • Review an example of working BCP documentation.

      Download Info-Tech’s BCP Recovery Workflows Example

      Create a Pandemic Response Plan

      If you’ve been asked to build a pandemic-specific response plan, use your core BCP findings to complete these pandemic planning documents.

      • At the onset of the COVID-19 crisis, IT departments were asked to rapidly ramp up work-from-home capabilities and support other process workarounds.
      • IT managers already knew that obstacles to working from home would go beyond internet speed and needing a laptop. Business input is critical to uncover unexpected obstacles.
      • IT needed to address a range of issues from security risk to increased service desk demand from users who don’t normally work from home.
      • Workarounds to speed the process up had to be balanced with good IT practices and governance (Asset Management, Security, etc.)
      • If you’ve been asked to update your Pandemic Response Plan, use this template and your core BCP deliverables to deliver a set of streamlined documentation that draws on lessons learned from the COVID-19 pandemic.

      Structure HR’s role in the pandemic plan

      Leverage the following materials from Info-Tech’s HR-focused sister company, McLean & Company.

      These HR research resources live on the website of Info-Tech’s sister company, McLean & Company. Contact your Account Manager to gain access to these resources.

      Summary of Accomplishment

      Knowledge Gained

      This blueprint outlined:

      • The streamlined approach to BCP development.
      • A BIA process to identify acceptable, appropriate recovery objectives.
      • Tabletop planning exercises to document and validate business recovery procedures.

      Processes Optimized

      • Business continuity development processes were optimized, from business impact analysis to incident response planning.
      • In addition, pilot business unit processes were identified and clarified to support BCP development, which also provided the opportunity to review and optimize those processes.

      Key Deliverables Completed

      • Core BCP deliverables for the pilot business unit, including a business impact analysis, recovery workflows, and a project roadmap.
      • BCP Executive Presentation to communicate pilot results as well as a summary of the methodology to the executive team.
      • BCP Summary to provide a high-level view of BCP scope, objectives, capabilities, and requirements.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com

      1-888-670-8889

      Research Contributors and Experts

      Dr. Bernard A. Jones, MBCI, CBCP

      Professor and Continuity Consultant Berkeley College

      Dr. Jones is a professor at Berkeley College within the School of Professional Studies teaching courses in Homeland Security and Emergency Management. He is a member of the National Board of Directors for the Association of Continuity Professionals (ACP) as well as the Information & Publications Committee Chair for the Garden State Chapter of the ACP. Dr. Jones earned a doctorate degree in Civil Security Leadership, Management & Policy from New Jersey City University where his research focus was on organizational resilience.

      Kris L. Roberson

      Disaster Recovery Analyst Veterans United Home Loans

      Kris Roberson is the Disaster Recovery Analyst for Veterans United Home Loans, the #1 VA mortgage lender in the US. Kris oversees the development and maintenance of the Veterans United Home Loans DR program and leads the business continuity program. She is responsible for determining the broader strategies for DR testing and continuity planning, as well as the implementation of disaster recovery and business continuity technologies, vendors, and services. Kris holds a Masters of Strategic Leadership with a focus on organizational change management and a Bachelors in Music. She is a member of Infragard, the National Association of Professional Women, and Sigma Alpha Iota, and holds a Project+ certification.

      Trevor Butler

      General Manager of Information Technology City of Lethbridge

      As the General Manager of Information Technology with the City of Lethbridge, Trevor is accountable for providing strategic management and advancement of the city’s information technology and communications systems consistent with the goals and priorities of the corporation while ensuring that corporate risks are appropriately managed. He has 15+ years of progressive IT leadership experience, including 10+ years with public sector organizations. He holds a B.Mgt. and PMP certification along with masters certificates in both Project Management and Business Analysis.

      Robert Miller

      Information Services Director Witt/Kieffer

      Bob Miller is the Information Services Director at Witt/Kieffer. His department provides end-user support for all company-owned devices and software for Oak Brook, the regional offices, home offices, and traveling employees. The department purchases, implements, manages, and monitors the infrastructure, which includes web hosting, networks, wireless solutions, cell phones, servers, and file storage. Bob is also responsible for the firm’s security planning, capacity planning, and business continuity and disaster preparedness planning to ensure that the firm has functional technology to conduct business and continue business growth.

      Related Info-Tech Research

      Create a Right-Sized Disaster Recovery Plan

      Close the gap between your DR capabilities and service continuity requirements.

      Create Visual SOP Documents that Drive Process Optimization, Not Just Peace of Mind

      Go beyond satisfying auditors to drive process improvement, consistent IT operations, and effective knowledge transfer.

      Select the Optimal Disaster Recovery Deployment Model

      Determine which deployment models, including hybrid solutions, best meet your DR requirements.

      Bibliography

      “Business Continuity Planning.” IT Examination HandBook. The Federal Financial Institution Examination Council (FFIEC), February 2015. Web.

      “Business Continuity Plans and Emergency Contact Information.” FINRA, 12 February 2015. Web.

      “COBIT 5: A Business Framework for the Governance and Management of Enterprise IT.” ISACA, n.d. Web.

      Disaster Resource GUIDE. Emergency Lifeline Corporation, n.d. Web.

      “DR Rules & Regulations.” Disaster Recovery Journal, March 2017. Web.

      “Federal Information Security Management Act (FISMA).” Homeland Security, 2014. Web.

      FEMA. “Planning & Templates.” FEMA, n.d. Web.

      “FINRA-SEC-CFTC Joint Advisory (Regulatory Notice 13-25).” FINRA, August 2013. Web.

      Gosling, Mel and Andrew Hiles. “Business Continuity Statistics: Where Myth Meets Fact.” Continuity Central, 24 April 2009. Web.

      Hanwacker, Linda. “COOP Templates for Success Workbook.” The LSH Group, 2016. Web.

      Potter, Patrick. “BCM Regulatory Alphabet Soup – Part Two.” RSA Link, 28 August 2012. Web.

      The Good Practice Guidelines. Business Continuity Institute, 2013. Web.

      Wang, Dashun and James A. Evans. “When Small Teams are Better than Big Ones.” Harvard Business Review, 21 February 2019. Web.

      Explore the Secrets of SAP Software Contracts to Optimize Spend and Reduce Compliance Risk

      • Buy Link or Shortcode: {j2store}140|cart{/j2store}
      • member rating overall impact: 9.8/10 Overall Impact
      • member rating average dollars saved: $73,994 Average $ Saved
      • member rating average days saved: 9 Average Days Saved
      • Parent Category Name: Licensing
      • Parent Category Link: /licensing
      • SAP has strict audit practices, which, in combination with 50+ types of user classifications and manual accounting for some licenses, make maintaining compliance difficult.
      • Mapping and matching SAP products to the environment can be highly complex, leading to overspending and an inability to reduce spend later.
      • Beware of indirect access to SAP applications from third-party applications (e.g. Salesforce).
      • Products that have been acquired by SAP may have altered licensing terms that are innocuously referred to in support renewal documents.

      Our Advice

      Critical Insight

      • Focus on needs first. Conduct a thorough requirements assessment and document the results. Well-documented license needs will be your core asset in navigating SAP licensing and negotiating your agreement.
      • Examine indirect access possibilities. Understanding how in-house or third-party applications may be accessing the SAP software is critical.
      • Know whats in the contract. Each customer agreement is different and there may be terms that are beneficial. Older agreements may provide both benefits and challenges when evaluating your SAP license position.

      Impact and Result

      • Conduct an analysis to remove inactive and duplicate users as multiple logins may exist and could end up costing the organization license fees when audited.
      • Adopt a cyclical approach to reviewing your SAP licensing and create a reference document to track your software needs, planned licensing, and purchase negotiation points.
      • Learn the “SAP way” of conducting business, which includes a best-in-class sales structure, unique contracts and license use policies, and a hyper-aggressive compliance function. Conducting business with SAP is not typical compared to other vendors, and you will need different tools to emerge successfully from a commercial transaction.
      • Manage SAP support and maintenance spend and policies. Once an agreement has been signed, it can be very difficult to decrease spend, as SAP will reprice products if support is dropped.

      Explore the Secrets of SAP Software Contracts to Optimize Spend and Reduce Compliance Risk Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you need to understand and document your SAP licensing strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish licensing requirements

      Begin your proactive SAP licensing journey by understanding which information to gather and assessing the current state and gaps.

      • Explore the Secrets of SAP Software Contracts to Optimize Spend and Reduce Compliance Risk – Phase 1: Establish Licensing Requirements
      • SAP License Summary and Analysis Tool

      2. Evaluate licensing options

      Review current licensing models and determine which licensing models will most appropriately fit your environment.

      • Explore the Secrets of SAP Software Contracts to Optimize Spend and Reduce Compliance Risk – Phase 2: Evaluate Licensing Options

      3. Evaluate agreement options

      Review SAP’s contract types and assess which best fit the organization’s licensing needs.

      • Explore the Secrets of SAP Software Contracts to Optimize Spend and Reduce Compliance Risk – Phase 3: Evaluate Agreement Options

      4. Purchase and manage licenses

      Conduct negotiations, purchase licensing, and finalize a licensing management strategy.

      • Explore the Secrets of SAP Software Contracts to Optimize Spend and Reduce Compliance Risk – Phase 4: Purchase and Manage Licenses
      [infographic]

      Improve IT Governance to Drive Business Results

      • Buy Link or Shortcode: {j2store}190|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $194,553 Average $ Saved
      • member rating average days saved: 32 Average Days Saved
      • Parent Category Name: IT Governance, Risk & Compliance
      • Parent Category Link: /it-governance-risk-and-compliance
      • IT governance is the number-one predictor of value generated by IT, yet many organizations struggle to organize their governance effectively.
      • Current IT governance does not address the changing goals, risks, or context of the organization, so IT spend is not easily linked to value.
      • The right people are not making the right decisions about IT.

      Our Advice

      Critical Insight

      • Organizations do not have a governance framework in place that optimally aligns IT with the business objectives and direction.
      • Implementing IT governance requires the involvement of key business stakeholders who do not see IT’s value in corporate governance and strategy.
      • The current governance processes are poorly designed, making the time to decisions too long and driving non-compliance.

      Impact and Result

      • Use Info-Tech’s four-step process to optimize your IT governance framework.
      • Our client-tested methodology supports the enablement of IT-business alignment, decreases decision-making cycle times, and increases IT’s transparency and effectiveness in decisions around benefits realization, risks, and resources.
      • Successful completion of the IT governance redesign will result in the following outcomes:
        1. Align IT with the business context.
        2. Assess the current governance framework.
        3. Redesign the governance framework.
        4. Implement governance redesign.

      Improve IT Governance to Drive Business Results Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should redesign IT governance, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Align IT with the business context

      Align IT’s direction with the business using the Statement of Business Context.

      • Redesign IT Governance to Drive Optimal Business Results – Phase 1: Align IT With the Business Context
      • Make the Case for an IT Governance Redesign
      • Stakeholder Power Map Template
      • IT Governance Stakeholder Communication Planning Tool
      • PESTLE Analysis Template
      • Business SWOT Analysis Template
      • Statement of Business Context Template

      2. Assess the current governance framework

      Evaluate the strengths and weaknesses of current governance using the Current State Assessment.

      • Redesign IT Governance to Drive Optimal Business Results – Phase 2: Assess the Current Governance Framework
      • Current State Assessment of IT Governance

      3. Redesign the governance framework

      Build a redesign of the governance framework using the Future State Design template.

      • Redesign IT Governance to Drive Optimal Business Results – Phase 3: Redesign the Governance Framework
      • Future State Design for IT Governance
      • IT Governance Terms of Reference

      4. Implement governance redesign

      Create an implementation plan to jump-start the communication of the redesign and set it up for success.

      • Redesign IT Governance to Drive Optimal Business Results – Phase 4: Implement Governance Redesign
      • Redesign IT Governance to Drive Optimal Business Results Executive Presentation Template
      • IT Governance Implementation Plan
      [infographic]

      Workshop: Improve IT Governance to Drive Business Results

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify the Need for Governance

      The Purpose

      Identify the need for governance in your organization and engage the leadership team in the redesign process.

      Key Benefits Achieved

      Establish an engagement standard for the leadership of your organization in the IT governance redesign.

      Activities

      1.1 Identify stakeholders.

      1.2 Make the case for improved IT governance.

      1.3 Customize communication plan.

      Outputs

      Stakeholder Power Map

      Make the Case Presentation

      Communication Plan

      2 Align IT With the Business Context

      The Purpose

      Create a mutual understanding with the business leaders of the current state of the organization and the state of business it is moving towards.

      Key Benefits Achieved

      The understanding of the business context will provide an aligned foundation on which to redesign the IT governance framework.

      Activities

      2.1 Review documents.

      2.2 Analyze frameworks.

      2.3 Conduct brainstorming.

      2.4 Finalize the Statement of Business Context.

      Outputs

      PESTLE Analysis

      SWOT Analysis

      Statement of Business Context

      3 Assess the Current Governance Framework

      The Purpose

      Establish a baseline of the current governance framework.

      Key Benefits Achieved

      Develop guidelines based off results from the current state that will guide the future state design.

      Activities

      3.1 Create committee profiles.

      3.2 Build governance structure map.

      3.3 Establish governance guidelines.

      Outputs

      Current State Assessment

      4 Redesign the Governance Framework

      The Purpose

      Redesign the governance structure and the committees that operate within it.

      Key Benefits Achieved

      Build a future state of governance where the relationships and processes that are built drive optimal business results.

      Activities

      4.1 Build governance structure map.

      4.2 Create committee profiles.

      Outputs

      Future State Design

      IT Governance Terms of Reference

      5 Implement Governance Redesign

      The Purpose

      Build a roadmap for implementing the governance redesign.

      Key Benefits Achieved

      Create a transparent and relationship-oriented implementation strategy that will pave the way for a successful redesign implementation.

      Activities

      5.1 Identify next steps for the redesign.

      5.2 Establish communication plan.

      5.3 Lead executive presentation.

      Outputs

      Implementation Plan

      Executive Presentation

      Further reading

      Improve IT Governance to Drive Business Results

      Avoid bureaucracy and achieve alignment with a minimalist approach.

      ANALYST PERSPECTIVE

      Governance optimization is achieved where decision making, authority, and context meet.

      "Governance is something that is done externally to IT and well as internally by IT, with the intention of providing oversight to direct the organization to meet goals and keep things on target.

      Optimizing IT governance is the most effective way to consistently direct IT spend to areas that provide the most value in producing or supporting business outcomes, yet it is rarely done well.

      IT governance is more than just identifying where decisions are made and who has the authority to make them – it must also provide the context and criteria under which decisions are made in order to truly provide business value" (Valence Howden, Director, CIO Practice Info-Tech Research Group)

      Our understanding of the problem

      This Research is Designed For:

      • CIOs
      • CTOs
      • IT Directors

      This Research Will Help You:

      • Achieve and maintain executive and business support for optimizing IT governance.
      • Optimize your governance structure.
      • Build high-level governance processes.
      • Build governance committee charters and set accountability for decision making.
      • Plan the transition to the optimized governance structure and processes.

      This Research Will Also Assist:

      • Executive Leadership
      • IT Managers
      • IT Customers
      • Project Managers

      This Research Will Help Them:

      • Improve alignment between business decisions and IT initiatives.
      • Establish a mechanism to validate, redirect, and reprioritize IT initiatives.
      • Realize greater value from more effective decision making.
      • Receive a better overall quality of service.

      Executive Summary

      Situation

      • IT governance is the #1 predictor of value generated by IT, yet many organizations struggle to organize their governance effectively.*
      • Current IT governance does not address the changing goals, risks, or context of the organization so IT spend is not easily linked to value.
      • The right people are not making the right decisions about IT.

      Complication

      • Organizations do not have a governance framework in place that optimally aligns IT with the business objectives and direction.
      • Implementing IT governance requires the involvement of key business stakeholders who do not see IT’s value in governance and strategy.
      • The current governance processes are poorly designed, creating long decision-making cycles and driving non-compliance with regulation.

      Resolution

      • Use Info-Tech’s four-step process for optimizing your IT governance framework. Our client-tested methodology supports the enablement of IT-business alignment, decreases decision-making cycle times, and increases IT’s transparency and effectiveness in making decisions around benefits realization, risks, and resources.
      • Successful completion of the IT governance redesign will result in the following outcomes:
        1. Align IT with the business context.
        2. Assess the current governance framework.
        3. Redesign the governance framework.
        4. Implement governance redesign.

      Info-Tech Insight

      • Establish IT-business fusion. In governance, alignment is not enough. Merge IT and the business through governance to ensure business success.
      • With great governance comes great responsibility. Involve relevant business leaders, who will be impacted by IT outcomes, to take on governing responsibility of IT.
      • Let IT manage and the business govern. IT governance should be a component of enterprise governance, allowing IT leaders to focus on managing.

      IT governance is...

      An enabling framework for decision-making context and accountabilities for related processes.

      A means of ensuring business-IT collaboration, leading to increased consistency and transparency in decision making and prioritization of initiatives.

      A critical component of ensuring delivery of business value from IT spend and driving high satisfaction with IT.

      IT governance is not...

      An annoying, finger-waving roadblock in the way of getting things done.

      Limited to making decisions about technology.

      Designed tacitly; it is purposeful, with business objectives in mind.

      A one-time project; you must review and revalidate the efficiency.

      Avoid common misconceptions of IT governance

      Don’t blur the lines between governance and management; each has a unique role to play. Confusing these results in wasted time and confusion around ownership.

      Governance

      A cycle of 'Governance Processes' and 'Management Processes'. On the left side of the cycle 'Governance Processes' begins with 'Evaluate', then 'Direct', then 'Monitor'. This leads to 'Management Processes' on the right side with 'Plan', 'Build', 'Run', and 'Monitor', which then feeds back into 'Evaluate'.

      Management

      IT governance sets direction through prioritization and decision making, and monitors overall IT performance.

      Governance aligns with the mission and vision of the organization to guide IT.

      Management is responsible for executing on, operating, and monitoring activities as determined by IT governance.

      Management makes decisions for implementing based on governance direction.

      The IT Governance Framework

      An IT governance framework is a system that will design structures, processes, authority definitions, and membership assignments that lead IT toward optimal results for the business.

      Governance is performed in three ways:
      1. Evaluate

        Governance ensures that business goals are achieved by evaluating stakeholder needs, criteria, metrics, portfolio, risk, and definition of value.
      2. Direct

        Governance sets the direction of IT by delegating priorities and determining the decisions that will guide the IT organization.
      3. Monitor

        Governance establishes a framework to monitor performance, compliance to regulation, and progress on expected outcomes.

      "Everyone needs good IT, but no one wants to talk about it. Most CFOs would rather spend time with their in-laws than in an IT steering-committee meeting. But companies with good governance consistently outperform companies with bad. Which group do you want to be in?" (Martha Heller, President, Heller Search Associates)

      Create impactful IT governance by embedding it within enterprise governance

      The business should engage in IT governance and IT should influence the direction of the business.

      Enterprise Governance

      IT Governance

      Authority for enterprise governance falls to the board and executive management.

      Responsibilities Include:
      • Provide strategic direction for the organization.
      • Ensure objectives are met.
      • Set the risk standards or profile.
      • Delegate resources responsibly.
      –› Engage in –›

      ‹– Influence ‹–

      Governance of IT is a component of enterprise governance.

      Responsibilities Include:
      • Build structure, authority, process, and membership designations in a governance framework.
      • Ensure the IT organization is aligned with business goals.
      • Influence the direction of the business to ensure business success.

      Identify signals of sub-optimal IT governance within any of these domains

      If you notice any of these signals, governance redesign is right for you!

      Inability to Realize Benefits

      1. IT is unable to articulate the value of its initiatives or spend.
      2. IT is regularly delegated unplanned projects.
      3. The is no standard approach to prioritization.
      4. Projects do not meet target metrics.

      Resource Misallocation

      1. Resources are wasted due to duplication or overlap in IT initiatives.
      2. IT projects fail at an unacceptable rate, leading to wasted resources.
      3. IT’s costs continue to increase without reciprocal performance increase.

      Misdiagnosed Risks

      1. Risk appetite is incorrectly identified or not identified at all.
      2. Disagreement on the approach to risk in the organization.
      3. Increasing rate of IT incidents related to risk.
      4. IT is failing to meet regulatory requirements.

      Dissatisfied Stakeholders

      1. There are no ways to measure stakeholder satisfaction with IT.
      2. Business strategies and IT strategies are misaligned.
      3. IT’s relationship with key stakeholders is unstable and there is a lack of mutual trust.

      A majority of organizations experience significant alignment gaps

      The majority of organizations and their key stakeholders experience highly visible gaps in the alignment of IT investments and organizational goals.

      There are two bars with percentages of their length marked out for different CXO responses. The possible responses are from '1, Critical Gap' to '7, No Gap'. The top bar says '57% of CXOs identify a major gap in IT's ability to support business goals', and shows 13% answered '1, Critical Gap', 22% answered '2', and 22% answered '3'. The bottom bar says '84% of CXOs often perceive that IT is investing in areas that do not support the business' and shows 38% answered '1, Critical Gap', 33% answered '2', and 13% answered '3'.

      88% of CIOs believe that their governance is not effective. (Info-Tech Diagnostics)

      Leverage governance as the catalyst for connecting IT and the business

      49% of firms are misaligned on current performance expectations for IT.

      • 49% Misaligned
      • 51% Aligned

      67% of firms are misaligned on the target role for IT.

      • 34% Highly Misaligned
      • 33% Somewhat Misaligned
      • 33% Aligned

      A well-designed IT governance framework will hep you to:

      1. Make sure IT keeps up with the evolving business context.
      2. Align IT with the mission and the vision of the organization.
      3. Optimize the speed and quality of decision making.
      4. Meet regulatory and compliance needs in the external environment.
      5. (Info-Tech Diagnostics)

      Align with business goals through governance to attain business-IT fusion

      Create a state of business-IT fusion, in which the two become one.

      Without business-IT fusion, IT will go in a different direction, leading to a divergence of purpose and outcomes. IT can transform into a fused partner of the business by ensuring that they govern toward the same goal.

      Firefighter
      • Delivers lower value
      • Duplication of effort
      • Unclear risk profile
      • High risk exposure
      Three sets of arrows, each pointing upward and arranged in an ascending stair pattern. The first, lowest set of arrows has a large blue arrow with a small green arrow veering off to the side, unaligned. The second, middle set of arrows has a large blue arrow with a medium green arrow overlaid on its center, somewhat aligned. The third, highest set of arrows has half of a large blue arrow, and the other half is a large green arrow, aligned. Business Partner
      • Increased speed of decision making
      • Aligned with business priorities
      • Optimized utility of people, financial, and time resources
      • Monitors and mitigates risk and compliance issues

      Redesign IT governance in accordance with COBIT and proven good practice

      Info-Tech’s approach to governance redesign is rooted in COBIT, the world-class and open-source IT governance standard.

      COBIT begins with governance, EDM – Evaluate, Direct, and Monitor.

      We build upon these standards with industry best practices and add a practical approach based on member feedback.

      This blueprint will help you optimize your governance framework.

      The upper image is a pyramid with 'Info-Tech Insights, Analysts, Experts, Clients' on top, 'IT Governance Best Practices' in the middle, and 'COBIT 5' on the bottom, indicating that Info-Tech's Governance guidance is based in COBIT 5. 'This project will focus on EDM01, Set/Maintain Governance Framework.'

      Use Info-Tech’s approach to implementing an IT governance redesign

      The four phases of Info-Tech’s governance redesign methodology will help you drive greater value for the business.

      1. Align IT With the Business Context
        Align IT’s direction with the business using the Statement of Business Context Template.
      2. Assess the Current Governance Framework
        Evaluate the strengths and weaknesses of current governance using the Current State Assessment of IT Governance.
      3. Redesign the Governance Framework
        Build a redesign of the governance framework using the Future State Design for IT Governance tool.
      4. Implement Governance Redesign
        Create an IT Governance Implementation Plan to jumpstart the communication of the redesign and set it up for success.
      5. Continuously assess your governance framework to ensure alignment.

      Leverage Info-Tech’s insights for an optimal redesign process

      Common Pitfalls

      Info-Tech Solutions

      Phase 1

      There must be an active understanding of the current and future state of the business for governance to address the changing needs of the business. –›
      1. Make the case for a governance redesign.
      2. Create a custom communication plan to facilitate support.
      3. Establish a collectively agreed upon statement of business context.

      Phase 2

      Take a proactive approach to revising your governance framework. Understand why you are making decisions before actually making them. –›
      1. Conduct the IT governance current state assessment.
      2. Create governance guidelines for redesign.

      Phase 3

      Keep the current and future goals in sight to build an optimized governance framework that maintains the minimum bar of oversight required. –›
      1. Redesign the future state of IT governance in your organization.

      Phase 4

      Don’t overlook the politics and culture of your organization in redesigning your governance framework. –›
      1. Rationalize steps in an implementation plan.
      2. Outline a communication strategy to navigate culture and politics.
      3. Construct an executive presentation to facilitate transparency for the governing framework.

      Leverage both COBIT and Info-Tech-defined metrics to evaluate the success of your redesign

      These metrics will help you determine the extent to which your governance is supporting your business goals, and whether the governance in place promotes business-IT fusion.

      Benefits Realization

      1. Percent of IT-enabled investments where benefit realization is monitored through the full economic life. (COBIT-defined metric)
      2. Percent of enterprise strategic goals and requirements supported by IT strategic goals. (COBIT-defined metric)
      3. Percent of IT services where expected benefits are realized or exceeded. (COBIT-defined metric)

      Resources

      1. Satisfaction level of business and IT executives with IT-related costs and capabilities. (COBIT-defined metric)
      2. Average time to turn strategic IT objectives into an agreed-upon and approved initiative. (COBIT-defined metric)
      3. Number of deviations from resource utilization plan.

      Risks

      1. Number of security incidents causing financial loss, business disruption, or public embarrassment. (COBIT-defined metric)
      2. Number of issues related to non-compliance with policies. (COBIT-defined metric)
      3. Percentage of enterprise risk assessments that include IT-related risks. (COBIT-defined metric)
      4. Frequency with which the risk profile is updated. (COBIT-defined metric)

      Stakeholders

      1. Change in score of alignment with the scope of the planned portfolio of programs and services (using CIO-CXO Alignment Diagnostic).
      2. Percent of executive management roles with clearly defined accountabilities for IT decisions. (COBIT-defined metric)
      3. Percent of business stakeholders satisfied that IT service delivery meets agreed-upon service levels. (COBIT-defined metric)
      4. Percent of key business stakeholders involved in IT governance.

      Capture monetary value by establishing and monitoring key metrics

      While benefits of governance are often qualitative, the power of effective governance can be demonstrated through quantitative financial gains.

      Scenario 1 – Realizing Expected Gains

      Scenario 2 – Mitigating Unexpected Losses

      Metric

      Track the percentage of initiatives that provided expected ROI year over year. The optimization of the governance framework should generate an increase in this metric. Monitor this metric for continuous improvement opportunities. Track the financial losses related to non-compliance with policy or regulation. An optimized governance framework should better protect the organization against policy breach and mitigate the possibility and impact of “rogue” actions.

      Formula

      ROI of all initiatives / number of initiatives in year 2 – ROI of all initiatives / number of initiatives in year 1

      The expected result should be positive.

      Cost of non-compliance in year 2 – cost of non-compliance in year 1

      The expected result should be negative.

      Redesign IT governance to achieve optimal business outcomes

      CASE STUDY

      Industry: Healthcare
      Source: Info-Tech

      Situation

      The IT governance had been structured based on regulations and had not changed much since it was put in place. However, a move to become an integration and service focused organization had moved the organization into the world of web services, Agile development, and service-oriented architecture.

      Complication

      The existing process was well defined and entrenched, but did not enable rapid decision making and Agile service delivery. This was due to the number of committees where initiatives were reviewed, made worse by their lack of approval authority. This led to issues moving initiatives forward in the timeframes required to meet clinician needs and committed governmental deadlines.

      In addition, the revised organizational mandate had created confusion regarding the primary purpose and function of the organization and impacted the ability to prioritize spend on a limited budget.

      To complicate matters further, there was political sensitivity tied to the membership and authority of different governing committees.

      Result:

      The CEO decided that a project would be initiated by the Enterprise Architecture Group, but managed by an external consultant to optimize and restructure the governance within the organization.

      The purpose of using the external consultant was to help remove internal politics from the discussion. This allowed the organization to establish a shared view of the organization’s revised mission and IT’s role in its execution.

      The exercise led to the removal of one governing committee and the merger of two others, modification to committee authority and membership, and a refined decision-making context that was agreed to by all parties.

      The redesigned governance process led to a 30% reduction in cycle time from intake to decision, and a 15% improvement in alignment of IT spend with strategic priorities.

      Use these icons to help direct you as you navigate this research

      Use these icons to help guide you through each step of the blueprint and direct you to content related to the recommended activities.

      A small monochrome icon of a wrench and screwdriver creating an X.

      This icon denotes a slide where a supporting Info-Tech tool or template will help you perform the activity or step associated with the slide. Refer to the supporting tool or template to get the best results and proceed to the next step of the project.

      A small monochrome icon depicting a person in front of a blank slide.

      This icon denotes a slide with an associated activity. The activity can be performed either as part of your project or with the support of Info-Tech team members, who will come onsite to facilitate a workshop for your organization.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Redesign IT Governance – project overview

      Align IT With the Business Context

      Assess the Current State

      Redesign Governance

      Implement Redesign

      Supporting Tool icon

      Best-Practice Toolkit

      1.1 Identify Stakeholders
      1.2 Make the Case
      1.3 Present to Executives
      1.4 Customize Comm. Plan
      1.5 Review Documents
      1.6 Analyze Frameworks
      1.7 Conduct Brainstorming
      1.8 Finalize the SoBC
      2.1 Create Committee Profiles

      2.2 Build a Governance Structure Map

      2.3 Establish Governance Guidelines

      3.1 Build Governance Structure Map

      3.2 Create Committee Profiles

      3.3 Leverage Process Specific Governance Blueprints

      4.1 Identify Next Steps for the Redesign

      4.2 Establish Communication Plan

      4.3 Lead Executive Presentation

      Guided Implementations

      • Move towards gaining buy-in from the business if necessary. Then identify the major components of the SoBC.
      • Review SoBC and discuss a strategy to engage key stakeholders in the redesign.
      • Explore the process of identifying the four major elements of governance. Build guidelines for the future state.
      • Review the current state of governance and discuss the implications and guidelines.
      • Identify the changes that will need to be made.
      • Review redesigned structure and authority.
      • Review redesigned process and membership.
      • Discuss and review the implementation plan.
      • Prepare the presentation for the executives. Provide support on any final questions.
      Associated Activity icon

      Onsite Workshop

      Module 1:
      Align IT with the business context
      Module 2:
      Assess the current governance framework
      Module 3:
      Redesign the governance framework
      Module 4:
      Implement governance redesign
      Phase 1 Results:
      • Align IT’s direction with the business.
      Phase 2 Results:
      • Evaluate the strengths and weaknesses of current governance and build guidelines.
      Phase 3 Results:
      • Establish a redesign of the governance framework.
      Phase 4 Results:
      • Create an implementation plan for the communication of the redesign.

      Workshop overview

      Contact your account representative or email Workshops@InfoTech.com for more information.

      Workshop Day 1

      Workshop Day 2

      Workshop Day 3

      Workshop Day 4

      Workshop Day 5

      Task – Identify the Need for Governance Task – Align IT with the Business Context Task – Assess the Current State Task – Redesign Governance Framework Task – Implement Governance Redesign

      Activities

      • 1.1 Identify Stakeholders
      • 1.2 Make the Case
      • 1.3 Present to Executives
      • 1.4 Customize Communication Plan
      • 2.1 Review Documents
      • 2.2 Analyze Frameworks
      • 2.3 Conduct Brainstorming
      • 2.4 Finalize the Statement of Business Context
      • 3.1 Create Committee Profiles
      • 3.2 Build Governance Structure Map
      • 3.3 Establish Governance Guidelines
      • 4.1 Build Governance Structure Map
      • 4.2 Create Committee Profiles
      • 4.3 Leverage Process Specific Governance Blueprints
      • 5.1 Identify Next Steps for the Redesign
      • 5.2 Establish Communication Plan
      • 5.3 Lead Executive Presentation

      Deliverables

      1. Make the Case Presentation
      2. Stakeholder Power Map Template
      3. Communication Plan
      1. PESTLE Analysis
      2. SWOT Analysis
      3. Statement of Business Context
      1. Current State Assessment
      1. Future State Design Tool
      2. IT Governance Terms of Reference
      1. Implementation Plan
      2. Executive Presentation

      Improve IT Governance to Drive Business Results

      PHASE 1

      Align IT With the Business Context

      Phase 1 outline

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 1: Align IT With the Business Context

      Proposed Time to Completion: 2-4 weeks
      Step 1.1: Identify the Need for Governance Step 1.2: Create the Statement of Business Context
      Start with an analyst kick-off call:
      • Understand the core concepts of IT governance.
      • Create a strategy for key stakeholder support.
      • Identify key communication milestones.
      Review findings with analyst:
      • Identify and discuss the process of engaging senior leadership.
      • Review findings from business analysis.
      • Review diagnostic and interview outcomes.
      Then complete these activities…
      • Identify stakeholders.
      • Make the case to executives.
      • Build a communication plan.
      Then complete these activities…
      • Review business documents.
      • Review the PESTLE and SWOT analyses.
      • Analyze outcomes of CIO-CEO Alignment Diagnostic.
      • Complete the Statement of Business Context.
      With these tools & templates:
      • Make the Case for an IT Governance Redesign
      • Stakeholder Power Map Template
      • IT Governance Stakeholder Communication Planning Tool
      With these tools & templates:
      • PESTLE Analysis Template
      • Business SWOT Analysis Template
      • CIO-CEO Alignment Diagnostic
      • Statement of Business Context Template

      Phase 1: Align IT With the Business Context

      1 2 3 4
      Align IT With the Business Context Assess the Current Governance Framework Redesign the Governance Framework Implement Governance Redesign

      Activities:

      • 1.1 Identify Stakeholders
      • 1.2 Customize Make the Case Presentation
      • 1.3 Present to Executives
      • 1.4 Customize Communication Plan
      • 1.5 Review Business Documents
      • 1.6 Analyze Business Frameworks
      • 1.7 Conduct Brainstorming Efforts
      • 1.8 Finalize the SoBC

      Outcomes:

      • Make the case for a governance redesign.
      • Create a custom communication plan to facilitate support for the redesign process.
      • Establish a collectively agreed upon statement of business context.

      Set up business-driven governance by gaining an understanding of the business context

      Fuse IT with the business by establishing a common context of what the business is trying to achieve. Align IT with the business by developing an understanding of the business state, creating a platform to build a well-aligned governance framework.

      "IT governance philosophies can no longer be a ‘black box’ … IT governance can no longer be ignored by senior executives." (Iskandar and Mohd Salleh, University of Malaya, International Journal of Digital Society)

      Info-Tech Insight

      Get consensus on the changing state of business. There must be an active understanding of the current and future state of the business for governance to address the changing needs of the business.

      The source for the governance redesign directive will dictate the route for attaining leadership buy-in

      "Without an awareness of IT governance, there is no chance that it will be followed … The higher the percentage of managers who can describe your governance, the higher the governance performance." (Jeanne Ross, Director, MIT Center for Information Systems Research)

      The path you will choose for your governance buy-in tactics will be based on the original directive to redesign governance.

      Enterprise Directive.
      In the case that the redesign is an enterprise directive, jump directly to building a communication plan.

      IT Directive.
      In the case that the redesign is an IT directive, make the case to get the business on board.

      Use the Make the Case presentation template to get buy-in from the business

      Supporting Tool icon 1A Convince senior management to redesign governance

      INSTRUCTIONS

      1. Identify Stakeholders
        Determine which business stakeholders will be impacted or involved in the redesign process.
      2. Customize the Presentation
        Identify specific pain points regarding IT-business alignment.
      3. Present to Executives
        Present the make the case presentation.

      Info-Tech Best Practice

      Use the Make the Case customizable deliverable to lead a boardroom-quality presentation proving the specific need for senior executive involvement in the governance redesign.

      Determine which business stakeholders will be impacted or involved in the redesign process

      Associated Activity icon 1.1 Identify the stakeholders for the IT governance redesign

      It is vital to identify key business and IT stakeholders before the IT governance redesign has begun. Consider whose input and influence will be necessary in order to align with the business context and redesign the governance framework accordingly.

      Business

      • Shareholders
      • Board
      • Chief Executive Officer
      • –› Example: the CEO wants to know how IT will support the achievement of strategic corporate objectives.
      • Chief Financial Officer
      • Chief Operating Officer
      • Business Executives
      • Business Process Owners
      • Strategy Executive Committee
      • Chief Risk Officer
      • Chief Information Security Officer
      • Architecture Board
      • Enterprise Risk Committee
      • Head of Human Resources
      • Compliance
      • Audit

      IT

      • Chief Information Officer
      • –› Example: the CIO would like validation from the business with regards to prioritization criteria.
      • Head Architect
      • Head of Development
      • Head of IT Operations
      • Head of IT Administration
      • Service Manager
      • Information Security Manager
      • Business Continuity Manager
      • Privacy Officer

      External

      • Government Agency
      • –› Example: some governments mandate that organizations develop and implement an IT governance framework.
      • Audit Firm

      Build a power map to prioritize stakeholders

      Associated Activity icon 1.1 2-4 hours

      Stakeholders may have competing concerns – that is, concerns that cannot be addressed with one solution. The governance redesigner must prioritize their time to address the concerns of the stakeholders who have the most power and who are most impacted by the IT governance redesign.

      Draw a stakeholder power map to visualize the importance of various stakeholders and their concerns, and to help prioritize your time with those stakeholders.

      • Power: How much influence does the stakeholder have? Enough to drive the project forward or into the ground?
      • Involvement: How interested is the stakeholder? How much involvement does the stakeholder have in the project already?
      • Impact: To what degree will the stakeholder be impacted? Will this significantly change the job?
      • Support: Is the stakeholder a supporter of the project? Neutral? A resistor?
      A power map of stakeholders with two axes and four quadrants. The vertical axis is 'Low Power' on the bottom and 'High Power' on top. The horizontal axis is 'Low Involvement' on the left and 'High Involvement' on the right. The top left quadrant is labeled 'Keep satisfied' and contains 'CFO', a Strongly Impacted Resistor, and 'COO', a Weakly Impacted Resistor. The top right quadrant is labeled 'Key Players' and contains 'CIO' and 'CEO', both Strongly Impacted Supporters. The bottom left quadrant is labeled 'Minimal effort' and contains 'Marketing Head', a Weakly Impacted Neutral, and 'Production Head', a Moderately Impacted Neutral. The bottom right quadrant is labeled 'Keep informed' and contains 'Director of Ops', a Strongly Impacted Supporter, and 'Chief Architect', a Strongly Impacted Neutral.

      Download Info-Tech’s Stakeholder Power Map Template to help you visualize your key stakeholders.

      Build a power map to prioritize stakeholders

      Associated Activity icon 1.1

      It is important to identify who will be impacted and who has power, and the level of involvement they have in the governance redesign. If they have power, will be highly impacted, and are not involved in governance, you have already lost – because they will resist later. You need to get them involved early.

      • Focus on key players – relevant stakeholders who have high power, are highly impacted, and should have a high level of involvement.
      • Engage the stakeholders that are impacted most and have the power to impede the success of redesigning IT governance.
        • For example, if a CFO, who has the power to block project funding, is heavily impacted and not involved, the IT governance redesign success will be put at risk.
      • Some stakeholders may have influence over others so you should focus your efforts on the influencer rather than the influenced.
        • For example, if an uncooperative COO is highly influenced by the Director of Operations, it is recommended to engage the latter.

      The same power map of stakeholders with two axes and four quadrants, but with focus points and notes. The vertical axis is 'Low Power' on the bottom and 'High Power' on top. The horizontal axis is 'Low Involvement' on the left and 'High Involvement' on the right. The top left quadrant is labeled 'Keep satisfied' and contains 'CFO', a Strongly Impacted Resistor, and 'COO', a Weakly Impacted Resistor, as well as a dotted line moving 'CFO' to the top right quadrant with the note 'A) needs to be engaged'. The top right quadrant is labeled 'Key Players' and contains 'CIO' and 'CEO', both Strongly Impacted Supporters, as well as the new required position of 'CFO'. The bottom left quadrant is labeled 'Minimal effort' and contains 'Marketing Head', a Weakly Impacted Neutral, and 'Production Head', a Moderately Impacted Neutral. The bottom right quadrant is labeled 'Keep informed' and contains 'Director of Ops', a Strongly Impacted Supporter, and 'Chief Architect', a Strongly Impacted Neutral, as well as a line from 'Director of Ops' to 'COO' in the top left quadrant with a note that reads 'B) Influences'.

      Identify specific pain points regarding business-IT alignment

      Associated Activity icon 1.2 2-4 hours

      INPUT: Signal Questions, CIO-CXO Alignment Diagnostic

      OUTPUT: List of Categorized Pain Points

      Materials: Make the Case for an IT Governance Redesign

      Participants: Identified Key Business Stakeholders

      1. Consider Signals for Redesign
        Refer to the Executive Brief for questions to identify pain points related to governance.
        • Benefits Realization
        • Resources
        • Risks
        • Stakeholders
      2. Conduct CIO-CEO Alignment Diagnostic
        Assess the current state of alignment between the CIO and the major stakeholders of the organization.

      See the CEO-CIO Alignment Program for more information.

      Conduct the CEO-CIO Alignment Diagnostic

      Why CEO-CIO Alignment?

      The CEO-CIO Alignment Program helps you understand the gaps between what the CEO wants for IT and what the CIO wants for IT. The program will also evaluate the current state of IT, from a strategic and tactical perspective, based on the CEO’s opinion.

      The CEO-CIO Alignment Program helps to:

      • Evaluate how the executive leadership currently feels about the IT organization’s performance along the following dimensions:
        • IT budgeting and staffing
        • IT strategic planning
        • Degree of project success
        • IT-business alignment
      • Answer the question, “What does the CEO want from IT?”
      • Understand the CEO’s perception of and vision for IT in the business.
      • Define the current and target roles for IT. Understanding IT’s current and target roles, in the eyes of the CEO, is crucial to creating IT governance. By focusing the IT governance on achieving the target role, you will ensure that the senior leadership will support the implementation of the IT governance.

      To conduct the CEO-CIO Alignment Program, follow the steps outlined below.

      1. Select the senior business leader to participate in the program. While Info-Tech suggests that the CEO participate, you might have other senior stakeholders who should be involved.
      2. Send the survey link to your senior business stakeholder and ensure the survey’s completion.
      3. Complete your portion of the survey.
      4. Hold a meeting to discuss the results and document your findings.

      See the CEO-CIO Alignment Program for more information.

      Present the “Make the Case” for IT governance redesign

      Associated Activity icon 1.3 30 minutes

      1. Review Finalized Stakeholder List
        Consolidate a list of the most important and impactful stakeholders who need further convincing to participate in the governance redesign and implementation.
      2. Present the Deck
        Include the information gathered throughout the discovery into the presentation deck and hold a meeting to review the findings.

      Business

      • Shareholders
      • Board
      • Chief Executive Officer
      • Chief Financial Officer
      • Chief Operating Officer
      • Business Executives
      • Strategy Executive Committee
      • Chief Risk Officer
      • Architecture Board
      • Enterprise Risk Committee
      • Head of Human Resources
      • Compliance

      IT

      • Chief Information Officer

      External

      • Government Agency
      • Audit Firm

      Use the Make the Case for an IT Governance Redesign template for more information.

      Create a custom communication plan to facilitate support for the redesign process

      Supporting Tool icon 1B Create a plan to engage the key stakeholders

      INSTRUCTIONS

      1. Identify Stakeholders
        Determine which business stakeholders will be involved (refer to Activity 1.1).
      2. Customize Communication Plan
        Follow up with individual communication plans.

      Info-Tech Best Practice

      Create personal communication plans to provide individualized engagement, instead of assuming that everyone will respond to the same communication style.

      Download the IT Governance Stakeholder Communication Planning Tool for more information.

      Create a communication plan to engage key stakeholders

      Associated Activity icon 1.4 1 hour
      1. Input Stakeholders
        Determine which business stakeholders will be involved (refer to Activity 1.1). Then, insert their position on the power map, the rationale to inform them, the timing of communications, and what inputs they will be needed to provide.

        Stakeholder role

        Power map position

        Why inform them

        When to inform them

        What we need from them

        Chief Executive Officer
        Chief Financial Officer
        Chief Operating Officer
      2. Identify Communication Strategy
        Outline the most effective communication plan for that stakeholder. Identify how to best communicate to the stakeholders to make sure they are appropriately engaged in the redesign process.

        Vehicle

        Audience

        Purpose

        Frequency

        Owner

        Distribution

        Level of detail

        Status Report IT Managers Project progress and deliverable status Weekly CIO, John Smith Email Details for milestones, deliverables, budget, schedule, issues, next steps
        Status Report Marketing Manager Project progress Monthly CIO, John Smith Email High-level detail for major milestone update and impact to the marketing unit

      Establish a collectively agreed upon statement of business context (SoBC)

      Supporting Tool icon 1C Document the mutual understanding of the business context

      INSTRUCTIONS

      1. Review Business Documents
        Review business documents from broad areas of the business to assess the business context.
      2. Analyze Business Frameworks
        Analyze business frameworks to articulate the current and projected future business context.
      3. Brainstorm With Key Stakeholders
        Conduct stakeholder brainstorming efforts to gain insights from key business stakeholders.
      4. Finalize the SoBC
        Document and sign the SoBC with identified stakeholders.

      Info-Tech Best Practice

      Use the Statement of Business Context customizable deliverable as a point of reference that will guide the direction of the governance redesign.

      Use the Statement of Business Context to identify the critical information needed to guide governance

      Components of the SoBC

      1. Mission
        • Who are you as an organization?
        • Who are your internal and external customers?
        • What are your core business functions?

        Example (Higher Education)
        Nurture global leaders and provide avenues for intellectual exploration.
      2. Vision
        • Is your vision statement future-facing?
        • Is your vision statement concise?
        • Is your vision statement achievable?
        • Does your vision statement involve change?

        Example
        Be a catalyst for creating the future leaders of tomorrow through dynamic and immersive educational experiences. The university will be recognized for being a prestigious innovative research hub and educational institution.
      Sample of Info-Tech's Statement of Business Context Template with the Mission and Vision Statements.

      Use the Statement of Business Context to identify the critical information needed to guide governance (cont.)

      More Components of the SoBC

      1. Strategic Objectives
        • What are the strategic initiatives of the organization?
        • Do you have a roadmap to accomplish your mission?
        • What are the primary goals of senior leaders for the organization?

        Example
        1. Meeting government regulation
        2. Revenue generation
        3. Top research quality
        4. High teaching quality
      Sample of Info-Tech's Statement of Business Context Template with Strategic Objectives.
      1. State of Business
        • Consider what the current state and future state are.
        • How does the operating model used define the state?
        • How do industry trends shape the business?
        • What internal changes impact the business model?

        Example
        Our organization aims to make quick decisions and navigate the fast-paced industry with agility, uniting the development and operational sides of the business.
      Sample of Info-Tech's Statement of Business Context Template with State of the Business.

      Leverage core concepts to determine the direction of the organization’s state of the business

      1. Mission
      2. Vision
      3. Strategic Objectives
      –›
      1. State of Business

      2. Work through if your organization’s state is small vs. large, public vs. private, and lean vs. DevOps vs. traditional.

      Small

      IT team is 30 people or less.

      Large

      IT team is more than 30 people.

      Public

      Wholly or partly funded by the government.

      Private

      No government funding is provided.
      Lean: The business aims to eliminate any waste of resources (time, effort, or money) by removing steps in the business process that do not create value. Devops/Agile: Our organization aims to make quick decisions and navigate the fast-paced industry with agility. Uniting the development and operational sides of the business. Hierarchical: Departments in the organization are siloed by function. The organization is top-down and hierarchical, and takes more time with decision making.

      ‹– Multi-State (any combination) –›

      Review business documents to assess business context

      Associated Activity icon 1.5 2-4 hours

      INPUT: Strategic Documents, Financial Documents

      OUTPUT: Mission, Vision, Strategic Objectives

      Materials: Corporate Documents

      Participants: IT Governance Redesign Owner

      Start assessing the state of the business context by leveraging easily accessible information. Many organization have strategic plans, documents, and presentations that already include a large portion of the information for the SoBC – use these sources first.

      Instructions

      1. Strategic Documents
        Leverage your organization’s strategic documents to gain understanding of the business context.

      2. Documents to Review:
      • Corporate strategy document.
      • Business unit strategy documents.
      • Annual general reports.
    • Financial Documents
      Leverage your organization’s financial documents to gain understanding of the business context.

    • Documents to Review:
      • Look for large capital expenditures.
      • Review operating costs.
      • Business cases submitted.

      Review strategic planning documents

      Overview

      Some organizations (and business units) create an authoritative strategy document. These documents contain the organization’s corporate aspirations and outline initiatives, reorganizations, and shifts in strategy. Additionally, some documents contain strategic analysis (Porter’s Five Forces, etc.).

      Action

      • Read through any of the following:
        • Corporate strategy document
        • Business unit strategy documents
        • Annual general reports
      • Watch out for key future-looking words:
        • We will be…
        • We are planning to…

      Overt Statements

      • Corporate objectives and initiatives are often explicitly stated in these documents. Look for statements that begin with phrases such as “Our corporate objectives are…”
      • Remember that different organizations use different terminology – if you cannot find the word “goal” or “objective” then look for “pillar,” “imperative,” “theme,” etc.
      • Ask a business partner to assist if you need some help.

      Covert, Outdated, and Non-Existent Statements

      • Some corporate objectives and initiatives will be mentioned in passing and will require clarification, for example:
        “As we continue to penetrate new markets, we will be diversifying our manufacturing geography to simplify distribution.”
      • Some corporate strategies may be outdated and therefore of limited use for understanding the state of business – validate the statement to ensure it is up to date.
      • Some organizations lack a strategic plan altogether. Use stakeholder interviews to identify imperatives and validate conflicting statements before moving on.

      Review financial documentation

      Overview

      Departmental budgets highlight the new projects that will launch in the next fiscal year. The overwhelming majority of these projects will have IT implications. Additionally, identifying where the department is spending money will allow you to identify business unit initiatives and operational change.

      Action

      • Scan budgets:
        • Look for large capital expenditures
        • Review operating costs
        • Review business cases submitted
      • Look for abnormalities or changes:
        • What does an increase in spending mean?
        • Does IT need to change as a result?

      Capital Budgets

      • Capital expenditures are driven by projects, which map to corporate goals and initiatives.
      • Look for large capital expenditures and cross-reference the outflows with any project plans that have been collected.
      • If an expenditure cannot be explained by project plans, request additional information.

      Operating Budgets

      • Major changes to operating costs typically reflect changes to a business unit. Some of these changes affect IT capabilities and can be classified as corporate initiatives.
      • Changes that should be classified as corporate initiatives are expansion or contraction of a labor force, outsourcing initiatives, and significant process changes.
      • Changes that should not be classified as corporate initiatives are changes in third-party fees, consulting engagements, and changes caused by inflation or growth.

      Analyze business frameworks to articulate context

      Associated Activity icon 1.6 2-4 hours

      INPUT: Industry Research, Organizational Research, Analysis Templates

      OUTPUT: PESTLE and SWOT Analysis

      Materials: Computer or Whiteboards and Markers

      Participants: IT Governance Redesign Owner

      If corporate documents denoting the key components of the SoBC are not easily available, or do not provide all information required, refer to business analysis frameworks to discover internal and external trends that impact the mission, vision, strategic objectives, and state of the business.

      1. Conduct a PESTLE Analysis
        The PESTLE analysis will support the organization in identifying external factors that impact the business. Keep watch for trends and changes in the industry.
      2. Political

        Economic

        Social

        Technological

        Legal

        Environmental

      3. Conduct a SWOT Analysis
        The SWOT analysis will be more specific to the organization and the industry in which it operates. Identify the unique strengths, weaknesses, opportunities, and threats for your organization.
      4. Strengths

        Weaknesses

        Opportunities

        Threats

      Conduct a PESTLE analysis

      Associated Activity icon 1.6 Conduct a PESTLE analysis
      • Break participants into teams and divide the categories amongst them:
        • Political trends
        • Economic trends
        • Social trends
        • Technological trends
        • Legal trends
        • Environmental trends
      • Have each group identify relevant trends under their respective categories. You must relate each trend back to the business by considering:
        • How does this affect my business?
        • Why do we care?
      • Use the prompt questions on the next slide to help the brainstorming process.
      • Have each team present its list and have remaining teams give feedback and additional suggestions.

      Political. Examine political factors such as taxes, environmental regulations, and zoning restrictions.

      Economic Examine economic factors such as interest rates, inflation rate, exchange rates, the financial and stock markets, and the job market.

      Social. Examine social factors such as gender, race, age, income, disabilities, educational attainment, employment status, and religion.

      Technological. Examine technological factors such as servers, computers, networks, software, database technologies, wireless capabilities, and availability of software as a service.

      Legal. Examine legal factors such as trade laws, labor laws, environmental laws, and privacy laws.

      Environmental. Examine environmental factors such as green initiatives, ethical issues, weather patterns, and pollution.

      Download Info-Tech’s PESTLE Analysis Template to help get started.

      Review these questions to help you conduct a PESTLE analysis

      For each prompt below, always try to answer the question: how does this affect my business?

      Political

      • Will a change in government (at any level) affect your organization?
      • Do inter-government or trade relations affect you?
      • Are there shareholder needs or demands that must be considered?

      Economical

      • How are your costs changing (moving off-shore, fluctuations in markets, etc.)?
      • Do currency fluctuations have an effect on your business?
      • Can you attract and pay for top-quality talent (e.g. desirable location, reasonable cost of living, changes to insurance requirements)?

      Social

      • What are the demographics of your customers or employees?
      • What are the attitudes of your customers or staff (do they require social media, collaboration, transparency of costs, etc.)?
      • What is the general lifecycle of an employee (i.e. is there high turnover)?
      • Is there a market of qualified staff?
      • Is your business seasonal?

      Technological

      • Do you require constant technology upgrades (faster network, new hardware, etc.)?
      • What is the appetite for innovation within your industry or business?
      • Are there demands for increasing data storage, quality, BI, etc.?
      • Are you looking at cloud technologies?
      • What is the stance on “bring your own device”?
      • Are you required to do a significant amount of development work in-house?

      Legal

      • Are there changes to trade laws?
      • Are there changes to regulatory requirements, e.g. data storage policies or privacy policies?
      • Are there union factors that must be considered?

      Environmental

      • Is there a push towards being environmentally friendly?
      • Does the weather have any effect on your business (hurricanes, flooding, etc.)?

      Conduct a SWOT analysis on the business

      Associated Activity icon 1.6 Conduct a business SWOT analysis

      Break the group into two teams.

      Assign team A internal strengths and weaknesses.

      Assign team B external opportunities and threats.

      • Have the teams brainstorm items that fit in their assigned grids. Use the prompt questions on the next slide to help you with your SWOT analysis.
      • Pick someone from each group to fill in the grids on the whiteboard.
      • Conduct a group discussion about the items on the list. Identify implications for IT and opportunities to innovate as you did for the other business and external drivers.
      Helpful
      to achieve the objective
      Harmful
      to achieve the objective
      Internal Origin
      attributes of the organization
      Strength Weaknesses
      External Origin
      attributes of the environment
      Opportunities Threats

      Download Info-Tech’s Business SWOT Analysis Template to help get started.

      Review these questions to help you conduct your SWOT analysis on the business

      Strengths (Internal)

      • What competitive advantage does your organization have?
      • What do you do better than anyone else?
      • What makes you unique (human resources, product offering, experience, etc.)?
      • Do you have location advantages?
      • Do you have price, cost, or quality advantages?
      • Does your organizational culture offer an advantage (hiring the best people, etc.)?

      Weaknesses (Internal)

      • What areas of your business require improvement?
      • Are there gaps in capabilities?
      • Do you have financial vulnerabilities?
      • Are there leadership gaps (succession, poor management, etc.)?
      • Are there reputational issues?
      • Are there factors that are making you lose sales?

      Opportunities (External)

      • Are there market developments or new markets?
      • Industry or lifestyle trends, e.g. move to mobile?
      • Are there geographical changes in the market?
      • Are there new partnerships or M&A opportunities?
      • Are there seasonal factors that can be used to the advantage of the business?
      • Are there demographic changes that can be used to the advantage of the business?

      Threats (External)

      • Are there obstacles that the organization must face?
      • Are there issues with respect to sourcing of staff or technologies?
      • Are there changes in market demand?
      • Are your competitors making changes that you are not making?
      • Are there economic issues that could affect your business?

      Conduct brainstorming efforts to gain insights from key business stakeholders

      Associated Activity icon 1.7 2-4 hours

      INPUT: SoBC Template

      OUTPUT: Completed SoBC

      Materials: Computer, Phone, or Other Mechanism of Connection

      Participants: CEO, CFO, COO, CMO, CHRO, and Business Unit Owners

      There are two ways to gather primary knowledge on the key components of the SoBC:

      1. Stakeholder Interviews
        Approach each individual to have a conversation about the key components of the SoBC. Go through the SoBC and fill it in together.
      2. Stakeholder Survey
        In the case that you are in a very large organization, create a stakeholder survey. Input the key components of the SoBC into an online survey maker and send it off the key stakeholders.

      Use the SoBC as the guide to both the interview and the survey. Be clear about the purpose of understanding the business context when connecting with key business stakeholders to participate in the brainstorming. This is a perfect opportunity to establish or develop a relationship with the stakeholders who will need to buy into the redesigned governance framework since it will involve and impact them significantly.

      Go directly to the information source – the key stakeholders

      Overview

      Talking to key stakeholders will allow you to get a holistic view of the business strategy. You will be able to ask follow-up questions to get a better understanding of abstract or complex concepts. Interviews also allow you to have targeted discussions with specific stakeholders who have in-depth subject-matter knowledge.

      Action

      • Talk to key stakeholders:
        • Structure focused, i.e. CEO or CFO
        • Customer focused, i.e. CMO or Head of Sales
        • Operational focused, i.e. COO
        • Lower-level employees or managers
      • Listen for key pains that IT could alleviate.

      Overcome the Unstructured Nature of Interviews

      • Interviewees will often explicitly state objectives and initiatives.
      • However, interviews are less formal and less structured than objective-oriented strategy documents. Objectives are often stated using informal language.
        “We’re talking rev gen here. That’s the name of the game. If we can get a foothold in India, there’s huge upside potential.” (VP Marketing)
      • Further analysis might translate this into a corporate imperative: increase revenue by growing our market share in India to 8% by January of next year.
      • If an imperative is unclear, ask the stakeholder for more detail.
      • Understand how key stakeholders evaluate, direct, and monitor their own areas of the business; this will give you insight as to their style.

      Receive final sign-off to proceed with developing the IT governance redesign

      Associated Activity icon 1.8 30 minutes

      Document any project assumptions or constraints. Before proceeding with the IT governance activities, validate the statement of business context with senior stakeholders. When consensus has been reached, have them sign the final page of the document.

      How to ensure sign-off:

      • Schedule a meeting with the senior stakeholders and conduct a review of the document. This meeting presents a great opportunity to deliver your interpretation of management expectations and make any modifications.
      • Obtaining stakeholder approval in person ensures there is no miscommunication or misunderstandings around the tasks that need to be accomplished to develop a successful IT governance.
      • This is an iterative process; if senior stakeholders have concerns over certain aspects of the document, revise and review again.
      • Final sign-off should only take place when mutual understanding has been reached.

      Download the SoBC Template and complete for final approval.

      Info-Tech Tip

      In most circumstances, you should have the SoBC validated with the following stakeholders:

      • CIO
      • CEO
      • CFO
      • Business Unit Leaders

      Understand the business context to set the foundation for governance redesign

      CASE STUDY

      Industry: Healthcare
      Source: Info-Tech

      Challenge

      The new business direction to become an integrator shifted focus to faster software iteration and on enabling integration and translation technologies, while moving away from creating complete, top-to-bottom IT solutions to be leveraged by clinicians and patients.

      Internal to the IT organization, this created a different in perspective on what was important to prioritize: foundational elements, web services, development, or data compliance issues. There was no longer agreement on which initiatives should move forward.

      Solution

      A series of mandatory meetings were held with key decision makers and SMEs within the organization in order to re-orient everyone on the overall purpose, goals, and outcomes of the organization.

      All attendees were asked to identify what they saw as the mission and vision of the organization.

      Finally, clinicians and patient representatives were brought in to describe how they were going to use the services the organization was providing and how it would enable better patient outcomes.

      Results

      Identifying the purpose of the work the IT organization was doing and how the services were going to be used realigned the different perspectives in the context of the healthcare outcomes they enabled.

      This activity provided a unifying view of the purpose and the state of the business. Understanding the business context prepared the organization to move forward with the governance redesign.

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of an Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      1.1

      Sample of activity 1.1 'Determine which business stakeholders will be impacted or involved in the redesign process'. Identify Relevant Stakeholders

      Build a list of relevant stakeholders and identify their position on the stakeholder power map.

      1.4

      Sample of activity 1.4 'Create a communication plan to engage key stakeholders'. Communication Plan

      Build customized communication plans to engage the key stakeholders in IT governance redesign.

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop

      Book a workshop with our Info-Tech analysts:

      1.7

      Sample of activity 1.7 'Review business documents to assess business context'. Gather Business Information

      Review business documents, leverage business analysis tools, and brainstorm with key executives to document the Statement of Business Context.

      1.8

      Sample of activity 1.8 'Receive final sign-off to proceed with developing the IT Governance redesign'. Finalize the Statement of Business Context

      Get final approval and acceptance on the Statement of Business Context that will guide your redesign.

      Improve IT Governance to Drive Business Results

      PHASE 2

      Assess the Current Governance Framework

      Phase 2 outline

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 2: Assess the Current Governance Framework

      Proposed Time to Completion: 2 weeks
      Step 2.1: Outline the Current State AssessmentStep 2.2: Review the Current State Assessment
      Start with an analyst kick-off call:
      • Connect the current business state identified in Phase 1 with the current state of governance.
      • Identify the key elements of current governance.
      • Begin building the structure and committee profiles.
      Review findings with analyst:
      • Review the current governing bodies that were identified.
      • Review the current structure that was identified.
      • Determine the strengths, weaknesses, and guidelines from the implications in the current state assessment.
      Then complete these activities…
      • Identify stakeholders.
      • Make the case to executives.
      • Build a communication plan.
      Then complete these activities…
      • Create committee profiles.
      • Build governance structure map.
      With these tools & templates:
      • Current State Assessment of IT Governance
      With these tools & templates:
      • Current State Assessment of IT Governance

      Phase 2: Assess the Current Governance Framework

      1 2 3 4
      Align IT With the Business Context Assess the Current Governance Framework Redesign the Governance Framework Implement Governance Redesign

      Activities:

      • 2.1 Create Committee Profiles
      • 2.2 Build a Governance Structure Map
      • 2.3 Establish Governance Guidelines

      Outcomes:

      • Use the Current State Assessment of IT Governance to determine governance guidelines.

      Info-Tech Insight

      Don’t be passive; take action! Take an active approach to revising your governance framework. Understand why you are making decisions before actually making them.

      Explore the current governance that exists within your organization

      Your current governance framework will give you a strong understanding of the way the key stakeholders in your business currently view IT governance.

      "Much of the focus of governance today has been on the questions:
      • Are we doing [things] the right way?
      • And are we getting them done well?"
      –› "We need to shift to…
      • Are we doing the right things?
      • Are we getting the benefits?
      • What are the outcomes?
      • What do we want to achieve?
      • How do we make intelligent decisions about what will help us achieve those outcomes?"
      (John Thorp, Author of The Information Paradox)

      Leverage this understanding of IT governance to determine where governance is occurring and how it transpires.

      Conduct a current state assessment

      Supporting Tool icon 2A Assess the current governance framework

      Use this tool to critically assess each governing body to determine the areas of improvement that are necessary in order to achieve optimal business results.

      1. Identify All Governing Bodies
        Some bodies govern intentionally, and some govern through habit and practice. Outline all bodies that take on an element of governance.
      2. Create a Governance Structure Map
        Configure the structural relationships for the governing bodies using the structure map.
      3. Reveal Strengths and Weaknesses
        Identify the strengths and weaknesses of the governance structure, authority definitions, processes, and membership.
      4. Establish Governance Guidelines
        Based on the SoBC, express clear and applicable guidelines to improve on the weaknesses while retaining the strengths of your governance framework.

      Download the Current State Assessment of IT Governance to work toward these outcomes

      Conduct a current state assessment to identify governance guidelines

      Supporting Tool icon 2A Assess the current governance framework

      How to use the Current State Assessment of IT Governance deliverable: Follow the steps below to create a cohesive understanding of the current state of IT governance and the challenges that the current system poses.

      Part A – Committee Profiles

      1. Identify Governing Bodies
      2. Leverage Committee Templates
      3. Create Committee Profiles
        Use the Committee Profile Template

      Part B – Structure Map

      1. Assess Inputs and Outputs to Express Structural Relationships
      2. Create Structure Map
        Use the Governance Structure Map

      Part C – Governance Guidelines

      1. Choose Operating Model Template
      2. Identify Strengths and Weaknesses
      3. Establish Governance Guidelines
        Use the Governance Guideline Template

      What makes up the “governance framework”?

      There are four major elements of the governance framework:

      1. Structure
        Structural relationships are shown by mapping the connections between committees.
      2. Authority
        Each committee will have a purpose and area of decision making that it is accountable for.
      3. Process
        The process includes the inputs, outputs, and activities required for the committee to function.
      4. Membership The individuals or roles who sit on each committee. Take into account members’ knowledge, capability, and political influence.

      Create governing board or committee profiles

      Supporting Tool icon 2A.1 Assess the current governance framework

      Part A – Committee Profiles

      1. Identify Governing Bodies

        Establish where governance happens and who is governing. For different organizations, the governance framework will contain a variety of governing bodies or people. Use a list format to identify governing bodies that exist in your organization.
      2. Leverage Committee Templates

        Use the templates provided. Create a profile for each governing body that currently operates in your IT governance framework as listed in step 1.
      3. Create Committee Profiles

        Identify what they are governing and how they are governing.
        Using the profiles created in step 2, identify each body’s membership roles, purpose, decision areas, inputs, and outputs. Refer to the example text in the template to guide you, but feel free to adjust the text to reflect the reality of your governing body. Screenshot of the 'Committee Template - Executive Management Committee'.
        Consider the following domains of governance:
        (refer to Executive Brief)
        • Benefits realization
        • Risks
        • Resources
        Refer to our examples for some common governing bodies.

      Consistently define the components of governance in the committee profiles

      Membership

      Membership Roles
      Insert information here that reflects who the individuals are that sit on that governing body and what their role is. Include other important information about the individuals’ knowledge, skills, or capabilities that are relevant.

      Authority

      Purpose
      Define why the committee was established in the first place.

      Decision Areas
      Explain the specific areas of decision making this group is responsible for overseeing.

      Process

      Inputs
      Consider the information and materials that are needed to make decisions.

      Outputs
      Describe the outcomes of the committee. Think about decisions that were made through the governance process.

      Screenshot of the components of governance section from the 'Committee Template'.

      Map out relationships on the Governance Map

      Supporting Tool icon 2A.2 Assess the current governance framework

      Part B – Structure Map

      Structure
      1. Assess Inputs and Outputs

        Governing Bodies

        Inputs

        Outputs

        Committee #1
        Committee #2
        Committee #3
        CFO
        IT Director
        CIO
        To understand relationships between governing bodies, list the inputs and outputs for each unique committee that rely on other committees in the table provided.
      2. Create Structure Map
        Sample of the 'Current State Structure Map'. Using the outline provided, create your own governance structure map to represent the way the governing bodies interact and feed into each other. This is crucial to ensure that the governing structure is streamlined. It will ensure that communication occurs efficiently and that there are no barriers to making decisions swiftly.

      Outline the governance structure in the governance structure map

      Associated Activity icon 2.2 30 minutes
      The 'Current State Structure Map' from the last slide, but with added description. There are three tiers of groups. At the bottom is 'Run', described as 'The lowest level of governance will be an oversight of more specific initiatives and capabilities within IT.' 'Design and Build', described as 'The second tier of groups will oversee prioritization of a certain area of governance as well as second-tier decisions that feed into strategic decisions.' At the top is 'Strategy', described as 'These groups will focus on decisions that directly connect to the strategic direction of the organization.' The specific groups laid out in the map are 'Risk and Compliance Committee' which straddle the line between 'Run' and 'Design and Build', 'Portfolio Review Board' and 'IT Steering Committee (ITSC)' both of which straddle the line between 'Design and Build' and 'Strategy', 'Executive Management Committee (EMC)' which is in 'Strategy', and 'Other' in all tiers.

      Identify strengths and weaknesses of the governance framework

      Supporting Tool icon 2A.3 Assess the current governance framework

      Part C – Governance Guidelines

      1. Choose Business State Template Choose the template that represents the identified future state of business in the Statement of Business Context. Mini sample of the 'State of Business' table from the 'Statement of Business Context'.
      2. Identify Strengths and Weaknesses Input the major strengths and weaknesses of your governance that were highlighted in the brainstorming activity. Mini sample of a Strengths and Weaknesses table.
      3. Establish Governance Guidelines Draw your own implications from the strength and weaknesses that will drive the design of your governance in its future state. These guidelines should be concise and easy to implement. Mini sample of an expanded Strengths and Weaknesses table including a row for 'Implication/Guideline'. Note: Refer to the example guidelines in the Current State Assessment of IT Governance after you have considered your own specific guidelines. The examples are supplementary for your convenience.

      Distinguish your business state from the others to ensure implications act as accurate guidelines

      Business State Options

      1

      Small

      IT team is 30 people or less.

      Large

      IT team is more than 30 people.

      2

      Public

      Wholly or partly funded by the government.

      Private

      No government funding is provided.

      3

      Lean: The business aims to eliminate any waste of resources (time, effort, or money) by removing steps in the business process that do not create value.Devops: Our organization aims to make quick decisions and navigate the fast-paced industry with agility. Uniting the development and operational sides of the business. Hierarchical: Departments in the organization are siloed by function. The organization is top-down and hierarchical, and takes more time with decision making.

      ‹– Multi-State (any combination) –›

      Multi-State Example A: If you are small organization that is publicly funded and you are shifting towards a lean methodology, combine the implications of all those groups in a way that fits your organization.

      Multi-State Example B: Your organization is shifting from a more traditional state of operating to combining the development and operations groups. Use hierarchical implications to govern one group and DevOps implications for the other.

      Identify strengths and weaknesses of the governance framework

      Associated Activity icon 2.3 2 hours

      INSTRUCTIONS

      1. Input Strengths of Governance
        Include useful components of the current framework; that may include elements that are operating well, fit the future state, or are required due to regulations or statutes.
      2. Determine Weaknesses and Challenges
        Discuss the pain points of the current governance framework by looking through the lenses of structure, authority, process, or membership.

      Consider:

      • Where is governance not meeting expectations?
      • Are we doing the right things?
      • Are we getting the benefits?
      • What are the outcomes?
      • What do we want to achieve?
      • How do we make intelligent decisions about what will help us achieve those outcomes?
      *Example

      Structure

      Authority

      Process

      Membership

      Strength

      • We must maintain a legal compliance committee due to the high level of legislation in the industry
      • The ITSC gathers and prioritizes investment options, saving time for the EMC
      • The EMC only make decisions on investments that are greater than $200,000
      • The legal board has a narrow focus, allowing it to maintain its necessary purpose efficiently
      • The information flow from ITSC to the EMC allows the EMC to spend their time effectively
      • The CIO sits on the EMC and the ITSC
      • The EMC is made up of senior leadership who have stakes in all areas of the business

      Weakness

      • Wrong number (too many/little groups)
      • Relationship is misaligned (input/output problems)
      • The tier it sits on the map is misguided
      • Duplication of the same tier of decisions in different groups
      • Approval for one specific topic occurs in more than one group
      • Lack of clarity in which group makes which decisions
      • Intake – where the information is coming from is the wrong source/inaccurate
      • Time to decision (too slow)
      • Poor results of governance (redoing projects, low value)
      • There is lack of knowledge in committee membership
      • Misplaced seniority (too Jr./Sr.)
      • Lack of representation in group (breadth across the business or depth of specific area)

      Derive governance implications from strengths and weaknesses

      Associated Activity icon 2.3 2-4 hours

      INSTRUCTIONS

      1. Copy and paste your strengths and weaknesses from part B into the template that reflects your business state.
      2. Draw your own implications from the strengths and weaknesses that will drive the design of your governance in its future state. These guidelines should be concise and practical.
      *Example

      Structure

      Authority

      Process

      Membership

      Strength

      Weakness

      Implication / Guideline

      • Make sure that the decision-making authority for most areas are at the lower tier
      • Governing bodies should be lower in the organization
      • One overarching governing body – directing priorities
      • High authority at a lower point of the organization
      • Highest tier is responsible for major budget shifts
      • High-level tier - reporting and feed in from lower level groups
      • Prioritization and sequencing occur at the mid-tier
      • Lowest governing tiers will have direct links to the customer to allow for interaction
      • Project or initiative owner as the leader of the body

      Note: Use the examples of guidelines provided in the Current State Assessment of IT Governance to help formulate your own.

      Conduct a current state assessment to identify guidelines for the future state of governance

      CASE STUDY

      Industry: Healthcare
      Source: Anonymous

      Challenge

      Over time, the organization had to create a large amount of governing committees and subcommittees in order to comply with governance frameworks applied to them and to meet regulatory compliance requirements.

      The current structure was no longer optimal to meet the newly identified mandate of the organization. However, the organization did not want to start from scratch and scrap the elements that worked, such as the dates and times that had been embedded into the organization.

      Solution

      A current state assessment was planned and executed in order to review what was currently being done and identify what could be retained and what should be added, changed, or removed to improve the governance outcomes.

      The scope involved examining how current and near-term governance needs were, or were not, met through the existing structure, bodies, and their processes.

      The organization investigated governance approaches of organizations with similar governance needs and with similar constraints to model their own.

      Results

      The outputs of this exercise included:

      • A list of effective practices and committee guidelines that could be leveraged with little to no change in the future state.
      • A list of opportunities to streamline the structure and processes.

      These guidelines were used to drive recommendations for improvements to the governance structures and processes in the organization.

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of an Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      2.1

      Sample of activity 2.1 'Outline the governance structure in the governance structure map'. Create Current State Structure and Profiles

      Take the time to clearly articulate the current governance framework of your organization. Outline the structure and build the committee profiles for the governing bodies in your organization.

      2.3

      Sample of activity 2.3 'Identify strengths and weaknesses of the governance framework'. Determine Strengths, Weaknesses, and Guidelines

      Evaluate the strengths of your governance framework, the weaknesses that it exhibits, and the guidelines that will help maintain the strengths and alleviate the pains.

      Improve IT Governance to Drive Business Results

      PHASE 3

      Redesign the Governance Framework

      Phase 3 Guided Implementation

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 3: Redesign the Governance Framework

      Proposed Time to Completion: 4 weeks
      Step 3.1: Understand the Redesign Process Step 3.2: Review Governance Structure Step 3.3: Review Governance Committees
      Start with an analyst kick-off call:
      • Review the guidelines from the current state assessment.
      • Begin modifying the governance structure, authorities, processes, and memberships.
      Review findings with analyst:
      • Determine the impact of the guidelines on the structural layout of the framework.
      • Determine the impact of the guidelines on the authority element of the framework.
      Finalize phase deliverable:
      • Determine the impact of the guidelines on the processes within the framework.
      • Determine the impact of the guidelines on the membership element of the framework.
      Then complete these activities…
      • Break down guidelines to make sure they are actionable and realistic.
      • Identify what to add, modify, or remove.
      • Review additional sources of information.
      Then complete these activities…
      • Build and review the governance structure map.
      • Identify additions, changes, or reductions in governing bodies and their areas of authority.
      Then complete these activities…
      • Use the template provided to build committee profiles for each identified committee.
      • Identify the membership, purpose, decision areas, inputs, and outputs of each.
      • Build committee charters if needed.
      With these tools & templates:
      • Current State Assessment
      • Future State Design for IT Governance
      With these tools & templates:
      • Future State Design for IT Governance
      With these tools & templates:
      • Future State Design for IT Governance
      • IT Governance Terms of Reference

      Phase 3: Redesign the Governance Framework

      1 2 3 4
      Align IT With the Business Context Assess the Current Governance Framework Redesign the Governance Framework Implement Governance Redesign

      Activities:

      • 3.1 Build a Governance Structure Map
      • 3.2 Create Committee Profiles
      • 3.3 Leverage Process-Specific Governance Blueprints

      Outcomes:

      • Use the Future State Design for IT Governance template to build the optimal governance framework for your organization.

      Info-Tech Insight

      Keep the current and future goals in sight to build an optimized governance framework that maintains the minimum bar of oversight required.

      Anticipate the outcomes of the Future State Design for IT Governance tool

      Supporting Tool icon 3A Redesign the governance frameworks

      Use this tool to guide your organization toward transformative outcomes gleaned from an optimized governance framework.

      1. Implement Structural Guidelines
        Determine what governing bodies to add, change, or remove from your governance structure.
      2. Create a Governance Structure Map
        Configure the structural relationships for the redesigned governing bodies using the structure map.
      3. Build Effective Committees
        Use the IT Governance Terms of Reference to build profiles for each newly created committee and to alter any existing committees.
      4. Determine Follow-up Governance Support
        Access external material on governance from other Info-Tech blueprints that will help with specific governance areas.

      Download the Future State Design for IT Governance template to work toward these outcomes.

      Use the Future State Design for IT Governance tool to create a custom governance framework for your organization

      Supporting Tool icon 3A Redesign the governance frameworks

      How to use the Future State Design for IT Governance deliverable: Follow the steps below to redesign the future state of IT governance. Use the guidelines to respond to challenges identified in the current governance framework based on the current state assessment.

      Part A – Structure Map

      Part B – Committee Profiles

      1a. Input Structural Guidelines 1b. Input Authority Guidelines 1a. Input Process Guidelines 1b. Input Member Guidelines
      2. Guiding Questions
      Do governing bodies operate at a tier that matches the guidelines?

      Do governing bodies focus on the decisions that align with the guidelines?
      2. Guiding Questions
      Do the process inputs and outputs reflect the structure and authority guidelines?

      Do governing bodies engage the right people who have the roles, capacity, and knowledge to govern?
      3. Add / Change (Tier/Authority) / Remove
      Governing Bodies – Structure
      3. Adapt / Refine
      Governing Bodies – Profiles
      4. Use the Structure Map to Show Redesign Use the IT Governance Terms of Reference for Redesign

      Connect key learnings to initiate governance redesign

      The future state design will reflect the state of business that was identified in Phase 1 along with the guidelines defined in Phase 2 to build a governance framework that promotes business-IT fusion.

      Statement of Business Context –› Current State Assessment

      Identified Future Business State

      Structure
      Authority

      Leverage the structure and authority guidelines to build the governance structure.

      Defined Governance Guidelines

      Process
      Membership

      Leverage the process and membership guidelines to build the governance committees.

      Future State Design

      Use structure and authority guidelines to build a new governance structure map

      Supporting Tool icon 3A.1 Redesign the governance frameworks

      Part A – Structure Map

      Structure
      Authority
      1a. Structural Guidelines1b. Authority Guidelines
      Input the guidelines from the current state assessment to guide the redesign.

      2. Leverage Guiding Questions

      Use the guiding questions provided to assess the needed changes.
      Guiding Questions


      Do governing bodies operate at a tier that matches the guidelines?


      Do governing bodies focus on the decisions that align with the guidelines?
      Build the “where/why” of governance. Consider at what tier each committee will reside and what area of governance will be part of its domain. Modify the current structure; do not start from scratch.

      3. Add / Change (Tier/Authority) / Remove

      Determine changes to structure or authority that will be occurring for each of the current governing bodies. Work within the current structure as much as possible.A mini sample of an 'Add/Change/Remove' table for governing bodies.

      4. Use the Structure Map to Show Redesign

      Create your own governance structure map to represent the way the governing bodies interact and feed into each other. A mini sample of the 'Current State Structure Map' from before.

      Maintain as much of the existing framework as possible in the redesign

      Associated Activity icon 3.1 2-4 hours

      Future State Design

      • Structure
      • Authority

      Info-Tech Best Practice

      Keep the number of added or removed committees as low as possible, while still optimizing. The less change to the structure, the easier it will be to implement.

      Refer to the example to help guide your committee redesign.

        Determine:
      1. Do the guidelines impact committees you already have? Will you have to modify the tier or the authority of those committees?
      2. Do the guidelines require you to build a new committee to meet needs?
      3. Do the guidelines require you to remove a committee that isn’t necessary?

      All Governing Bodies

      Add

      Change

      Remove

      ITSC Structure

      Authority
      Delegate the authority of portfolio investment decisions over $200K to this body
      Portfolio Review Board This committee no longer needs to exist since its authority of portfolio investment decisions over $200K has been redelegated
      Risk and Compliance Committee Create a new governing body to address increasing risk and compliance issues that face the organization

      Outline the new governance structure in the governance structure map in the Future State Design for IT Governance tool

      Associated Activity icon 3.1 The 'Current State Structure Map' from before, but with some abbreviated terms. There are three tiers of groups. At the bottom is 'Run', described as 'The lowest level of governance will be an oversight of more specific initiatives and capabilities within IT.' 'Design and Build', described as 'The second tier of groups will oversee prioritization of a certain area of governance as well as second-tier decisions that feed into strategic decisions.' At the top is 'Strategy', described as 'These groups will focus on decisions that directly connect to the strategic direction of the organization.' The specific groups laid out in the map are 'Risk and Compliance Committee' which straddle the line between 'Run' and 'Design and Build', 'Portfolio Review Board' and 'ITSC' both of which straddle the line between 'Design and Build' and 'Strategy', 'EMC' which is in 'Strategy', and 'Other' in all tiers.

      Use process and membership guidelines along with the IT Governance Terms of Reference to build committees

      Supporting Tool icon 3A.2 Redesign the governance frameworks

      Part B – Committee Profiles

      Process
      Membership
      1a. Process Guidelines 1b. Authority Guidelines
      Input the guidelines from the current state assessment to guide the redesign.

      2. Leverage Guiding Questions

      Use the guiding questions provided to assess the needed changes.
      Guiding Questions
      Do the process inputs and outputs reflect the structure and authority guidelines?

      Do governing bodies engage the right people who have the roles, capacity, and knowledge to govern?
      Build the “what/how” of governance. Build out the process and procedures that each committee will use.

      3. Adapt / Refine Governing Body Profiles

      Using your customized guidelines, create a profile for each committee.

      We have provided templates for some common committees. To make these committee profiles reflective of your organization, use the information you have gathered in your Current State Assessment of IT Governance guidelines.

      For a more detailed approach to building out specific charters for each committee refer to the IT Governance Terms of Reference.

      A mini sample of the 'Committee Template - Executive Management Committee'.

      A mini sample of the 'IT Governance Terms of Reference'.

      Use the IT Governance Terms of Reference to establish operational procedures for governing bodies

      Associated Activity icon 3.2 3-6 hours

      Future State Design

      • Process
      • Membership

      Info-Tech Best Practice

      The people on the committee matter. Governance committee membership does not have to correspond with the organizational structure, but it should correspond with the purpose and decision areas of the governance structure.

      Refer to the example to help guide your committee redesign.

        Determine:
      1. Do the guidelines alter the members needed to achieve the outcomes?
      2. Do the guidelines change the purpose and decision areas of the committee?
      3. How do the new structure’s guidelines impact the inputs and outputs of the governing body?

      Screenshot of the 'Committee Template - Executive Management Committee'.

      Add depth to the committee profiles using the IT Governance Terms of Reference

      Supporting Tool icon 3A.3 Redesign the governance frameworks

      Refer to the sections outlined below to build a committee charter for your governance committees. Four examples are provided in the tool and can be edited for your convenience. They are: Executive Management Committee, IT Steering Committee, Portfolio Review Board, and Risk and Compliance Committee.

      1. Purpose
      2. Goals
      3. Responsibilities
      4. Committee Members
      5. RACI
      6. Procedures
      7. Agenda

      Be sure to embed the domains of governance in the charters so that committees focus on the appropriate elements of benefits realization, risk optimization, and resource optimization.

      Download the IT Governance Terms of Reference for more in-depth committee charters.

      Three pillars of planning effective governance meetings

      The effectiveness of the governance is reliant on the ability to work within operational dependencies that will exist in the governance framework. Consider these questions to guide the duration, frequency, and sequencing of your governing body meetings.

      Frequency

      • What is the quantity of decisions that must be made?
      • Is a rapid or urgent response typically required?

      Duration

      • How long should your meeting run based on your meeting frequency and the volume of work to be accomplished?

      Sequencing

      • Are there other decisions that rely on the outcomes of this meeting?
      • Are there any decisions that must be made first for others to occur?
      A venn diagram of the three pillars of planning effective governance meetings, 'Frequency', 'Duration', and 'Sequencing'.

      Leverage process-specific governance blueprints

      Associated Activity icon 3.3

      If there are specific areas of IT governance that you require further support on, refer to Info-Tech’s library of DIY blueprints, Guided Implementations, and workshops for further support. We cover IT governance in the following areas:

      Enterprise Architecture Governance

      Service Portfolio Governance

      Security Governance

      Titlecard of 'Create a Right-Sized Enterprise Architecture Governance Framework' blueprint. Titlecard of 'Lead Strategic Decision Making With Service Portfolio Management' blueprint. Titlecard of 'Build a Security Governance and Management Plan' blueprint.

      Consider the challenges and solutions when identifying a multi-state reality for your business state

      A multi-state business will face unique challenges in navigating the redesign process with the goal of combining all related business states in governance.

      1. Divergent Governance Models
        Separate the governance groups that need to function differently, and bring them back together at the highest level.
      2. Reflecting the Organizational Structure
        Unlike single-state governance, multi-state organizations should model the governance framework in reflection of the organizational structure.
      3. Combining Implications
        Prioritize which implications are the most important and make sure they work first, then see what else fits (e.g. start with regulation, then insert lean guidelines).

      The multi-state business will not fit into one “box” – consider implications from the overlapping business states.

      As business needs change, ensure that you establish triggers to reassess the design of your governance framework.

      Leverage the outcomes of the Current State Assessment and Statement of Business Context to build the future state

      CASE STUDY

      Industry: Healthcare
      Source: Info-Tech

      Challenge

      Identifying the committees and processes that should be in place in the target state required a lot of different inputs.

      A number of high-profile senior management team members were still resistant to the overall idea of applying governance to their initiatives since they were clinician driven.

      The approach and target state, including the implementation plan, had to be approved and built out.

      Solution

      The information pulled together from the current state assessment, including best practices and jurisdictional scans, were tied together with the updated mandate and future state, and a list of recommended improvements were documented.

      The improvements were presented to the optimization committee and the governance committee members to ensure agreement on the approach and confirm the timeline for agreed improvements.

      Results

      A future state mapping of the new committee structure was created, as well as the revised membership requirements, responsibilities, and terms of reference.

      The approved recommendations were prioritized and turned into an implementation plan, with each improvement being assigned an owner who would be responsible for driving the effort to completion.

      Integration points in other processes, like SDLC, where change would be required were highlighted and included in the implementation plan.

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of an Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      3.1

      Sample of activity 3.1 'Maintain as much of the existing framework as possible in the redesign'. Redesign the Governance Structure

      Identify committees that need to be added, ones that must be changed, and the no-longer-needed governing bodies in an optimized and streamlined structure. Draw it out in the governance structure map.

      3.2

      Sample of activity 3.2 'Utilize the IT Governance Terms of Reference to establish operational procedures for governing bodies'. Redesign the Governing Bodies

      Use the IT Governance Terms of Reference and the Committee Template to build a committee profile for each governing body identified. Use these activities to build out and establish the processes of the modified governing groups.

      Improve IT Governance to Drive Business Results

      PHASE 4

      Implement Governance Redesign

      Phase 4 outline

      Associated Activity icon Call 1-888-670-8889 or email GuidedImplementations@InfoTech.com for more information.

      Complete these steps on your own, or call us to complete a guided implementation. A guided implementation is a series of 2-3 advisory calls that help you execute each phase of a project. They are included in most advisory memberships.

      Guided Implementation 4: Implement Governance Redesign

      Proposed Time to Completion: 2-3 weeks
      Step 4.1: Identify Steps for Implementation Step 4.2: Finalized Implementation Plan
      Start with an analyst kick-off call:
      • Identify major steps required to implement the governance redesign.
      • Outline the components and milestones of the implementation plan.
      • Review materials needed for the executive presentation.
      Review findings with analyst:
      • Review the major milestones identified in the implementation plan.
      • Discuss potential challenges and stakeholder objections.
      • Strategize for the executive presentation.
      Then complete these activities…
      • Then complete these activities…
      • Identify next steps for the redesign.
      • Establish a communication plan.
      Then complete these activities…
      • Review the implementation plan.
      • Assess any challenging milestones and build implementation strategies.
      • Finalize the executive presentation.
      With these tools & templates:
      • IT Governance Implementation Plan
      • Redesign IT Governance to Drive Optimal Business Results Executive Presentation Template
      With these tools & templates:
      • IT Governance Implementation Plan
      • Redesign IT Governance to Drive Optimal Business Results Executive Presentation Template

      Phase 4: Implement Governance Redesign

      1 2 3 4
      Align IT With the Business Context Assess the Current Governance Framework Redesign the Governance Framework Implement Governance Redesign

      Activities:

      • 4.1 Identify Next Steps for the Redesign
      • 4.2 Establish a Communication Plan
      • 4.3 Lead the Executive Presentation

      Outcomes:

      • Rationalize steps in the Implementation Plan tool.
      • Construct an executive presentation to facilitate transparency for the governing framework.

      Anticipate and overcome implementation obstacles for the redesign

      Often high-level organizational changes create challenges. We will help you break down the barriers to optimal IT governance by addressing key obstacles.

      Key Obstacles

      Solutions

      Identifying Steps The prioritization must be driven by the common view of what is important for the organization to succeed. Prioritize the IT governance next steps according to the value they are anticipated to provide to the business.
      Communicating the Redesign The redesign of IT governance will bring impactful changes to diverse stakeholders across the organization. This phase will help you plan communication strategies for the different stakeholders.

      Info-Tech Insight

      Don’t overlook the politics and culture of your organization while redesigning your governance framework.

      Create an implementation roadmap to organize a plan for the redesign

      Supporting Tool icon 4A Create an implementation and communication plan

      INSTRUCTIONS

      1. Identify Tasks
        Decide on the order of tasks for your implementation plan. Consider the dependencies of actions and plan the sequence accordingly.
      2. Determine Communication Method
        Identify the most appropriate and impactful method of communicating at each milestone identified in step 1.

      Download the IT Governance Implementation Plan to organize your customized implementation and communication plan.

      Screenshot of a table in the 'IT Governance Implementation Plan'.

      Outline next steps for governance redesign

      Associated Activity icon 4.1

      INPUT: Tasks Identified in the Future State Design

      OUTPUT: Identified Tasks for Implementation as Well as the Audience

      Materials: N/A

      Participants: IT Governance Redesign Owner

      INSTRUCTIONS

      Keep these questions in mind as you analyze and assess what steps to take first in the redesign implementation.

      1. What needs to happen?
        Use the identified changes from the redesign as your guiding list of tasks that need to occur. If they are larger tasks, break them down into smaller parts to make the milestones more achievable.
      2. What are the dependencies?
        Throughout the implementation of the redesign, certain tasks will need to occur to enable other tasks to be performed. Make sure to clearly identify what dependencies exist in the implementation process and clearly identify the order of the tasks.
      3. Who do the changes impact?
        Consider the groups and individuals that will be impacted by changes to the governance framework. This includes key business stakeholders, IT leaders, members of governing boards, and anyone who provides an input or requires an output from one of the committees.

      Use a big-bang approach to implement the IT governance redesign

      While there are other methods to implementing change, the big-bang approach is the most effective for governance redesign and will maintain the momentum of the change as well as the support needed to make it successful.

      Phased

      Parallel

      Big Bang

      Implementation of redesign occurs in steps over a significant period of time.

      Three arrows, each beginning where the previous one ends, separated.

      Components of the redesign are brought into the governance framework, while maintaining some of the old components.

      Three arrows, each beginning slightly after the previous one begins, overlapping.

      Implementation of redesign occurs all at once. This requires significant preparation.

      One large arrow, spanning the length of the other grouped arrows, circled to emphasize.
      • Some committees will be operating under a new structure while others are not, which will undermine the changes being made.
      • This method proliferates a lack of transparency and trust.
      • Releasing IT governance in parallel leads to members sitting on too many boards and spending too much time on governance.
      • There will be a lack of clarity on a committee’s authority.
      • This approach will lead to consistency and transparency in the new process.
      • The change will be clear and fully embedded in the organization with stronger boundaries and well-defined expectations.

      Determine the most effective and impactful communication mediums for relevant stakeholders

      Associated Activity icon 4.2 1 hour

      INSTRUCTIONS

      1. Consider the Individual or Group
        Consider the group and individuals identified in step 4.1. Determine the most appropriate mechanism for communicating with that person or group. Keep in mind: If they are local, how much influence they have and if they are already engaged in the redesign process.
      2. Consider the Message
        The type of message that you are communicating will vary in impact and importance depending on the task. Make sure that the communication medium reflects your message. Keep in mind: If the you are communicating an important or more personal issue, the medium should be more personal as well.

      Screenshot of the same table in the 'IT Governance Implementation Plan'.

      Communicate the changes that result from the redesign

      Plan the message first, then deliver it to your stakeholders through the most appropriate medium to avoid message avoidance or confusion.

      Communication Medium

      Face-to-Face Communication

      Face-to-face communication helps to ensure that the audience is receiving and understanding a clear message, and allows them to voice their concerns and clarify any confusion or questions.

      • Use one-on-one meetings for key stakeholders and large organizational meetings to introduce large changes in the redesign.
      Emails

      Use email to communicate information to broad audiences. In addition, use email as the mass feedback mechanism.

      • Use email to follow up on meetings, or to invite people to next ones, but not as the sole medium of communication.
      Internal Website or Drive

      Use an internal website or drive as an information repository.

      • Store meeting minutes, policies, procedures, terms of reference, and feedback online to ensure transparency.

      Message Delivery

      1. Plan Your Message
        Emphasize what the audience really needs to know and how the change will impact them.
      2. Test Your Message
        If possible, test your communications with a small audience (2-3 people) first to get feedback and adjust messages before delivering them more broadly.
      3. Deliver and Repeat Your Message
        “Tell them what you’re going to tell them, then tell them, then tell them what you told them.”
      4. Gather Feedback and Evaluate Communications
        Evaluate the effectiveness of the communications (through surveys, stakeholder interviews, or metrics) to ensure the message was delivered and received successfully and communication goals were met.

      Construct an executive presentation to facilitate transparency for the governing framework

      Supporting Tool icon 4B Present the redesign to the key business stakeholders

      INSTRUCTIONS

      1. Identify Stakeholders
        Determine which business stakeholders have been the most involved in the redesign process.
      2. Customize Presentation
        Use the deliverables that you have built throughout this redesign to communicate the changes to the structure, authority, processes, and memberships in the governance framework.
      3. Present to Executives
        Present the executive presentation to the key business stakeholders who have been involved in the redesign process.

      Info-Tech best Practice

      Use the Executive Presentation customizable deliverable to lead a boardroom-quality presentation outlining the process and outcomes of the IT governance redesign.

      Present the executive presentation

      Associated Activity icon 4.3 1 hour

      INSTRUCTIONS

      1. Input SoBC Outcomes
        Input the outcomes of the SoBC. Specify the state of the business you have identified through the process of Phase 1.
      2. Input Current State Framework and Guidelines
        Input the outcomes of the current state assessment. Explain the process you used to identify the current governance framework and how you determined the strengths, weaknesses, and guidelines.
      3. Input Redesigned Governance Framework
        Input the governance redesign outcomes. Explain the process you used to modify and reconstruct the governance framework to drive optimal business results. Show the new structure and committee profiles.

      Use the Redesign IT Governance to Drive Optimal Business Results Executive Presentation Template for more information.

      Implement the governance redesign to optimize governance and, in turn, business results

      CASE STUDY

      Industry: Healthcare
      Source: Info-Tech

      Challenge

      Members of the project management group and in the larger SDLC process identified a lack of clarity on how to best govern active projects and initiatives that were moving through the governance process during the changes to the governance framework.

      These projects had already begun under the old frameworks and applying the redesigned governance framework would lead to work duplication and wasted time.

      Solution

      The organization decided that instead of applying the redesign to all initiatives across the organization, it would only be applied to new initiatives and ones that were still working within the first part of the “gating” process, where revised intake information could still be provided.

      Active initiatives that fell into the grandfathered category were identified and could proceed based on the old process. Yet, those that did not receive this status were provided carry-over lead time to revise their documentation during the changes.

      Results

      The implementation plan and timeframes were approved and an official change-over date identified.

      A communication plan was provided, including the grandfathered approach to be used with in-flight initiatives.

      A review cycle was also established for three months after launch to ensure the process was working as expected and would be repeated annually.

      The revised process improved the cycle time by 30% and improved the ability of the organization to govern high-speed requests and decisions.

      Summary of accomplishment

      Insights

      • IT governance requires business leadership.
        Instead of IT managing and governing IT, engage business leaders to take responsibility for governing IT.
      • With great governance comes great responsibility.
        Involve relevant business leaders, who will be impacted by IT outcomes, to share governing authority of IT.
      • Establish IT-business fusion.
        In governance, alignment is not enough. Merge IT and the business through governance to ensure business success.

      Knowledge Gained

      • There must be an active understanding of the current and future state of the business for governance to address the changing needs of the business.
      • Take a proactive approach to revising your governance framework. Understand why you are making decisions before actually making them.
      • Keep the current and future goals in sight to build an optimized governance framework that maintains the minimum bar of oversight required.

      Processes Optimized

      • EDM01 – Establishing a Governance Framework
      • Understanding the four elements of governance:
        • Structure
        • Authority
        • Process
        • Members
      • Embedding the benefits realization criteria, risk optimization, and resource optimization in governance.

      Deliverables Completed

      • Statement of Business Context
      • Current State Assessment of IT Governance
      • Future State Design for IT Governance
      • IT Governance Implementation Plan

      If you want additional support, have our analysts guide you through this phase as part of an Info-Tech Workshop Associated Activity icon

      Book a workshop with our Info-Tech analysts:

      Photo of an Info-Tech analyst.
      • To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.
      • Info-Tech analyst will join you and your team onsite at your location or welcome you to Info-Tech's historic Toronto office to participate in an innovative onsite workshop.
      • Contact your account manager (www.infotech.com/account), or email Workshops@InfoTech.com for more information.

      The following are sample activities that will be conducted by Info-Tech analysts with your team:

      4.1

      Sample of activity 4.1 'Outline next steps for governance redesign'. Build and Deploy the Implementation Plan

      Construct a list of tasks and consider the individuals or groups that those tasks will impact when implementing the governance redesign. Ensure consistent and transparent communication for successful outcomes.

      4.3

      Sample of activity 4.3 'Present the Executive Presentation'. Build the Executive Presentation

      Insert the state of business, current state, and future state design outcomes into a presentation to inform the key business stakeholders on the process and outcomes of the governance redesign.

      Research contributors and experts

      Deborah Eyzaguirre, IT Business Relationship Manager, UNT System

      Herbert Kraft, MIS Manager, Prairie Knights Casino

      Roslyn Kaman, CFO, Miles Nadal JCC

      Nicole Haggerty, Associate Professor of Information Systems, Ivey Business School

      Chris Austin, CTO, Ivey Business School

      Adriana Callerio, IT Director Performance Management, Molina Healthcare Inc.

      Joe Evers, Consulting Principal, JcEvers Consulting Corp

      Huw Morgan, IT Research Executive

      Joy Thiele, Special Projects Manager, Dunns Creek Baptist Church

      Rick Daoust, CIO, Cambrian College

      Related Info-Tech Research

      Bibliography

      A.T. Kearney. “The 7 Habits of Highly Effective Governance.” A.T. Kearney, 2008. Web. Nov. 2016.

      Bertolini, Phil. “The Transformational Effect of IT Governance.” Government Finance Review, Dec. 2012. Web. Nov. 2016.

      CGI. “IT Governance and Managed Services – Creative a win-win relationship” CGI Group Inc., 2015. Web. Dec. 2016.

      De Haes, Steven, and Wim Van Grembergen. “An Exploratory Study into the Design of an IT Governance Minimum Baseline through Delphi Research.” Communications of the Association for Information Systems: Vol. 22 , Article 24. 2008. Web. Nov. 2016.

      Deloitte LLP. “The Role of Senior Leaders in IT Governance.” The Wall Street Journal, 22 Jun. 2015. Web. Oct. 2016.

      Dragoon, Alice. “Four Governance Best Practices.” CIO From IDG, 15 Aug. 2003. Web. Dec. 2016.

      du Preez, Gert. “Company Size Matters: Perspectives on IT Governance.” PricewaterhouseCoopers, Aug. 2011. Web. Nov. 2016.

      Hagen, Christian, et. al. “Building a Capability-Driven IT Organization.” A.T. Kearney, Jun. 2011. Web. Nov. 2016.

      Heller, Martha. “Five Best Practices for IT Governance.” CFO.com, 27 Aug. 2012. Web. Oct. 2016.

      Hoch, Detlev, and Payan, Miguel. “Establishing Good IT Governance in the Public Sector.” McKinsey Dusseldorf, Mar. 2008. Web. Oct. 2016.

      Horne, Andrew, and Brian Foster. “IT Governance Is Killing Innovation.” Harvard Business Review, 22 Aug. 2013. Web. Dec. 2016.

      ISACA. “COBIT 5: Enabling Processes.” ISACA, 2012. Web. Oct. 2016.

      IT Governance Institute. “An Executive View of IT Governance.” IT Governance Institute, in association with PricewaterhouseCoopers. 2009. Web. Nov. 2016.

      Bibliography continued

      IT Governance Institute. “IT Governance Roundtable: Defining IT Governance.” IT Governance Institute, 2009. Web. Nov. 2016.

      Macgregor, Stuart. “The linchpin between Corporate Governance and IT Governance.” The Open Group’s EA Forum Johannesburg and Cape Town, Nov. 2013. Web. Nov. 2016.

      Mallette, Debra. “Implementing IT Governance An Introduction.” ISACA San Francisco Chapter, 23 Sep. 2009. Web. Oct. 2016.

      Massachusetts Institute of Technology. “IT Governance Introduction.” MIT Centre for Information System Research, 2016. Web. Nov. 2016.

      Mueller, Lynn, et. al. “IBM IT Governance Approach – Business Performance through IT Execution.” IBM Redbooks, Feb. 2008. Web. Nov. 2016.

      National Computing Centre. “IT Governance: Developing a successful governance strategy.” The National Computing Centre, Nov. 2005. Web. Oct. 2016.

      Pittsburgh ISACA Chapter. “Practical Approach to COBIT 5.0.” Pittsburgh ISACA Chapter, 17 Sep. 2012. Web. Nov. 2016.

      PricewaterhouseCoopers. “Great by governance: Improve IT performance and Value While Managing Risks.” PricewaterhouseCoopers, Nov. 2014. Web. Dec. 2016.

      PricewaterhouseCoopers. “IT Governance in Practice: Insights from leading CIOs.” PricewaterhouseCoopers, 2006. Web. Nov. 2016.

      Routh, Richard L. “IT Governance Part 1 of 2.” Online video clip. YouTube. The Institute of CIO Excellence, 01 Aug. 2012. Web. Nov. 2016.

      Salleh, Noor Akma Mohd, et. al. “IT Governance in Airline Industry: A Multiple Case Study.” International Journal of Digital Society, Dec. 2010. Web. Nov. 2016.

      Bibliography continued

      Speckert, Thomas, et. al. “IT Governance in Organizations Facing Decentralization – Case Study in Higher Education.” Department of Computer and Systems Sciences. Stockholm University, 2014. Web. Nov. 2016.

      Thorp, John. The Information Paradox—Realizing the Business Benefits of Information Technology. Revised Edition, McGraw Hill, 2003 (written jointly with Fujitsu).

      Vandervost, Guido, et. al. “IT Governance for the CxO.” Deloitte, Nov. 2013. Web. Nov. 2016.

      Weill, Peter, and Jeanne W. Ross. “IT Governance: How Top Performers Manage IT Decision Rights for Superior Results.” Boston: Harvard Business School, 2004. Print. Oct. 2016.

      Wong, Daron, et. al. “IT Governance in Oil and Gas: CIO Roundtable, Priorities for Surviving and Thriving in Lean Times.” Online video clip. YouTube. IT Media Group, Jun. 2016. Web. Nov. 2016.

      Stakeholder Relations

      • Buy Link or Shortcode: {j2store}25|cart{/j2store}
      • Related Products: {j2store}25|crosssells{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Strategy and Governance
      • Parent Category Link: /strategy-and-governance

      The challenge

      • Stakeholders come in a wide variety, often with competing and conflicting demands.
      • Some stakeholders are hard to identify. Those hidden agendas may derail your efforts.
      • Understanding your stakeholders' relative importance allows you to prioritize your IT agenda according to the business needs.

      Our advice

      Insight

      • Stakeholder management is an essential factor in how successful you will be.
      • Stakeholder management is a continuous process. The landscape constantly shifts.
      • You must also update your stakeholder management plan and approach on an ongoing basis.

      Impact and results 

      • Use your stakeholder management process to identify, prioritize, and manage key stakeholders effectively.
      • Continue to build on strengthening your relationships with stakeholders. It will help to gain easier buy-in and support for your future initiatives. 

      The roadmap

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Make the case

      Identify stakeholders

      • Stakeholder Management Analysis Tool (xls)

      Analyze your stakeholders

      Assess the stakeholder's influence, interest, standing, and support to determine priority for future actions 

      Manage your stakeholders

      Develop your stakeholder management and communication plans

      • Stakeholder Management Plan Template (doc)
      • Communication Plan Template (doc)

      Monitor your stakeholder management plan performance

      Measure and monitor the success of your stakeholder management process.

       

       

      Negotiate SaaS Agreements That Are Built to Last

      • Buy Link or Shortcode: {j2store}137|cart{/j2store}
      • member rating overall impact: 9.4/10 Overall Impact
      • member rating average dollars saved: $72,298 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Vendor Management
      • Parent Category Link: /vendor-management
      • Internal stakeholders usually have different – and often conflicting – needs and expectations that require careful facilitation and management.
      • SaaS solutions bring forth a unique form of “switching costs” that can make a decision to migrate solutions financially, technically, and politically painful.

      Our Advice

      Critical Insight

      • Conservatively, it’s possible to save 5% of the overall IT budget through comprehensive software and SaaS contract review.
      • Focus on the terms and conditions, not just the price.
      • Learning to negotiate is crucial.

      Impact and Result

      • Take control of your SaaS contract negotiations from the beginning.
      • Look at your contract holistically to find cost savings.
      • Guide communication between vendors and your organization for the duration of contract negotiations.
      • Redline the terms and conditions of your SaaS contract.
      • Prioritize crucial terms and conditions to negotiate.

      Negotiate SaaS Agreements That Are Built to Last Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how to redline and negotiate a SaaS agreement, review Info-Tech’s methodology, and understand the different ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Gather requirements

      Build and manage the stakeholder team, and then document the business use case.

      • Negotiate SaaS Agreements That Are Built to Last – Phase 1: Gather Requirements
      • RASCI Chart
      • Vendor Communication Management Plan
      • Software Business Use Case Template
      • SaaS TCO Calculator

      2. Redline contract

      Redline the proposed SaaS contract.

      • Negotiate SaaS Agreements That Are Built to Last – Phase 2: Redline Contract
      • SaaS Terms and Conditions Evaluation Tool

      3. Negotiate contract

      Create a thorough negotiation plan.

      • Negotiate SaaS Agreements That Are Built to Last – Phase 3: Negotiate Contract
      • SaaS Contract Negotiation Terms Prioritization Checklist
      • Controlled Vendor Communications Letter
      • Key Vendor Fiscal Year End Calendar
      • Contract Negotiation Tactics Playbook
      [infographic]

      Workshop: Negotiate SaaS Agreements That Are Built to Last

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Collect and Review Data

      The Purpose

      Assemble documentation.

      Key Benefits Achieved

      Understand current position before going forward.

      Activities

      1.1 Assemble existing contracts.

      1.2 Document their strategic and tactical objectives.

      1.3 Identify current status of the vendor relationship and any historical context.

      1.4 Clarify goals for ideal future state.

      Outputs

      Business Use Case.

      2 Define the Business Use Case and Build a Stakeholder Team

      The Purpose

      Define the business use case and build a stakeholder team.

      Key Benefits Achieved

      Create a business use case to document functional and non-functional requirements.

      Build an internal cross-functional stakeholder team to negotiate the contract.

      Activities

      2.1 Establish a negotiation team and define roles.

      2.2 Write a communication plan.

      2.3 Complete a business use case.

      Outputs

      RASCI Matrix

      Communications Plan

      SaaS TCO Calculator

      Business Use Case

      3 Redline the Contract

      The Purpose

      Examine terms and conditions and prioritize for negotiation.

      Key Benefits Achieved

      Discover cost savings.

      Improve agreement terms.

      Prioritize terms for negotiation.

      Activities

      3.1 Review general terms and conditions.

      3.2 Review license and application specific terms and conditions.

      3.3 Match to business and technical requirements.

      3.4 Redline the agreement.

      Outputs

      SaaS Terms and Conditions Evaluation Tool

      SaaS Contract Negotiation Terms Prioritization Checklist

      4 Build a Negotiation Strategy

      The Purpose

      Create a negotiation strategy.

      Key Benefits Achieved

      Controlled communication established.

      Negotiation tactics chosen.

      Negotiation timeline plotted.

      Activities

      4.1 Review vendor and application specific negotiation tactics.

      4.2 Build negotiation strategy.

      Outputs

      Contract Negotiation Tactics Playbook

      Controlled Vendor Communications Letter

      Key Vendor Fiscal Year End Calendar

      Annual CIO Survey Report 2024

      • Buy Link or Shortcode: {j2store}106|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation

      CIOs today face increasing pressures, disruptive emerging technologies, talent shortages, and a slew of other challenges. What are their top concerns, priorities, and technology bets that will define the future direction of IT?

      CIO responses to our Future of IT 2024 survey reveal key insights on spending projects, the potential disruptions causing the most concern, plans for adopting emerging technology, and how firms are responding to generative AI.

      See how CIOs are sizing up the opportunities and threats of the year ahead

      Map your organization’s response to the external environment compared to CIOs across geographies and industries. Learn:

      • The CIO view on continuing concerns such as cybersecurity.
      • Where they rate their IT department’s maturity.
      • What their biggest concerns and budget increases are.
      • How they’re approaching third-party generative AI tools.

      Annual CIO Survey Report 2024 Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Future of IT Survey 2024 – A summary of key insights from the CIO responses to our Future of IT 2024 survey.

      Take the pulse of the IT industry and see how CIOs are planning to approach 2024.

      • Annual CIO Survey Report for 2024
      [infographic]

      Further reading

      Annual CIO Survey Report 2024

      An inaugural look at what's on the minds of CIOs.

      1. Firmographics

      • Region
      • Title
      • Organization Size
      • IT Budget Size
      • Industry

      Firmographics

      The majority of CIO responses came from North America. Contributors represent regions from around the world.

      Countries / Regions Response %
      United States 47.18%
      Canada 11.86%
      Australia 9.60%
      Africa 6.50%
      China 0.28%
      Germany 1.13%
      United Kingdom 5.37%
      India 1.41%
      Brazil 1.98%
      Mexico 0.56%
      Middle East 4.80%
      Asia 0.28%
      Other country in Europe 4.52%

      n=354

      Firmographics

      A typical CIO respondent held a C-level position at a small to mid-sized organization.

      Half of CIOs hold a C-level position, 10% are VP-level, and 20% are director level

      Pie Chart of CIO positions

      38% of respondents are from an organization with above 1,000 employees

      Pie chart of size of organizations

      Firmographics

      A typical CIO respondent held a C-level position at a small to mid-sized organization.

      40% of CIOs report an annual budget of more than $10 million

      Pie chart of CIO annual budget

      A range of industries are represented, with 29% of respondents in the public sector or financial services

      Range of industries

      2. Key Factors

      • IT Maturity
      • Disruptive Factors
      • IT Spending Plans
      • Talent Shortage

      Two in three respondents say IT can deliver outcomes that Support or Optimize the business

      IT drives outcomes

      Most CIOs are concerned with cybersecurity disruptions, and one in four expect a budget increase of above 10%

      How likely is it that the following factors will disrupt your business in the next 12 months?

      Chart for factors that will disrupt your business

      Looking ahead to 2024, how will your organization's IT spending change compared to spending in 2023?

      Chart of IT spending change

      3. Adoption of Emerging Technology

      • Fastest growing tech for 2024 and beyond

      CIOs plan the most new spend on AI in 2024 and on mixed reality after 2024

      Top five technologies for new spending planned in 2024:

      1. Artificial intelligence - 35%
      2. Robotic process automation or intelligent process automation - 24%
      3. No-code/low-code platforms - 21%
      4. Data management solutions - 14%
      5. Internet of Things (IoT) - 13%

      Top five technologies for new spending planned after 2024:

      1. Mixed reality - 20%
      2. Blockchain - 19%
      3. Internet of Things (IoT) - 17%
      4. Robotics/drones - 16%
      5. Robotic process automation or intelligent process automation - 14%

      n=301

      Info-Tech Insight
      Three in four CIOs say they have no plans to invest in quantum computing, more than any other technology with no spending plans.

      4. Adoption of AI

      • Interest in generative AI applications
      • Tasks to be completed with AI
      • Progress in deploying AI

      CIOs are most interested in industry-specific generative AI applications or text-based

      Rate your business interest in adopting the following generative AI applications:

      Chart for interest in AI

      There is interest across all types of generative AI applications. CIOs are least interested in visual media generators, rating it just 2.4 out of 5 on average.

      n=251

      Info-Tech Insight
      Examples of generative AI solutions specific to the legal industry include Litigate, CoCounsel, and Harvey.

      By the end of 2024, CIOs most often plan to use AI for analytics and repetitive tasks

      Most popular use cases for AI by end of 2024:

      1. Business analytics or intelligence - 69%
      2. Automate repetitive, low-level tasks - 68%
      3. Identify risks and improve security - 66%
      4. IT operations - 62%
      5. Conversational AI or virtual assistants - 57%

      Fastest growing uses cases for AI in 2024:

      1. Automate repetitive, low-level tasks - 39%
      2. IT operations - 38%
      3. Conversational AI or virtual assistants - 36%
      4. Business analytics or intelligence - 35%
      5. Identify risks and improve security - 32%

      n=218

      Info-Tech Insight
      The least popular use case for AI is to help define business strategy, with 45% saying they have no plans for it.

      One in three CIOs are running AI pilots or are more advanced with deployment

      How far have you progressed in the use of AI?

      Chart of progress in use of AI

      Info-Tech Insight
      Almost half of CIOs say ChatGPT has been a catalyst for their business to adopt new AI initiatives.

      5. AI Risk

      • Perceived impact of AI
      • Approach to third-party AI tools
      • AI features in business applications
      • AI governance and accountability

      Six in ten CIOs say AI will have a positive impact on their organization

      What overall impact do you expect AI to have on your organization?

      Overall impact of AI on organization

      The majority of CIOs are waiting for professional-grade generative AI tools

      Which of the following best describes your organization's approach to third-party generative AI tools (such as ChatGPT or Midjourney)?

      Third-party generative AI

      Info-Tech Insight
      Business concerns over intellectual property and sensitive data exposure led OpenAI to announce ChatGPT won't use data submitted via its API for model training unless customers opt in to do so. ChatGPT users can also disable chat history to avoid having their data used for model training (OpenAI).

      One in three CIOs say they are accountable for AI, and the majority are exploring it cautiously

      Who in your organization is accountable for governance of AI?

      Governance of AI

      More than one-third of CIOs say no AI governance steps are in place today

      What AI governance steps does your organization have in place today?

      Chart of AI governance steps

      Among organizations that plan to invest in AI in 2024, 30% still say there are no steps in place for AI governance. The most popular steps to take are to publish clear explanations about how AI is used, and to conduct impact assessments (n=170).

      Chart of AI governance steps

      Among all CIOs, including those that do not plan to invest in AI next year, 37% say no steps are being taken toward AI governance today (n=243).

      6. Contribute to Info-Tech's Research Community

      • Volunteer to be interviewed
      • Attend LIVE in Las Vegas

      It's not too late; take the Future of IT online survey

      Contribute to our tech trends insights

      If you haven't already contributed to our Future of IT online survey, we are keeping the survey open to continue to collect insights and inform our research reports and agenda planning process. You can take the survey today. Those that complete the survey will be sent a complimentary Tech Trends 2024 report.

      Complete an interview for the Future of IT research project

      Help us chart the future course of IT

      If you are receiving this for completing the Future of IT online survey, thank you for your contribution. If you are interested in further participation and would like to provide a complementary interview, please get in touch at brian.Jackson@infotech.com. All interview subjects must also complete the online survey.

      If you've already completed an interview, thank you very much, and you can look forward to seeing more impacts of your contribution in the near future.

      LIVE 2023

      Methodology

      All data in this report is from Info-Tech's Future of IT online survey 2023 edition.

      A CIO focus for the Future of IT

      Data in this report represents respondents to the Future of IT online survey conducted by Info-Tech Research Group between May 11 and July 7, 2023.

      Only CIO respondents were selected for this report, defined as those who indicated they are the most senior member of their organization's IT department.

      This data segment reflects 355 total responses with 239 completing every question on the survey.

      Further data from the Future of IT online survey and the accompanying interview process will be featured in Info-Tech's Tech Trends 2024 report this fall and in forthcoming Priorities reports including Applications, Data & EA, CIO, Infrastructure, and Security.

      Extend Agile Practices Beyond IT

      • Buy Link or Shortcode: {j2store}175|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Architecture & Strategy
      • Parent Category Link: /architecture-and-strategy
      • Your organization has started to realize benefits from adopting Agile principles and practices. However, these advances are contained within your IT organization.
      • You are seeking to extend Agile development beyond IT into other areas of the organization. You are looking for a coordinated approach aligned to business priorities.

      Our Advice

      Critical Insight

      • Not all lessons from scaling Agile to IT are transferable. IT Agile scaling processes are tailored to IT’s scope, team, and tools, which may not account for diverse attributes within your organization.
      • Control may be necessary for coordination. With increased time-to-value, enforcing consistent cadences, reporting, and communication is a must if teams are not disciplined or lack good governance.
      • Extend Agile in departments tolerant to change. Incrementally roll out Agile in departments where its principles are accepted (e.g. a culture that embraces failures as lessons).

      Impact and Result

      • Complete an assessment of your prior efforts to scale Agile across IT to gauge successful, consistent adoption. Identify the business objectives and the group drivers that are motivating the extension of Agile to the business.
      • Understand the challenges that you may face when extending Agile to business partners. Investigate the root causes of existing issues that can derail your efforts.
      • Ideate solutions to your scaling challenges and envision a target state for your growing Agile environment. Your target state should realize new opportunities to drive more business value and eliminate current activities driving down productivity.
      • Coordinate the implementation and execution of your scaling Agile initiatives with an implementation action plan. This collaborative document will lay out the process, roles, goals, and objectives needed to successfully manage your Agile environment.

      Extend Agile Practices Beyond IT Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should extend Agile practices to improve product delivery, review Info-Tech’s methodology, and understand the ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Assess your readiness to scale agile vertically

      Assess your readiness to scale Agile vertically by identifying and mitigating potential Agile maturity gaps remaining after scaling Agile across your IT organization.

      • Extend Agile Practices Beyond IT – Phase 1: Assess Your Readiness to Scale Agile Vertically
      • Agile Maturity Assessment Tool

      2. Establish an enterprise scaled agile framework

      Complete an overview of various scaled Agile models to help you develop your own customized delivery framework.

      • Extend Agile Practices Beyond IT – Phase 2: Establish an Enterprise Scaled Agile Framework
      • Framework Selection Tool

      3. Create your implementation action plan

      Determine the effort and steps required to implement your extended delivery framework.

      • Extend Agile Practices Beyond IT – Phase 3: Create Your Implementation Action Plan
      [infographic]

      Workshop: Extend Agile Practices Beyond IT

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Assess Current State of Agile Maturity

      The Purpose

      Assess your readiness to scale Agile vertically.

      Identify and mitigate potential Agile maturity gaps remaining after scaling Agile across your IT organization.

      Key Benefits Achieved

      IT Agile maturity gaps identified and mitigated to ensure successful extension of Agile to the business

      Activities

      1.1 Characterize your Agile implementation using the CLAIM model.

      1.2 Assess the maturity of your Agile teams and organization.

      Outputs

      Maturity gaps identified with mitigation requirements

      2 Establish an Enterprise Scaled Agile Framework

      The Purpose

      Complete a review of scaled Agile models to help you develop your own customized delivery framework.

      Key Benefits Achieved

      A customized Agile delivery framework

      Activities

      2.1 Explore various scaled frameworks.

      2.2 Select an appropriate scaled framework for your enterprise.

      2.3 Define the future state of your team and the communication structure of your functional business group.

      Outputs

      Blended framework delivery model

      Identification of team and communication structure impacts resulting from the new framework

      3 Create Your Implementation Action Plan

      The Purpose

      Create your implementation action plan for the new Agile delivery framework.

      Key Benefits Achieved

      A clearly defined action plan

      Activities

      3.1 Define your value drivers.

      3.2 Brainstorm the initiatives that must be completed to achieve your target state.

      3.3 Estimate the effort of your Agile initiatives.

      3.4 Define your Agile implementation action plan.

      Outputs

      List of target state initiatives

      Estimation of effort to achieve target state

      An implementation action plan

      Select a Security Outsourcing Partner

      • Buy Link or Shortcode: {j2store}246|cart{/j2store}
      • member rating overall impact: 8.8/10 Overall Impact
      • member rating average dollars saved: $13,739 Average $ Saved
      • member rating average days saved: 8 Average Days Saved
      • Parent Category Name: Security Processes & Operations
      • Parent Category Link: /security-processes-and-operations
      • Most organizations do not have a clear understanding of their current security posture, their security goals, and the specific security services they require. Without a clear understanding of their needs, organizations may struggle to identify a partner that can meet their requirements.
      • Breakdowns and lack of communication can be a significant obstacle, especially when clear lines of communication with partners, including regular check-ins, reporting, and incident response protocols, have not been clearly established.
      • Ensuring that security partners’ systems and processes integrate seamlessly with existing systems can be a challenge for most organizations in addition to making sure that security partners have the necessary access and permissions to perform their services effectively.
      • Adhering to security policies is rarely a priority to users as compliance often feels like an interference to daily workflow. For a lot of organizations, security policies are not having the desired effect.

      Our Advice

      Critical Insight

      • You can outsource your responsibilities but not your accountability.
      • Be aware that in most cases, the traditional approach is more profitable to MSSPs, and they may push you toward one, so make sure you get the service you want, not what they prescribe.

      Impact and Result

      • Determine which security responsibilities can be outsourced and which should be insourced and the right procedure to outsourcing to gain cost savings, improve resource allocation, and boost your overall security posture.

      Select a Security Outsourcing Partner Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Select a Security Outsourcing Partner Storyboard – A guide to help you determine your requirements and select and manage your security outsourcing partner.

      Our systematic approach will ensure that the correct procedure for selecting a security outsourcing partner is implemented. This blueprint will help you build and implement your security policy program by following our three-phase methodology: determine what to outsource, select the right MSSP, and manage your MSSP.

      • Select a Security Outsourcing Partner – Phases 1-3

      2. MSSP RFP Template – A customizable template to help you choose the right security service provider.

      This modifiable template is designed to introduce consistency and outline key requirements during the request for proposal phase of selecting an MSSP.

      • MSSP RFP Template

      Infographic

      Further reading

      Select a Security Outsourcing Partner

      Outsource the right functions to secure your business.

      Analyst Perspective

      Understanding your security needs and remaining accountable is the key to selecting the right partner.

      The need for specialized security services is fast becoming a necessity to most organizations. However, resource challenges will always mean that organizations will still have to take practical measures to ensure that the time, quality, and service that they require from outsourcing partners have been carefully crafted and packaged to elicit the right services that cover all their needs and requirements.

      Organizations must ensure that security partners are aligned not only with their needs and requirements, but also with the corporate culture. Rather than introducing hindrances to daily operations, security partners must support business goals and protect the organization’s interests at all times.

      And as always, outsource only your responsibilities and do not outsource your accountability, as that will cost you in the long run.

      Photo of Danny Hammond
      Danny Hammond
      Research Analyst
      Security, Risk, Privacy & Compliance Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      A lack of high-skill labor increases the cost of internal security, making outsourcing more appealing.

      A lack of time and resources prevents your organization from being able to enable security internally.

      Due to a lack of key information on the subject, you are unsure which functions should be outsourced versus which functions should remain in-house.

      Having 24/7/365 monitoring in-house is not feasible for most firms.

      There is difficulty measuring the effectiveness of managed security service providers (MSSPs).

      Common Obstacles

      InfoSec leaders will struggle to select the right outsourcing partner without knowing what the organization needs, such as:

      • How to start the process to select the right service provider that will cover your security needs. With so many service providers and technology tools in this field, who is the right partner?
      • Where to obtain guidance on externalization of resources or maintaining internal posture to enable to you confidently select an outsourcing partner.

      InfoSec leaders must understand the business environment and their own internal security needs before they can select an outsourcing partner that fits.

      Info-Tech’s Approach

      Info-Tech’s Select a Security Outsourcing Partner takes a multi-faceted approach to the problem that incorporates foundational technical elements, compliance considerations, and supporting processes:

      • Determine which security responsibilities can be insourced and which should be outsourced, and the right procedure to outsourcing in order to gain cost savings, improve resource allocation, and boost your overall security posture.
      • Understand the current landscape of MSSPs that are available today and the features they offer.
      • Highlight the future financial obligations of outsourcing vs. insourcing to explain which method is the most cost-effective.

      Info-Tech Insight

      Mitigate security risks by developing an end-to-end process that ensures you are outsourcing your responsibilities and not your accountability.

      Your Challenge

      This research is designed to help organizations select an effective security outsourcing partner.

      • A security outsourcing partner is a third-party service provider that offers security services on a contractual basis depending on client needs and requirements.
      • An effective outsourcing partner can help an organization improve its security posture by providing access to more specialized security experts, tools, and technologies.
      • One of the main challenges with selecting a security outsourcing partner is finding a partner that is a good fit for the organization's unique security needs and requirements.
      • Security outsourcing partners typically have access to sensitive information and systems, so proper controls and safeguards must be in place to protect all sensitive assets.
      • Without careful evaluation and due diligence to ensure that the partner is a good fit for the organization's security needs and requirements, it can be challenging to select an outsourcing partner.

      Outsourcing is effective, but only if done right

      • 83% of decision makers with in-house cybersecurity teams are considering outsourcing to an MSP (Syntax, 2021).
      • 77% of IT leaders said cyberattacks were more frequent (Syntax, 2021).
      • 51% of businesses suffered a data breach caused by a third party (Ponemon, 2021).

      Common Obstacles

      The problem with selecting an outsourcing partner isn’t a lack of qualified partners, it’s the lack of clarity about an organization's specific security needs.

      • Most organizations do not have a clear understanding of their current security posture, their security goals, and the specific security services they require. Without a clear understanding of their needs, organizations may struggle to identify a partner that can meet their requirements.
      • Breakdowns and lack of communication can be a significant obstacle, especially when clear lines of communication with partners, including regular check-ins, reporting, and incident response protocols, have not been clearly established.
      • Ensuring that security partner's systems and processes integrate seamlessly with existing systems can be a challenge for most organizations. This is in addition to making sure that security partners have the necessary access and permissions to perform their services effectively.
      • Adhering to security policies is rarely a priority to users, as compliance often feels like an interference to daily workflow. For a lot of organizations, security policies are not having the desired effect.

      A diagram that shows Average cost of a data breach from 2019 to 2022.
      Source: IBM, 2022 Cost of a Data Breach; N=537.


      Reaching an all-time high, the cost of a data breach averaged US$4.35 million in 2022. This figure represents a 2.6% increase from 2021, when the average cost of a breach was US$4.24 million. The average cost has climbed 12.7% since 2020.

      Info-Tech’s methodology for selecting a security outsourcing partner

      Determine your responsibilities

      Determine what responsibilities you can outsource to a service partner. Analyze which responsibilities you should outsource versus keep in-house? Do you require a service partner based on identified responsibilities?

      Scope your requirements

      Refine the list of role-based requirements, variables, and features you will require. Use a well-known list of critical security controls as a framework to determine these activities and send out RFPs to pick the best candidate for your organization.

      Manage your outsourcing program

      Adopt a program to manage your third-party service security outsourcing. Trust your managed security service providers (MSSP) but verify their results to ensure you get the service level you were promised.

      Select a Security Outsourcing Partner

      A diagram that shows your organization responsibilities & accountabilities, framework for selecting a security outsourcing partner, and benefits.

      Blueprint benefits

      IT/InfoSec Benefits

      Reduces complexity within the MSSP selection process by highlighting all the key steps to a successful selection program.

      Introduces a roadmap to clearly educate about the do’s and don’ts of MSSP selection.

      Reduces costs and efforts related to managing MSSPs and other security partners.

      Business Benefits

      Assists with selecting outsourcing partners that are essential to your organization’s objectives.

      Integrates outsourcing into corporate culture, leveraging organizational requirements while maximizing value of outsourcing.

      Reduces security outsourcing risk.

      Insight summary

      Overarching insight: You can outsource your responsibilities but not your accountability.

      Determine what to outsource: Assess your responsibilities to determine which ones you can outsource. It is vital that an understanding of how outsourcing will affect the organization, and what cost savings, if any, to expect from outsourcing is clear in order to generate a list of responsibilities that can/should be outsourced.

      Select the right partner: Create a list of variables to evaluate the MSSPs and determine which features are important to you. Evaluate all potential MSSPs and determine which one is right for your organization

      Manage your MSSP: Align the MSSP to your organization. Adopt a program to monitor the MSSP which includes a long-term strategy to manage the MSSP.

      Identifying security needs and requirements = Effective outsourcing program: Understanding your own security needs and requirements is key. Ensure your RFP covers the entire scope of your requirements; work with your identified partner on updates and adaptation, where necessary; and always monitor alignment to business objectives.

      Measure the value of this blueprint

      Phase

      Purpose

      Measured Value

      Determine what to outsource Understand the value in outsourcing and determining what responsibilities can be outsourced. Cost of determining what you can/should outsource:
      • 120 FTE hours at $90K per year = $5,400
      Cost of determining the savings from outsourcing vs. insourcing:
      • 120 FTE hours at $90K per year = $5,400
      Select the right partner Select an outsourcing partner that will have the right skill set and solution to identified requirements. Cost of ranking and selecting your MSSPs:
      • 160 FTE hours at $90K per year = $7,200
      Cost of creating and distributing RFPs:
      • 200 FTE hours at $90K per year = $9,000
      Manage your third-party service security outsourcing Use Info-Tech’s methodology and best practices to manage the MSSP to get the best value. Cost of creating and implementing a metrics program to manage the MSSP:
      • 80 FTE hours at $90K per year = $3,600

      After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.

      Overall Impact: 8.9 /10

      Overall Average Cost Saved: $22,950

      Overall Average Days Saved: 9

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit
      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation
      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop
      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting
      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      The Rapid Application Selection Framework

      • Buy Link or Shortcode: {j2store}608|cart{/j2store}
      • member rating overall impact: 9.2/10 Overall Impact
      • member rating average dollars saved: $37,512 Average $ Saved
      • member rating average days saved: 22 Average Days Saved
      • Parent Category Name: Selection & Implementation
      • Parent Category Link: /selection-and-implementation
      • Selection takes forever. Traditional software selection drags on for years, sometimes in perpetuity.
      • IT is viewed as a bottleneck and the business has taken control of software selection.
      • “Gut feel” decisions rule the day. Intuition, not hard data, guides selection, leading to poor outcomes.
      • Negotiations are a losing battle. Money is left on the table by inexperienced negotiators.
      • Overall: Poor selection processes lead to wasted time, wasted effort, and applications that continually disappoint.

      Our Advice

      Critical Insight

      • Adopt a formal methodology to accelerate and improve software selection results.
      • Improve business satisfaction by including the right stakeholders and delivering new applications on a truly timely basis.
      • Kill the “sacred cow” requirements that only exist because “it’s how we’ve always done it.”
      • Forget about “RFP” overload and hone in on the features that matter to your organization.
      • Skip the guesswork and validate decisions with real data.
      • Take control of vendor “dog and pony shows” with single-day, high-value, low-effort, rapid-fire investigative interviews.
      • Master vendor negotiations and never leave money on the table.

      Impact and Result

      Improving software selection is a critical project that will deliver huge value.

      • Hit a home run with your business stakeholders: use a data-driven approach to select the right application vendor for their needs – fast.
      • Shatter stakeholder expectations with truly rapid application selections.
      • Boost collaboration and crush the broken telephone with concise and effective stakeholder meetings.
      • Lock in hard savings and do not pay list price by using data-driven tactics.

      The Rapid Application Selection Framework Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. The Rapid Application Selection Framework

      • The Rapid Application Selection Framework Deck

      2. The Guide to Software Selection: A Business Stakeholder Manual

      • The Guide to Software Selection: A Business Stakeholder Manual

      3. The Software Selection Workbook

      • The Software Selection Workbook

      4. The Vendor Evaluation Workbook

      • The Vendor Evaluation Workbook
      [infographic]

      Digital Data Ethics

      • Download01-Title: Tech Trend Update: If Digital Ethics Then Data Equity
      • Download-01: Visit Link
      • member rating overall impact: 9/10
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation

      In the past two years, we've seen that we need quick technology solutions for acute issues. We quickly moved to homeworking and then to a hybrid form. We promptly moved many of our offline habits online.

      That necessitated a boost in data collection from us towards our customers and employees, and business partners.
      Are you sure how to approach this structurally? What is the right thing to do?

      Impact and Results

      • When you partner with another company, set clear expectations
      • When you are building your custom solution, invite constructive criticism
      • When you present yourself as the authority, consider the most vulnerable in the relationship

      innovation

      Demystify Oracle Licensing and Optimize Spend

      • Buy Link or Shortcode: {j2store}136|cart{/j2store}
      • member rating overall impact: 9.9/10 Overall Impact
      • member rating average dollars saved: $85,754 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: Licensing
      • Parent Category Link: /licensing
      • License keys are not needed with optional features accessible upon install. Conducting quarterly checks of the Oracle environment is critical because if products or features are installed, even if they are not actively in use, it constitutes use by Oracle and requires a license.
      • Ambiguous license models and definitions abound: terminology and licensing rules can be vague, making it difficult to purchase licensing even with the best of intentions to keep compliant.
      • Oracle has aggressively started to force new Oracle License and Service Agreements (OLSA) on customers that slightly modify language and remove pre-existing allowances to tilt the contract terms in Oracle's favor.

      Our Advice

      Critical Insight

      • Focus on needs first. Conduct a thorough requirements assessment and document the results. Well-documented license needs will be your core asset in navigating Oracle licensing and negotiating your agreement.
      • Communicate effectively. Be aware that Oracle will reach out to employees at your organization at various levels. Having your executives on the same page will help send a strong message.
      • Manage the relationship. If Oracle is managing you, there is a high probability you are over paying or providing information that may result in an audit.

      Impact and Result

      • Conducting business with Oracle is not typical compared to other vendors. To emerge successfully from a commercial transaction with Oracle, customers must learn the "Oracle way" of conducting business, which includes a best-in-class sales structure, highly unique contracts and license use policies, and a hyper-aggressive compliance function.
      • Map out the process of how to negotiate from a position of strength, examining terms and conditions, discount percentages, and agreement pitfalls.
      • Develop a strategy that leverages and utilizes an experienced Oracle DBA to gather accurate information, and then optimizes it to mitigate and meet the top challenges.

      Demystify Oracle Licensing and Optimize Spend Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you need to understand and document your Oracle licensing strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish licensing requirements

      Begin your proactive Oracle licensing journey by understanding which information to gather and assessing the current state and gaps.

      • Demystify Oracle Licensing and Optimize Spend – Phase 1: Establish Licensing Requirements
      • Oracle Licensing Purchase Reference Guide
      • Oracle Database Inventory Tool
      • Effective Licensing Position Tool
      • RASCI Chart

      2. Evaluate licensing options

      Review current licensing models and determine which licensing models will most appropriately fit your environment.

      • Demystify Oracle Licensing and Optimize Spend – Phase 2: Evaluate Licensing Options

      3. Evaluate agreement options

      Review Oracle’s contract types and assess which best fit the organization’s licensing needs.

      • Demystify Oracle Licensing and Optimize Spend – Phase 3: Evaluate Agreement Options
      • Oracle TCO Calculator

      4. Purchase and manage licenses

      Conduct negotiations, purchase licensing, and finalize a licensing management strategy.

      • Demystify Oracle Licensing and Optimize Spend – Phase 4: Purchase and Manage Licenses
      • Oracle Terms & Conditions Evaluation Tool
      • Controlled Vendor Communications Letter
      • Vendor Communication Management Plan
      [infographic]

      Workshop: Demystify Oracle Licensing and Optimize Spend

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Licensing Requirements

      The Purpose

      Assess current state and align goals; review business feedback

      Interview key stakeholders to define business objectives and drivers

      Key Benefits Achieved

      Have a baseline for requirements

      Assess the current state

      Determine licensing position

      Examine cloud options

      Activities

      1.1 Gather software licensing data

      1.2 Conduct a software inventory

      1.3 Perform manual checks

      1.4 Reconcile licenses

      1.5 Create your Oracle licensing team

      1.6 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation

      Outputs

      Copy of your Oracle License Statement

      Software inventory report from software asset management (SAM) tool

      Oracle Database Inventory Tool

      RASCI Chart

      Oracle Licensing Effective License Position (ELP) Template

      Oracle Licensing Purchase Reference Guide

      2 Evaluate Licensing Options

      The Purpose

      Review licensing options

      Review licensing rules

      Key Benefits Achieved

      Understand how licensing works

      Determine if you need software assurance

      Discuss licensing rules, application to current environment.

      Examine cloud licensing

      Understand the importance of documenting changes

      Meet with desktop product owners to determine product strategies

      Activities

      2.1 Review full, limited, restricted, and AST use licenses

      2.2 Calculate license costs

      2.3 Determine which database platform to use

      2.4 Evaluate moving to the cloud

      2.5 Examine disaster recovery strategies

      2.6 Understand purchasing support

      2.7 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation

      Outputs

      Oracle TCO Calculator

      Oracle Licensing Purchase Reference Guide

      3 Evaluate Agreement Options

      The Purpose

      Review contract option types

      Review vendors

      Key Benefits Achieved

      Understand why a type of contract is best for you

      Determine if ULA or term agreement is best

      The benefits of other types and when you should change

      Activities

      3.1 Prepare to sign or renew your ULA

      3.2 Decide on an agreement type that nets the maximum benefit

      Outputs

      Type of contract to be used

      Oracle TCO Calculator

      Oracle Licensing Purchase Reference Guide

      4 Purchase and Manage Licenses

      The Purpose

      Finalize the contract

      Prepare negotiation points

      Discuss license management

      Evaluate and develop a roadmap for future licensing

      Key Benefits Achieved

      Negotiation strategies

      Licensing management

      Introduction of SAM

      Leverage the work done on Oracle licensing to get started on SAM

      Activities

      4.1 Control the flow of communication terms and conditions

      4.2 Use Info-Tech’s readiness assessment in preparation for the audit

      4.3 Assign the right people to manage the environment

      4.4 Meet with stakeholders to discuss the licensing position, cloud offerings, and budget allocation

      Outputs

      Controlled Vendor Communications Letter

      Vendor Communication Management Plan

      Oracle Terms & Conditions Evaluation Tool

      RASCI Chart

      Oracle Licensing Purchase Reference Guide

      Take Control of Cloud Costs on AWS

      • Buy Link or Shortcode: {j2store}425|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $62,500 Average $ Saved
      • member rating average days saved: 26 Average Days Saved
      • Parent Category Name: Cloud Strategy
      • Parent Category Link: /cloud-strategy
      • Traditional IT budgeting and procurement processes don't work for public cloud services.
      • The self-service nature of the cloud means that often the people provisioning cloud resources aren't accountable for the cost of those resources.
      • Without centralized control or oversight, organizations can quickly end up with massive AWS bills that exceed their IT salary cost.

      Our Advice

      Critical Insight

      • Most engineers care more about speed of feature delivery and reliability of the system than they do about cost.
      • Often there are no consequences for over architecting or overspending on AWS.
      • Many organizations lack sufficient visibility into their AWS spend, making it impossible to establish accountability and controls.

      Impact and Result

      • Define roles and responsibilities.
      • Establish visibility.
      • Develop processes, procedures, and policies.

      Take Control of Cloud Costs on AWS Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should take control of cloud costs, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Build cost accountability framework

      Assess your current state, define your cost allocation model, and define roles and responsibilities.

      • Cloud Cost Management Worksheet
      • Cloud Cost Management Capability Assessment
      • Cloud Cost Management Policy
      • Cloud Cost Glossary of Terms

      2. Establish visibility

      Define dashboards and reports, and document account structure and tagging requirements.

      • Service Cost Cheat Sheet

      3. Define processes and procedures

      Establish governance for tagging and cost control, define processes for right-sizing, and define processes for purchasing commitment discounts.

      • Right-Sizing Workflow (Visio)
      • Right-Sizing Workflow (PDF)
      • Commitment Purchasing Workflow (Visio)
      • Commitment Purchasing Workflow (PDF)

      4. Build implementation plan

      Document process interactions, establish program KPIs, and build implementation roadmap and communication plan.

      • Cloud Cost Management Task List

      Infographic

      Workshop: Take Control of Cloud Costs on AWS

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Build Cost Accountability Framework

      The Purpose

      Establish clear lines of accountability and document roles and responsibilities to effectively manage cloud costs.

      Key Benefits Achieved

      Chargeback/showback model to provide clear accountability for costs.

      Understanding of key areas to focus on to improve cloud cost management capabilities.

      Activities

      1.1 Assess current state

      1.2 Determine cloud cost model

      1.3 Define roles and responsibilities

      Outputs

      Cloud cost management capability assessment

      Cloud cost model

      Roles and responsibilities

      2 Establish Visibility

      The Purpose

      Establish visibility into cloud costs and drivers of those costs.

      Key Benefits Achieved

      Better understanding of what is driving costs and how to keep them in check.

      Activities

      2.1 Develop architectural patterns

      2.2 Define dashboards and reports

      2.3 Define account structure

      2.4 Document tagging requirements

      Outputs

      Architectural patterns; service cost cheat sheet

      Dashboards and reports

      Account structure

      Tagging scheme

      3 Define Processes and Procedures

      The Purpose

      Develop processes, procedures, and policies to control cloud costs.

      Key Benefits Achieved

      Improved capability of reducing costs.

      Documented processes and procedures for continuous improvement.

      Activities

      3.1 Establish governance for tagging

      3.2 Establish governance for costs

      3.3 Define right-sizing process

      3.4 Define purchasing process

      3.5 Define notification and alerts

      Outputs

      Tagging policy

      Cost control policy

      Right-sizing process

      Commitment purchasing process

      Notifications and Alerts

      4 Build Implementation Plan

      The Purpose

      Document next steps to implement and improve cloud cost management program.

      Key Benefits Achieved

      Concrete roadmap to stand up and/or improve the cloud cost management program.

      Activities

      4.1 Document process interaction changes

      4.2 Define cloud cost program KPIs

      4.3 Build implementation roadmap

      4.4 Build communication plan

      Outputs

      Changes to process interactions

      Cloud cost program KPIs

      Implementation roadmap

      Communication plan

      Master the Art of Stakeholder Management in Small Enterprise Environments

      • Buy Link or Shortcode: {j2store}572|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Stakeholder Management
      • Parent Category Link: /stakeholder-management
      • IT hasn’t taken into account critical stakeholders and their concerns and preferences as they plan projects or operate on daily business.
      • It is difficult to tailor communication and messaging to all of the different personal and professional styles and motivations of stakeholders.
      • Access to stakeholders and getting an accurate understanding of their needs and concerns regarding IT can be difficult to obtain.

      Our Advice

      Critical Insight

      • Small enterprises have an advantage in stakeholder management. Less people and fewer barriers create opportunities for more productive interactions and stronger relationships.
      • The guiding principles for effective stakeholder management are common concepts, but unfortunately not common practice.
      • By stepping back and taking the time to thoughtfully consider the dynamics and needs of important IT stakeholders, you will be better able to position yourself and your department.

      Impact and Result

      • Info-Tech’s guiding principles provide clear and feasible recommendations for how to incorporate stakeholder management into daily interactions.
      • This blueprint’s guidance will enable IT leaders to tailor communication and interactions that will enable them to build stronger and more meaningful relationships with stakeholders.
      • Following this approach and its guiding principles will make IT projects be more successful by reducing their risk of failure due to issues of buy-in, misunderstanding of priorities, or a lack of support from critical stakeholders.

      Master the Art of Stakeholder Management in Small Enterprise Environments Research & Tools

      Executive Overview

      Use Info-Tech’s approach to stakeholder management to guide you in building stronger and more beneficial relationships, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Master the Art of Stakeholder Management in Small Enterprise Environments Storyboard
      • None
      • None

      1. Identify stakeholders

      Determine the stakeholders for an IT department of a singular initiative.

      • Stakeholder Management Analysis Tool

      2. Analyze stakeholders

      Use the guidance of this section to analyze stakeholders on both a professional and personal level.

      3. Manage stakeholders

      Use Info-Tech’s guiding principles of stakeholder management to direct how to best engage key stakeholders.

      4. Review case studies

      Use real-life experiences from Info-Tech’s analysts to understand how to use and apply stakeholder management techniques.

      [infographic]

      Build a Winning Business Process Automation Playbook

      • Buy Link or Shortcode: {j2store}407|cart{/j2store}
      • member rating overall impact: 8.3/10 Overall Impact
      • member rating average dollars saved: $8,065 Average $ Saved
      • member rating average days saved: 7 Average Days Saved
      • Parent Category Name: Business Analysis
      • Parent Category Link: /business-analysis
      • Organizations often have many business processes that rely on manual, routine, and repetitive data collection and processing work. These processes need to be automated to meet strategic priorities.
      • Your stakeholders may have decided to invest in process automation solutions. They may be ready to begin the planning and delivery of their first automated processes.
      • However, if your processes are costly, slow, defective, and do not generate the value end users want, automation will only magnify these inefficiencies.

      Our Advice

      Critical Insight

      • Put the user front and center. Aim to better understand the end user and their operational environment. Use cases, data models, and quality factors allow you to visualize the human-computer interactions from an end-user perspective and initiate a discussion on how technology and process improvements can be better positioned to help your end users.
      • Build for the future. Automation sets the technology foundations and process governance and management building blocks in your organization. Expect that more automation will be done using earlier investments.
      • Manage automations as part of your application portfolio. Automations are add-ons to your application portfolio. Unmanaged automations, like applications, will sprawl and reduce in value over time. A collaborative rationalization practice pinpoints where automation is required and identifies which business inefficiencies should be automated next.

      Impact and Result

      • Clarify the problem being solved. Gain a grounded understanding of your stakeholders’ drivers for business process automation. Discuss current business operations and systems to identify automation candidates.
      • Optimate your processes. Apply good practices to first optimize (opti-) and then automate (-mate) key business processes. Take a user-centric perspective to understand how users interact with technology to complete their tasks.
      • Deliver minimum viable automations (MVAs). Maximize the learning of automation solutions and business operational changes through small, strategic automation use cases. This sets the foundations for a broader automation practice.

      Build a Winning Business Process Automation Playbook Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Business Process Automation Deck – A step-by-step document that walks you through how to optimize and automate your business processes.

      This blueprint helps you develop a repeatable approach to understand your process challenges and to optimize and automate strategic business processes.

      • Build a Winning Business Process Automation Playbook – Phases 1-3

      2. Business Process Automation Playbook – A repeatable set of practices to assess, optimize, and automate your business processes.

      This playbook template gives your teams a step-by-step guide to build a repeatable and standardized framework to optimize and automate your processes.

      • Business Process Automation Playbook

      3. Process Interview Template – A structured approach to interviewing stakeholders about their business processes.

      Info-Tech's Process Interview Template provides a number of sections that you can populate to help facilitate and document your stakeholder interviews.

      • Process Interview Template

      4. Process Mapping Guide – A guide to mapping business processes using BPMN standards.

      Info-Tech's Process Mapping Guide provides a thorough framework for process mapping, including the purpose and benefits, the best practices for facilitation, step-by-step process mapping instructions, and process mapping naming conventions.

      • Process Mapping Guide

      Infographic

      Workshop: Build a Winning Business Process Automation Playbook

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Automation Opportunities

      The Purpose

      Understand the goals and visions of business process automation.

      Develop your guiding principles.

      Build a backlog of automation opportunities

      Key Benefits Achieved

      Business process automation vision, expectations, and objectives.

      High-priority automation opportunities identified to focus on.

      Activities

      1.1 State your objectives and metrics.

      1.2 Build your backlog.

      Outputs

      Business process automation vision and objectives

      Business process automation guiding principles

      Process automation opportunity backlog

      2 Define Your MVAs

      The Purpose

      Assess and optimize high-strategic-importance business process automation use cases from the end user’s perspective.

      Shortlist your automation solutions.

      Build and plan to deliver minimum viable automations (MVAs).

      Key Benefits Achieved

      Repeatable framework to assess and optimize your business process.

      Selection of the possible solutions that best fit the business process use case.

      Maximized learning with a low-risk minimum viable automation.

      Activities

      2.1 Optimize your processes.

      2.2 Automate your processes.

      2.3 Define and roadmap your MVAs.

      Outputs

      Assessed and optimized business processes with a repeatable framework

      Fit assessment of use cases to automation solutions

      MVA definition and roadmap

      3 Deliver Your MVAs

      The Purpose

      Modernize your SDLC to support business process automation delivery.

      Key Benefits Achieved

      An SDLC that best supports the nuances and complexities of business process automation delivery.

      Activities

      3.1 Deliver your MVAs

      Outputs

      Refined and enhanced SDLC

      Evolve Your Business Through Innovation

      • Buy Link or Shortcode: {j2store}330|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation
      • Innovation teams are tasked with the responsibility of ensuring that their organizations are in the best position to succeed while the world is in a period of turmoil, chaos, and uncertainty.
      • CIOs have been expected to help the organization transition to remote work and collaboration instantaneously.
      • CEOs are under pressure to redesign, and in some cases reinvent, their business model to cope with and compete in a new normal.

      Our Advice

      Critical Insight

      It is easy to get swept up during a crisis and cling to past notions of normal. Unfortunately, there is no controlling the fact that things have changed fundamentally, and it is now incumbent upon you to help your organization adapt and evolve. Treat this as an opportunity because that is precisely what this is.

      Impact and Result

      There are some lessons we can learn from innovators who have succeeded through past crises and from those who are succeeding now.

      There are a number of tactics an innovation team can employ to help their business evolve during this time:

      1. Double down on digital transformation (DX)
      2. Establish a foresight capability
      3. Become a platform for good

      Evolve Your Business Through Innovation Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Evolve your business through innovation

      Download our guide to learn what you can do to evolve your business and innovate your way through uncertainty.

      • Evolve Your Business Through Innovation Storyboard
      [infographic]

      Drive Business Value With Off-the-Shelf AI

      • Buy Link or Shortcode: {j2store}205|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Business Intelligence Strategy
      • Parent Category Link: /business-intelligence-strategy
      • Understanding the impact of the machine learning/AI component that is built into most of the enterprise products and tools and its role in the implementation of the solution.
      • Understanding the most important aspects that the organization needs to consider while planning the implementation of the AI-powered product.

      Our Advice

      Critical Insight

      • Organizations are faced with multiple challenges trying to adopt AI solutions. Challenges include data issues, ethics and compliance considerations, business process challenges, and misaligned leadership goals.
      • When choosing the right product to meet business needs, organizations need to know what questions to ask vendors to ensure they fully understand the implications of buying an AI/ML product.
      • To guarantee the success of your off-the-shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.

      Impact and Result

      To guarantee success of the off-the-shelf AI implementation and deliver value, in addition to formulating a clear definition of the business case and understanding of data, organizations should also:

      • Know what questions to ask vendors while evaluating AI-powered products.
      • Measure the impact of the project on business and IT processes.

      Drive Business Value With Off-the-Shelf AI Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Drive Business Value With Off-the-Shelf AI Deck – A step-by-step approach that will help guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers business value

      Use this practical and actionable framework that will guide you through the planning of your Off-the-Shelf AI product implementation.

      • Drive Business Value With Off-the-Shelf AI Storyboard

      2. Off-the-Shelf AI Analysis – A tool that will guide the analysis and planning of the implementation

      Use this analysis tool to ensure the success of the implementation.

      • Off-the-Shelf AI Analysis

      Infographic

      Further reading

      Drive Business Value With Off-the-Shelf AI

      A practical guide to ensure return on your Off-the-Shelf AI investment

      Executive Summary

      Your Challenge
      • Understanding the impact of the machine learning/AI component that is built into most of the enterprise products and tools and its role in the implementation of the solution.
      • What are the most important aspects that organizations needs to consider while planning the implementation of the AI-powered product?
      Common Obstacles
      • Organizations are faced with multiple challenges trying to adopt an AI solution. Challenges include data issues, ethics and compliance considerations, business process challenges, and misaligned leadership goals.
      • When choosing the right product to meet business needs, organizations need to know what questions to ask vendors to ensure they fully understand the implications of buying an AI/ML product.
      Info-Tech’s Approach

      Info-Tech’s approach includes a framework that will guide organizations through the process of the Off-the-Shelf AI product selection.

      To guarantee success of the Off-the-Shelf AI implementation and deliver value, organization should start with clear definition of the business case and an understanding of data.

      Other steps include:

      • Knowing what questions to ask vendors to evaluate AI-powered products.
      • Measuring the impact of the project on your business and IT processes.
      • Assessing impact on the organization and ensure team readiness.

      Info-Tech Insight

      To guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Getting value out of AI and machine learning investments

      92.1%

      of companies say they are achieving returns on their data and AI investments

      91.7%

      said they were increasing investments in data and AI

      26.0%

      of companies have AI systems in widespread production
      However, CIO Magazine identified nine main hurdles to AI adoption based on the survey results:
      • Data issues
      • Business process challenges
      • Implementation challenges and skill shortages
      • Costs of tools and development
      • Misaligned leadership goals
      • Measuring and proving business value
      • Legal and regulatory risks
      • Cybersecurity
      • Ethics
      • (Source: CIO, 2019)
      “Data and AI initiatives are becoming well established, investments are paying off, and companies are getting more economic value from AI.” (Source: NewVantage, 2022.)

      67% of companies are currently using machine learning, and 97% are using or planning to use it in the next year.” (Source: Deloitte, 2020)

      AI vs. ML

      Machine learning systems learn from experience and without explicit instructions. They learn patterns from data then analyze and make predictions based on past behavior and the patterns learned.

      Artificial intelligence is a combination of technologies and can include machine learning. AI systems perform tasks mimicking human intelligence such as learning from experience and problem solving. Most importantly, AI is making its own decisions without human intervention.

      The AI system can make assumptions, test these assumptions, and learn from the results.

      (Level of decision making required increases from left to right)
      Statistical Reasoning
      Infer relationships between variables

      Statistical models are designed to find relationships between variables and the significance of those relationships.

      Machine Learning:
      Making accurate predictions

      Machine learning is a subset of AI that discovers patterns from data without being explicitly programmed to do so.

      Artificial Intelligence
      Dynamic adaptation to novelty

      AI systems choose the optimal combination of methods to solve a problem. They make assumptions, reassess the model, and reevaluate the data.

      “Machine learning is the study of computer algorithms that improve automatically through experience.” (Tom Mitchell, 1997)

      “At its simplest form, artificial intelligence is a field, which combines computer science and robust datasets, to enable problem-solving.” (IBM, “What is artificial intelligence?”)

      Types of Off-the-Shelf AI products and solutions

      ML/AI-Powered Products Off-the-Shelf Pre-built and Pre-trained AI/ML Models
      • AI/ML capabilities built into the product and might require training as part of the implementation.
      • Off-the-Shelf ML/AI Models, pre-built, pre-trained, and pre-optimized for a particular task. For example, language models or image recognition models that can be used to speed up and simplify ML/AI systems development.
      Examples of OTS tools/products: Examples of OTS models:

      The data inputs for these models are defined, the developer has to conform to the provided schema, and the data outputs are usually fixed due to the particular task the OTS model is built to solve.

      Insight summary

      Overarching insight:

      To guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.

      Business Goals

      Question the value that AI adds to the tool you are evaluating. Don’t go after the tool simply because it has an AI label attached to it. AI/ML capabilities might add little value but increase implementation complexity. Define the problem you are solving and document business requirements for the tool or a model.

      Data

      Know your data. Determine data requirements to:

      • Train the model during the implementation and development.
      • Run the model in production.

      People/Skills

      Define the skills required for the implementation and assemble the team that will support the project from requirements to deployment and support, through its entire lifecycle. Don’t forget about production support and maintenance.

      Choosing an AI-Powered Tool

      No need to reinvent the wheel and build a product you can buy, but be prepared to work around tool limitations, and make sure you understand the data and the model the tool is built on.

      Choosing an AI/ML Model

      Using Off-the-Shelf-AI models enables an agile approach to system development. Faster POC and validation of ideas and approaches, but the model might not be customizable for your requirements.

      Guaranteeing Off-the-Shelf AI Implementation Success

      Info-Tech Insight

      To guarantee the success of your Off-the-Shelf AI implementation and ensure it delivers value, you must start with a clear definition of the business case and an understanding of your data.

      Why do you need AI in your toolset?
      Business Goals

      Clearly defined problem statement and business requirements for the tool or a model will help you select the right solution that will deliver business value even if it does not have all the latest bells and whistles.

      Small chevron pointing right.
      Do you know the data required for implementation?
      Data

      Expected business outcome defines data requirements for implementation. Do you have the right data required to train and run the model?

      Large chevron pointing right.
      Is your organization ready for AI?
      People/Team/ Skills

      New skills and expertise are required through all phases of the implementation: design, build, deployment, support, and maintenance, as well as post-production support, scaling, and adoption.

      Data Architecture/ Infrastructure

      New tool or model will impact your cloud and integration strategy. It will have to integrate with the existing infrastructure, in the cloud or on prem.

      Large chevron pointing right.
      What questions do you need to ask when choosing the solution?
      Product/ Tool or Model Selection

      Do you know what model powers the AI tool? What data was used to train the tool and what data is required to run it? Ask the right questions.

      Small chevron pointing right.
      Are you measuring impact on your processes?
      Business and IT Processes

      Business processes need to be defined or updated to incorporate the output of the tool back into the business processes to deliver value.

      IT governance and support processes need to accommodate the new AI-powered tool.

      Small chevron pointing right.
      Realize and measure business value of your AI investment
      Value

      Do you have a clear understanding of the value that AI will bring to your organization?Optimization?Increased revenue?Operational efficiency?

      Introduction of Off-the-Shelf AI Requires a Strategic Approach

      Business Goals and Value Data People/Team/ Skills Infrastructure Business and IT Processes
      AI/ML–powered tools
      • Define a business problem that can be solved with either an AI-powered tool or an AI/ML pre-built model that will become part of the solution.
      • Define expectations and assumptions around the value that AI can bring.
      • Document business requirements for the tool or model.
      • Define the scope for a prototype or POC.
      • Define data requirements.
      • Define data required for implementation.
      • Determine if the required data can be acquired or captured/generated.
      • Document internal and external sources of data.
      • Validate data quality (define requirements and criteria for data quality).
      • Define where and how the data is stored and will be stored. Does it have to be moved or consolidated?
      • Define all stakeholders involved in the implementation and support.
      • Define skills and expertise required through all phases of the implementation: design, build, deployment, support, and maintenance.
      • Define skills and expertise required to grow AI practice and achieve the next level of adoption, scaling, and development of the tool or model POC.
      • Define infrastructure requirements for either Cloud, Software-as-a-Service, or on-prem deployment of a tool or model.
      • Define how the tool is integrated with existing systems and into existing infrastructure.
      • Determine the cost to deploy and run the tool/model.
      • Define processes that need to be updated to accommodate new functionality.
      • Define how the outcome of the tool or a model (e.g. predictions) are incorporated back into the business processes.
      • Define new business and IT processes that need to be defined around the tool (e.g. chatbot maintenance; analysis of the data generated by the tool).
      Off-the-shelf AI/ML pre-built models
      • Define the business metrics and KPIs to measure success of the implementation against.
      • Determine if there are requirements for a specific data format required for the tool or a model.
      • Determine if there is a need to classify/label the data (supervised learning).
      • Define privacy and security requirements.
      • Define requirements for employee training. This can be vendor training for a tool or platform training in the case of a pre-built model or service.
      • Define if ML/AI expertise is required.
      • Is the organization ready for ML/AI? Conduct an AI literacy survey and understand team’s concerns, fears, and misconceptions and address them.
      • Define requirements for:
        • Data migration.
        • Security.
        • AI/ML pipeline deployment and maintenance.
      • Define requirements for operation and maintenance of the tool or model.
      • Confirm infrastructure readiness.
      • How AI and its output will be used across the organization.

      Define Business Goals and Objectives

      Why do you need AI in your toolset? What value will AI deliver? Have a clear understanding of business benefits and the value AI delivers through the tool.

      • Define a business problem that can be solved with either an AI-powered tool or AI/ML pre-built model.
      • Define expectations and assumptions around the value that AI can bring.
      • Document business requirements for a tool or model.
      • Start with the POC or a prototype to test assumptions, architecture, and components of the solution.
      • Define business metrics and KPIs to measure success of the implementation.

      Info-Tech Insight

      Question the value that AI adds to the tool you are evaluating. Don’t go after the tool simply because it has an AI label attached to it. AI/ML capabilities might add little value but increase implementation complexity. Define the problem you are solving and document business requirements for the tool or a model.

      Venn diagram of 'Applied Artificial Intelligence (AAI)' with a larger circle at the top, 'Machine Learning (ML)', and three smaller ovals intersecting, 'Computer Vision', 'Natural Language Processing (NLP)', and 'Robotic Process Automation (RPA)'.

      AAI solutions and technologies are helping organizations make faster decisions and predict future outcomes such as:

      • Business process automation
      • Intelligent integration
      • Intelligent insights
      • Operational efficiency improvement
      • Increase revenue
      • Improvement of existing products and services
      • Product and process innovation

      1. Use Info-Tech’s Off-the-Shelf AI Analysis Tool to define business drivers and document business requirements

      2-3 hours
      Screenshot of the Off-the-Shelf AI Analysis Tool's Business Drivers tab, a table with columns 'AI/ML Tool or Model', 'Use Case', 'Business problem / goal for AI/ML use case', 'Description', 'Business Owner (Primary Stakeholder)', 'Priority', 'Stakeholder Groups Impacted', 'Requirements Defined? Yes/No', 'Related Data Domains', and 'KPIs'. Use the Business Drivers tab to document:
      • Business objectives of the initiative that might drive the AI/ML use case.
      • The business owner or primary stakeholder who will help to define business value and requirements.
      • All stakeholders who will be involved or impacted.
      • KPIs that will be used to assess the success of the POC.
      • Data required for the implementation.
      • Use the Business Requirements tab to document high-level requirements for a tool or model.
      • These requirements will be used while defining criteria for a tool selection and to validate if the tool or model meets your business goals.
      • You can use either traditional BRD format or a user story to document requirements.
      Screenshot of the Off-the-Shelf AI Analysis Tool's Business Requirements tab, a table with columns 'Requirement ID', 'Requirement Description / user story', 'Requirement Category', 'Stakeholder / User Role', 'Requirement Priority', and 'Complexity (point estimates)'.

      Download the Off-the-Shelf AI Analysis Tool

      1. Define business drivers and document business requirements

      Input

      • Strategic plan of the organization
      • Data strategy that defines target data capabilities required to support enterprise strategic goals
      • Roadmap of business and data initiatives to support target state of data capabilities

      Output

      • Prioritized list of business use cases where an AI-powered tool or AI/ML can deliver business value
      • List of high-level requirements for the selected use case

      Materials

      • Whiteboard/Flip Charts
      • Off-the-Shelf-AI Analysis Tool, “Business Drivers” and “Business Requirements” tabs

      Participants

      • CIO
      • Senior business and IT stakeholders
      • Data owner(s)
      • Data steward(s)
      • Enterprise Architect
      • Data Architect
      • Data scientist/Data analyst

      Understand data required for implementation

      Do you have the right data to implement and run the AI-powered tool or AI/ML model?

      Info-Tech Insight

      Know your data. Determine data requirements to:

      • Train the model during the implementation and development, and
      • Run the model in production
      AvailabilityArrow pointing rightQualityArrow pointing rightPreparationArrow pointing rightBias, Privacy, SecurityArrow pointing rightData Architecture
      • Define what data is required for implementation, e.g. customer data, financial data, product sentiment.
      • If the data is not available, can it be acquired, gathered, or generated?
      • Define the volume of data required for implementation and production.
      • If the model has to be trained, do you have the data required for training (e.g. dictionary of terms)? Can it be created, gathered, or acquired?
      • Document internal and external sources of data.
      • Evaluate data quality for all data sources based on the requirements and criteria defined in the previous step.
      • For datasets with data quality issues, determine if the data issues can be resolved (e.g. missing values are inferred). If not, can this issue be resolved by using other data sources?
      • Engage a Data Governance organization to address any data quality concerns.
      • Determine if there are requirements for a specific data format required for the tool or model.
      • Determine if there is a need to classify/label or tag the data. What are the metadata requirements?
      • Define whether or not the implementation team needs to aggregate or transform the data before it can be used.
      • Define privacy requirements, as these might affect the availability of the data for ML/AI.
      • Define data bias concerns and considerations. Do you have datasheets for datasets that will be used in this project? What datasets cannot be used to prevent bias?
      • What are the security requirements and how will they affect data storage, product selection, and infrastructure requirements for the tool and overall solution?
      • Define where and how the data is currently stored and will be stored.
      • Does it have to be migrated or consolidated? Does it have to be moved to the cloud or between systems?
      • Is a data lake or data warehouse a requirement for this implementation as defined by the solution architecture?

      2. Use Info-Tech’s Off-the-Shelf AI Analysis Tool to document data requirements

      2-3 hours

      Use the Data tab to document the following for each data source or dataset:
      • Data Domain – e.g. Customer data
      • Data Concept – e.g. Customer
      • Data Internally Accessible – Identify datasets that are required for the implementation even if the data might not be available internally. Work on determining if the data ca be acquired externally or collected internally.
      • Source System – define the primary source system for the data, e.g. Salesforce
      • Target System (if applicable) – Define if the data needs to be migrated/transferred. For example, you might use a datalake or data warehouse for the AI/ML solution or migrate data to the cloud.
      • Classification/Taxonomy/Ontology
      • Data Steward
      • Data Owner
      • Data Quality – Data quality indicator
      • Refresh Rate – Frequency of data refresh. Indicate if the data can be accessed in real time or near-real time

      Screenshot of the Off-the-Shelf AI Analysis Tool's Data tab, a spreadsheet table with the columns listed to the left and below.
      • Retention – Retention policy requirements
      • Compliance Requirements – Define if data has to comply with any of the regulatory requirements, e.g. GDPR
      • Privacy, Bias, and Ethics Considerations – Privacy Act, PIPEDA, etc. Identify if the dataset contains sensitive information that should be excluded from the model, such as gender, age, race etc. Indicate fairness metrics, if applicable.

      Download the Off-the-Shelf AI Analysis Tool

      2. Document data requirements

      Input

      • Documented business use cases from Step 1.
      • High-level business requirements from Step 1.
      • Data catalog, data dictionaries, business glossary
      • Data flows and data architecture

      Output

      • High-level data requirements
      • List of data sources and datasets that can be used for the implementation
      • Datasets that need to be collected or acquired externally

      Materials

      • Whiteboard/Flip Charts
      • Off-the-Shelf AI Analysis Tool, “Data” tab

      Participants

      • CIO
      • Business and IT stakeholders
      • Data owner(s)
      • Data steward(s)
      • Enterprise Architect
      • Data Architect
      • Data scientist/Data analyst

      Is Your Organization Ready for AI?

      Assess organizational readiness and define stakeholders impacted by the implementation. Build the team with the right skillset to drive the solution.

      • Implementation of the AI/ML-powered Off-the-Shelf Tool or an AI/ML model will require a team with a combination of skills through all phases of the project, from design of the solution to build, production, deployment, and support.
      • Document the skillsets required and determine the skills gap. Before you start hiring, depending on the role, you might find talent within the organization to join the implementation team with little to no training.
      • AI/ML resources that may be needed on your team driving AI implementation (you might consider bringing part-time resources to fill the gaps or use vendor developers) are:
        • Data Scientist
        • Machine Learning Engineer
        • Data Engineer
        • Data Architect
        • AI/ML Ops engineer
      • Define training requirements. Consider vendor training for a tool or platform.
      • Plan for future scaling and the growing of the solution and AI practice. Assess the need to apply AI in other business areas. Work with the team to analyze use cases and prioritize AI initiatives. As the practice grows, grow your team expertise.
      • Identify the stakeholders who will be affected by the AI implementation.
      • Work with them to understand and address any concerns, fears, or misconceptions around the role of AI and the consequences of bringing AI into the organization.
      • Develop a communication and change management plan to educate everyone within the organization on the application and benefits of using AI and machine learning.

      Info-Tech Insight:

      Define the skills required for the implementation and assemble the team that will support the project through its entire lifecycle. Don’t forget about production, support, and maintenance.

      3. Build your implementation team

      1-2 hours

      Input: Solution conceptual design, Current resource availability

      Output: Roles required for the implementation of the solution, Resources gap analysis, Training and hiring plan

      Materials: Whiteboard/Flip charts, Off-the-Shelf AI Analysis Tool, “People and Team” tab

      Participants: Project lead, HR, Enterprise Architect

      1. Review your solution conceptual design and define implementation team roles.
      2. Document requirements for each role.
      3. Review current org chart and job descriptions and identify skillset gaps. Draft an action plan to fill in the roles.
      4. Use Info-Tech’s Off-the-Shelf AI Analysis Tool's People and Team tab to document team roles for the entire implementation, including design, build/implement, deployment, support and maintenance, and future development.

      Screenshot of the Off-the-Shelf AI Analysis Tool's People and Team tab, a table with columns 'Design', 'Implement', 'Deployment', 'Support and Maintenance', and 'Future Development'.

      Download the Off-the-Shelf AI Analysis Tool

      Cloud, SaaS or On Prem – what are my options and what is the impact?

      Depending on the architecture of the solution, define the impact on the current infrastructure, including system integration, AI/ML pipeline deployment, maintenance, and data storage

      • Data Architecture: use the current data architecture to design the architecture for an AI-powered solution. Assess changes to the data architecture with the introduction of a new tool to make sure it is scalable enough to support the change.
      • Define infrastructure requirements for either Cloud, Software-as-a-Service, or on-prem deployment of a tool or model.
      • Define how the tool will be integrated with existing systems and into existing infrastructure.
      • Define requirements for:
        • Data migration and data storage
        • Security
        • AI/ML pipeline deployment, production monitoring, and maintenance
      • Define requirements for operation and maintenance of the tool or model.
      • Work with your infrastructure architect and vendor to determine the cost of deploying and running the tool/model.
      • Make a decision on the preferred architecture of the system and confirm infrastructure readiness.

      Download the Create an Architecture for AI blueprint

      4. Use Info-Tech’s Off-the-Shelf AI Analysis Tool to document infrastructure decisions

      2-3 hours

      Input: Solution conceptual design

      Output: Infrastructure requirements, Infrastructure readiness assessment

      Materials: Whiteboard/Flip charts, Off-the-Shelf AI Analysis Tool, “Infrastructure” tab

      Participants: Infrastructure Architect, Solution Architect, Enterprise Architect, Data Architect, ML/AI Ops Engineer

      1. Work with Infrastructure, Data, Solution, and Enterprise Architects to define your conceptual solution architecture.
      2. Define integration and storage requirements.
      3. Document security requirements for the solution in general and the data specifically.
      4. Define MLOps requirements and tools required for ML/AI pipeline deployment and production monitoring.
      5. Use Info-Tech’s Off-the-Shelf AI Analysis Tool's Infrastructure tab to document requirements and decisions around Data and Infrastructure Architecture.

      Screenshot of the Off-the-Shelf AI Analysis Tool's Infrastructure tab, a table with columns 'Cloud, SaaS or On-Prem', 'Data Migration Requirements', 'Data Storage Requirements', 'Security Requirements', 'Integrations Required', and 'AI/ML Pipeline Deployment and Maintenance Requirements'.

      Download the Off-the-Shelf AI Analysis Tool

      What questions do you need to ask vendors when choosing the solution?

      Take advantage of Info-Tech’s Rapid Application Selection Framework (RASF) to guide tool selection, but ask vendors the right questions to understand implications of having AI/ML built into the tool or a model

      Data Model Implementation and Integration Deployment Security and Compliance
      • What data (attributes) were used to train the model?
      • Do you have datasheets for the data used?
      • How was data bias mitigated?
      • What are the data labeling/classification requirements for training the model?
      • What data is required for production? E.g. volume; type of data, etc.
      • Were there any open-source libraries used in the model? If yes, how were vulnerabilities and security concerns addressed?
      • What algorithms are implemented in the tool/model?
      • Can model parameters be configured?
      • What is model accuracy?
      • Level of customization required for the implementation to meet our requirements.
      • Does the model require training? If yes, can you provide details? Can you estimate the effort required?
      • Integration capabilities and requirements.
      • Data migration requirements for tool operation and development.
      • Administrator console – is this functionality available?
      • Implementation timeframe.
      • Is the model or tool deployable on premises or in the cloud? Do you support hybrid cloud and multi-cloud deployment?
      • What cloud platforms are your product/model integrated with (AWS, Azure, GCP)?
      • What are the infrastructure requirements?
      • Is the model containerized/ scalable?
      • What product support and product updates are available?
      • Regulatory compliance (GDPR, PIPEDA, HIPAA, PCI DSS, CCPA, SOX, etc.)?
      • How are data security risks addressed?

      Use Info-Tech’s Off-the-Shelf AI Analysis Tool, “Vendor Questionnaire” tab to track vendor responses to these questions.

      Are you measuring impact on your processes?

      Make sure that you understand the impact of the new technology on the existing business and IT processes.

      And make sure your business processes are ready to take advantage of the benefits and new capabilities enabled by AI/ML.

      Process automation, optimization, and improvement enabled by the technology and AI/ML-powered tools allow organizations to reduce manual work, streamline existing business processes, improve customer satisfaction, and get critical insights to assist decision making.

      To take full advantage of the benefits and new capabilities enabled by the technology, make sure that business and IT processes reflect these changes:

      • Processes that need to be updated.
      • How the outcome of the tool or a model (e.g. predictions) is incorporated into the existing business processes and the processes that will monitor the accuracy of the outcome and monitor performance of the tool or model.
      • New business and IT processes that need to be defined for the tool (e.g. chatbot maintenance, analysis of the data generated by the tool, etc.).

      5. Document the Impact on Business and IT Processes

      2-3 hours

      Input: Solution design, Existing business and IT processes

      Output: Documented updates to the existing processes, Documented new business and IT processes

      Materials: Whiteboard/Flip charts, Off-the-Shelf AI Analysis Tool, “Business and IT Processes” tab

      Participants: Project lead, Business stakeholders, Business analyst

      1. Review current business processes affected by the implementation of the AI/ML- powered tool or model. Define the changes that need to be made. The changes might include simplification of the process due to automation of some of the steps. Some processes will need to be redesigned and some processes might become obsolete.
      2. Document high-level steps for any new processes that need to be defined around the AI/ML-powered tool. An example of such a process would be defining new IT and business processes to support a new chatbot.
      3. Use Info-Tech’s Off-the-Shelf AI Analysis Tool's Business and IT Processes tab, to document process changes.

      Screenshot of the Off-the-Shelf AI Analysis Tool's Business and IT Processes tab, a table with columns 'Existing business process affected', 'New business process', 'Stakeholders involved', 'Changes to be made', and 'New Process High-Level Steps'.

      Download the Off-the-Shelf AI Analysis Tool

      AI-powered Tools – Considerations

      PROS:
      • Enhanced functionality, allows the power of AI without specialized skills (e.g., Mathematica – recognizing patterns in data).
      • Might be a cheaper option compared to building a solution in-house (chatbot, for ex.).

      Info-Tech Insight:

      No need to reinvent the wheel and build the product you can buy, but be prepared to work around tool limitations, and make sure you understand the data and the model the tool is built on.

      CONS:
      • Dependency on the service provider.
      • The tool might not meet all the business requirements without customization.
      • Bias can be built into the tool:
        • Work with the vendor to understand what data was used to train the model.
        • From the perspective of ethics and bias, learn what model is implemented in the tool and what data attributes the model uses.

      Pre-built/pre-trained models – what to keep in mind when choosing

      PROS:
      • Lower cost and less time to development compared to creating and training models from scratch (e.g. using image recognition models or pre-trained language models like BERT).
      • If the pre-trained and optimized model perfectly fits your needs, the model accuracy might be high and sufficient for your scenario.
      • Off-the-Shelf AI models are useful for creating prototypes or POCs, for testing a hypothesis, and for validating ideas and requirements.
      • Usage of Off-the-Shelf models shortens the development cycle and reduces investment risks.
      • Language models are particularly useful if you don’t have data to train your own model (a “small data” scenario).
      • Infrastructure and model training cost reduction.
      CONS:
      • Might be a challenge to deploy and maintain the system in production.
      • Lack of flexibility: you might not be able to configure input or output parameters to your requirements. For example, a pre-built sentiment analysis model might return four values (“positive,” “negative,” “neutral,” and “mixed”), but your solution will require only two or three values.
      • Might be a challenge to comply with security and privacy requirements.
      • Compliance with privacy and fairness requirements and considerations: what data was used to pretrain the model?
      • If open-source libraries were used to create the model, how will vulnerabilities, risks, and security concerns be addressed?

      Info-Tech Insight:

      Using Off-the-Shelf AI models enables an agile approach to system development – faster POC and validation of ideas and approaches, but the model might not be customizable for your requirements.

      Metrics

      Metrics and KPIs for this project will depend on the business goals and objectives that you will identify in Step 1 of the tool selection process.

      Metrics might include:

      • Reduction of time spent on a specific business process. If the tool is used to automate certain steps of a business process, this metric will measure how much time was saved, in minutes/hours, compared to the process time before the introduction of the tool.
      • Accuracy of prediction. This metric would measure the accuracy of estimations or predictions compared to the same estimations done before the implementation of the tool. It can be measured by generating the same prediction or estimation using the AI-powered tool or using any methods used before the introduction of the tool and comparing the results.
      • Accuracy of the search results. If the AI-powered tool is a search engine, compare a) how much time it would take a user to find an article or a piece of content they were searching for using new tool vs. previous techniques, b) how many steps it took the user to locate the required article in the search results, and c) the location of the correct piece of content in the search result list (at the top of the search result list or on the tenth page).
      • Time spent on manual tasks and activities. This metric will measure how much time, in minutes/hours, is spent by the employees or users on manual tasks if the tool automates some of these tasks.
      • Reduction of business process steps (if the steps are being automated). To derive this metric, create a map of the business process before the introduction of the AI-powered tool and after, and determine if the tool helped to simplify the process by reducing the number of process steps.

      Bibliography

      Adryan, Boris. “Is it all machine learning?” Badryan, Oct. 20, 2015. Accessed Feb. 2022.

      “AI-Powered Data Management Platform.” Informatica, N.d. Accessed Feb 2022.

      Amazon Rekognition. “Automate your image and video analysis with machine learning.” AWS. N.d. Accessed Feb 2022.

      “Artificial Intelligence (AI).” IBM Cloud Education, 3 June 2020. Accessed Feb 2022.

      “Artificial intelligence (AI) vs machine learning (ML).” Microsoft Azure Documentation. Accessed Feb. 2022.

      “Avante Garde in the Realm of AI” SearchUnify Cognitive Platform. Accessed Feb 2022.

      “Azure Cognitive Services.” Microsoft. N.d. Accessed Feb 2022.

      “Becoming an AI-fueled organization. State of AI in the enterprise, 4th edition,” Deloitte, 2020. Accessed Feb. 2022.

      “Coveo Predictive Search.” Coveo, N.d. Accessed Feb 2022.

      ”Data and AI Leadership. Executive Survey 2022. Executive Summary of Findings.” NewVantage Partners. Accessed Feb 2022.

      “Einstein Discovery in Tableau.” Tableau, N.d. Accessed Feb 2022.

      Korolov, Maria. “9 biggest hurdles to AI adoption.” CIO, Feb 26, 2019. Accessed Feb 2022.

      Meel, Vidushi. “What Is Deep Learning? An Easy to Understand Guide.” visio.ai. Accessed Feb. 2022.

      Mitchell, Tom. “Machine Learning,” McGraw Hill, 1997.

      Stewart, Matthew. “The Actual Difference Between Statistics and Machine Learning.” Towards Data Science, Mar 24, 2019. Accessed Feb 2022.

      “Sentiment analysis with Cognitive Services.” Microsoft Azure Documentation. Accessed February 2022.

      “Three Principles for Designing ML-Powered Products.” Spotify Blog. Oct 2019, Accessed Feb 2022.

      “Video Intelligence API.” Google Cloud Platform. N.d. Accessed Feb 2022

      Achieve IT Spend & Staffing Transparency

      • IT spend has increased in volume and complexity, but how IT spend decisions are made has not kept pace.
      • In most organizations, technology has evolved faster than the business’ understanding of what it is, how it works, and what it can do for them.
      • How traditional financial accounting methods are applied to IT expenditure don’t align well to modern IT realities.
      • IT is often directed to make cuts when cost optimization and targeted investment are what’s really needed to sustain and grow the organization in the long term.

      Our Advice

      Critical Insight

      • Meaningful conversations about IT spend don’t happen nearly as frequently as they should. When they do happen, they are often inhibited by a lack of IT financial management (ITFM) maturity combined with the absence of a shared vocabulary between IT, the CFO, and other business function leaders.
      • Supporting data about actual technology spend taking place that would inform decision making is often scattered and incomplete.
      • Creating transparency in your IT financial data is essential to powering collaborative and informed technology spend decisions.

      Impact and Result

      • Understand the uses and benefits of making your IT spend more transparent.
      • Discover and organize your IT financial data.
      • Map your organization’s total technology spend against four IT stakeholder views: CFO, CIO, CXO, and CEO.
      • Gain vocabulary and facts that will help you tell the true story of IT spend.

      Members may also be interested in Info-Tech's IT Spend & Staffing Benchmarking Service.

      Achieve IT Spend & Staffing Transparency Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Achieve IT Spend & Staffing Transparency Deck – A detailed, do-it-yourself framework and process for clearly mapping your organization’s total technology spend.

      This deck mirrors Info-Tech’s own internal methods for delivering its IT Spend & Staffing Benchmarking Service in a do-it-yourself format. Based on Info-Tech’s proven ITFM Cost Model, it includes an IT spend mapping readiness assessment, expert advice for sourcing and organizing your financial data, a methodology for mapping IT staff and vendor spend according to four key stakeholder views (CFO, CIO, CXO, and CEO), and guidance on how to analyze and share your results.

      • Achieve IT Spend & Staffing Transparency Storyboard

      2. IT Spend & Staffing Transparency Workbook – A structured Excel tool that allows you to allocate your IT spend across four key stakeholder views and generate high-impact visualizations.

      This workbook offers a step-by-step approach for mapping and visualizing your organization’s true IT spend.

      • IT Spend & Staffing Transparency Workbook

      3. IT Spend & Staffing Transparency Executive Presentation Template – A PowerPoint template that helps you summarize and showcase key results from your IT spend transparency exercise.

      This presentation template offers a recommended structure for introducing key executive stakeholders to your organization’s true IT spending behavior and IT financial management as a whole.

      • IT Spend & Staffing Transparency Executive Presentation Template

      Infographic

      Further reading

      Achieve IT Spend & Staffing Transparency

      Lay a foundation for meaningful conversations with the business.

      Analyst Perspective

      Take the first step in your IT spend journey.

      Talking about money is hard. Talking to the CEO, CFO, and other business leaders about money is even harder, especially if IT is seen as just a cost center, is not understood by stakeholders, or is simply taken for granted. In times of economic hardship, already lean IT operations are tasked with becoming even leaner.

      When there's little fat to trim, making IT spend decisions without understanding the spend's origin, location, extent, and purpose can lead to mistakes that weaken, not strengthen, the organization.

      The first step in optimizing IT spend decisions is setting a baseline. This means having a comprehensive and transparent view of all technology spend, organization-wide. This baseline is the only way to have meaningful, data-driven conversations with stakeholders and approvers around what IT delivers to the business and the implications of making changes to IT funding.

      Before stepping forward in your IT financial management journey, know exactly where you're standing today.

      Jennifer Perrier, Principal Research Director, ITFM Practice

      Jennifer Perrier
      Principal Research Director, ITFM Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge Common Obstacles Info-Tech's Approach
      IT spend has increased in volume and complexity, but how IT spend decisions are made has not kept pace:
      • Technology has evolved faster than the business' understanding of what it is, how it works, and what it can do for them.
      • How traditional financial accounting methods are applied doesn't align well to modern IT realities.
      • IT is directed to make cuts when cost optimization and targeted investment are what's really needed to sustain and grow the organization in the long-term.
      Meaningful conversations about IT spend don't happen nearly as much as they should. This is often due to:
      • A lack of maturity in how ITFM (IT financial management) is executed within IT and across the organization as a whole.
      • The absence of a shared vocabulary between IT, the CFO, and other business function leaders.
      • Scattered and incomplete data about the actual technology spend taking place in the organization.
      Lay a foundation for meaningful conversations and informed decision-making around IT spend.
      • Understand the uses and benefits of making your IT spend more transparent.
      • Discover and organize your IT financial data.
      • Map your organization's total technology spend against four IT stakeholder views: CFO, CIO, CXO, and CEO.
      • Gain both vocabulary and facts that will help you tell the true story of IT spend.

      Info-Tech Insight
      Create transparency in your IT financial data to power both collaborative and informed technology spend decisions.

      IT spend has grown alongside IT complexity

      IT spend has grown alongside IT complexity

      Growth creates change ... and challenges

      IT has become more integral to business operations and achievement of strategic goals, driving complexity in how IT funds are allocated and managed.

      How IT funds are spent has changed
      Value demonstration is two-pronged. The first is return on performance investment, focused on formal and objective goals, metrics, and KPIs. The second is stakeholder satisfaction, a more subjective measure driven by IT-business alignment and relationship. IT leaders must do both well to prove and promote IT's value.
      Funding decision cadence has sped up
      Many organizations have moved from three- to five-year strategic planning cycles to one-year planning horizons or less, most noticeably since the 2008/2009 recession. Not only has the pace of technological change accelerated, but so too has volatility in the broader business and economic environments, forcing rapid response.
      Justification rigor around IT spend has increased
      The need for formal business cases, proposals, and participation in formal governance processes has increased, as has demand for financial transparency. With many IT departments still reporting into the CFO, there's no getting around it - today's IT leaders need to possess financial management savvy.
      Clearly showing business value has become priority
      IT spend has moved from the purchase of discrete hardware and software tools traditionally associated with IT to the need to address larger-scale issues around interoperability, integration, and virtualized cloud solutions. Today's focus is more on big-picture architecture than on day-to-day operations.

      ITFM capabilities haven't grown with IT spend

      IT still needs to prove itself.

      Increased integration with the core business has made it a priority for the head of IT to be well-versed in business language and practice, specifically in the areas of measurement and financial management.

      However, IT staff across all industries aren't very confident in how well IT is doing in managing its finances via three core processes:

      • Accounting of costs and budgets.
      • Optimizing costs to gain the best return on investment.
      • Demonstrating IT's value to the business.

      Recent data from 4,137 respondents to Info-Tech's IT Management & Governance Diagnostic shows that while most IT staff feel that these three financial management processes are important, notably fewer feel that IT management is effective at executing them.

      IT leadership's capabilities around fundamental cost data capture appear to be lagging, not to mention the essential value-added capabilities around optimizing costs and showing how IT contributes to business value.

      Graph of Cost and Budget Management

      Graph of Cost Optimization

      Questions for support transition

      Source: IT Management & Governance Diagnostic, Info-Tech Research Group, 2022.

      Take the perspective of key IT stakeholders as a first step in ITFM capability improvement

      Other business unit leaders need to deliver on their own specific and unique accountabilities. Create true IT spend transparency by accounting for these multiple perspectives.

      Exactly how is IT spending all that money we give them?
      Many IT costs, like back-end infrastructure and apps maintenance, can be invisible to the business.

      Why doesn't my department get more support from IT?
      Some business needs won't align with spend priorities, while others seem to take more than their fair share.

      Does the amount we spend on each IT service make sense?
      IT will get little done or fall short of meeting service level requirements without appropriate funding.

      I know what IT costs us, but what is it really worth?
      Questions about value arise as IT investment and spend increase. How to answer these questions is critical.

      At the end of the day, telling IT's spend story to the business is a significant challenge if you don't understand your audience, have a shared vocabulary, or use a repeatable framework.

      Mapping your IT spend against a reusable framework helps generate transparency

      A framework makes transparency possible by simplifying methods, creating common language, and reducing noise.

      However, the best methodological framework won't work if the materials and information plugged into it are weak. With IT spend, the materials and information are your staff and your vendor financial data. To achieve true transparency, inputs must have the following three characteristics:

      Availability Reliability Usability
      The data and information are up-to-date and accessible when needed. The data and information are accurate, complete, and verifiable. The data and information are clearly defined, consistently and predictably organized, consumable, and meaningful for decision-making.

      A framework is an organizing principle. When it comes to better understanding your IT spend, the things being organized by a framework are your method and your data.

      If your IT spend information is transparent, you have an excellent foundation for having the right conversations with the right people in order to make strategically impactful decisions.

      Info-Tech's approach enables meaningful dialogue with stakeholders about IT spend

      View of meaningful dialogue with stakeholders about IT spend

      Investing time in preparing and mapping your IT spend data enables better IT governance

      While other IT spend transparency methods exist, Info-Tech's is designed to be straightforward and tactical.

      Info-Tech method for IT spend transparency

      Put your data to work instead of being put to work by your data.

      Introducing Info-Tech's methodology for creating transparency on technology spend

      1. Know your objectives 2. Gather required data 3. Map your IT staff spend 4. Map your IT vendor spend 5. Identify implications for IT
      Phase Steps
      1. Review your business context
      2. Set IT staff and vendor spend transparency objectives
      3. Assess effort and readiness
      1. Collect IT staff spend data
      2. Collect IT vendor spend data
      3. Define industry-specific CXO Business View categories
      1. Categorize IT staff spend in each of the four views
      2. Validate
      1. Categorize IT vendor spend in each of the four views
      2. Validate
      1. Analyze your findings
      2. Craft your key messages
      3. Create an executive presentation
      Phase Outcomes Goals and scope for your IT spend and staffing transparency effort. Information and data required to perform the IT staff and vendor spend transparency initiative. A mapping of the allocation of IT staff spend across the four views of the Info-Tech ITFM Cost Model. A mapping of the allocation of IT vendor spend across the four views of the Info-Tech ITFM Cost Model. An analysis of your results and a presentation to aid your communication of findings with stakeholders.

      Insight Summary

      Overarching insight
      Take the perspective of key stakeholders and lay out your organization's complete IT spend footprint in terms they understand to enable meaningful conversations and start evolving your IT financial management capability.

      Phase 1 insight
      Your IT spend transparency efforts are only useful if you actually do something with the outcomes of those efforts. Be clear about where you want your IT transparency journey to take you.

      Phase 2 insight
      Your IT spend transparency efforts are only as good as the quality of your inputs. Take the time to properly source, clean, and organize your data.

      Phase 3 insight
      Map your IT staff spend data first. It involves work but is relatively straightforward. Practice your mapping approach here and carry forward your lessons learned.

      Phase 4 insight
      The importance of good, usable data will become apparent when mapping your IT vendor spend. Apply consistent and meaningful vendor labels to enable true aggregation and insight.

      Phase 5 insight
      Communicating your final IT spend transparency mapping with executive stakeholders is your opportunity to debut IT financial management as not just an IT issue but an organization-wide concern.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals.

      Use this tool in Phases 1-4

      IT Spend & Staffing Transparency Workbook

      Input your IT staff and vendor spend data to generate visual outputs for analysis and presentation in your communications.

      Key deliverable:

      IT Spend & Staffing Transparency Executive Presentation

      Create a showcase for your newly-transparent IT staff and vendor spend data and present it to key business stakeholders.

      Use this tool in Phase 5

      IT and business blueprint benefits

      IT Benefits Business Benefits
      • Gain insight into exactly where you're spending IT funds on hardware, software, service providers, and the workforce.
      • Understand how much it's costing IT to deliver specific IT services.
      • Illustrate differences in business consumption of IT spend.
      • Learn the ratio of spend allocated to innovation vs. growth vs. keeping the lights on (KTLO).
      • Develop a series of core IT spend metrics including IT spend as a percent of revenue, IT spend per organization employee, and IT spend per IT staff member.
      • Create a complete IT spend baseline to serve as a foundation for future benchmarking, cost optimization, and other forms of IT financial analysis.
      • Understand the relative allocation of IT spend across capital vs. operational expenditure.
      • See the degree to which IT differentially supports and enables organizational goals, strategies, and functions.
      • Have better data for informing the organization's IT spend allocation and prioritization decisions.
      • Gain better visibility into real-life IT spending behaviors, cadences, and patterns.
      • Identify potential areas of spend waste as well as underinvestment.
      • Understand the true value that IT brings to the business.

      Measure the value of this blueprint

      You will know that your IT spend and staffing transparency effort is succeeding when:

      • Your understanding of where technology funds are really being allocated is comprehensive.
      • You're having active and meaningful dialogue with key stakeholders about IT spend issues.
      • IT spend transparency is a permanent part of your IT financial management toolkit.

      In phase 1 of this blueprint, we will help you identify initiatives where you can leverage the outcomes of your IT spend and staffing transparency effort.

      In phases 2, 3, and 4, we will guide you through the process of mapping your IT staff and vendor spend data so you can generate your own IT spend metrics based on reliable sources and verifiable facts.

      Win #1: Knowing how to reliably source the financial data you need to make decisions.

      Win #2: Getting your IT spend data in an organized format that you can actually analyze.

      Win #3: Having a framework that puts IT spend in a language stakeholders understand.

      Win #4: Gaining a practical starting point to mature ITFM practices like cost optimization.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit Guided Implementation Workshop Consulting
      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Guided Implementation

      Info-Tech recommends the following calls in your Guided Implementation.

      Phase 1: Know your objectives Phase 2: Gather required data Phase 3: Map your IT staff spend Phase 4: Map your IT vendor spend Phase 5: Identify implications for IT
      Call #1: Discuss your IT spend and staffing transparency objectives and readiness. Call #2: Review spend and staffing data sources and identify data organization and cleanup needs. Call #3: Review your mapped IT staff spend and resolve lingering challenges. Call #4: Review your mapped IT vendor spend and resolve lingering challenges. Call #5: Analyze your mapping outputs for opportunities and devise next steps.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between four to six calls over the course of two to three months.

      Want even more help with your IT spend transparency effort?

      Let us fast-track your IT spend journey.

      The path to IT financial management maturity starts with knowing exactly where your money is going. To streamline this effort, Info-Tech offers an IT Spend & Staffing Benchmarking service that provides full transparency into where your money is going without any heavy lifting on your part.

      This unique service features:

      • A client-proven approach to meet your IT spend transparency goals.
      • Vendor and staff spend mapping that reveals business consumption of IT.
      • Industry benchmarking to compare your spending and staffing to that of your peers.
      • Results in a fraction of the time with much less effort than going it alone.
      • Expert review of results and ongoing discussions with Info-Tech analysts.

      If you'd like Info-Tech to pave the way to IT spend transparency, contact your account manager for more information - we're happy to talk anytime.

      Phase 1

      Know Your Objectives

      This phase will walk you through the following activities:

      • Establish IT spend and staffing transparency uses and objectives
      • Assess your readiness to tackle IT spend and staffing transparency

      This phase involves the following participants:

      • Head of IT
      • IT financial lead
      • Other members of IT management

      Phase 1: Know your objectives

      Envision what transparency can do.

      You're at the very beginning of your IT spend transparency journey. In this phase you will:

      • Set your objectives for making your IT spend and staffing transparent.
      • Assess your readiness to tackle the exercise and gauge how much work you'll need to do in order to do it well.

      "I've heard this a lot lately from clients: 'I've got my hands on this data, but it's not structured in a way that will allow me to make any decisions about it. I have these journal entries and they have some accounting codes, GL descriptors, cost objects, and some vendors, but it's not enough detail to make any decisions about my services, my applications, my asset spend.'"
      - Angie Reynolds, Principal Research Director, ITFM Practice, Info-Tech Research Group

      Transparency positively enables both business outcomes and the practice of business ethics

      However, transparency's real superpower is in how it provides fact-based context.

      • More accurate and relevant data for decision-making.
      • Better managed and more impactful financial outcomes.
      • Increased inclusion of people in the decisions that affect them.
      • Clearer accountabilities for organizational efficiency and effectiveness goals.
      • Concrete proof that business priorities and decisions are being acted on and implemented.
      • Greater trust and respect between IT and the business.
      • Demonstration of integrity in how funds are being used.

      IT spend transparency efforts are only useful if you actually do something with the outputs

      Identify in advance how you plan to leverage IT spend transparency outcomes.

      CFO expense view

      • Demonstrate actual IT costs at the right level of granularity.
      • Update/change the categories finance uses to track IT spend.
      • Adjust the expected CapEx/OpEx ratio.

      CXO business view

      • Calculate consumption of IT resources by department.
      • Implement a showback/chargeback mechanism.
      • Change the funding conversation about proposed IT projects.

      CIO service view

      • Calculate the total cost to deliver a specific IT service.
      • Adjust the IT service spend-to-value ratio as per business priorities.
      • Rightsize IT service levels to reflect true value to the business.

      CEO innovation view

      • Formalize the organization's position on use of cloud/outsourcing.
      • Reduce the portion of spend dedicated to "keeping the lights on."
      • Develop a plan for boosting commitment to innovation investment.

      When determining your end objectives, think about the real questions IT is being asked by the business and how IT spend transparency will help you answer them.

      CFO: Financial accounting perspective

      IT spend used to be looked at from a strictly financial accounting perspective - this is the view of the CFO and the finance department. Their question, "exactly how is IT spending all that money we give them," is really about how money is distributed across different asset classes. This question breaks down into other questions that IT leaders needs to ask themselves in order to provide answers:

      • How should I classify my IT costs? What are the standard categories you need to have that are meaningful to folks crunching the corporate numbers? If you're too detailed, it won't make sense to them. If you pick outmoded categories, you'll have to adjust in the future as IT evolves, which makes tracking year-over-year spend patterns harder.
      • What information should I include in my plans and reports? This is about two things. One is about communicating with the finance department in language that reduces back-and-forth and eliminates misinterpretation. The other is about aligning with the categories the finance department uses to track financial data in the general ledger.
      • How do I justify current spend? This is about clarity and transparency. Specifically itemizing spend into categories that are meaningful for your audience does a lot of justification work for you since you don't have to re-explain what everything means.
      • How do I justify a budget increase? In a declining economy, this question may not be appropriate. However, establishing a baseline puts you in a better position to discuss spend requirements based on past performance and to focus the conversation.

      Exactly how is IT spending all that money we give them?

      Example
      Asset Class % IT Spend
      Workforce 42.72%
      Software - Cloud 9.26%
      Software - On Prem 13.61%
      Hardware - Cloud 0.59%
      Hardware - On Prem 15.68%
      Contract Services 18.14%
      Info-Tech IT Spend & Staffing Studies, 2022.

      CIO: IT operations management perspective

      As the CIO role was adopted, IT spend was viewed from the IT operations management perspective. Optimizing the IT delivery model is a critical step to reducing time to provision services. For the IT leader, the questions they need to ask themselves are:

      • What's the impact of cloud adoption on speed of delivery? Leveraging a SaaS solution can reduce time to deployment as well as increase your ability to scale; however, integration with other functionality will still be a challenge that will incur costs.
      • Where can I improve spend efficiency? This is about optimizing spend in your IT delivery model. What service levels does the business require and what's the most cost-effective way to meet those levels without incurring significant technical debt?
      • Is my support model optimized? By reviewing where support staff are focused and which services are using most of your resources, you can investigate underlying drivers of your staffing requirements. If staff costs in support of a business function are high, perhaps the portfolio of applications needs to be reviewed.
      • How does our spend compare to others? Benchmarking against peers is a useful input, but reflects common practice, not best practice. For example, if you need to invest in IT security, your entire industry is lagging on this front, and you happen to be doing slightly better than most, then bringing forth this benchmark won't help you make the case. Starting with year-over-year internal benchmarking is essential - establish your categories, establish your baseline, and track it consistently.

      Does the amount we spend on each IT service make sense?

      Example
      Service Area % IT Spend
      App Development 9.06%
      App Maintenance 30.36%
      Hosting/Network 25.39%
      End User 18.59%
      Data & BI 3.58%
      Security & Risk 5.21%
      IT Management 7.82%
      Info-Tech IT Spend & Staffing Studies, 2022.

      CXO: Business unit perspective

      As business requests have increased, so too has the importance of the business unit perspective. Each business function has a unique mandate to fulfill in the organization and also competes with other business functions for IT resources. By understanding business consumption of IT, organizations can bring transparency and drive a different dialog with their business partners. Every IT leader should find out the answers to these questions:

      • Which business units consume the most IT resources? By understanding consumption of IT by business function, IT organizations can clearly articulate which business units are getting the highest share of IT resources. This will bring much needed clarity when it comes to IT spend prioritization and investment.
      • Which business units are underserved by IT? By providing full transparency into where all IT spend is consumed, organizations can determine if certain business functions may need increased attention in an upcoming budget cycle. Knowing which levers to pull is critical in aligning IT activities with delivering business value.
      • How do I best communicate spend data internally? Different audiences need information presented to them differently. This is not just about the language - it's also about the frequency, format, and channel you use. Ask your audiences directly what methods of communication stand the best chance of you being seen and heard.
      • Where do I need better business sponsorship for IT projects? If a lot of IT spend is going toward one or two business units, the leaders of those units need to be active sponsors of IT projects and associated spend that will benefit all users.

      Why doesn't my business unit get more support from IT?

      Example
      Business Function % IT Spend
      HR Department 6.16%
      Finance Department 15.15%
      IT Department 10.69%
      Business Function 1 23.80%
      Business Function 2 10.20%
      Business Function 3 6.80%
      Business Function 4 27.20%
      Source: Info-Tech IT Spend & Staffing Studies, 2022.

      CEO: Strategic vs. operations perspective

      With a business view now available, evaluating IT spend from a strategic standpoint is critical. Simply put, how much is being spent keeping the lights on (KTLO) in the organization versus supporting business or organizational growth versus net-new business innovations? This view is not about what IT costs but rather how it is being prioritized to drive revenue, operating margin, or market share. Here are the questions IT leaders should be asking themselves along with the organization's executive leadership and the CEO:

      • Why is KTLO spend so high? This question is a good gauge of where the line is drawn between operations and strategy. Many IT departments want to reduce time spent on maintenance and redeploy resource investment toward strategic projects. This reallocation must include retiring or eliminating technologies to free up funds.
      • What should our operational spend priorities be? Maintenance and basic operations aren't going anywhere. The issue is what is necessary and what could be done more wisely. Are you throwing good money after bad on a high-maintenance legacy system?
      • Which projects and investments should we prioritize? The answer to this question should tightly align with business strategic goals and account for the lion's share of growth and innovation spend.
      • Are we spending enough on innovative initiatives? This is the ultimate dialogue between business partners, the CEO, and IT that needs to take place, yet often doesn't.

      I know what IT costs us, but what is it really worth?

      Example
      Focus Area % IT Spend
      KTLO 89.16%
      Grow 7.18%
      Innovate 3.66%
      Info-Tech IT Spend Studies, 2022.

      Be clear about where you want your IT spend transparency journey to take you in real life

      Transparent IT spend data will allow you to have conversations you couldn't have before. Consider this example of how telling an IT spend story could evolve.

      I want to ...
      Analyze the impact of the cloud on IT operating expenditure to update finance's expectations of a realistic IT CapEx/OpEx ratio now and into the future.

      To address the problem of ...

      • Many of our key software vendors have eliminated on-premises products and only offer software as an OpEx service.
      • Assumptions that modern IT solutions are largely on-premises and can be treated as capitalizable assets are out-of-date and don't reflect IT financial realities.

      And will use transparency to ...

      • Provide the CFO with specific, accurate, and annotated OpEx by product/service and vendor for all cloud-based and on-premises solutions.
      • Facilitate a realistic calculation of CapEx/OpEx distribution based on actuals, as well as let us develop defendable projections of OpEx into the future based on typical annual service fee increases and anticipated growth in the number of users/licenses.

      1.1 Establish ITFM objectives that leverage IT spend transparency

      Duration: One hour

      1. Consider the problems or issues commonly voiced by the business about IT, as well as your own ongoing challenges in communicating with stakeholders. Document these problems/issues as questions or statements as spoken by a person. To help structure your brainstorming, consider these general process domains and examples:
        1. Spend tracking and reporting. E.g. Why is IT's OpEx so high? We need you to increase IT's percentage of CapEx.
        2. Service levels and business continuity. E.g. Why do we need to hire more service desk staff? There are more of them in IT than any other role.
        3. Project and operations resourcing. E.g. Why can't IT just buy this new app we want? It's not very expensive.
        4. Strategy and innovation. E.g. Did output increase or decrease last quarter per input unit? IT should be able to run those reports for us.
      2. For each problem/issue noted, identify:
        1. The source(s) of the question/concern (e.g. CEO, CFO, CXO, CIO).
        2. The financial process involved (e.g. accurate costing, verification of costs, building a business case to invest).
      3. For each problem/issue, identify a broader project-style initiative where having transparent IT spend data is a valuable input. One initiative may apply to multiple problems/issues. For each initiative:
        1. Give it a working title.
        2. State the goal for the initiative with reference to ITFM aspirations.
        3. Identify key stakeholders (these will likely overlap with the problem/issue source).
        4. Set general time frames for resolution.

      Document your outputs on the slide immediately following the instruction slides for this exercise. Examples are included.

      1.1 Establish ITFM objectives that leverage IT spend transparency

      Input Output
      • Organizational knowledge
      • List of the potential uses and objectives of transparent IT spend and staffing data
      Materials Participants
      • Whiteboard/flip charts
      • Head of IT
      • IT financial lead

      ITFM initiatives that leverage transparency

      Problem/Issue Statement Source/ Stakeholder Associated ITFM Process Potential Initiative Initiative Goal Time Frame
      "Why is IT's OpEx so high? We need you to increase IT's percentage of CapEx." CFO IT spend categorization and reporting. Analyze the impact of the cloud on IT operating expenditure. To update finance's expectations of a realistic IT CapEx/OpEx ratio. <12 months
      "Why do we need to hire more service desk staff? There are more of them in IT than any other role." CFO, VP of HR Business case for hiring IT staff. Document ongoing IT support requirements for proposed ERP platform migration project. To ensure sufficient resources for an anticipated increase in service desk tickets due to implementation of a new ERP system. 1-3 months
      "Why can't IT just buy this new app we want? It's not very expensive." CEO, all CXOs/VPs Total cost of technology ownership. Develop a mechanism to review the lifecycle impact on IT of proposed technology purchases. To determine if functionality of new tool already exists in the org. and the total cost of ownership of a new app. <6 months
      "Did output increase or decrease last quarter per input unit? IT should be able to run those reports for us." CEO, CFO, VP of Production IT service costing. Develop an organizational business intelligence strategy. To create a comprehensive plan for evolving BI capability in the organization and transferring report development to users. Select a department for pilot. <12 months

      Your organization's governance culture will affect how you approach transparency

      Know your governance culture Lower Governance
      • Few regulations.
      • Financial reporting is largely internal.
      • Change is frequent and rapid.
      • Informal or nonexistent mechanisms and structures.
      • Data sharing behavior driven by competitive concerns.
      Higher Governance
      • Many regulations.
      • Stringent and regular external reporting requirements.
      • Change is limited and/or slow.
      • Defined and established mechanisms and structures.
      • Data sharing behavior driven by regulatory concerns.
      Determine impact on opportunities How does your governance culture impact IT spend transparency opportunities?
      Resistance to formality and bureaucracy Resistance to change and uncertainty
      Set expectations and approach You have plenty of room to implement transparency rigor within the confines of IT, but getting others to give you the time and attention you want will be a challenge. One-on-one, informal relationship building to create goodwill and dialogue is needed before putting forth recommendations or numbers. Many existing procedures must be accommodated and respected. While you can benefit by working with preexisting mechanisms and touchpoints, expect any changes you want to make to things like IT cost categories or CapEx/OpEx ratios to require a lot of time, meetings, and case-making.

      IT's current maturity around ITFM practice will also affect your approach to transparency

      Know your ITFM maturity level Lower ITFM Maturity
      • No/few formal policies, standards, or procedures exist.
      • There is little/no formal education or experience within IT around budget, costing, charging, or accounting practices.
      • Financial reporting is sporadic and inconsistent in its contents.
      • Business cases are rarely used in decision-making.
      • Financial data is neither reliable nor readily available.
      Higher ITFM Maturity
      • Formal policies, standards, and procedures are enforced organization-wide for all financial management activities.
      • Formally-trained accountants are embedded within IT.
      • Financial reporting is regular, scheduled, and defined.
      • Business cases are leveraged in most decision-making activities.
      • Financial data is governed, centralized, and current.
      Determine stakeholders' financial literacy How does your degree of ITFM maturity impact IT spend transparency opportunities?
      Improve your own financial literacy first Determine stakeholders' financial literacy
      Set expectations and approach Brush up on core financial management and accounting concepts before taking the discussion beyond IT's walls. Do start mapping your costs, but just know how to communicate what the data is saying before sharing it. Not everyone will be at your level, familiar with ITFM language and concepts, or focused on the same things you are. Gauge where your audience is at so you can prepare for meaningful dialogue.

      1.2 Assess your readiness to tackle IT spend transparency

      Duration: One hour

      Note: This assessment is general in nature. It's intended to help you identify and prepare for potential challenges in your IT spend and staffing transparency effort.

      1. Rate your agreement with the "Data & Information" and "Experience, Expertise, & Support" statements listed on the slide immediately following the two instruction slides for this exercise. For each statement, indicate the extent to which you agree or disagree, where:
        1. 1 = Strongly disagree
        2. 2 = Disagree
        3. 3 = Neither agree nor disagree
        4. 4 = Agree
        5. 5 = Strongly agree
      2. Add up your numerical scores for all statements, where the highest possible score is 65.
      3. Assess your general readiness against the following guidelines:
        1. 50-65: Ready. The transparency exercise will involve work, but should be straightforward since you have the data, skills, tools, processes, and support to do it.
        2. 40-49: Ready, with caveats. The transparency exercise is doable but will require some preparatory legwork and investigation on your part around data sourcing, organization, and interpretation.
        3. 30-39: Challenged. The transparency exercise will present some obstacles. Expect to encounter data gaps, inconsistencies, errors, roadblocks, and frustrations that will need to be resolved.
        4. Less than 30: Not ready. You don't have the data, skills, tools, processes, and/or support to do the data transparency exercise. Take time to develop a stronger foundation of financial literacy and governance before tackling it.

      Document your outputs on the slide immediately following the two instruction slides for this exercise.

      1.2 Assess your readiness to tackle IT spend transparency

      InputOutput
      • Organizational knowledge
      • Estimation of IT spend and staffing transparency effort
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT financial lead

      IT spend transparency readiness assessment

      Data & Information
      Statement Rating
      We know how to access all IT department spend records.
      We know how to access all non-IT-department technology spend records.
      We know how to access all IT vendor/contractor agreements.
      We know how to access data about our IT staff costs and allocation, such as organizational charts and salaries/benefits.
      Our financial and staffing data is up-to-date.
      Our financial and staffing data are labeled, described, and organized so that we know what they're referring to.
      Our financial and staffing data are in a format that we can easily manipulate (e.g. export, copy and paste, perform calculations).
      Experience, Expertise, & Support
      Statement Rating
      We have sufficient expertise within the IT department to navigate and accurately interpret financial records.
      We have reasonable access to expertise/resources in our finance department to support us in an IT spend transparency exercise.
      We can allocate sufficient time (about 40 hours) and resources in the near term to do an IT spend transparency exercise.
      We have current accountabilities to track and internally report financial information to others on at least a monthly basis.
      There are existing financial policies, procedures, and standards in the organization with which we must closely adhere and comply.
      We have had the experience of participating in, or responding to the results of, an internal or external audit.

      Rating scale:
      1 = Strongly Disagree; 2 = Disagree; 3 = Neither agree nor disagree; 4 = Agree; 5 = Strongly agree
      Assessment scale:
      Less than 30 = Not ready; 30-39 = Challenged; 40-49 = Ready with caveats; 50-65 = Ready

      Take a closer look at the statements you rated 1, 2, or 3. These will be areas of challenge no matter what your total score on the assessment scale.

      Phase 1: Know your objectives

      Achievement summary

      You've now completed the first two steps on your IT spend transparency journey. You have:

      • Set your objectives for making your IT spend and staffing transparent.
      • Assessed your readiness to tackle the exercise and know how much work you'll need to do in order to do it well.

      "Mapping to a transparency model is labor intensive. You can do it once and never revisit it again, but we would never advise that. What it does is play well into an IT financial management maturity roadmap."
      - Monica Braun, Research Director, ITFM Practice, Info-Tech Research Group

      Phase 2

      Gather Required Data

      This phase will walk you through the following activities:

      • Gather, clean, and organize your data
      • Build your industry-specific business views

      This phase involves the following participants:

      • Head of IT
      • IT financial lead
      • Other members of IT management

      Phase 2: Gather required data

      Finish your preparation.

      You're now ready to do the final preparation for your IT spend and staffing transparency journey. In this phase you will:

      • Gather your IT spend and staffing data and information.
      • Clean and organize your data to streamline mapping.
      • Identify your baseline data points.

      "Some feel like they don't have all the data, so they give up. Don't. Every data point counts."
      - Rex Ding, Research Specialist, ITFM Practice, Info-Tech Research Group

      Your IT spend transparency efforts are only as good as the quality of your inputs

      Aim for a comprehensive, complete, and accurate set of data and information.

      Diagram of comprehensive, complete, and accurate set of data and information

      Start by understanding what's included in technology spend

      Info-Tech's ITFM Technology Inventory

      In scope:

      • All network, telecom, and data center equipment.
      • All end-user productivity software and devices (e.g. laptops, peripheral devices, cell phones).
      • Information security.
      • All acquisition, development, maintenance, and management of business and operations software.
      • All systems used for the storage and management of business assets, data, records, and information.
      • All managed IT services.
      • Third-party consulting services.
      • All identifiable spend from the business for the above.

      Expand your thinking: Total tech spend goes beyond what's under IT's operational umbrella

      "Technology" means all technology in the organization regardless of where it lives, who bought it, who owns it, who runs it, or who uses it.

      IT may have low or no visibility into technologies that exist in the broader business environment beyond IT. Accept that you won't gain 100% visibility right now. However, do get started and be persistent.

      Where to look for non-IT technology ...

      • Highly specialized business functions - niche tools that are probably used by only a few people.
      • Power users and the "underserved" - cloud-based workflow, communication, and productivity tools they got on their own.
      • Operational technology - network-connected industrial, building, or physical security sensors and control systems.
      • Recently acquired/merged entities - inherited software.

      Who might get you what you need ...

      • Business unit and team leaders - identification of what they use and copies of their spend records and/or contracts.
      • Finance - a report of the "software" expenditure category to spot unrecognized technologies and their owners.
      • Vendors - copies of contracts if not forthcoming internally.
      • Your service desk - informal knowledge gained about unknown technologies at play in the course of doing their job.

      The IT spend and staffing transparency exercise is an opportunity to kick-start a technology discovery process that will give you and the business a true picture of your technology profile, use, and spend.

      Seek out data at the right level of granularity with the right supporting information

      Key data and information to seek out:

      • Credits applied to appropriate debits that show net expense, or detailed descriptions of credits with no matching debit.
      • Cash-based accounting (not accrual accounting). If accrual, will need to determine how to simplify the data for your uses.
      • Vendor names, asset classes, descriptors, and departments.
      • A total spend amount (CapEx + OpEx) that:
        • Aligns with the spend period.
        • Passes your gut check for total IT spend.
        • Includes annual amounts for multi-year contracts (e.g. one year of a three-year Microsoft enterprise agreement).
        • Includes technology spend from the business (e.g. OT that IT supports).
      • Insights on large projects.
      • Consolidated recurring payments, salaries and benefits, and other small expenses.

      Look for these data descriptors in your files:

      • Cost center/accounting unit
      • Cost center/department description
      • GL ACCT
      • CL account description
      • Activity description
      • Status
      • Program/business function/project description
      • Accounting period
      • Transaction amount
      • Vendor/vendor name
      • Product/product name

      Avoid data that's hard to use or problematic as it will slow you down and bring limited benefits

      Spend data that's out of scope:

      • Depreciation/amortization.
      • Gain or loss of asset write-off.
      • Physical security (e.g. key cards, cameras, motion sensors, floodlights).
      • Printer consumables costs.
      • Heating and cooling costs (for data centers).

      Challenging data formats:

      • Large raw data files with limited or no descriptors.
      • Major accounts (hardware and software) combined in the same line item.
      • Line items (especially software) with no vendor reference information.
      • PDF files or screenshots that you can't extract data from readily. Use Excel or CSV files whenever possible.

      Getting at the data you need can be easy or hard – it all depends

      This is where your governance culture and ITFM maturity start to come into play.

      Data source Potential data and information What to expect
      IT Current/past budget, vendor agreements, IT project records, discretionary spend, number of IT employees. The rigor of your ITFM practice and centralization of data and documents will affect how straightforward this is.
      Finance General ledger, cash and income statements, contractor payments and other accounts payable, general revenue. Secure their expertise early. Let them know what you're trying to do and what you need. They may be willing to prepare data for you in the format you need and help you decipher records.
      Purchasing List of vendors/suppliers, vendor agreements, purchase invoices. Purchasing often has more descriptive information about vendors than finance. They can also point you to tech spend in other departments that you didn't know about.
      Human Resources Organizational chart, staff salaries and benefits, number of employees overall and by department. Data about benefits costs is something you're not likely to have, and there's only one place you can reliably get it.
      Other Business Units Non-IT technology spend vendor agreements and purchase invoices, number of department employees. Other departments may be tracking spend in an entirely different way than you. Be prepared to dig and reconcile.

      There may be some data or information you can't get without a Herculean effort. Don't worry about it too much - these items are usually relatively minor and won't significantly affect the overall picture.

      Commit to finding out what you don't know

      Many IT leaders don't have visibility into other departments' technology spend. In some cases, the fact that spend is even happening may be a complete surprise.

      Near-term visibility fix ...

      • Ask your finance department for a report on all technology-related spend categories. "Software" is a broad category that finance departments tend to track. Scan the report for items that don't look familiar and confirm the originating department or approver.
      • Check in with the procurement office. See what technology-related contracts they have on record and which departments "own" them. Get copies of those contracts if possible.
      • Contact individual department heads or technology spend approvers. Devise your contact shortlist based on what you already know or learned from finance and procurement. Position your outreach as a discovery process that supports your transparency effort. Avoid coming across as though you're judging their spend or planning to take over their technologies.

      Long-term visibility fix ...

      • Develop your relationships with other business unit leaders. This will help open the lines of communication permanently.
      • Establish a cross-functional central technology office or group. The main task of this unit is to set and manage technology standards organization-wide, including standards for tracking and documenting technology costs and asset lifecycle factors.
      • Ensure IT is formally involved in all technology spend proposals and plans. This gives IT the opportunity to assess them for security compliance, IT network/system interoperability, manageability, and IT support requirements prior to purchase.
      • Ensure IT is notified of all technology financial transactions. This includes contracts, invoices, and payments for all one-time purchases, subscription fees, and maintenance costs.

      Finally, note any potential anomalies in the IT spend period you're looking at

      No two years have the exact same spend patterns. One-time spend for a big capital project, for example, can dramatically alter your overall spend landscape.

      Look for the following anomalies:

      • New or ongoing capital implementations or projects that span more than one fiscal year.
      • Completed projects that have recently transitioned, or are transitioning, from CapEx (decreasing) to OpEx (increasing).
      • A major internal reorganization or merger, acquisition, or divestiture event.
      • Crises, disasters, or other rare emergencies.
      • Changes in IT funding sources (e.g. new or expiring grants).

      These anomalies often explain why IT spend is unusually high in certain areas. There's often a good business reason.

      In many cases, doing a separate spend transparency exercise for these anomalous projects or events can isolate their costs from other spend so their true nature and impact can be better understood.

      2.1 Gather your input data and information

      Duration: Variable

      1. Develop a complete list of the spending and staffing data and information you need to complete the transparency mapping exercise. For each required item, note the following:
        1. Description of data needed (i.e. type, timeframe, and format).
        2. Ideal timeframe or deadline for receipt.
        3. Probable source(s) and contact(s).
        4. Additional facilitation/support required.
        5. Person on your transparency team responsible for obtaining it.
      2. Set up a data and information repository to store all files as soon as they're received. Ideally, you'll want all data/information files to be in an electronic format so that everything can be stored in one place. Avoid paper documents if possible.
      3. Conduct your outreach to obtain the input data and information on your list. This could include delegating it to a subordinate, sending emails, making phone calls, booking meetings, and so on.
      4. Review the data and information received to confirm that it's the right type of data, at the correct level of granularity, for the right timeframe, in a usable format, and is generally accurate.
      5. Enter documentation about your data and information sources in tab "1. Data & Information Sources" in the IT Spend & Staffing Transparency Workbook to reflect what you needed and where you got it in order to make the discovery process easier in the future.
      6. In the same tab in the IT Spend & Staffing Transparency Workbook, document any significant events that occurred that directly or indirectly impacted the selected year's spend values. These could include mergers/acquisitions/divestitures, major reorganizations or changes in leadership, significant shifts in product offerings or strategic direction, large capital projects, legal/regulatory changes, natural disasters, or changes in the economy.

      Download the IT Spend & Staffing Transparency Workbook

      2.1 Gather your input data and information

      InputOutput
      • Knowledge of potential data and information sources
      • List of data and information required to complete the IT spend and staffing transparency exercise
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT financial lead

      Tidy up your data before beginning any spend mapping

      Most organizations aren't immaculate in their tech spend documentation and tracking practices. This creates data rife with gaps that lives in hard-to-use formats.

      The more preparation you do to approach the "good data" intersection point in the diagram below, the easier your mapping effort will be and the more useful and insightful your final findings.

      Venn diagram of good data

      Make your data "un-unique" to reduce the number of line items and make it manageable

      There's a good chance that the IT spend data you've received is in the form of tens of thousands of unique line items. Use the checklist below to help you roll it up.

      Warning: Never overwrite your original data. Insert new columns/rows and put your alternate information in these instead.

      Step 1: Standardize vendor names

      • Start with known large vendors.
      • Select a standard name for the vendor.
      • Brainstorm possible variations on the vendor name, including abbreviations and shortforms.
      • Search for the vendor in your data and document the new standardized vendor name in the appropriate row.
      • Repeat the above for all vendors.
      • Sort the new vendor name column from A-Z. Look for instances where names remain unique or are missing entirely. Reconcile if needed and fill in missing data.

      Step 2: Consolidate vendor spend

      • Sort the new vendor name column from A-Z. Start with vendors that have the most line items.
      • Add together related spend items from a given vendor. Create a new row for the consolidated spend item and flag it as consolidated. Keep the following item types in separate rows:
        • Hardware vs. software spend for the same vendor.
        • Cloud vs. on-premises spend for the same vendor.
      • Repeat the above for all vendors.
      • Consider breaking out separate rows for overly consolidated line items that contain too many different types of IT spend.

      2.2 Clean and organize your data

      Duration: Variable

      1. Check to ensure that you have all data and information required to conduct the IT spend transparency exercise.
      2. Conduct an initial scan to assess the data's current state of hygiene and overall usability. Flag anything of concern and follow up with the data/information provider to fix or reconcile any issues.
      3. Normalize your data to make it easier to work with. This includes selecting data format standards and changing anything that doesn't conform to those standards. This includes items such as date conventions, currencies, and so on.
      4. Standardize product and vendor naming/references throughout to enable searching, sorting, and grouping. For example, Microsoft Office may be variably referred to as "Microsoft", "Office", "Office 365", and "Office365" throughout your data. Pick one descriptor for the product/vendor and replace all related references with that descriptor.
      5. Consolidate and aggregate your data. Ideally, the data you received from your sources has already been simplified; however, you may need to further organize it to reduce the number of individual line items to a more manageable number. The transparency exercise uses relatively high-level categories, so combine data sets and aggregate where feasible without losing appropriate granularity.
      6. Archive any original copies of files that have been modified or replaced with consolidated/aggregated versions for future reference if needed.

      2.2 Clean and organize your data

      InputOutput
      • Data and information files
      • A normalized set of data and information for completing the IT spend and staffing transparency exercise
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT financial lead

      Select IT spend "buckets" for the CXO Business View as your final preparatory step

      Every organization has both industry-agnostic and industry-specific lines of business that are the direct beneficiaries of IT spend.

      Common shared business functions:

      • Human resources.
      • Finance and accounting.
      • Sales/customer service.
      • Marketing and advertising.
      • Legal services and regulatory compliance.
      • Information technology.

      It may seem odd to see IT on the business functions list since the purpose of this exercise is to map IT spend. For business view purposes, IT spend refers to what IT spends on itself to support its own internal operations.

      Examples of industry-specific functions:

      • Manufacturing: Product research and development; production operations; supply chain management.
      • Retail banking: Core banking services; loan, mortgage and credit services; investment and wealth management services.
      • Hospitals: Patient intake and admissions; patient diagnosis; patient treatment; patient recovery and ongoing care.
      • Insurance: Actuarial analysis; policy creation; underwriting; claims processing.

      See the Appendix of this blueprint for definitions of shared business functions plus sample industry-specific business view categories.

      Define your CXO Business View categories to set yourself up well for future ITFM analyses

      The CXO Business View buckets you set up today are tools you can and should reuse in your overall approach to ITFM governance. Spend some time to get them right.

      Stay high-level

      Getting too granular invites administrative headaches and overhead. Keep things high-level and general:

      • Limit the number of direct stakeholders represented: This will reduce communication overhead and ensure you're dealing only with people who have real decision-making authority.
      • Look to your org. chart: Note the departments or business units listed across the top of the chart that have one executive or top-ranking senior manager accountable for them. These business units often translate as-is into a tidy CXO Business View category.

      Limit your number of buckets

      Tracking IT spend across more than 8-10 shared and industry-specific business categories is impractical.

      • Simplify your options: Too many buckets gets confusing and invites time-wasting doubt.
      • Reduce future rework: Business structures will change, which means recategorizing spend data. Using a forklift is a lot easier than using tweezers.
      • Stick to major business units: Create separate "Business Other" and "Industry Other" catch-all categories to track IT spend for smaller functions that fall outside of major business unit structures.

      Stay high-level with the CXO Business View

      Be clear on what's in and what's out of your categories to keep everyone on the same page

      Clear lines of demarcation between CXO Business View categories reduce confusion, doubt, and wheel-reinvention when deciding where to allocate IT spend.

      Ensure clear boundaries

      Mutual exclusivity is key when defining categories in any taxonomical structure.

      • Avoid overlaps: Each high-level business function category should have few or no core function or process overlaps with another business function category. Aim for clear vertical separation.
      • Be encompassing: When defining a category, list all the business capabilities and sub-functions included in that category. For example, if defining the finance and accounting function, remember to specify its less obvious accountabilities, like enterprise asset management if appropriate.

      Identify exclusions

      Listing what's out can be just as informative and clarifying as listing what's in.

      • Beware odd bedfellows: Minor business groups are often tucked under a bigger organizational entity even though the two use different processes and technologies. Separate them if appropriate and state this exclusion in the bigger entity's definition.
      • Draw a line: If a process crosses business function categories, state which sub-steps are out of scope.
      • Document your decisions: This helps ensure you allocate IT spend the same way every time.

      Clear lines of demarcation between CXO Business View categories

      2.3 Build your industry-specific business views

      Duration: Two hours

      1. Confirm your list of high-level shared business services (human resources, finance and accounting, etc.) as provided in Info-Tech's IT Spend & Staffing Transparency Workbook. Rename them if needed to match the nomenclature used in your organization.
      2. Set and define your additional list of high-level, industry-specific business categories that are unique to or define your industry. See the slides immediately following this exercise for tips on developing these categories, as well as the appendix of this blueprint for some examples of industry-specific categories and definitions.
      3. Create "Business Other" and "Industry Other" categories to capture minor groups and activities supported by IT that fall beyond the major shared and industry-specific business functions you've shortlisted. Briefly note the business groups/activities that fall under these categories.
      4. Edit/enter your shared and industry-specific business function categories and their definitions on tab "2. Business View Definitions" in the IT Spend & Staffing Transparency Workbook.

      Download the IT Spend & Staffing Transparency Workbook

      2.3 Build your industry-specific business views

      InputOutput
      • Knowledge about your organization's structure and business functions/units
      • A list of major shared business functions and industry-specific business functions/capabilities that are defining of your industry
      MaterialsParticipants
      • Whiteboard/flip charts
      • Head of IT
      • IT financial lead

      Lock in key pieces of baseline data

      Calculating core IT spend metrics relies on a few key numbers. Settle these first based on known data before diving into detailed mapping.

      These baseline data will allow you to calculate high-level metrics like IT spend as a percent of revenue and year-over-year percent change in IT spend, as well as more granular metrics like IT staff spend per employee for a specific IT service.

      Baseline data checklist

      • IT spend analysis period (date range).
      • Currency used.
      • Organizational revenue.
      • Organizational OpEx.
      • Total current year IT spend.
      • Total current year IT CapEx and IT OpEx.
      • Total previous-year IT spend.
      • Total projected next-year IT spend.
      • Number of organizational employees.
      • Number of IT employees.

      You may have discovered some things you didn't know about during the mapping process. Revisit your baseline data when your mapping is complete and make adjustments where needed.

      2.4 Enter your baseline data

      Duration: One hour

      1. Navigate to tab "3. Baseline Data" in the IT Spend & Staffing Transparency Workbook. Using the data you've gathered, enter the following information to set your baseline data for future calculations:
        1. Your IT spend analysis date range. This can be concrete dates, a fiscal year abbreviation, etc.
        2. The currency you will be using throughout the workbook. It's important that all monetary values entered are in the same currency.
        3. Your organization's total revenue and total operating expenditure (OpEx) for the spend analysis data range you've specified. Revenue includes all sources of funding/income.
        4. Your total IT OpEx and total IT capital expenditure (CapEx). The workbook will add your OpEx and CapEx values for you to arrive at a total IT spend value.
        5. Total IT spend for the year prior to the current IT spend analysis date range, as well as anticipated total IT spend for the year following.
        6. Total IT staff spend (salaries, benefits, training, travel, and fees for employees and contractors in a staff augmentation role) for the spend analysis date range.
        7. The total number of organizational employees and total number of IT employees. These are typically full-time equivalent (FTE) values and include contractors in a staff augmentation role.
      2. Make note of any issues that have influenced the values you entered.

      Download the IT Spend & Staffing Transparency Workbook

      2.4 Enter your baseline data

      InputOutput
      • Cleaned and organized spend and staffing data and information
      • Finalized baseline data for deriving spend metrics
      MaterialsParticipants
      • IT Spend & Staffing Transparency Workbook
      • Head of IT
      • IT financial lead

      Phase 2: Gather required data

      Achievement summary

      You've now completed all preparation steps for your IT spend transparency journey. You have:

      • Gathered your IT spend and staffing data and information.
      • Cleaned and organized your data to streamline mapping.
      • Identified your baseline data points.

      "As an IT person, you're not speaking the same language at all as the accounting department. There's almost always a session of education that's required first."
      - Angie Reynolds, Principal Research Director, ITFM Practice, Info-Tech Research Group

      Phase 3

      Map Your IT Staff Spend

      This phase will walk you through the following activities:

      • Mapping your IT staff spend across the four views of the ITFM Cost Model
      • Validating your mapping

      This phase involves the following participants:

      • Head of IT
      • IT financial lead
      • Other members of IT management

      Phase 3: Map your IT staff spend

      Allocate your workforce costs across the four views.

      Now it's time to tackle the first part of your hands-on spend mapping effort, namely IT staff spend. In this phase you will:

      • Allocate your IT staff spend across the four views of the ITFM Cost Model.
      • Validate your mapping to ensure that it's accurate and complete.

      "We're working towards the truth. We know the answer, but it's how to get it. Take Data & BI. For some organizations, four FTEs is too many. Are these people really doing Data & BI? Look at the big picture and see if something's missing."
      - Rex Ding, Research Specialist, ITFM Practice, Info-Tech Research Group

      Staffing costs comprise a significant percent of OpEx

      Staffing is the first thing that comes to mind when it comes to spend. Intentionally bring it out of the shadows to promote constructive conversations.

      • Total staffing costs stand out from other IT spend line items. This is because they're comparatively large, often comprising 30-50% of total IT costs.
      • Standing out comes at a price. Staff costs are where business leadership looks first if they want cuts. If IT leadership doesn't bring forward ways to cut staffing costs as part of a broader cost-cutting mandate, it will be seen as ignorant of business priorities at best and outright insubordinate at worst.
      • Staffing costs as a percentage of total costs vary between IT functions. On the business side, there's a lack of understanding about what functions IT staff serve and support and the real-world costs of obtaining (and keeping) needed IT skills. For example, IT security staffing costs as a percentage of that service's total OpEx will likely be higher than service desk staff given the scarcity and higher market value of the former. Trimming 20% of IT staffing costs from the IT security function has much different implications than cutting 20% of service desk staffing costs.

      Staffing spend transparency can do a lot to change the conversation from one where the business thinks that IT management is just being self-protecting to one where they know that IT management is actually protecting the business.

      Demonstrating the legitimate reasons behind IT staff spend is critical in both rationalizing past and current spend decisions as well as informing future decisions.

      Info-Tech recommends that you map your IT staffing costs before all other IT costs

      Mapping your IT staffing spend first is a good idea because:

      • Staffing costs are usually documented more clearly, simply, and accurately than other IT costs.
      • Gathering all your IT staffing data is usually a one-stop shop (i.e. the HR department).
      • The comparative straightforwardness of mapping staff costs compared to other IT costs gives you the opportunity to:
        • Get familiar with the ITFM Cost Model views and categories.
        • Get the hang of the hands-on mapping process.
        • Determine the kinds of speed bumps and questions you'll encounter down the road when you tackle the more complicated mappings.

      "Some companies will say software developer. Others say application development specialist or engineer. What are these things? You have to have conversations ..."
      - Rex Ding, Research Specialist, ITFM Practice, Info-Tech Research Group

      Understand the CFO Expense View: "Workforce" categories defined

      For the staffing spend mapping exercise, we're defining the Workforce category here and will offer Vendor category definitions in the vendor spend mapping exercise later.

      Workforce: The total costs of employing labor in the IT organization. This includes all salary/wages, benefits, travel/training, dues and memberships, and contractor pay. Managed services expenses associated with an external service provider should be excluded from Workforce and included in Contract Services.

      Employee: A person employed by the IT organization on a permanent full-time or part-time basis. Costs include salary, benefits, training, travel and expenses, and professional dues and memberships. These relationships are managed under human resources and the bulk of spend transactions via payroll processes.

      Contractor: A person serving in a non-permanent staff augmentation role. These relationships are typically managed under procurement or finance and spend transactions handled via invoicing and accounts payable processes. Labor costs associated with an external service provider are excluded.

      CFO Expense View

      Mapping your IT staff across the CFO Expense View is relatively cut-and-dried

      The CFO Expense View is the most straightforward in terms of mapping IT staffing costs as it's made up of only two main categories: Workforce and Vendor.

      In the CFO Expense View, all IT spend on staffing is allocated to the Workforce bucket under either Employee or Contractor.

      What constitutes a Contractor can be confusing given increased use of long-term labor augmentation strategies, so being absolutely clear about this is imperative. For spend mapping purposes:

      • Any staff members under independent contract where individuals are paid directly by your organization as opposed to indirectly via a service provider (e.g. staffing firm) are considered Workforce > Contractor.
      • Any circumstances where you pay a third-party organization for labor is slotted under Vendor > Contract Services.

      CFO Expense View

      Understand the CIO Service View: Categories defined

      We've provided definitions for the major categories that require clarification.

      Applications Development: Purchase/development, testing, and deployment of application projects. Includes internally developed or packaged solutions.

      Applications Maintenance: Software maintenance fees or maintaining current application functionality along with minor enhancements.

      Hosting & Networks: Compute, storage, and network functionality for running/hosting applications and providing communications/connectivity for the organization.

      End User: Procurement, provision, management, and maintenance (break/fix) of end-user devices (desktop, laptops, tablets, peripherals, and phones) as well as purchase/support and use of productivity software on these devices. The IT service desk is included here as well.

      PPM & Projects: People, processes, and technologies dedicated to the management of IT projects and the IT project portfolio as a whole.

      Data & BI: Strategy and oversight of the technology used to support data warehousing, business intelligence, and analytics.

      IT Management: Senior IT leadership, IT finance, IT strategy and governance, enterprise architecture, process management, vendor management, talent management, and program and portfolio management oversight.

      Security: Information security strategy and oversight, practices, procedures, compliance, and risk mitigation to protect and prevent unauthorized access to organizational data and technology assets.

      CIO Service View

      Mapping your IT staff across the CIO Service View is a slightly harder exercise

      The complexity of mapping staff across this view depends on how your IT department is organized and the degree of role specialization vs. generalization.

      The CIO Service View mirrors how many IT departments are organized into teams or work groups. However, some partial percentage-based allocations are probably required, especially for smaller IT units with more generalized, cross-functional roles. For example:

      • A systems administrator's costs may need to be allocated 80% to Hosting & Networks and 20% to Security.
      • An app development team lead may spend about 40% of their time doing hands-on Development work and the other 60% on project management (i.e. PPM & Projects).

      Info-Tech has found that allocating staffing costs for Data & BI raises the most doubts as it can be very entangled with Applications and other spend. Do the best you can.

      Understand the CXO Expense View: Categories defined

      Expand shared services and industry function categories as suits your organization.

      Industry Functions: As listed and defined by you for your specific industry.

      Human Resources: IT staff and specific application functionality in support of organizational human resource management.

      Finance & Accounting: IT staff and specific application functionality in support of corporate finance and accounting.

      Shared Services Other: IT staff and specific application functionality in support of all other shared enterprise functions.

      Information Technology: IT staff and specific application functionality in support of IT performing its own internal IT operations functions.

      Industry Other: IT staff and specific application functionality in support of all other industry-specific functions.

      CXO Expense View

      Mapping your IT staff across the CXO Business View warrants the most time

      This view is probably the most difficult as many IT department roles are set up according to lines of IT service, not lines of business. Prepare to do a little math.

      The CXO Expense View also requires percentage-based splitting of role spend, but to a greater extent.

      • Start by mapping staff cost allocations for those roles that are at, or close to, 100% dedicated to a specific business function (if any).
      • For IT roles that support organization-wide or multi-department functions, knowing the percent of employees that work in each relevant business unit and parceling IT staff spend by those same percentages may be easiest. For example, a general systems administrator's costs could be allocated as 4% to HR, 2% to finance, 25% to sales, 20% to production operations, and so on based on the percentage of employees in each of the supported business units.

      Take a minute to figure out how you plan to map IT's indirect CXO Business View costs

      Direct IT costs are those that are dedicated to a specific business unit or user group, such a marketing campaign management app, specialized devices used by a specific subset of workers in the field, or a business analyst embedded full-time in a sales organization.

      VS

      Indirect IT costs are pretty much everything else that's shared broadly across the organization and can't be tied to just one stakeholder or user group, such as network infrastructure, the service desk, and office productivity apps. These costs must be fairly and evenly distributed.

      No indirect mapping method is perfect, but here's a suggestion:

      • Take the respective headcount of all business functions sharing the IT resource/service in question.
      • Calculate each business function's staff as a percentage of all organizational staff.
      • Use this same percent of staff to calculate and allocate a business function's indirect staff and indirect vendor costs.

      "There is always a conversation about indirect allocations. There's never been an organization I've heard of or worked for which has been able to allocate every technology cost directly to a business consumption or business unit."
      Monica Braun, ITFM Research Director, Info-Tech Research Group

      Example:

      • A company of 560 employees has six HR staff (about 1.1% of total staff).
      • Network admin staffing costs $143,000, so $1,573 (1.1%) would be allocated to HR.
      • Internet services cost $40,000, so $440 (1.1%) would be allocated to HR.

      Some indirect costs are shared by multiple business functions, but not all. In these cases, exclude non-participating business functions from the total number of organizational employees and re-calculate a new percent of staff for each participating business function.

      Know where you're most likely to encounter direct vs. indirect IT staffing costs

      Info-Tech has found that direct vs. indirect staffing spend is more commonly found in some areas than others. Use this insight to focus your work.

      Direct IT staffing spend

      Definition: Individuals or teams whose total time is formally dedicated to the support of one business unit/function.

      • Data & BI (direct to one non-IT unit)
      • IT Management (direct to IT)
        • Service planning & Architecture
        • Strategy & Governance
        • Financial Management
        • People & Resources

      Hybrid IT staffing spend

      Definition: Teams with a percent of time or entire FTEs formally dedicated to one business unit/function while the remainder of the time or team is generalized.

      • Applications
        • Applications Development
        • Applications Maintenance
      • IT Management
        • PPM & Projects

      Indirect IT staffing spend

      Definition: Individuals or teams whose total time is generalized to the support of multiple or all business units or functions.

      • Infrastructure
        • Hosting & Networks
        • End Users
      • Security

      Indirect staff spend only comes into play in the CXO Business View. Thoroughly map the CIO Service View first and leverage its outcomes to inform your allocations to individual business and industry functions.

      Understand the CEO Innovation View: Categories defined

      Be particularly clear on your understanding of the difference between business growth and business innovation.

      Business Innovation: IT spend/ activities focused on the development of new business capability, new products and services, and/or introduction of existing products/ services into new markets. It does not include expansion or update of existing capabilities.

      Business Growth: IT spend/activities focused on the expansion, scaling, or modernization of an existing business capability, product/service, or market. This is specifically related to growth within a current market.

      Keep the Lights On: IT spend/activities focused on keeping the organization running on a day-to-day basis. This includes all activities used to ensure the smooth operation of business functions and overall business continuity.

      CEO Innovation View

      Important Note

      Info-Tech analysts often skip mapping staff for the CEO Innovation View when delivering the IT Spend & Staffing Benchmarking Service.

      This is because, for many organizations, either most IT staff spend is allocated to Keep the Lights On or any IT staff allocation to Business Growth and Business Innovation activities is untracked, undocumented, and difficult to parse out.

      Mapping your IT staff across the CEO Innovation View is largely straightforward

      Clear divisions between CapEx and OpEx can be your friend when it comes to mapping this view. Focus your efforts on parsing growth vs. innovation.

      • The majority of IT staff costs are OpEx: And the majority of OpEx will land in the Keep the Lights On category. This is a comparatively simple mapping exercise. Know in advance that this will be the largest of the three buckets in the CEO Innovation View by a very wide margin, so don't be surprised if over 90% of IT staffing costs end up here.
      • Most of the remaining IT staff costs will be tied to capital projects and investments: This means that they will land in either Business Growth or Business Innovation, with the majority typically sitting under Business Growth. Again, don't be surprised if the Business Innovation category holds less than 3% of total IT staffing spend.

      Take your IT staff spend mapping to the next level with detailed time and headcount data

      Overlay a broader assessment of your IT staff

      Info-Tech's IT Staffing Assessment diagnostic can expand your view of what's really happening on the staffing front.

      • Learn your true distribution of IT staff across the same IT services listed in the ITFM Cost Model's CIO Service View.
      • Get other metrics such as degrees of seniority, manager span of control, and IT staff perception of their effectiveness.

      Take action

      1. Set it up: Contact your Info-Tech Account Manager and sign your team up to take the diagnostic.
      2. Assess the findings: Review the output report, specifically how your staff says they spend their time versus what your organization chart's been telling you.
      3. Apply the percentages: Use the FTE allocation percentages in the output report to guide how you distribute your staff spend across the CIO Service View.
      4. Expand your analysis: Use your staff's feedback around perceived aids and obstacles to effectiveness in order to inform and defend your recommendations and decisions on how IT funds should be spent.

      Consider these final tips for mapping your IT staffing costs before diving in

      Mapping your IT staffing costs definitely requires some work. However, knowing the common stumbling blocks and being systematic will yield the best results.

      Approach: Be efficient to be effective

      Start with what you know best: Map the CFO Expense View first to plug in information you already have. Next, map the CIO Service View since it's most aligned to your organization chart.

      Keep a list of questions: You'll need to seek clarifications. Note your questions, but don't reach out until you've done a first pass at the mapping - don't annoy people with a barrage of questions.

      Delegate: Your managers and leads have a more accurate view of exactly what their staff do. Consider delegating the CIO Service View and CXO Business View to them or turn the mapping exercise into a series of collaborative leadership team activities.

      Biggest challenge: Role/title ambiguity

      • The Business Analyst role is often vague. These staffers are often jacks-of-all-trades in IT. You probably can't rely on a generic job description to figure out exactly which services and business functions BAs are spending their time on. Plan to ask a lot of questions.
      • Other role titles may be completely inaccurate. Is the word "system" referring to apps, infrastructure, or both? Is the user experience specialist actually a programmer? Is a manager really managing anything? Know your organization's tendencies around meaningful job titling and set your workload expectations accordingly.

      Key step - validate! If you see services or functions with low or no allocation, or something just doesn't look right, investigate. Someone's doing that work - take the time to figure out who.

      3.1 Map your IT staffing costs

      Duration: Variable

      1. Navigate to tab "4. Staff Spend Mapping" in the IT Spend & Staffing Transparency Workbook. On one row, enter the name of an individual or group to be mapped, their role/title (if an individual), and their total known cost as per your collected data.
      2. Under the CFO Expense View (columns F-G), enter the number of FTEs represented by the individual or group named and their status (i.e. Employee or Contractor).
      3. Under the CIO Service View (columns L-AF), allocate the individual or group's spend as a percentage across all service categories. If the allocation for a service is 0%, leave the cell blank.
      4. Under the CXO Business View (columns AI-BA), allocate the individual or group's spend as a percentage across all business function and industry-specific function categories. If the allocation for a function is 0%, leave the cell blank.
      5. Under the CEO Innovation View (columns BD-BH), allocate the individual or group's spend as a percentage across Business Innovation, Business Growth, and Keep the Lights On. If the allocation for an investment type is 0%, leave the cell blank.
      6. Repeat steps 2 to 5 for all other IT staff (as individuals or groups).
      7. Follow up on and resolve any additional inquiries you need to make based on questions that arose during the mapping process.
      8. Validate your mapping by:
        1. Identifying spend categories that have zero staff spend allocation. Additional percentage allocation splits for certain roles are probably required.
        2. Investigating spend categories that seem to have very high or very low spend allocations based on a gut check. Again, double-check your percentage allocation splits.
        3. Ensuring your amounts add up to your previously calculated total IT staff spend. A balance tracker is provided on tab "6. Tracker & General Outputs" of the IT Spend & Staffing Transparency Workbook.

      Download the IT Spend & Staffing Transparency Workbook

      3.1 Map your staffing costs

      Input Output
      • Cleaned and organized IT staffing data and information
      • Finalized mapping of IT staff spend across the four views of the ITFM Cost Model
      Materials Participants
      • IT Spend & Staffing Transparency Workbook
      • Head of IT
      • IT financial lead
      • Other IT management as required

      Phase 3: Map your IT staff spend

      Achievement summary

      You've now completed your IT staff spend mapping. You have:

      • Allocated your IT staff spend across the four views of the ITFM Cost Model.
      • Validated your mapping to ensure it's accurate and complete.

      "Some want to allocate everybody to IT, but that's not how we do it. [In one CXO Business View mapping], a client allocated all their sand network people to the IT department. At the end of the process, the IT department itself accounted for 20% of total IT spend. We went back and reallocated those indirect staff costs across the business."
      - Kennedy Confurius, Research Analyst, ITFM Practice, Info-Tech Research Group

      Phase 4

      Map Your IT Vendor Spend

      This phase will walk you through the following activities:

      • Mapping your IT vendor spend across the four views of the ITFM Cost Model
      • Validating your mapping

      This phase involves the following participants:

      • Head of IT
      • IT financial lead
      • Other members of IT management

      Phase 4: Map your IT vendor spend

      Allocate your vendor costs across the four views.

      Now you're ready to take on the second part of your spend mapping, namely IT vendor spend. In this phase you will:

      • Allocate your IT vendor spend across the four views of the ITFM Cost Model.
      • Validate your mapping to ensure it's accurate and complete.

      "[One CIO] said that all technology spend runs through their IT group. But they didn't have hardware in their financial data file - no cellphones or laptops, no network or server expenses. They thought they had everything, but they didn't know what they didn't have. Assume it's out there somewhere."
      - Kennedy Confurius, Research Analyst, ITFM Practice, Info-Tech Research Group

      Tackle the non-staff side of IT spend

      Info-Tech analysts find that mapping the IT vendor spend data is harder because the source data is often scattered and not meaningfully labeled.

      • Be patient and systematic. As with mapping your IT staff spend data, the more organized you are from the outset and the more thoroughly you've prepared your data, the more straightforward the exercise will be.
        • Did you "un-unique" your data? If not, do that now before attempting mapping.
      • Get comfortable with making some assumptions. You need to get through the exercise, so sometimes making a best guess and entering a value is better than diving down a rabbit hole. Your gut is probably right anyway. But only make assumptions around smaller line items that don't have a massive impact on your final numbers. Never assume anything when it comes to big-ticket items.
      • Curb your urge to fix. Some of your buckets will start to get big, while others will barely budge. This is normal ... and interesting! Resist the urge to "balance" staffing spend in a bucket by loading it with apps and hardware for fear that the staffing spend looks too high and will be questioned. This exercise is about how things are, not how they look.

      "A common financial data problem is no vendor names. I've noticed that, even if the vendor name is there, there are no descriptors. You cannot actually tell what type of service it is. Data security? Infrastructure? Networking? Ask yourself 'What did we purchase and what does it do?'"
      - Aman Kumari, Research Specialist, ITFM Practice, Info-Tech Research Group

      Understand the CFO Expense View: Vendor categories defined

      These are the final definitions for this view. See the previous section for CFO Expense View > Workforce definitions used in the IT staffing cost mapping exercise.

      Vendor: Provider of a good or service in exchange for payment.

      Hardware: Costs of procuring, maintaining, and managing all IT hardware, including end-user devices, data center and networking equipment, cabling, and hybrid appliances for both on-premises and cloud-based providers.

      Software: Costs for all software (applications, database, middleware, utilities, tools) used across the organization. This includes purchase, maintenance, and licensing costs.

      Contract Services: Costs for all third-party services including managed service providers, consultants, and advisory services.

      Cloud: Offsite hosting and delivery of an on-demand software or hardware computing function by a third-party provider, often on a subscription-type basis.

      On-Prem: On-site hosting and delivery of a software or hardware computing function, often requiring upfront purchase cost and subsequent maintenance costs.

      Managed Services: Costs for outsourcing the provision and maintenance of a technical process or function.

      Consulting & Advisory: Costs for the third-party provision of professional or technical advice and expertise.

      CFO Expense View

      Know if a technology is cloud-based or on-premises before mapping

      A technology may be one, the other, or both if multiple versions are in play. Financial records rarely indicate which, but on-premises vs. cloud matters in your planning.

      On-Premises

      • Check your CapEx. Any net-new purchases of software or hardware for the IT spend analysis year in question should appear on the CapEx side of the equation. After the first year of implementation/rollout, all ongoing maintenance and management costs should be found under OpEx.
      • Focus on real in-year costs.
        • Don't try to map depreciation or amortization associated with CapEX. Instead, map any upfront purchase costs that occurred in the relevant IT spend analysis year.
        • Map any OpEX costs incurred from maintenance and management. For multi-year maintenance contracts, apply the percentage of fees paid for the relevant year.

      Cloud

      • Check your OpEx. Cloud services are typically fee-based, which means the costs often come in the form of regularly timed bills akin to a subscription.
      • Differentiate new services from older ones. If the cloud service was initiated during the IT spend analysis year in question, there may be some one-time service setup and initiation fees that were legitimately slotted under CapEx. If the cloud service isn't new, then all costs should be OpEx.

      Vendors are increasingly "retiring" on-premises software products. This means an older version may be on-prem, a newer one cloud, and you may have both in play.

      Mapping built-in data, analytics, and security functions can raise doubts

      With so many apps focused on capturing, manipulating, and protecting data, built-in analytics, reporting, and security functions blur CIO Service View bucket boundaries.

      Applications vs. Data & BI

      • In recent years, much more powerful analysis and report-generation features have been added to core enterprise applications. If analytics and reporting functionality is an extended feature of a database-driven application, such as ERP or CRM, then map it to one of the Applications buckets.
      • If the sole purpose of the application is to store, manipulate, query, analyze, and/or visualize data, then log its costs under Data & BI. These would include technologies such as data warehouses, marts, cubes, and lakes; desktop data visualization tools; enterprise business intelligence platforms; and specialized reporting tools.

      Applications vs. Security

      • A similar conundrum exists for Security. So many tools today have built-in security functionality that cannot be unintegrated from the app they support. Don't even try to isolate native security functionality for spend mapping purposes - map it to Applications.
      • If the tool is a special-purpose, standalone security tool or security platform, then map it to Security. These tools usually sit within, and are used/managed by, IT. They include firewalls; antivirus/anti-malware; intrusion prevention, detection and response; access control and authentication; encryption; and penetration testing and vulnerability assessment.

      Putting spend in the right bucket does matter. However, if uncertainty persists, err on the side of consistency. For most organizations Applications Maintenance does end up being the biggest bucket.

      When mapping the CXO Business View, do the biggest vendors first

      Below is a suggested order of operations to clear through the majority of vendor spend as early as possible in the process.

      1 Sort high to low Sort your list of vendor spend from highest to lowest. Your top 20 vendors should constitute most of the spend.
      2 Map multi-department enterprise apps Flag your top apps vendors that have presence in most or all of your business units. Map these first. These tend to be enterprise-level business apps "owned" by core business functions but used broadly across the organization such as enterprise resource planning (ERP), customer relationship management (CRM), and people management systems.
      3 Map end-user spend Identify top vendors of general end-user technologies like office productivity apps, desktop hardware, and IT service desk tools. Allocate percentages according to your selected indirect spend mapping method.
      4 Map core infrastructure spend Map the behind-the-scenes network, telecom, and data center technologies that underpin IT, plus any infrastructure managed services. Again, apply your selected indirect spend mapping method.
      5 Map business-unit specific technologies This is the spend that's often incurred by just one department. This may also be technology spend that's out in the business, not in IT proper. Map it to the right business function or put it in Business Other or Industry Other if the business function doesn't have its own bucket.
      6 Map the miscellaneous Only smaller spend items likely remain at this point. When in doubt, map them to either Business Other or Industry Other.

      After mapping the CXO Business View, your Other buckets might be getting a bit big

      It's common for the Business Other and Industry Other categories to be quite large, and even the largest. This is okay, but plan to dig deeper and understand why.

      Remember "when in doubt, map to either the Business Other or Industry Other category"? Know what large Other buckets might really be telling you. After your first pass at mapping the CXO Business View, review Business Other and Industry Other if either is more than about 10% of your total spend.
      Diversification: Your organization has a wide array of business functions and/or associated staff that exist outside the core business and industry-specific categories selected. Are there minor business functions that can reasonably be included with the core categories identified? If not, don't force it. Better to keep your core buckets clean and uncomplicated.
      Non-core monolith: There's a significant technology installation outside the core that's associated with a comparatively minor business function. Is there a business function incurring substantial technology spend that should probably be broken out on its own and added to the core? If so, do it. Spend is unlikely to get smaller as the organization grows, so best to shine a light on it now.
      Shadow IT: There's significant technology spend in several areas of the organization that is unowned, unmanaged, or serving an unknown purpose as far as IT is concerned. Is a lot of the spend non-IT technology in the business? If yes, flag it and plan to learn more. It's likely that technologies living elsewhere in the organization will become IT concerns eventually. Better to be ready than to be surprised.

      As with staffing, CapEx vs. OpEx helps map the CEO Innovation View

      Mapping to this view was optional for IT staffing. For hard technology vendor spend, mapping this view is key. Use the guidance below to determine what goes where.

      Keep the Lights On
      Spend usually triggered by a service deck ticket or work order, not a formal project. Includes:

      • Daily maintenance and management.
      • Repair or upgrade of existing technology to preserve business function/continuity.
      • Purchase of "commodity" technology, such as standard-issue laptops and licenses for office productivity software.

      Business Growth
      Spend usually in the context of a formal project under a CapEx umbrella. Includes:

      • Technology spend that directly supports business expansion of an existing product or service and/or market.
      • Modernizing existing technology.
      • Extension of, or investment in, existing infrastructure to ensure reliability and availability in response to growth-driven scaling of headcount and utilization.

      Business Innovation
      Spend is always in the context of a formal project and should be 100% CapEx in the first year after purchase. Includes:

      • Technology spend that directly supports development and rollout of new products or service and/or entry into new markets.
      • Use of existing technology or investment in net-new technology in direct support of a new business initiative, direction, or requirement.

      In many organizations, most technology spend will be allocated to Keep the Lights On. This is normal but should generate conversations with the business about redirecting funds to growth and innovation.

      Remember these top tips when mapping your technology vendor spend

      The benefits of having tidy and organized data can't be overstated, as your source data will be in a more varied state for this phase of the mapping than with IT staffing data.

      Approach: Move from macro to micro

      • Start with the big enterprise apps: These will probably be in the top five of your vendor spend list and will likely have good info about how and by whom they're used. Get them out of the way.
      • Clear out shared technologies. This will feature infrastructure and operations plus office productivity and communications spend. Portioning spend by department headcount for the CXO Business View is the hardest part. Get this forklift task out of the way too.
      • Don't sweat the small stuff. Wasting hours chasing the details of a $500 line item isn't worth it when you have five-, six-, or even seven-figure line items to map.

      Biggest challenge: Poor vendor labeling

      • Vendor labels are often an inconsistent mess or missing entirely. Standardize and apply consistent vendor labels throughout your data so that you can aggregate your data into a workable form.
      • Spend transactions with the same vendor can be scattered all over the place in your general ledger. Take the time to "un-unique" your data to save yourself tremendous grief later on.
      • Start new go-forward labeling habits. Talk to finance about your new list of vendor naming standards and tagging spend as on-prem or cloud. Getting their cooperation with these are major wins.

      Key step - validate! If you see services or functions with low or no allocation, or something just doesn't look right, investigate. There's probably a technology out there in the business doing that work.

      4.1 Map your IT vendor spend

      Duration: Variable

      1. Navigate to tab "5. Vendor Spend Mapping" in the IT Spend & Staffing Transparency Workbook. On one row, enter a spend line item (vendor, product, etc.), a brief description, and the known amount of spend.
      2. Under the CFO Expense View (columns F-P), allocate the line item's spend as a percentage across all asset-class categories. If the allocation for a line item is 0%, leave the cell blank.
      3. Under the CIO Service View (columns S-AM), allocate the line item's spend as a percentage across all service categories. If the allocation for a service is 0%, leave the cell blank.
      4. Under the CXO Business View (columns AP-BH), allocate the line item's spend as a percentage across all business function and industry-specific function categories. If the allocation for a function is 0%, leave the cell blank.
      5. Under the CEO Innovation View (columns BK-BO), allocate the line item's spend as a percentage across Business Innovation, Business Growth, and Keep the Lights On. If the allocation for an investment type is 0%, leave the cell blank.
      6. Repeat steps 2-5 for all spend line items.
      7. Follow up on and resolve any additional inquiries you need to make based on questions that arose during the mapping process.
      8. Validate your mapping by:
        1. Ensuring your amounts add up to your previously calculated total IT vendor spend. A balance tracker is provided on tab "6. Tracker & General Outputs" of the IT Spend & Staffing Transparency Workbook.
        2. Identifying spend categories that have zero spend allocation. Additional percentage allocation splits for certain line items are probably required.
        3. Investigating spend categories that seem to have very high or very low spend allocations based on a gut check. Again, double-check your percentage allocation splits.

      Download the IT Spend & Staffing Transparency Workbook

      4.1 Map your IT vendor spend

      InputOutput
      • Cleaned and organized IT vendor spend data and information
      • Finalized mapping of IT vendor spend across the four views of the IT Cost Model
      MaterialsParticipants
      • IT Spend & Staffing Transparency Workbook
      • Head of IT
      • IT financial lead
      • Other IT management as required

      Phase 4: Map your IT vendor spend

      Achievement summary

      You've now completed your IT vendor spend mapping. You have:

      • Allocated your IT vendor spend across the four views of the ITFM Cost Model.
      • Validated your mapping to ensure it's accurate and complete.

      "A lot of organizations log their spending by vendor name with no description of the goods or services they actually purchased from the vendor. It could be hardware, software, consulting services ... anything. Having a clear understanding of what's really in there is an essential aspect of the spend conversation."
      - Rex Ding, Research Specialist, ITFM Practice, Info-Tech Research Group

      Phase 5

      Identify Implications for IT

      This phase will walk you through the following activities:

      • Analyzing the results of your IT staff and vendor spend mapping across the four views of the ITFM Cost Model
      • Preparing an executive presentation of your transparent IT spend

      This phase involves the following participants:

      • Head of IT
      • IT financial lead
      • Other members of IT management

      Phase 5: Identify implications for IT

      Analyze and communicate.

      You're now nearing the end of the first leg in your IT spend transparency journey. In this phase you will:

      • Analyze the results of your IT spend mapping process.
      • Revisit your transparency objectives.
      • Prepare an executive presentation so you can share findings with other leaders in your organization.

      "Don't plug in numbers just to make yourself look good or please someone else. The only way to improve is to look at real life."
      - Monica Braun, Research Director, ITFM Practice, Info-Tech Research Group

      You've mapped your IT spend data. Now what?

      With mapped data in hand, now you can start to tell IT's spend story with stakeholders in the business.

      Mapping your IT spend is a lot of work, but what you've achieved is impressive (applause!) as well as essential for growing your ITFM maturity. Now put your hard work to work.

      • Consider benchmarking. While not covered in-depth here, benchmarking against yourself in a year-over-year approach as well as against external industry peers are very useful exercises in your technology spend analysis.
      • Review your numbers and graphs. Your IT Spend & Staffing Transparency Workbook contains a series of data visualizations that will help you see the big picture as well as relationships between spend categories.
      • Note the very big numbers, the very small numbers, and the things that just look odd. You'll want to investigate and understand these further.
      • Prepare to communicate. Facilitating conversations with stakeholders in the business is the immediate objective of the IT spend and staffing transparency exercise. Decide where and with whom you want to start dialogue.

      The slides that follow show sample data summaries and visualizations generated in the IT Spend & Staffing Transparency Workbook. We'll take a look at the metrics, tables, and graphs you now have available to you post-mapping and how you can potentially use them in conversations with different IT stakeholders.

      Evaluate how you might use benchmarks before diving into your analysis

      Benchmarking can be a useful input for contextualizing and interpreting your IT spend data. It's not essential at this point but should be part of your ITFM toolkit.

      There are two basic types of benchmarking ...

      Internal: Capturing a current-state set of data about an in-house operation to serve as a baseline. Over time, snapshots of the same data are taken and compared to the baseline to track and assess changes. Common uses for internal benchmarking include:

      • Assessing the impact of a project or initiative.
      • Measuring year-over-year performance.

      External: Seeking out aggregated, current-state data about a peer-group operation to assess your own relative status or performance on the same operation. Common uses for external benchmarking include:

      • Understanding common practices in the industry.
      • Strategic and operational visioning, planning, and goal-setting.
      • Putting together a business case for change or investment.

      Both types of benchmarking benefit from some formality and rigor. Info-Tech can help you stand up an ITFM benchmarking approach as well as connect you with actual IT spend peer benchmarks via our IT Spend & Staffing Benchmarking service.

      5.1 Analyze the results of your IT spend mapping

      Duration: Variable

      1. Review the guidance slides that follow the two instruction slides for this exercise to provide yourself with a grounding on how to interpret and analyze your mapped IT staff and vendor spend data.
      2. Systematically review the data tables and graphs on the "Outputs" tabs 6 through 10 in the IT Spend & Staffing Transparency Workbook. There are several approaches you can take - use the one that works best for you. For example:
        1. Review each view in its entirety, one at a time.
        2. Review all workforce spend collectively across all four views, followed by all vendor spend across all four views (or vice versa).
      3. Make note of any spend values that are comparatively high or low or strike you as odd or worth further investigation.
      4. Craft a series of spend-related questions you want to answer for yourself and your stakeholders using the data.
        1. For example, you need to cut costs and apps maintenance is high. Your question could be, "Can we cut costs on applications maintenance staffing?"
        2. Alternatively, you can develop a series of statements (research hypotheses) that you seek to prove true or false with the data. This approach is useful for testing assumptions you've been making. For example, "We can cut spending on applications maintenance staff. True or false?"
      5. Use the template provided on tab "11. Data Analysis" in the IT Spend & Staffing Transparency Workbook to document your findings and conclusions, along with the data that supports them.

      Download the IT Spend & Staffing Transparency Workbook

      5.1 Analyze the results of your IT spend mapping

      InputOutput
      • Tabular and graphical data outputs
      • Conclusions and potential actions about IT staff and vendor spend
      MaterialsParticipants
      • IT Spend & Staffing Transparency Workbook
      • Head of IT
      • IT financial lead
      • Other IT management as required

      High-level findings: Use these IT spend metrics to review and set big picture goals

      Think of these metrics as key anchors in your long-term strategic planning efforts.

      Use IT spend metrics to review and set big goals

      It's common for the business to want a sacrifice in IT OpEx in favor of CapEx

      CapEx and OpEx approval mechanisms are often entirely separate. Different tax treatment for CapEx means that it's usually preferred by the business over OpEx.

      OpEx is often seen as a sunk cost (i.e. an IT problem).

      • Barring a major decision or event, OpEx on an individual item will generally trend upward over time, often by a few percent every year, in lockstep with inflation and growth in organizational headcount.
      • A good portion of OpEx, however, is necessary for basic business continuity.

      CapEx is usually seen as investment (i.e. a business growth opportunity).

      • CapEx behaves quite differently than OpEx. On-the-books capitalized spend on an individual asset tends to trend downward over time due to depreciation or amortization.
      • CapEx only tends to go up when a net-new capital project is initiated, and organizations often have more control over if, when, and how this spend happens.

      Break down the OpEx/CapEx wall. Reference OpEx whenever you talk about CapEx. The best way to do this is via Total Cost of Ownership (TCO).

      • Present data on long-term OpEx projections whenever a new capital project is proposed and ensure ongoing maintenance funds are secured.
      • Educate your CFO about the impact of the cloud on OpEx. See if internal OpEx/CapEx ratio expectations can be adjusted to reflect this reality.

      Spend by asset class offers the CFO a visual illustration of where the money's really gone

      The major spend categories should look very familiar to your CFO. It's the minor sub-categories that sit underneath where you ultimately want to drive the conversation.

      Traditional categories don't reflect IT reality anymore.

      • Most finance departments have "software" accounts that contain apples and oranges, plus other dissimilar fruit.
      • Software isn't just software anymore. Now it's on-premises (CapEx) or cloud (OpEx). The same distinction applies to traditional hardware due to the advent of managed services.
      • The basic categories traditionally used to tag IT spend are out of date. This makes it hard for IT to have meaningful conversations with the CFO since they're not working from the same glossary.

      "Software (on-premises)" and "hardware (cloud)" are more meaningful descriptors than "software" and "hardware." Shift the dialogue.

      Start the migration from major categories to minor categories.

      • Still give the CFO the traditional major categories they're looking for but start including minor category breakdowns into your communications. Most importantly, have a meeting to explain what these minor categories are and why they're important to managing IT effectively.
      • Next, see if the CFO can formally split on-premises vs. cloud software on the books as a first step in making IT spend tracking more meaningful.

      Employees vs. contractors warrants a specific conversation, plus a change in mindset

      IT leaders often find it easier to get approval for contracted labor than to hire a permanent employee. However, the true value proposition for contractors does vary.

      The decision to go with permanent employees or contractors depends on your ultimate goals.

      • Contractors tend to be less expensive and provide more flexibility when adjusting to changing business needs. However, contractors may be less dedicated and take their skills and knowledge with them when they leave.
      • Permanent employees bring additional costs like benefits and training. Plus, letting them go is a lot more complicated. However, they can also bring real value in a way a contractor can't when it comes to sustaining long-term strategic growth. They're assets in themselves.

      Far too often, labor-sourcing decisions are driven by controlling near-term costs instead of generating and sustaining long-term value.

      Introduce the cost-to-value ratio to your workforce spend conversations.

      • Your mapped data will allow you to talk about comparative headcount and spend. This is a financial conversation devoid of context.
      • Go beyond. Show how workforce spend has allowed stated goals to be achieved while controlling for costs. This is the true definition of value.

      CFO Expense View: Shift the ITFM conversation

      Now that you've mapped your IT spend data to the CFO Expense View, there are some questions you're better equipped to answer, namely:

      • How should I classify my IT costs?
      • What information should I include in my plans and reports?
      • How do I justify current spend?
      • How do I justify a budget increase?

      You now have:

      • A starting point for educating the CFO about IT spend realities.
      • A foundation for creating a shared glossary of terms that works for both IT and the finance department and facilitates more meaningful conversations.
      • Proof that there are major areas of IT spend, such as cloud software, that are distinctive and probably warrant their own financial category in the general ledger.
      • A transparent record of IT spend that shows that you understand and care about financial issues, fostering the goodwill and trust that facilitates investment in IT.
      • A starting point to change the ITFM conversation with the CFO from one focused on cost to one focused on value.

      Exactly how is IT spending all that money we give them?

      Exactly like this ...

      Chart of the CFO Expense View

      The CIO Service View aligns with how IT organizes and manages itself – this is your view

      The data mapped here is a critical input for IT's service planning and management program and should be integrated into your IT performance measurement activities.

      Major service categories: These values give a high-level snapshot of your general IT service spend priorities. In most organizations, Applications dominates, making it a focus for cost optimization.

      Minor service categories: The level of granularity for these values prove more practical when measuring performance and making service management decisions - not too big, not too small. While not reflected in this example, application maintenance is usually the largest relative consumer of IT spend in most organizations.

      Data & BI and security: Isolating the exact spend for these services is challenging given that they're often entangled in applications and infrastructure spend respectively, and separate spend tracking for both is a comparatively recent practice.

      Table of CIO Service View

      Check the alignment of individual service spend against known business objectives

      Some IT services are taken for granted by the business, while others are virtually invisible. This lack of visibility often translates into funding misalignments.

      Is the amount of spend on a given service in parallel with the service's overall importance?

      • Though often unstated, ensuring continuity of basic business operations is always the top priority. This means business apps, core infrastructure, end users, and security need to be appropriately funded - these should collectively comprise the majority of IT service spend.
      • Strategy-supporting IT services, like data & BI, see high investment variability between organizations. If its strategic role/importance doesn't align with spend, flag it as an issue you'll need to reconcile with the business by increasing funding (important) or reducing service levels (unimportant).
      • The strategic importance of IT as a whole is often reflected in the spend on IT management services. If spend is low, IT's probably seen as a support function, not a strategic one.

      Identify the hot spots and pick your battles.

      • Spend levels are just approximate gauges of where and how the business is willing to spend its money. Start with this simple gut check.
      • Noting the areas of importance vs. spend misalignment will help you identify where negotiations with the business should probably happen.

      A mature IT cost optimization practice is often approached from the service perspective

      When optimizing IT costs, you have two OpEx levers to pull - vendor spend and staff spend. Isolating these two sources of IT service spend will help shortlist your options.

      It's all about how much room you have to move.

      • Any decision made about how a service is provisioned will push vendor and staff spend in clear, predictable, and often opposite directions (e.g. in-house and people-intensive services tend to see higher staff spend, while outsourced and tech-intensive services higher vendor spend).
      • Service levels required by the business should be the driving factor behind service design and spend decisions. High service spend may reflect priority but may also indicate it's over-built and is ripe for a cost-optimization treatment.
      • Service spend is a useful barometer for tracking the financial impact of any changes made to IT. Add simple unit-cost metrics like "service spend per organizational employee" and "service spend per FTE assigned to the service" to see if and how the dial has moved over time.

      Grow your IT service management practice.

      • The real power of the CIO Service View is laying the groundwork for next-level IT service management initiatives like developing a service catalog, negotiating service-level agreements, rolling out chargeback and showback mechanisms, and calculating IT's value to the business.
      • Use service spend as a common denominator for both your IT service management and IT performance management programs. Better yet, integrate the two programs to ensure a single version of the truth.

      CIO Service View: Optimize your cost-to-value ratio

      Now that you've mapped your IT spend data to the CIO Service View, there are some questions you're better equipped to answer, namely:

      • What's the impact of cloud adoption on speed of delivery?
      • Where can I improve spend efficiency?
      • Is my support model optimized?
      • How does our spend compare to others?

      You now have:

      • Data that shows the financial impact of change decisions on service costs.
      • Insight into the relationship between vendor spend and staff spend within a given IT service.
      • The information you need to start developing service unit costing mechanisms.
      • A tool for setting and right-sizing service-level agreements with the business.
      • A more focused starting point for investigating IT cost-optimization opportunities.
      • A baseline for benchmarking common IT services against your peers.

      Does the amount we spend on each IT service make sense?

      We have some good opportunities for optimization ...

      Chart of CIO Service View

      The CXO Business View will spur conversations that may have never happened before

      This view is a potential game changer as previously unknown technology spend is often revealed, triggering change in IT's relationship with business unit leaders.

      Table of CXO Business View

      The big beneficiaries of IT spend will leap out

      The CXO Business View mapping does have a "shock and awe" quality to it given large spend disparities. They may be totally legitimate, but they're still eye-catching.

      Share information, don't push recommendations.

      • Have a series of one-on-one meetings with business unit leaders to present these numbers.
        • Approach initial meetings as information-sharing sessions only. The data is probably new to them, and they'll need time to reflect and ask questions.
        • Bring a list of the big-ticket spend items for that business unit to focus the conversation.
      • Present these numbers at a broader leadership meeting.
        • It's critical for everyone to hear the same truth and learn about each other's technology needs and uses.
        • This is where recommendations for better aligning IT spend with business goals and cost-optimization strategies should surface. A group approach will bring technology haves and have-nots into the open, as well as provide a forum for collaborative solutioning.

      If possible, slice the numbers by business unit headcount.

      • IT spend per business unit employee is an attention-getting metric that can help gain entry to important conversations.
      • Comparing per-employee spend across different business functions is not necessarily an apples-to-apples comparison, as units like HR may have few employees but serve the entire organization. Bring up these kinds of differences to provide context and avoid misinterpretations.

      Questions will arise in how you calculated and allocated indirect IT spend

      IT spend for things like core infrastructure and end-user services must be distributed fairly across multiple or all business units. Be prepared to explain your methods.

      Be transparent in your transparency.

      • Distributing indirect spend is imprecise by nature. You can't account for every unique circumstance. However, you can devise a logic-driven, general approach that's defensible, fair, and works for most people most of the time.
      • Lay out your assumptions from the start. This is an important part of communicating transparently and can prevent unwanted descent into weedy rabbit holes.
        • List what you classified as indirect spend. Use the CFO Expense View and/or CIO Service View categories to aid your presentation of this information.
        • Point out known circumstances that didn't fit your general allocation method and how you handled them. Opting to ignore minor anomalies is reasonable but be sure to tell business unit leaders you did this and why.

      Use questions about indirect IT staff spend distribution to engage stakeholders.

      • As a percentage, the indirect IT staff spend allocation to a specific business unit may be higher than that for IT vendor spend since IT staff tend to operate more generally than the technologies they support.
      • Leverage any pushback about indirect spend as an opportunity to engage the broader business leadership group. Let them arrive at a consensus of how they want it done and confirm buy-in.

      CXO Business View: Bring the truth to light

      Now that you've mapped your IT spend data to the CXO Business View, there are some questions you're better equipped to answer, namely:

      • Which business units consume the most IT resources?
      • Which business units are underserved by IT?
      • How do I best communicate spend data internally?
      • Where do I need better business sponsorship for IT projects?

      You now have:

      • A reason-based accounting of direct and indirect amounts spent on IT vendors and staff in support of each major business unit.
      • Insight into the technology haves and have-nots in your organization and where opportunities to optimize costs may exist.
      • Attention-getting numbers that will help you engage business-unit leaders in meaningful conversations about their use of IT resources and the value they receive.
      • A mechanism to assess if a business unit's consumption of IT is appropriate and aligned with its purpose and mandate in the organization.
      • A list of previously unknown business-side technologies that IT will investigate further.

      Why doesn't my business unit get more support from IT?

      Let's look at how you compare to the other departments ...

      Chart of the CXO Business View

      From the CEO's high-level perspective, IT spend is a collection of distinct financial islands

      From IT's perspective, these islands are intimately connected, with events on one affecting what happens (or doesn't) on another. Focus on the bridges.

      Table of CEO High-level Perspective

      Focus more on unifying the view of technology spend than on the numbers

      When talking to the CEO, seek to build mutual understanding and encourage a holistic approach to the organization's technology spend.

      Use the numbers to get to the real issues.

      • Clarify with the CEO what business innovation, business growth, and KTLO means to them and the role each plays in the organization's strategic and operational plans.
      • Find out the role they think IT, and technology as a whole, has in realizing business plans. Only then can you look at the relative allocation of IT spend with them to see if the aspiration aligns with reality.
      • Eventually, you'll need to discuss expectations around who pays the bills for operationally supporting capital technology investments over the long-term (i.e. IT or the business units that actually want and use it). You'll have concrete examples of business projects that consumed IT operations resources without a corresponding increase in IT's OpEx budget.

      Focus your KTLO spend conversation on risk and trade-off.

      • Every strategic conversation needs to look at the impact on ongoing operations. Every discussion about CapEx needs to investigate the long-term repercussions for OpEx. Look at the whole tech spend picture.
      • Use risk to get KTLO/OpEx into the conversation. Be straightforward (i.e. "If we do/don't do this, then we can/can't do that"). Simply put, mitigating the risks that get in the way of having it all usually requires spending.

      CEO Innovation View: Learn what's really expected of IT

      Now that you've mapped your IT spend data to the CEO Innovation View, there are some questions you're better equipped to answer, namely:

      • Why is KTLO spend so high?
      • What should our operational spend priorities be?
      • Which projects and investments should we prioritize?
      • Are we spending enough on innovative initiatives?

      You now have:

      • A holistic, organization-wide view of total technology spend in support of different investment types, namely business innovation, business growth, and keeping things up and running.
      • Data-driven examples that prove the impact of near-term capital spend on long-term operational expenses and the intimate relationship between the two types of spend.
      • A way to measure the degree of alignment between the innovation and growth goals the organization has and how money is actually being spent to realize those goals.
      • A platform to discuss how technology investment decision-making and governance can work better to realize organizational mandates and goals.

      I know what IT costs us, but what is it really worth?

      Here's how tech spend directly supports business objectives ...

      Chart of CEO Innovation View

      Revisit your IT spend transparency objectives before crafting your executive presentation

      Go back to exercise 1.1 to remind yourself why you undertook this effort in the first place, clear your head of all that data, and refocus on the big picture.

      Review the real problems and issues you need to address and the key stakeholders.
      This will guide what data you focus on or showcase with other business leaders. For example, if IT OpEx is perceived as high, be prepared to examine the CapEx/OpEx ratio as well as cloud-related spend's impact on OpEx.

      Flag ITFM processes you'll develop as part of your ITFM maturity improvement plan.
      You won't become a TCO math expert overnight, but being able to communicate your awareness of and commitment to developing and applying ITFM capabilities helps build confidence in you and the information you're presenting.

      Use your first big presentation to debut ITFM.
      ITFM as a formal practice and the changes you hope to make may be a novel concept for your business peers. Use your newfound IT spend and staffing transparency to gently wade into the topic instead of going for the deep dive.

      Now it's time to present your transparent IT spend and staffing data to your executive

      Pull out of analysis mode. You're starting to tell the IT spend story, and this is just the first chapter. Introduce your cast of characters and pique your audience's interest.

      The goal of this first presentation is to showcase IT spend in general and make sure that everyone's getting the same information as everyone else.

      Go broad, not deep
      Defer any in-depth examinations until after you're sure you have everyone's attention. Only dive deep when you're ready to talk about specific plans via follow-up sessions.

      Focus on the CXO
      Given your audience, the CXO Business View may be the most interesting for them and will trigger the most questions and discussion. Plan to spend the largest chunk of your time here.

      Avoid judgment
      Let the numbers speak for themselves. Do point out what's high and what's low, but don't offer your opinion about whether it's good or bad. Let your audience draw their own conclusions.

      Ask for impressions
      Education and awareness are primary objectives. What comes up will give a good indication of what's known, what's news, who's interested, and where there's work to do.

      Pick a starting point
      Ask what they see as high-priority areas for both optimizing IT costs as well as improving the organization's approach to making IT spend decisions in general.

      What to include in your presentation ...

      • Purpose: Why you did the IT spend and staffing transparency exercise.
      • Method: The models and processes you used to map the data.
      • Data: Charts from the IT Spend & Staffing Transparency Workbook.
      • Feedback: Space for your audience to voice their thoughts.
      • Next steps: Discussion and summary of actions to come.

      5.2 Develop an executive presentation

      Duration: Two hours

      1. Download the IT Staff & Spend Executive Presentation Template.
      2. Copy and paste the IT spend output tables and graphs into the template. (Note: Pasting as an image will preserve formatting.)
      3. Incorporate observations and insights about your analysis of your IT spend metrics.
      4. Conduct an internal review of the final presentation to ensure it includes all the elements you need and is error free.
      5. Book time to make your presentation to the executive team. Plan time after the presentation to field questions, engage in follow-up information sessions, and act on feedback.

      Note: Refer to your organization's standards and norms for executive-level presentations and either adapt the Info-Tech template accordingly or use your own.

      Input Output
      • Tabular and graphical data outputs in the IT Spend & Staffing Transparency Workbook
      • Executive presentation summarizing your organization's actual IT spend
      Materials Participants
      • IT Spend & Staffing Transparency Workbook
      • IT Staff & Spend Executive Presentation Template
      • CIO/IT directors
      • IT financial lead
      • Other IT management

      Download the IT Spend & Staffing Transparency Executive Presentation TemplateTemplate

      Phase 5: Identify implications for IT

      Achievement summary

      You've done the hard part in starting your IT spend transparency journey. You have:

      • Analyzed the results of your IT spend mapping process.
      • Revisited your transparency objectives.
      • Prepared an executive presentation so you can share findings with other leaders in your organization.

      "Having internal conversations, especially if there is doubt, allows for accuracy and confidence in your model. I was showing someone the cost of a service he managed. He didn't believe the service was so expensive. We went through it: here are the people we allocated, the assets we allocated, and the software we allocated. It was right - that was the total cost. He was like, 'No way. Wow.' The costs were high, and the transparency is what allowed for a conversation on cost optimization."
      - Monica Braun, Research Director, ITFM Practice, Info-Tech Research Group

      Next Steps

      Achieve IT Spend & Staffing Transparency

      This final section will provide you with:

      • An overall summary of accomplishment
      • Recommended next steps
      • A list of contributors to this research
      • Some related Info-Tech resources to help you grow your ITFM practice

      Summary of Accomplishment

      Congratulations! You now have a fully transparent view of your IT spend.

      You've now mapped the entirety of technology spend in your organization. You've:

      1. Learned the key sources of spend data and information in your organization.
      2. Set some standards for data organization and labeling.
      3. Have a methodology for continuing to track and document spend in a transparent way.
      4. Crafted an executive presentation that's a first step in having more meaningful and constructive conversations about IT spend with your key stakeholders.

      What's next?

      With a reliable baseline, you can look forward to more informed and defensible IT budgeting and cost optimization. Use your newly-transparent IT spend as a foundation for improving your financial data hygiene in the near term and evolving your overall ITFM governance maturity in the long-term.

      If you would like additional support, have our analysts guide you through an Info-Tech full-service engagement or Guided Implementation.

      Contact your account representative for more information.

      1-888-670-8889

      Research Contributors and Experts

      Monica Braun, Research Director, ITFM Practice

      Monica Braun
      Research Director, ITFM Practice
      Info-Tech Research Group

      Dave Kish, Practice Lead, ITFM Practice

      Dave Kish
      Practice Lead, ITFM Practice
      Info-Tech Research Group

      Kennedy Confurius, Research Analyst, ITFM Practice

      Kennedy Confurius
      Research Analyst, ITFM Practice
      Info-Tech Research Group

      Aman Kumari, Research Specialist, ITFM Practice

      Aman Kumari
      Research Specialist, ITFM Practice
      Info-Tech Research Group

      Rex Ding, Research Specialist, ITFM Practice

      Rex Ding
      Research Specialist, ITFM Practice
      Info-Tech Research Group

      Angie Reynolds, Principal Research Director, ITFM Practice

      Angie Reynolds
      Principal Research Director, ITFM Practice
      Info-Tech Research Group

      Related Info-Tech Research

      Build Your IT Cost Optimization Roadmap

      • Cost optimization often doesn't go beyond the cutting part, but cutting costs isn't strategic - it's reactive and can easily result in mistakes.
      • True cost optimization is much more than this. Re-focus your efforts on optimizing your cost-to-value ratio and implementing a sustainable cost-optimization practice.

      Build an IT Budget

      • Budgetary approval is difficult because finance executives have a limited understanding of IT and use a different vocabulary.
      • Detailed budgets must be constructed in a way that is transparent but at a level of appropriate detail in order to limit complexity and confusion.

      Manage an IT Budget

      • No one likes to be over budget, but being under budget isn't necessarily good either.
      • Implement a budget management process that documents your planned budget and actual expenditures, tracks variances, and responds to those variances to stay on track.
      • Control for under- or overspending using Info Tech's budget management tool and tactics.

      APPENDIX

      Sample shared business services

      Sample industry-specific business services

      Sample shared business functions

      Business function Definition
      Human Resources The management of the recruitment, training, development, appraisal, compensation/reward, retention, and departure of employees in an organization. Does not include management of subcontractor or outsourced relationships.
      Finance and Accounting The management and analysis of an organization's revenue, funds, spend, investments, financial transactions, accounts, and financial statements. Often includes enterprise asset management.
      Procurement and Supplier Management Acquiring materials, goods, and services from an external party, including identifying potential suppliers/providers, managing tendering or bidding processes, negotiating terms and agreements, and managing the relationship with the vendor/provider.
      Information Technology The development, management, and optimization of information technology resources and systems over their lifecycle in support of an organization's work priorities and goals. Includes computer-based information and communication systems, but typically excludes industrial operational technologies.
      Legal Expertise in interpretation, implication, and application of legislation and regulation that affects the enterprise, including guidance and support in the areas of risk, contracting, compliance, ownership, and litigation.
      Regulatory Affairs and Compliance Management Identification, operationalization, monitoring, reporting, and enforcement of the standards, rules, codes, and laws that apply to an organization's operating environment and the products and services it offers.
      Sales Transactional provision of a product or service to a buyer at an agreed-upon price. Includes identifying and developing prospective buyers, presenting and explaining the product/service, overcoming prospect objections and concerns to purchase, negotiating terms, developing contracts, and billing or invoicing.
      Customer Service and Support A range of activities designed to optimize the customer experience with an organization and its products and services throughout the customer lifecycle with the goals of retaining the customer; encouraging additional spend or consumption; the customer positively influencing other potential customers; and minimizing financial and reputational business risks.
      Marketing and Advertising Understanding customer/prospect needs, developing strategies to meet those needs, and promotion of the organization's products/services to a target market via a range of channels to maximize revenue, membership, donations, and/or develop the organization's brand or reputation. Includes market research and analysis and promotion, campaign, and brand management.

      Sample industry-specific functions

      Supply chain and capital-intensive industries.

      Industry function Definition
      Product Innovation Research, design, development, and launch of new products, including the engineering of their underlying production processes.
      Product and Service Portfolio Management The management of an organization's collection of products and services, including management of the product/service roadmap; product/service portfolio and catalog; product/service quality and performance; and product/service pricing, bundling and markdown.
      Logistics and Supply Chain Management Sourcing raw materials or component parts needed and shipping of a finished product. Includes demand planning; procurement/supplier management; inventory management; yard management; allocation management; fulfillment and replenishment; and product distribution and delivery.
      Production Operations Manufacture, storage, and tracking of a product and ensuring product and production process quality. Includes operations management, materials management, quality/safety control, packaging management, and management of the tools, equipment, and technologies that support it.
      Architecture & Engineering The design and planning of structures or critical infrastructure systems according to scientific, functional, and aesthetic principles.
      Construction New construction, assembly, or alteration of buildings and critical infrastructure (e.g. transportation systems; telecommunications systems; utilities generation/transmission/distribution facilities and systems). Includes management of all construction project plans and the people, materials, and equipment required to execute.
      Real Estate Management Management of any residential, commercial, or industrial real estate holdings (land and buildings), including any financial dealings such as its purchase, sale, transfer, and rental as well as ongoing maintenance and repair of associated infrastructure and capital assets.

      Sample industry-specific functions

      Financial services and insurance industries.

      Industry function Definition
      Core Banking Services Includes ATM management; account management (opening, deposit/withdrawal, interest calculation, overdraft management, closing); payments processing; funds transfers; foreign currency exchange; cash management.
      Loan, Mortgage, and Credit Services Includes application, adjudication, and approval; facility; disbursement/card issuance; authorization management; merchant services; interest calculation; billing/payment; debt/collections management.
      Investment and Wealth Management Processes for the investment of premiums/monies received from policy holders/customers to generate wealth. Often two-pronged: internal investment to fund claim payout in the case of insurance, and customer-facing investment as a financial service (e.g. retirement planning/annuities). Includes product development and management, investment management, safety deposit box services, trust management services.
      Actuarial Analysis & Policy Creation Development of new policy products based on analysis of past losses and patterns, forecasts of financial risks, and assessment of potential profitability (i.e. actuarial science). These processes also include development of rate schedules (pricing) and the reserves that the insurer needs to have available for potential claim payouts.
      Underwriting & Policy Administration Processes for assessing risk of a potential policy holder; determining whether to insure them or not; setting the premiums the policy holder must pay; and administering the policy over the course of its lifecycle (including updates and billing).
      Claims Processing & Claims Management Processes for receiving, investigating, evaluating, approving/denying, and disbursing a claim payout. This process is unique to the insurance industry. In health insurance, ongoing case management processes need to be considered here whereby the insurer monitors and approves patient treatments over a long-term basis to ensure that the treatments are both necessary and beneficial.

      Sample industry-specific functions

      Healthcare industry

      Industry function Definition
      Patient Intake & Admissions Processes whereby key pieces of information about a patient are registered, updated, or confirmed with the healthcare provider in order to access healthcare services. Includes patient triage, intake management, and admissions management. These processes are generally administrative in nature.
      Patient Diagnosis A range of methods for determining the medical condition a patient has in order to provide appropriate care or treatment. Includes examination, consultation, testing, and diagnostic imaging.
      Patient Treatment The range of medical procedures, methods, and interventions to mitigate, relieve, or cure a patient's symptom, injury, disease, or other medical condition. Includes consultation and referral; treatment and care planning; medical procedure management; nursing and personal support; medicine management; trauma management; diet and nutrition management; and patient transportation.
      Patient Recovery & Ongoing Care Processes and methods for tracking the progress of a patient post-treatment; improving their health outcomes; restoring, maintaining, or improving their quality of life; and discharging or transferring them to other providers. Includes remote monitoring of vital parameters, physical therapy, post-trauma care, and a range of restorative and lifestyle modification programs.

      Sample industry-specific functions

      Gaming and hospitality industries

      Industry function Definition
      Accommodation Short-term lodging in hotel facilities. Includes management and maintenance of guest rooms and common spaces, amenities (e.g. swimming pool), and other related services (e.g. valet parking).
      Gaming Includes table wagering games and gambling activities such as slot machines or any other activity that includes on premises mobile casino gaming.
      Food & Beverage Services Food and beverages prepared, served, or available for sale by the hotel on the hotel premises via restaurants and bars and room service. Excludes catering (see Events Management) and management or operation of independent leased food and beverage establishments located on the hotel premises.
      Entertainment & Events Planning, coordination, and on-premises hosting of events including conferences, conventions, trade shows, parties, ceremonies and live entertainment, and other forms of recreation on the hotel premises. Includes all aspects of entertainment operations, facility management and catering for the event.

      Manage Poor Performance While Working From Home

      • Buy Link or Shortcode: {j2store}599|cart{/j2store}
      • member rating overall impact: 9.0/10 Overall Impact
      • member rating average dollars saved: $1,600 Average $ Saved
      • member rating average days saved: 18 Average Days Saved
      • Parent Category Name: Manage & Coach
      • Parent Category Link: /manage-coach
      • For many, emergency WFH comes with several new challenges such as additional childcare responsibilities, sudden changes in role expectations, and negative impacts on wellbeing. These new challenges, coupled with previously existing ones, can result in poor performance. Owing to the lack of physical presence and cues, managers may struggle to identify that an employee’s performance is suffering. Even after identifying poor performance, it can be difficult to address remotely when such conversations would ideally be held in person.

      Our Advice

      Critical Insight

      • Poor performance must be managed, despite the pandemic. Evaluating root causes of performance issues is more important than ever now that personal factors such as lack of childcare and eldercare for those working from home are complicating the issue.

      Impact and Result

      • Organizations need to have a clear process for improving performance for employees working remotely during the COVID-19 pandemic. Provide managers with resources to help them identify performance issues and uncover their root causes as part of addressing overall performance. This will allow managers to connect employees with the required support while working with them to improve performance.

      Manage Poor Performance While Working From Home Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Follow the remote performance improvement process

      Determine how managers can identify poor performance remotely and help them navigate the performance improvement process while working from home.

      • Manage Poor Performance While Working From Home Storyboard
      • Manage Poor Performance While Working From Home: Manager Guide
      • Manage Poor Performance While Working From Home: Infographic

      2. Clarify roles and leverage resources

      Clarify roles and responsibilities in the performance improvement process and tailor relevant resources.

      • Wellness and Working From Home
      [infographic]

      Further reading

      Manage Poor Performance While Working From Home

      Assess and improve remote work performance with our ready-to-use tools.

      Executive Summary

      McLean & Company Insight

      Poor performance must be managed, despite the pandemic. Evaluating root causes of performance issues is more important than ever now that personal factors such as lack of childcare and eldercare for those working from home are complicating the issue.

      Situation

      COVID-19 has led to a sudden shift to working from home (WFH), resulting in a 72% decline in in-office work (Ranosa, 2020). While these uncertain times have disrupted traditional work routines, employee performance remains critical, as it plays a role in determining how organizations recover. Managers must not turn a blind eye to performance issues but rather must act quickly to support employees who may be struggling.

      Complication

      For many, emergency WFH comes with several new challenges such as additional childcare responsibilities, sudden changes in role expectations, and negative impacts on wellbeing. These new challenges, coupled with previously existing ones, can result in poor performance. Owing to the lack of physical presence and cues, managers may struggle to identify that an employee’s performance is suffering. Even after identifying poor performance, it can be difficult to address remotely when such conversations would ideally be held in person.

      Solution

      Organizations need to have a clear process for improving performance for employees working remotely during the COVID-19 pandemic. Provide managers with resources to help them identify performance issues and uncover their root causes as part of addressing overall performance. This will allow managers to connect employees with the required support while working with them to improve performance.

      Manage Poor Performance While Working From Home is made up of the following resources:

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide
      Storyboard

      This storyboard is organized by the four steps of the performance improvement process: identify, initiate, deploy, and follow up/decide. These will appear on the left-hand side of the slides as a roadmap.

      The focus is on how HR can design the process for managing poor performance remotely and support managers through it while emergency WFH measures are in place. Key responsibilities, email templates, and relevant resources are included at the end.

      Adapt the process as necessary for your organization.

      Manager Guide

      The manager guide contains detailed advice for managers on navigating the process and focuses on the content of remote performance discussions.

      It consists of the following sections:

      • Identifying poor performance.
      • Conducting performance improvement discussions.
      • Uncovering and addressing root causes of poor performance.
      Manager Infographic

      The manager infographic illustrates the high-level steps of the performance improvement process for managers in a visually appealing and easily digestible manner.

      This can be used to easily outline the process, providing managers with a resource to quickly reference as they navigate the process with their direct reports.

      In this blueprint, “WFH” and “remote working” are used interchangeably.

      This blueprint will not cover the performance management framework; it is solely focused on managing performance issues.

      For information on adjusting the regular performance management process during the pandemic, see Performance Management for Emergency Work-From-Home.

      Identify how low performance is normally addressed

      A process for performance improvement is not akin to outlining the steps of a performance improvement plan (PIP). The PIP is a development tool used within a larger process for performance improvement. Guidance on how to structure and use a PIP will be provided later in this blueprint.

      Evaluate how low performance is usually brought to the attention of HR in a non-remote situation:
      • Do managers approach HR for an employee transfer or PIP without having prior performance conversations with the employee?
      • Do managers come to HR when they need support in developing an employee in order to meet expectations?
      • Do managers proactively reach out to HR to discuss appropriate L&D for staff who are struggling?
      • Do some departments engage with the process while others do not?
      Poor performance does not signal the immediate need to terminate an employee. Instead, managers should focus on helping the struggling employee to develop so that they may succeed.
      Evaluate how poor performance is determined:
      • Do managers use performance data or concrete examples?
      • Is it based on a subjective assessment by the manager?
      Keep in mind that “poor performance” now might look different than it did before the pandemic. Employees must be aware of the current expectations placed on them before they can be labeled as underperforming – and the performance expectations must be assessed to ensure they are realistic.

      For information on adjusting performance expectations during the pandemic, see Performance Management for Emergency Work-From-Home.

      The process for non-union and union employees will likely differ. Make sure your process for unionized employees aligns with collective agreements.

      Determine how managers can identify poor performance of staff working remotely

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide
      Identify: Determine how managers can identify poor performance.
      In person, it can be easy to see when an employee is struggling by glancing over at their desk and observing body language. In a remote situation, this can be more difficult, as it is easy to put on a brave face for the half-hour to one-hour check-in. Advise managers on how important frequent one-one-ones and open communication are in helping identify issues when they arise rather than when it’s too late.

      Managers must clearly document and communicate instances where employees aren’t meeting role expectations or are showing other key signs that they are not performing at the level expected of them.

      What to look for:
      • PM data/performance-related assessments
      • Continual absences
      • Decreased quality or quantity of output
      • Frequent excuses (e.g. repeated internet outages)
      • Lack of effort or follow-through
      • Missed deadlines
      • Poor communication or lack of responsiveness
      • Failure to improve
      It’s crucial to acknowledge an employee might have an “off week” or need time to adjust to working from home, which can be addressed with performance management techniques. Managers should move into the process for performance improvement when:
      • Performance fluctuates frequently or significantly.
      • Performance has dropped for an extended period of time.
      • Expectations are consistently not being met.

      While it’s important for managers to keep an eye out for decreased performance, discourage them from over-monitoring employees, as this can lead to a damaging environment of distrust.

      Support managers in initiating performance conversations and uncovering root causes

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide
      Initiate: Require that managers have several conversations about low performance with the employee.
      Before using more formal measures, ensure managers take responsibility for connecting with the employee to have an initial performance conversation where they will make the performance issue known and try to diagnose the root cause of the issue.

      Coach managers to recognize behaviors associated with the following performance inhibitors:

      Personal Factors

      Personal factors, usually outside the workplace, can affect an employee’s performance.

      Lack of clarity

      Employees must be clear on performance expectations before they can be labeled as a poor performer.

      Low motivation

      Lack of motivation to complete work can impact the quality of output and/or amount of work an employee is completing.

      Inability

      Resourcing, technology, organizational change, or lack of skills to do the job can all result in the inability of an employee to perform at their best.

      Poor people skills

      Problematic people skills, externally with clients or internally with colleagues, can affect an employee’s performance or the team’s engagement.

      Personal factors are a common performance inhibitor due to emergency WFH measures. The decreased divide between work and home life and the additional stresses of the pandemic can bring up new cases of poor performance or exacerbate existing ones. Remind managers that all potential root causes should still be investigated rather than assuming personal factors are the problem and emphasize that there can be more than one cause.

      Ensure managers continue to conduct frequent performance conversations

      Once an informal conversation has been initiated, the manager should schedule frequent one-on-one performance conversations (above and beyond performance management check-ins).

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide
      Explain to managers the purpose of these discussions is to:
      • Continue to probe for root causes.
      • Reinforce role expectations and performance targets.
      • Follow up on any improvements.
      • Address the performance issue and share relevant resources (e.g. HR or employee assistance program [EAP]).
      Given these conversations will be remote, require managers to:
      • Use video whenever possible to read physical cues and body language.
      • Bookend the conversation. Starting each meeting by setting the context for the discussion and finishing with the employee reiterating the key takeaways back will ensure there are no misunderstandings.
      • Document the conversation and share with HR. This provides evidence of the conversations and helps hold managers accountable.
      What is HR’s role? HR should ensure that the manager has had multiple conversations with the employee before moving to the next step. Furthermore, HR is responsible for ensuring manages are equipped to have the conversations through coaching, role-playing, etc.

      For more information on the content of these conversations or for material to leverage for training purposes, see Manage Poor Performance While Working From Home: Manager Guide.

      McLean & Company Insight

      Managers are there to be coaches, not therapists. Uncovering the root cause of poor performance will allow managers to pinpoint supports needed, either within their expertise (e.g. coaching, training, providing flexible hours) or by directing the employee to proper external resources such as an EAP.

      Help managers use formal performance improvement tools with remote workers

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide
      Deploy: Use performance improvement tools.
      If initial performance conversations were unsuccessful and performance does not improve, refer managers to performance improvement tools:
      • Suggest any other available support and resources they have not yet recommended (e.g. EAP).
      • Explore options for co-creation of a development plan to increase employee buy-in. If the manager has been diligent about clarifying role expectations, invite the employee to put together their own action plan for meeting performance goals. This can then be reviewed and finalized with the manager.
      • Have the manager use a formal PIP for development and to get the employee back on track. Review the development plan or PIP with the manager before they share it with the employee to ensure it is clear and has time bound, realistic goals for improvement.
      Using a PIP solely to avoid legal trouble and terminate employees isn’t true to its intended purpose. This is what progressive discipline is for.In the case of significant behavior problems, like breaking company rules or safety violations, the manager will likely need to move to progressive discipline. HR should advise managers on the appropriate process.

      When does the issue warrant progressive discipline? If the action needs to stop immediately, (e.g. threatening or inappropriate behavior) and/or as outlined in the collective agreement.

      Clarify remote PIP stages and best practices

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide
      Sample Stages:
      1. Written PIP
      • HR reviews and signs off on PIP
      • Manager holds meeting to provide employee with PIP
      • Employee reviews the PIP
      • Manager and employee provide e-signatures
      • Signed PIP is given to HR
      2. Possible Extension
      3. Final Notice
      • Manager provides employee with final notice if there has been no improvement in agreed time frame
      • Copy of signed final notice letter given to HR

      Who is involved?

      The manager runs the meeting with the employee. HR should act as a support by:

      • Ensuring the PIP is clear, aligned with the performance issue, and focused on development, prior to the meeting.
      • Pointing to resources and making themselves available prior to, during, and after the meeting.
        • When should HR be involved? HR should be present in the meeting if the manager has requested it or if the employee has approached HR beforehand with concerns about the manager. Keep in mind that if the employee sees HR has been unexpectedly invited to the video call, it could add extra stress for them.
      • Reviewing documentation and ensuring expectations and the action plan are reasonable and realistic.

      Determine the length of the PIP

      • The length of the initial PIP will often depend on the complexity of the employee’s role and how long it will reasonably take to see improvements. The minimum (before a potential extension) should be 30-60 days.
      • Ensure the action plan takes sustainment into account. Employees must be able to demonstrate improvement and sustain improved performance in order to successfully complete a PIP.

      Timing of delivery

      Help the manager determine when the PIP meeting will occur (what day, time of day). Take into account the schedule of the employee they will be meeting with (e.g. avoid scheduling right before an important client call).

      1

      Identify

      2

      Initiate

      3

      Deploy

      4

      a) Follow Up
      b) Decide

      Follow up: If the process escalated to step 3 and is successful.

      What does success look like? Performance improvement must be sustained after the PIP is completed. It’s not enough to simply meet performance improvement goals and expectations; the employee must continue to perform.

      Have the manager schedule a final PIP review with the employee. Use video, as this enables the employee and manager to read body language and minimize miscommunication/misinterpretation.

      • If performance expectations have been met, instruct managers to document this in the PIP, inform the employee they are off the PIP, and provide it to HR.

      The manager should also continue check-ins with the employee to ensure sustainment and as part of continued performance management.

      • Set a specific timeline, e.g. every two weeks or every month. Choose a cadence that works best for the manager and employee.

      OR

      Decide: Determine action steps if the process is unsuccessful.

      If at the end of step 3 performance has not sufficiently improved, the organization (HR and the manager) should either determine if the employee could/should be temporarily redeployed while the emergency WFH is still in place, if a permanent transfer to a role that is a better fit is an option, or if the employee should be let go.

      See the Complete Manual for COVID-19 Layoffs blueprint for information on layoffs in remote environments.

      Managers, HR, and employees all have a role to play in performance improvement

      Managers
      • Identify the outcomes the organization is looking for and clearly outline and communicate the expectations for the employee’s performance.
      • Diagnose root cause(s) of the performance issue.
      • Support employee through frequent conversations and feedback.
      • Coach for improved performance.
      • Visibly recognize and broadcast employee achievements.
      Employees
      • Have open and honest conversations with their manager, acknowledge their accountability, and be receptive to feedback.
      • Set performance goals to meet expectations of the role.
      • Prepare for frequent check-ins regarding improvement.
      • Seek support from HR as required.
      HR
      • Provide managers with a process, training, and support to improve employee performance.
      • Coach managers to ensure employees have been made aware of their role expectations and current performance and given specific recommendations on how to improve.
      • Reinforce the process for improving employee performance to ensure that adequate coaching conversations have taken place before the formal PIP.
      • Coach employees on how to approach their manager to discuss challenges in meeting expectations.

      HR should conduct checkpoints with both managers and employees in cases where a formal PIP was initiated to ensure the process for performance improvement is being followed and to support both parties in improving performance.

      Email templates

      Use the templates found on the next slides to draft communications to employees who are underperforming while working from home.

      Customize all templates with relevant information and use them as a guide to further tailor your communication to a specific employee.

      Customization Recommendations

      Review all slides and adjust the language or content as needed to suit the needs of the employee, the complexity of their role, and the performance issue.

      • The pencil icon to the left denotes slides requiring customization of the text. Customize text in grey font and be sure to convert all font to black when you are done.

      Included Templates

      1. Performance Discussion Follow-Up
      2. PIP Cover Letter

      This template is not a substitute for legal advice. Ensure you consult with your legal counsel, labor relations representative, and union representative to align with collective agreements and relevant legislation.

      Sample Performance Discussion Follow-Up

      Hello [name],

      Thank you for the commitment and eagerness in our meeting yesterday.

      I wanted to recap the conversation and expectations for the month of [insert month].

      As discussed, you have been advised about your recent [behavior, performance, attendance, policy, etc.] where you have demonstrated [state specific issue with detail of behavior/performance of concern]. As per our conversation, we’ll be working on improvement in this area in order to meet expectations set out for our employees.

      It is expected that employees [state expectations]. Please do not hesitate to reach out to me if there is further clarification needed or you if you have any questions or concerns. The management team and I are committed to helping you achieve these goals.

      We will do a formal check-in on your progress every [insert day] from [insert time] to review your progress. I will also be available for daily check-ins to support you on the right track. Additionally, you can book me in for desk-side coaching outside of my regular desk-side check-ins. If there is anything else I can do to help support you in hitting these goals, please let me know. Other resources we discussed that may be helpful in meeting these objectives are [summarize available support and resources]. By working together through this process, I have no doubt that you can be successful. I am here to provide support and assist you through this.

      If you’re unable to show improvements set out in our discussion by [date], we will proceed to a formal performance measure that will include a performance improvement plan. Please let me know if you have any questions or concerns; I am here to help.

      Please acknowledge this email and let me know if you have any questions.

      Thank you,

      PIP Cover Letter

      Hello [name] ,

      This is to confirm our meeting on [date] in which we discussed your performance to date and areas that need improvement. Please find the attached performance improvement plan, which contains a detailed action plan that we have agreed upon to help you meet role expectations over the next [XX days]. The aim of this plan is to provide you with a detailed outline of our performance expectations and provide you the opportunity to improve your performance, with our support.

      We will check in every [XX days] to review your progress. At the end of the [XX]-day period, we will review your performance against the role expectations set out in this performance improvement plan. If you don’t meet the performance requirements in the time allotted, further action and consequences will follow.

      Should you have any questions about the performance improvement plan or the process outlined in this document, please do not hesitate to discuss them with me.

      [Employee name], it is my personal objective to help you be a fully productive member of our team. By working together through this performance improvement plan, I have no doubt that you can be successful. I am here to provide support and assist you through the process. At this time, I would also like to remind you about the [additional resources available at your organization, for example, employee assistance program or HR].

      Please acknowledge this email and let me know if you have any questions.

      Thank you,

      Prepare and customize manager guide and resources

      Sample of Manage Poor Performance While Working From Home: Manager Guide. Manage Poor Performance While Working From Home: Manager Guide

      This tool for managers provides advice on navigating the process and focuses on the content of remote performance discussions.

      Sample of Set Meaningful Employee Performance Measures. Set Meaningful Employee Performance Measures

      See this blueprint for information on setting holistic measures to inspire employee performance.

      Sample of Manage Poor Performance While Working From Home: Infographic. Manage Poor Performance While Working From Home: Infographic

      This tool illustrates the high-level steps of the performance improvement process.

      Sample of Wellness and Working From Home: Infographic. Wellness and Working From Home: Infographic

      This tool highlights tips to manage physical and mental health while working from home.

      Sample of Build a Better Manager: Team Essentials. Build a Better Manager: Team Essentials

      See this solution set for more information on kick-starting the effectiveness of first-time IT managers with essential management skills.

      Sample of Leverage Agile Goal Setting for Improved Employee Engagement & Performance. Leverage Agile Goal Setting for Improved Employee Engagement & Performance

      See this blueprint for information on dodging the micromanaging foul and scoring with agile short-term goal setting.

      Bibliography

      Arringdale, Chris. “6 Tips For Managers Trying to Overcome Performance Appraisal Anxiety.” TLNT. 18 September 2015. Accessed 2018.

      Borysenko, Karlyn. “What Was Management Thinking? The High Cost of Employee Turnover.” Talent Management and HR. 22 April 2015. Accessed 2018.

      Cook, Ian. “Curbing Employee Turnover Contagion in the Workplace.” Visier. 20 February 2018. Accessed 2018.

      Cornerstone OnDemand. Toxic Employees in the Workplace. Santa Monica, California: Cornerstone OnDemand, 2015. Web.

      Dewar, Carolyn and Reed Doucette. “6 elements to create a high-performing culture.” McKinsey & Company. 9 April 2018. Accessed 2018.

      Eagle Hill. Eagle Hill National Attrition Survey. Washington, D.C.: Eagle Hill, 2015. Web.

      ERC. “Performance Improvement Plan Checklist.” ERC. 21 June 2017. Accessed 2018.

      Foster, James. “The Impact of Managers on Workplace Engagement and Productivity.” Interact. 16 March 2017. Accessed 2018.

      Godwins Solicitors LLP. “Employment Tribunal Statistics for 2015/2016.” Godwins Solicitors LLP. 8 February 2017. Accessed 2018.

      Mankins, Michael. “How to Manage a Team of All-Stars.” Harvard Business Review. 6 June 2017. Accessed 2018.

      Maxfield, David, et al. The Value of Stress-Free Productivity. Provo, Utah: VitalSmarts, 2017. Web.

      Murphy, Mark. “Skip Your Low Performers When Starting Performance Appraisals.” Forbes. 21 January 2015. Accessed 2018.

      Quint. “Transforming into a High Performance Organization.” Quint Wellington Redwood. 16 November 2017. Accessed 2018.

      Ranosa, Rachel. "COVID -19: Canadian Productivity Booms Despite Social Distancing." Human Resources Director, 14 April 2020. Accessed 2020.

      Get the Best Discount Possible With a Data-Driven Negotiation Approach

      • Buy Link or Shortcode: {j2store}610|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Selection & Implementation
      • Parent Category Link: /selection-and-implementation
      • Vendors have well-honed negotiation strategies that don’t prioritize the customer’s best interest, and they will take advantage of your weaknesses to extract as much money as they can from the deal.
      • IT teams are often working with time pressure and limited resources or experience in negotiation. Even those with an experienced procurement team aren’t evenly matched with the vendor when it comes to the ins and outs of the product.
      • As a result, many have a poor negotiation experience and fail to get the discount they wanted, ultimately leading to dissatisfaction with the vendor.

      Our Advice

      Critical Insight

      • Requirements should always come first, but IT leaders are under pressure to get discounts and cost ends up playing a big role in decision making.
      • Cost is one of the top factors influencing satisfaction with software and the decision to leave a vendor.
      • The majority of software customers are receiving a discount. If you’re in the minority who are not, there are strategies you can and should be using to improve your negotiating skills. Discounts of up to 40% off list price are available to those who enter negotiations prepared.

      Impact and Result

      • SoftwareReviews data shows that there are multiple benefits to taking a concerted approach to negotiating a discount on your software.
      • The most common ways of getting a discount (e.g. volume purchasing) aren’t necessarily the best methods. Choose a strategy that is appropriate for your organization and vendor relationship and that focuses on maximizing the value of your investment for the long term. Optimizing usage or licenses as a discount strategy leads to the highest software satisfaction.
      • Using a vendor negotiation service or advisory group was one of the most successful strategies for receiving a discount. If your team doesn’t have the right negotiation expertise, Info-Tech can help.

      Get the Best Discount Possible With a Data-Driven Negotiation Approach Research & Tools

      Prepare to negotiate

      Leverage insights from SoftwareReviews data to best position yourself to receive a discount through your software negotiations.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Get the Best Discount Possible with a Data-Driven Negotiation Approach Storyboard
      [infographic]

      Project Management

      • Buy Link or Shortcode: {j2store}48|cart{/j2store}
      • Related Products: {j2store}48|crosssells{/j2store}
      • member rating overall impact: 9.7/10
      • member rating average dollars saved: $303,499
      • member rating average days saved: 42
      • Parent Category Name: Project Portfolio Management and Projects
      • Parent Category Link: /ppm-and-projects

      The challenge

      • Ill-defined or even lack of upfront project planning will increase the perception that your IT department cannot deliver value because most projects will go over time and budget.
      • The perception is those traditional ways of delivering projects via the PMBOK only increase overhead and do not have value. This is less due to the methodology and more to do with organizations trying to implement best-practices that far exceed their current capabilities.
      • Typical best-practices are too clinical in their approach and place unrealistic burdens on IT departments. They fail to address the daily difficulties faces by staff and are not sized to fit your organization.
      • Take a flexible approach and ensure that your management process is a cultural and capacity fit for your organization. Take what fits from these frameworks and embed them tailored into your company.

      Our advice

      Insight

      • The feather-touch is often the right touch. Ensure that you have a lightweight approach for most of your projects while applying more rigor to the more complex and high-risk developments.
      • Pick the right tools. Your new project management processes need the right tooling to be successful. Pick a tool that is flexible enough o accommodate projects of all sizes without imposing undue governance onto smaller projects.
      • Yes, take what fits within your company from frameworks, but there is no cherry-picking. Ensure your processes stay in context: If you do not inform for effective decision-making, all will be in vain. Develop your methods such that guide the way to big-picture decision taking and support effective portfolio management.

      Impact and results 

      • The right amount of upfront planning is a function of the type of projects you have and your company. The proper levels enable better scope statements, better requirements gathering, and increased business satisfaction.
      • An investment in a formal methodology is critical to projects of all sizes. An effective process results in more successful projects with excellent business value delivery.
      • When you have a repeatable and consistent approach to project planning and execution, you can better communicate between the IT project managers and decision-makers.
      • Better communication improves the visibility of the overall project activity within your company.

      The roadmap

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Get started.

      Read our executive brief to understand why you should tailor project management practices to the type of projects you do and your company and review our methodology. We show you how we can support you.

      Lay the groundwork for project management success

      Assess your current capabilities to set the right level of governance.

      • Tailor Project Management Processes to Fit Your Projects – Phase 1: Lay the Groundwork for PM Success (ppt)
      • Project Management Triage Tool (xls)
      • COBIT BAI01 (Manage Programs and Projects) Alignment Workbook (xls)
      • Project Level Definition Matrix (xls)
      • Project Level Selection Tool (xls)
      • Project Level Assessment Tool (xls)
      • Project Management SOP Template (doc)

      Small project require a lightweight framework

      Increase small project's throughput.

      • Tailor Project Management Processes to Fit Your Projects – Phase 2: Build a Lightweight PM Process for Small Initiatives (ppt)
      • Level 1 Project Charter Template (doc)
      • Level 1 Project Status Report Template (doc)
      • Level 1 Project Closure Checklist Template (doc)

      Build the standard process medium and large-scale projects

      The standard process contains fully featured initiation and planning.

      • Tailor Project Management Processes to Fit Your Projects – Phase 3: Establish Initiation and Planning Protocols for Medium-to-Large Projects (ppt)
      • Project Stakeholder and Impact Assessment Tool (xls)
      • Level 2 Project Charter Template (doc)
      • Level 3 Project Charter Template (doc)
      • Kick-Off Meeting Agenda Template (doc)
      • Scope Statement Template (doc)
      • Project Staffing Plan(xls)
      • Communications Management Plan Template (doc)
      • Customer/Sponsor Project Status Meeting Template (doc)
      • Level 2 Project Status Report Template (doc)
      • Level 3 Project Status Report Template (doc)
      • Quality Management Workbook (xls)
      • Benefits Management Plan Template (xls)
      • Risk Management Workbook (xls)

      Build a standard process for the execution and closure of medium to large scale projects

      • Tailor Project Management Processes to Fit Your Projects – Phase 4: Develop Execution and Closing Procedures for Medium-to-Large Projects (ppt)
      • Project Team Meeting Agenda Template (doc)
      • Light Project Change Request Form Template (doc)
      • Detailed Project Change Request Form Template (doc)
      • Light Recommendation and Decision Tracking Log Template (xls)
      • Detailed Recommendation and Decision Tracking Log Template (xls)
      • Deliverable Acceptance Form Template (doc)
      • Handover to Operations Template (doc)
      • Post-Mortem Review Template (doc)
      • Final Sign-Off and Acceptance Form Template (doc)

      Implement your project management standard operating procedures (SOP)

      Develop roll-out and training plans, implement your new process and track metrics.

      • Tailor Project Management Processes to Fit Your Projects – Phase 5: Implement Your PM SOP (ppt)
      • Level 2 Project Management Plan Template (doc)
      • Project Management Process Costing Tool (xls)
      • Project Management Process Training Plan Template (doc)
      • Project Management Training Monitoring Tool (xls)
      • Project Management Process Implementation Timeline Tool (MS Project)
      • Project Management Process Implementation Timeline Tool (xls)

       

       

      Build Your Data Practice and Platform

      • Buy Link or Shortcode: {j2store}347|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management

      The complex nature of data investment leads to de-scoping and delivery of data services that do not meet business needs or give value to the business. Subject matter experts are hired to resolve the problem, but their success is impacted by absent architecture, technology, and organizational alignment.

      Our Advice

      Critical Insight

      Walking through a book of architecture building plans with a personal guide is cheaper and faster than employing an architect to build and design your home.

      Impact and Result

      Info-Tech's approach provides a proven methodology that includes the following:

      • Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives.
      • Comprehensive data practice designed based on the required business and data capabilities.
      • Data platform design based on Info-Tech data architecture reference patterns and prioritized data initiatives and capabilities.

      Build Your Data Practice and Platform Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Build Your Data Practice and Platform Storyboard – A step-by-step document that leverages road-tested patterns and frameworks to properly build your data practice and pattern in continuous alignment with the business landscape.

      Info-Tech's approach provides a proven methodology that includes following:   

    • Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives.
    • Comprehensive data practices designed based on the required business and data capabilities.
      • Build Your Data Practice and Platform Storyboard

      2. Data Practice and Platform Models – Leveraging best-of-breed frameworks to help you build a clear, concise, and compelling data practice and platform.

      Data practice & platform pre-build pattern templates based on Info-Tech data reference patterns and data platform design best practices.

      • Data Practice and Platform Models

      Infographic

      Workshop: Build Your Data Practice and Platform

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish Business Context and Value

      The Purpose

      Establish business context and value.

      Key Benefits Achieved

      Business context and strategic driver.

      Activities

      1.1 Understand/confirm the organization's strategic goals

      1.2 Classify the strategic goals and map to business drivers

      1.3 Identify the business capabilities that the strategy focuses on

      1.4 Identify the business processes realizing the strategy

      Outputs

      Business context and strategic drivers

      Prioritized business capabilities and processes

      Data culture survey results analysis

      2 Identify Your Top Initiatives

      The Purpose

      Identify your top initiatives.

      Key Benefits Achieved

      High-value business-aligned data initiative.

      Activities

      2.1 Highlight data-related outcomes/goals to realize to fulfill the business goal

      2.2 Map business data initiatives to the business strategic goals

      2.3 Prioritize data initiatives

      Outputs

      High-value, business-aligned data initiatives

      3 Analyze Data Challenges

      The Purpose

      Analyze data challenges.

      Key Benefits Achieved

      Clear understanding of the data challenges.

      Activities

      3.1 Map data challenges to Info-Tech data challenges

      3.2 Review Info-Tech data capabilities based on prioritized initiatives

      3.3 Discuss data platform and practice next steps

      Outputs

      List of data challenges preventing data maturation with the organization

      4 Map Data Capability

      The Purpose

      Map data capability.

      Key Benefits Achieved

      Prioritized data capability.

      Activities

      4.1 Map data challenges to Info-Tech data challenges

      4.2 Review Info-Tech data capabilities based on prioritized initiatives

      4.3 Discuss data platform and practice next steps

      Outputs

      Required data capabilities

      Data platform and practice – plan

      Initialized data management RACI 

      Further reading

      Build Your Data Practice and Platform

      Construct a scalable data foundation

      Analyst Perspective

      Build a data practice and platform that delivers value to your organization.

      The build or optimization of your data practice and data platform must be predicated on a thorough understanding of the organization’s goals, objectives, and priorities and the business capabilities and process they are meant to support and enable.

      Formalizing your practice or constructing your platform just for the sake of doing so often results in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.

      Leverage Info-Tech’s approach and incorporate our pre-built models and patterns to effectively navigate that crucial and often difficult phase upfront of comprehensively defining business data needs so you can ultimately realize faster time-to-delivery of your overall data practice and platform.

      Photo of Rajesh Parab, Director, Research & Advisory, Data & Analytics Practice, Info-Tech Research Group.

      Rajesh Parab
      Director, Research & Advisory, Data & Analytics Practice
      Info-Tech Research Group

      Photo of Crystal Singh, Director, Research & Advisory, Data & Analytics Practice, Info-Tech Research Group.

      Crystal Singh
      Director, Research & Advisory, Data & Analytics Practice
      Info-Tech Research Group

      Attempting to Solve Data Problems?

      Situation
      • Lack of data centric leadership results in downstream issues such as integration, quality, and accessibility.
      • The complex nature of the data and lack of understanding leads to de-scoping delivery of data services that does not meet business needs or add value.
      • Poorly designed practice and siloed platforms result in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.
      Complication
      • Data problem: When the data problem is diagnosed, the organization adopts a tactical approach.
      • Confirmation bias: Subject matter experts (SME) are hired to resolve the poorly defined problem, but the success of the SME is impacted by lack of architecture, technology, and organizational alignment.
      • Still no value: The selected tactical approach does not provide a solid foundation or solve your data problem.
      • Strategy for sake of strategy: Implementing a strategic approach for the sake of being strategic but this becomes overwhelming.
      • Fall back to tactical and operational: The data services are now potentially exposed and vulnerable, which strains business continuity and increases data debt.
      • Increased complexity and risk: Data silos, poor understanding, and high complexity results in an unmanageable data environment.
      Resolution
      • Requirements: Define and align your data requirement to business.
      • Capabilities: Discover data, identify data capabilities, and map your requirements.
      • Practices: Design and select fit-for-purpose data practices.
      • Platform: Optimize your data platform investments though sound architecture.

      Info-Tech Insight

      The true value of data comes from defining intentional relationships between the business and the data through a well thought out data platform and practice.

      Situation – Perpetual Data Problem

      Diagram of a head with gears around it and speech bubbles with notes titled 'Data Problem'. The surrounding gears, clockwise from bottom left, say 'Accessibility', 'Trust', 'Data Breach', 'Ambiguity', 'Ownership', 'Duplication', 'System Failure', and 'Manual Manipulation'. The speech bubbles notes, clockwise from bottom left, say 'Value-Add: How do I translate business needs to data capabilities?', 'Practice Organization: How do I organize resources and roles assignment challenges?', 'Platform: How do I organize data flows with no conceptual view of the environment?', and 'Break Down Silos: How do I break down silos?'
      I can’t access the data.
      I don’t trust the data in the report.
      It takes too long to get to the data for decision making
      • Lack of data-centric leadership results in downstream issues: integration, quality, accessibility
      • The organization’s data is too complex to manage without a cohesive plan.
      • The complex nature of the data and a lack of understanding leads to de-scoping delivery of data services that does not meet business needs or add value.
      • Poorly designed practice and siloed platforms result in an initiative that is lengthy, costly, fizzles out, does not deliver business value, and ends up being considered a failure.

      Complication – Data Initiative Fizzles Out

      • Data problem: When the data problem is diagnosed the organization adopts a tactical approach.
      • Confirmation bias: Subject matter experts (SME) are hired to resolve the poorly defined problem, but the success of the SME is impacted by lack of architecture, technology, and organizational alignment.
      • Still no value: the selected tactical approach does not provide a solid foundation or solve your data problem.
      • Strategy for sake of strategy: Implementing a strategic approach for sake of being strategic but this becomes overwhelming.
      • Fall back to tactical and operational: The data services are now potentially exposed and vulnerable, which strains business continuity and increases data debt.
      • Increased complexity and risk: Data silos, poor understanding, and high complexity result in an unmanageable data environment.
      Flowchart beginning with 'Data Symptom Exhibited' and 'Data Problem Diagnosed', then splitting into two paths 'Solve Data Problem as a point solution' or 'Attempt Strategic approach without culture, capacity, and business leadership'. Each approach ends with 'Data too complex, and initiative fizzles out...' and cycles back to the beginning.
      Use the road-tested patterns and frameworks in our blueprint to break the perpetual data solution cycle. Focus on the value that a data and analytics platform will bring rather than focusing on the data problems alone.

      Build Your Data Practice and Platform

      Bring Your Data Strategy to Life

      Logo for Info-Tech.
      Logo for #iTRG.
      CONVENTIONAL WISDOM

      Attempting to Solve Your Data Problems

      DATA SYMPTOM EXHIBITED

      Mismatch report, data quality issue, or similar symptom of a data problem.

      DATA PROBLEM DIAGNOSED

      Data expert identifies it as a data problem.

      COMPLEX STRATEGIC APPROACH ATTEMPTED

      Recognized need to attempt it strategically, but don't have capacity or culture to execute.

      Cycle diagram titled 'Data Problems' with numbers connected to surrounding steps, and a break after Step 3 where one can 'BREAK THE CYCLE'. In the middle are a list of data problems: 'Accessibility’, ‘Data Breach', 'Manual Manipulation', 'System Failure', 'Ambiguity', 'Duplication', 'Ownership', and 'Trust'.
      SOLUTION FAILS

      The tactical solution fails to solve the root cause of the data problem, and the data symptoms persist.

      TACTICAL SOLUTION FALLBACK

      A quick and dirty solution is attempted in order to fix the data problem.

      THE COMPLEX APPROACH FIZZLES OUT

      Attempted strategic approach takes too long, fizzles out.

      BREAK THE CYCLE

      Solving Your Data Problems

      1. DEFINE YOUR DATA REQUIREMENTS Incorporate a Business to Data Approach by utilizing Info-Tech's business capability templates for identifying data needs. BUSINESS-ALIGNED DATA REQUIREMENTS
      2. CONDUCT YOUR DATA DISCOVERY Understand the data behind your business problem. Identify the required data capabilities and domains as required by your business processes. RECOMMENDED DATA CAPABILITIES
      3. DESIGN YOUR DATA PRACTICES Build your custom data practices based on the predefined reusable models. CUSTOMIZED DATA PRACTICE
      4. ARCHITECT YOUR DATA PLATFORM Build your custom data platform based on the redefined reusable architecture patterns. CUSTOMIZED DATA PLATFORM
      CONTINUOUS PHASE: ROADMAP, SPONSORSHIP FEEDBACK AND DELIVERY

      Develop a roadmap to establish the practice and implement the architecture as designed. Ensure continuous alignment of the practice and architecture with the business landscape.

      Phase-by-Phase Approach to Build Your Data Practice and Platform

      Flowchart detailing the path to take through the four phases of this blueprint beginning with the 'Inputs' and 'People' involved and incorporating 'Deliverables' along the way. Phase-by-Phase Approach
      • Phase 1: Step 1 – Define Your Data Requirement
      • Phase 1: Step 2 – Conduct Your Data Discovery
      • Phase 2 – Design Your Data Practice
      • Phase 3 – Architect Your Data Platform

      Measure value when building your data practice and platform

      Sample Data Management Metrics

      Lists of data management metrics in different categories.

      • Refine the metrics for the overall Data Management practice and every initiative therein.
      • Refine the metrics at each platform and practice component to show business value against implementation effort.

      Understand and Build Data Culture

      See your Info-Tech Account Representative for more details on our Data Culture Diagnostic

      Only 14.29% of Transportation and Logistics respondents agree BI and Analytics Process and Technology are sufficient What is a diagnostic?

      Our diagnostics are the simplest way to collect the data you need, turn it into actionable insights, and communicate with stakeholders across the organization.

      52.54% of respondents from the healthcare industry are unaware of their organization’s data security policy
      Ask the Right Questions

      Use our low-effort surveys to get the data you need from stakeholders across the organization.

      Use Our Diagnostic Engine

      Our diagnostic engine does all the heavy lifting and analysis, turning your data into usable information.

      Communicate & Take Action

      Wow your executives with the incredible insights you've uncovered. Then, get to action: make IT better.

      On average only 40% agree that they have the reporting when needed


      (Source: Info-Tech’s Data Culture Diagnostic, 53 Organizations, 3138 Responses)

      35% of respondents feel that a governance body is in place looking at strategic data

      Build a Data-Driven Strategy Using Info-Tech Diagnostic Programs

      Make informed IT decisions by starting your diagnostic program today. Your account manager is waiting to help you.
      Sample of Info-Tech's 'Data Culture Scorecard'.

      Use Our Predefined Data and Analytics Patterns to Build Your DnA Landscape

      Walking through a book of architecture building plans with a personal guide is cheaper and faster than employing an architect to build and design your home

      Two books titled 'The Everything Homebuilding Book' and 'Architecture 101'. An open book with a finger pointing to a diagram.

      The first step is to align business strategy with data strategy and then start building your data practice and data platform

      Flowchart starting with business strategy focuses, then to data strategy focuses, and eventually to 'Data Metrics'.

      Insights

      The true value of data comes from defining intentional relationships between the business and the data through a well-thought-out data platform and practice.

      • Phase 1
        • Some organizations are low maturity so using the traditional Capability Maturity Model Integration (CMMI) would not make sense. A great alternative is to leverage existing models and methodologies to get going off the bat.
        • The Data Strategy is an input into the platform and practice. This is considered the Why; Data Practice and Platform is the How.
      • Phase 2
        • Info-Tech’s approach is business-goal driven and it leverages patterns, which enable the implementation of critical and foundational components and subsequently facilitates the evolution and development of the practice over time.
        • Systems should not be designed in isolation. Cross-functional collaboration throughout the design is critical to ensure all types of issues are revealed early. Otherwise, crucial tests are omitted, deployments fail, and end-users are dissatisfied.
      • Phase 3
        • Build your conceptual data architecture based on well-thought-out formulated patterns that align with your organization’s needs and environment.
        • Functional needs often take precedence over quality architecture. Quality must be baked into design, execution, and decision-making practices to ensure the right trade-offs are made.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Info-Tech’s Methodology for Building Your Data Practice and Platform

      Phase 1 –
      Define Your Data Requirements and Conduct Your Data Discovery
      Phase 2 –
      Design Your Data Practices
      Phase 3 –
      Architect Your Data Platform
      Phase Steps
      1. Identify your top initiatives
      2. Map your data initiatives to data capabilities
      1. Understand the practices value statement
      2. Review the Info-Tech practice pattern
      3. Initiate your practice design and setup
      1. Identify your data component
      2. Refine your data platform architecture
      3. Design your data platform
      4. Identify your new components and capabilities
      5. Initiative platform build and rollout
      Phase Outcomes Business-aligned data initiatives and capabilities that address data challenges and realize business strategic objectives Comprehensive data practice design based on the required business and data capabilities Data platform design based on Info-Tech data architecture reference pattern and prioritized data initiatives and capabilities

      Data Platform and Practice Implementation Plan

      Example timeline for data platform and practice implementation plan with 'Fiscal Years' across the top, and below they're broken down into quarters. Along the left side 'Phase 1: Step 1...', 'Phase 1: Step 2...', 'Phase 2...' and 'Phase 3'. Tasks are mapped onto the timeline in each phase with a short explanation.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Info-Tech’s Workshop support for Build Your Data Practice and Platform. 'Build Your Data Practice and Platform' slide from earlier.
      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Workshop 1

      Data Needs and Discovery

      Workshop 2

      Data Practice Design

      Workshop 3

      Data Platform Design

      Workshop 1:
      Data Needs and Discovery

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Day 1 Day 2 Day 3 Day 4
      Establish Business Context and Value
      Identify Your Top Initiatives
      Analyze Data Challenges
      Map Data Capability
      Activities

      1.1 Understand/confirm your organization’s strategic goals

      1.2 Classify the strategic goals and map to business drivers

      1.3 Identify the business capabilities that the strategy focus is on

      1.4 Identify the business processes realizing the strategy

      2.1 Highlight data-related outcomes /goals to realize to fulfill the business goal

      2.2 Map business data initiatives to the business strategic goals

      2.3 Prioritize Data initiatives

      3.1 Understand data management capabilities and framework

      3.2 Classify business data requirements using Info-Tech’s classification approach

      3.3 Highlight data challenges in your current environment

      4.1 Map data challenges to Info-Tech data challenges

      4.2 Review Info-Tech data capabilities based on prioritized initiative

      4.3 Discuss Data Platform and Practice Next Steps

      Deliverables
      • Business context and strategic drivers
      • Prioritized business capabilities and processes
      • Data Culture Survey results analysis
      • High-value business-aligned data initiative
      • List of data challenges preventing data maturation with the organization
      • Required data capabilities
      • Data platform and practice – plan
      • Initialized data management RACI
      Participants Business stakeholder, Business leader Business Subject Matter Expert, Data IT sponsor (CIO), Head of Data, Data Architect Business stakeholder, Business leader Business Subject Matter Expert, Data IT sponsor (CIO), Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect

      Workshop 2:
      Data Practice Design

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Day 1 Day 2 Day 3 Day 4
      Plan Your Data Practices
      Design Your Data Practices 1
      Design Your Data Practices 2
      Design Your Data Practices 3
      Activities

      Prerequisite: Business context, business data requirement, and data capabilities

      1.1 Understand data practice framework

      1.2 Define your practice implementation approach

      1.3 Review and update data management RACI

      2.1 Understand Info-Tech data practice patterns for each prioritized practice

      2.2 Define your practice setup for each prioritized practice

      2.3 Highlight critical processes for each practice

      3.1 Understand Info-Tech data practice patterns for each prioritized practice

      3.2 Define your practice setup for each prioritized practice

      3.3 Highlight critical processes for each practice

      4.1 Understand Info-Tech data practice patterns for each prioritized practice

      4.2 Define your practice setup for each prioritized practice

      4.3 Highlight critical processes for each practice

      4.4 Discuss data platform and practice next steps

      Deliverables
      • Data practice implementation approach
      • Data management RACI
      • Data practice setup pattern for your organization
      • Data practice process pattern for your organization
      • Data practice setup pattern for your organization
      • Data practice process pattern for your organization
      • Data practice setup pattern for your organization
      • Data practice process pattern for your organization
      • Data platform and practice – plan
      Participants Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect Data experts, Business Subject Matter Expert, Head of Data, Data Architect

      Workshop 3:
      Data Platform Design

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889
      Day 1Day 2Day 3Day 4
      Data Platform Overview
      Update Data Platform Reference Architecture
      Design Your Data Platform
      Design Your Data Practices 4
      Activities

      Prerequisite: Business context, business data requirement, and data capabilities

      1.1 Understand data platform framework and data capabilities

      1.2 Understand key data architecture principles and best practices

      1.3 Shortlist data platform patterns

      2.1 Map and identify data capabilities to data platform components

      2.2 Build data platform architecture using Info-Tech data platform reference architecture

      2.3 Highlight critical processes for each practice

      3.1 Design your target data platform using Info-Tech’s data platform template

      3.2 Identify new capabilities and components in your platform design

      4.1 Identify new capabilities and component in your platform design

      4.2 Discuss data platform initiatives

      Deliverables
      • Shortlisted data platform patterns
      • Data platform reference architecture for your organization
      • Data platform design for your organization
      • Data platform plan
      ParticipantsData experts, Business Subject Matter Expert, Head of Data, Data ArchitectData experts, Business Subject Matter Expert, Head of Data, Data ArchitectData experts, Business Subject Matter Expert, Head of Data, Data ArchitectData experts, Business Subject Matter Expert, Head of Data, Data Architect

      Build Your Data Practice and Platform

      Phase 1

      Phase 1: Step 1 – Define Your Data Requirements
      Phase 1: Step 2 – Conduct Your Data Discovery

      Phase 1

      1.1 Define Your Data Requirements
      1.2 Conduct Your Data Discovery

      Phase 2 Phase 3

      Phase 1: Step 1 – Define Your Data Requirements will walk you through the following activities:

      • Confirm the organizational strategic goals, business drivers, business capabilities, and processes driving the Data Practice and Platform effort.
      • Identify the data related outcomes, goals, and ideal environment needed to fulfill the business goals.

      This phase involves the following participants:

      A blend of business leaders and business SMEs together with the Data Strategy team.

      Phase 1: Step 2 – Conduct Your Data Discovery will walk you through the following activities:

      • Identify and highlight the data challenges faced in achieving the desired outcome.
      • Map the data challenges to the data capabilities required to realize the desired data outcome.

      This phase involves the following participants:

      Key personnel from IT/Data team: (Data Architect, Data Engineers, Head of Head of Reporting and Analytics)

      What is resilience?

      • Large vertical image:
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A

      Aside from the fact that operational resilience is mandated by law as of January 2025 (yes, next year), having your systems and applications available to your customers whenever they need your services is always a good idea. Customers, both existing and new ones, typically prefer smooth operations over new functionality. If you have any roadblocks in your current customer journey, then solving those is also part of operational resilience (and excellence).

      Does this mean you should not market new products or services? Of course not! Solving a customer journey roadblock is ensuring that your company is resilient. The Happy Meal is a prime example: it solved a product roadblock for small children and a profits roadblock for the company. For more info, just google it. But before you bring a new service online, be sure that it can withstand the punches that will be thrown at it. 

      What is resilience? 

      Resilience is the art of making sure your services are available to your customers whenever they can use them. Note I did not say 24/7/365. Your business may require that, but perhaps your systems need "only" to be available during "normal" business hours.

      Resilient systems can withstand adverse events that impair their ability to perform normal functions, and, like in the case the Happy Meals, increased peak demands. Events can include simple breakdowns (like a storage device, an internet connection that fails, or a file that fails to load) or something worse, like a cyber attack or a larger failure in your data center.

      Your client does not care what the cause is; what counts for the client is, "Can I access your service? (or buy that meal for my kid.)"

      Resilience entails several aspects:

      • availability
      • performance
      • right-sizing
      • hardening
      • restore-ability
      • testing
      • monitoring
      • management and governance

      It is now tempting to apply these aspects only to your organization's IT or technical parts. That is insufficient. Your operations, management, and even e.g. sales must ensure that services rendered result in happy clients and happy shareholders/owners. The reason is that resilient operations are a symphony. Not one single department or set of actions will achieve this. When you have product development working with the technical teams to develop a resilient flow at the right level for its earning potential, then you maximize profits.

      This synergy ensures that you invest exactly the right level of resources. There are no exaggerated technical or operational elements for ancillary services. That frees resources to ensure your main services receive the full attention they deserve.

      Resilience, in other words, is the result of a mindset and a way of operating that helps your business remain at the top of its game and provides a top service to clients while keeping the bottom line in the black. 

      Why do we need to spend on this?

      I mean, if it ain't broke, don't fix it. That old adage is true, and yet not. Services can remain up and running for a long time with single points of failure. But can you afford to have them break at any time? If yes, and your customers don't mind waiting for you to patch things up, then you can "risk-accept" that situation. But how realistic is that these days? If I cannot buy it at your shop today, I'll more than likely get it from another. If I'm in a contract with you, yet you cannot deliver, we will have a conversation, or at the very least, a moment of disappointment. If you have enough "disappointments," you will lose the customer. Lose enough customers, and you will have a reputational problem or worse.

      We don't like to spend resources on something that "may"go wrong. We do risk assessments to determine the true cost of non-delivery and the likelihood of that happening. And there are different ways to deal with that assessment's outcome. Not everything needs to have double the number of people working on it, just in case one resignes. Not every system needs an availability of 99,999%.

      But sometimes, we do not have a choice. When lives are at stake, like in medical or aviation services, being sorry is not a good starting point. The same goes for financial services. the DORA and NIS2 legislation in the EU, the CEA, FISMA, and GLBA in the US, and ESPA in Japan, to name a few, are legislations that require your company, if active in the relevant regulated sectors, to comply and ensure that your services continue to perform.

      Most of these elements have one thing in common: we need to know what is important for our service delivery and what is not.

      Business service

      That brings us to the core subject of what needs to be resilient. The answer is very short and very complex at the same time. It is the service that you offer to your customers which must meet reliance levels.

      Take the example of a hospital. When there is a power outage, the most critical systems must continue operating for a given period. That also means that sufficient capable staff must be present to operate said equipment; it even means that the paths leading to said hospital should remain available; if not by road, then, e.g., by helicopter. If these inroads are unavailable, an alternate hospital should be able to take on the workload. 

      Not everything here in this example is the responsibility of the hospital administrators! This is why the management and governance parts of the resilience ecosystem are so important in the bigger picture. 

      If we look at the financial sector, the EU DORA (Digital Operational Resilience Act) specifically states that you must start with your business services. Like many others, the financial sector can no longer function without its digital landscape. If a bank is unexpectedly disconnected from its payment network, especially SWIFT, it will not be long before there are existential issues. A trading department stands to lose millions if the trading system fails. 

      Look in your own environment; you will see many such points. What if your internet connection goes down, and you rely on it for most of your business? How long can you afford to be out? How long before your clients notice and take action? Do you supply a small but critical service to an institution? Then, you may fall under the aforementioned laws (it's called third-party requirements, and your client may be liable to follow them.)

      But also, outside of the technology, we see points in the supply chain that require resilience. Do you still rely on a single person or provider for a critical function? Do you have backup procedures if the tech stops working, yet your clients require you to continue to service them? 

      In all these and other cases, you must know what your critical services are so that you can analyze the requirements and put the right measures in place.

      Once you have defined your critical business services and have analyzed their operational requirements, you can start to look at what you need to implement the aforementioned areas of availability, monitoring, hardening, and others. Remember we're still at the level of business service. The tech comes later and will require a deeper analysis. 

      In conclusion.

      Resilient operations ensure that you continue to function, at the right price, in the face of adverse events. If you can, resilience starts at the business level from the moment of product conception. If the products have long been developed, look at how they are delivered to the client and upgrade operations, resources, and tech where needed.

      In some cases, you are legally required to undertake this exercise. But in all cases, it is important that you understand your business services and the needs of your clients and put sufficient resources in the right places of your delivery chain. 

      If you want to discuss this further, please contact me for a free talk.

       

      IT Operations

      Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program

      • Buy Link or Shortcode: {j2store}338|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Performance Measurement
      • Parent Category Link: /performance-measurement
      • According to Info-Tech research, 74% of our clients feel that IT quality management is an important process, however, only 15% said they actually had effective quality management.
      • IT is required to deliver high quality projects and services, but if CIOs are ineffective at quality management, how can IT deliver?
      • Rather than disturb the status quo with holistic quality initiatives, heads of IT leave quality in the hands of process owners, functional areas, and other segmented facets of the department.
      • CIOs are facing greater pressures to be innovative, agile, and cost-effective, but cannot do so without stable operations, an accountable staff base, and business support; all of which are achieved by high IT quality.

      Our Advice

      Critical Insight

      • Quality management needs more attention that it’s typically getting. It’s not going to happen randomly; you must take action to see results.
      • Quality must be holistic. Centralized accountability will align inconsistencies in quality and refocus IT towards a common goal.
      • Accountability is the key to quality. Clearly defined roles and responsibilities will put your staff on the hook for quality outcomes.

      Impact and Result

      • Shift your mindset to the positive implications of high quality. Info-Tech’s quality management methodology will promote innovation, agility, lower costs, and improved operations.
      • We will help you develop a fully functional quality management program in four easy steps:
        • Position your program as a group to encourage buy-in and unite IT around a common quality vision. Enact a center of excellence to build, support, and monitor the program.
        • Build flexible program requirements that will be adapted for a fit-to-purpose solution.
        • Implement the program using change management techniques to alleviate challenges and improve adoption.
        • Operate the program with a focus on continual improvement to ensure that your IT department continues to deliver high quality projects and services as stakeholder needs change.

      Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program Research & Tools

      Start here – read the Executive Brief

      Understand why Info-Tech’s unique approach to quality management can fix a variety of IT issues and understand the four ways we can support you in building a quality management program designed just for you.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Position the program

      Hold a positioning working session to focus the program around business needs, create solid targets, and create quality champions to get the job done.

      • Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program – Phase 1: Position the Quality Program
      • Quality Management Program Charter
      • Quality Management Capability Assessment and Planning Tool
      • Quality Management Roadmap

      2. Build the program

      Build program requirements and design standard templates that will unite IT quality.

      • Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program – Phase 2: Build a Quality Program
      • Quality Management Quality Plan Template
      • Quality Management Review Template
      • Quality Management Dashboard Template

      3. Implement the program

      Evaluate the readiness of the department for change and launch the program at the right time and in the right way to transform IT quality.

      • Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program – Phase 3: Implement the Quality Program
      • Quality Management Communication Plan Template
      • Quality Management Readiness Assessment Template

      4. Operate the program

      Facilitate the success of key IT practice areas by operating the Center of Excellence to support the key IT practice areas’ quality initiatives.

      • Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program – Phase 4: Operate the Quality Program
      • Quality Management User Satisfaction Survey
      • Quality Management Practice Area Assessment and Planning Tool
      • Quality Management Capability Improvement Plan
      [infographic]

      Workshop: Drive Efficiency and Agility with a Fit-for-Purpose Quality Management Program

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Position Your Program

      The Purpose

      Create a quality center of excellence to lead and support quality initiatives.

      Position your quality program to meet the needs of your business.

      Develop clear targets and create a roadmap to achieve your vision. 

      Key Benefits Achieved

      Defined Center of Excellence roles & responsibilities.

      A firm vision for your program with clearly outlined targets.

      A plan for improvements to show dedication to the program and create accountability. 

      Activities

      1.1 Identify current quality maturity.

      1.2 Craft vision and mission.

      1.3 Define scope.

      1.4 Determine goals and objectives.

      1.5 Specify metrics and critical success factors.

      1.6 Develop quality principles.

      1.7 Create action plan.

      Outputs

      Completed Maturity Assessment

      Completed Project Charter

      Completed Quality Roadmap

      2 Build Your Program

      The Purpose

      Build the requirements for the quality program, including outputs for quality planning, quality assurance, quality control, and quality improvement.

      Key Benefits Achieved

      Defined standards for the quality program.

      General templates to be used to unify quality throughout IT. 

      Activities

      2.1 Define quality policy, procedures, and guidelines.

      2.2 Define your standard Quality Plan.

      2.3 Define your standard Quality Review Document.

      2.4 Develop your Standard Quality Management Dashboard.

      Outputs

      Quality Policy

      Standard Quality Plan Template

      Standard Quality Review Template

      Standard Quality Dashboard

      3 Implement Your Program

      The Purpose

      Launch the program and begin quality improvement.

      Key Benefits Achieved

      Perform a readiness assessment to ensure your organization is ready to launch its quality program.

      Create a communication plan to ensure constant and consistent communication throughout implementation. 

      Activities

      3.1 Assess organizational readiness.

      3.2 Create a communication plan.

      Outputs

      Completed Readiness Assessment

      Completed Communication Plan

      4 Operate Your Program

      The Purpose

      Have the Center of Excellence facilitate the roll-out of the quality program in your key practice areas.

      Initiate ongoing monitoring and reporting processes to enable continuous improvement.  

      Key Benefits Achieved

      Quality plans for each practice area aligned with the overall quality program.

      Periodic quality reviews to ensure plans are being acted upon.

      Methodology for implementing corrective measures to ensure quality expectations are met.

      Activities

      4.1 Perform a quality management satisfaction survey.

      4.2 Complete a practice area assessment.

      4.3 Facilitate the creation of practice area quality plans.

      4.4 Populate quality dashboards.

      4.5 Perform quality review(s).

      4.6 Address issues with corrective and preventative measures.

      4.7 Devise a plan for improvement.

      4.8 Report on quality outcomes.

      Outputs

      Completed Satisfaction Surveys

      Practice Area Assessments

      Quality Plans (for each practice area)

      Quality Reviews (for each practice area)

      Quality Improvement Plan

      Embed Privacy and Security Culture Within Your Organization

      • Buy Link or Shortcode: {j2store}379|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: 10 Average Days Saved
      • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
      • Parent Category Name: Governance, Risk & Compliance
      • Parent Category Link: /governance-risk-compliance

      Engagement with privacy and security within organizations has not kept pace with the increasing demands from regulations. As a result, organizations often find themselves saying they support privacy and security engagement but struggling to create behavioral changes in their staff.

      However, with new privacy and security requirements proliferating globally, we can’t help but wonder how much longer we can carry on with this approach.

      Our Advice

      Critical Insight

      To truly take hold, privacy and security engagement must be supported by senior leadership, aligned with business objectives, and embedded within each of the organization’s operating groups and teams.

      Impact and Result

      • Develop a defined structure for privacy and security in the context of your organization, your obligations, and your objectives.
      • Align your business goals and strategy with privacy and security to obtain support from your senior leadership team.
      • Identify and implement a set of metrics to monitor the success of each of the six engagement enablers amongst your team.

      Embed Privacy and Security Culture Within Your Organization Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should develop a culture of privacy and security at your organization, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Define privacy and security in the context of the organization

      Use the charter template to document the primary outcomes and objectives for the privacy and security engagement program within the organization and map the organizational structure to each of the respective roles to help develop a culture of privacy and security.

      • Privacy and Security Engagement Charter

      2. Map your privacy and security enablers

      This tool maps business objectives and key strategic goals to privacy and security objectives and attributes identified as a part of the overall engagement program. Leverage the alignment tool to ensure your organizational groups are mapped to their corresponding enablers and supporting metrics.

      • Privacy and Security Business Alignment Tool

      3. Identify and track your engagement indicators

      This document maps out the organization’s continued efforts in ensuring employees are engaged with privacy and security principles, promoting a strong culture of privacy and security. Use the playbook to document and present the organization’s custom plan for privacy and security culture.

      • Privacy and Security Engagement Playbook

      Infographic

      Workshop: Embed Privacy and Security Culture Within Your Organization

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Determine Drivers and Engagement Objectives

      The Purpose

      Understand the current privacy and security landscape in the organization.

      Key Benefits Achieved

      Targeted set of drivers from both a privacy and security perspective

      Activities

      1.1 Discuss key drivers for a privacy and security engagement program.

      1.2 Identify privacy requirements and objectives.

      1.3 Identify security requirements and objectives.

      1.4 Review the business context.

      Outputs

      Understanding of the role and requirements of privacy and security in the organization

      Privacy drivers and objectives

      Security drivers and objectives

      Privacy and security engagement program objectives

      2 Align Privacy and Security With the Business

      The Purpose

      Ensure that your privacy and security engagement program is positioned to obtain the buy-in it needs through business alignment.

      Key Benefits Achieved

      Direct mappings between a culture of privacy and security and the organization’s strategic and business objectives

      Activities

      2.1 Review the IT/InfoSec strategy with IT and the InfoSec team and map to business objectives.

      2.2 Review the privacy program and privacy strategic direction with the Privacy/Legal/Compliance team and map to business objectives.

      2.3 Define the four organizational groupings and map to the organization’s structure.

      Outputs

      Privacy and security objectives mapped to business strategic goals

      Mapped organizational structure to Info-Tech’s organizational groups

      Framework for privacy and security engagement program

      Initial mapping assessment within Privacy and Security Business Alignment Tool

      3 Map Privacy and Security Enablers to Organizational Groups

      The Purpose

      Make your engagement plan tactical with a set of enablers mapped to each of the organizational groups and privacy and security objectives.

      Key Benefits Achieved

      Measurable indicators through the use of targeted enablers that customize the organization’s approach to privacy and security culture

      Activities

      3.1 Define the privacy enablers.

      3.2 Define the security enablers.

      3.3 Map the privacy and security enablers to organizational structure.

      3.4 Revise and complete Privacy and Security Business Alignment Tool inputs.

      Outputs

      Completed Privacy and Security Engagement Charter.

      Completed Privacy and Security Business Alignment Tool.

      4 Identify and Select KPIs and Metrics

      The Purpose

      Ensure that metrics are established to report on what the business wants to see and what security and privacy teams have planned for.

      Key Benefits Achieved

      End-to-end, comprehensive program that ensures continued employee engagement with privacy and security at all levels of the organization.

      Activities

      4.1 Segment KPIs and metrics based on categories or business, technical, and behavioral.

      4.2 Select KPIs and metrics for tracking privacy and security engagement.

      4.3 Assign ownership over KPI and metric tracking and monitoring.

      4.4 Determine reporting cadence and monitoring.

      Outputs

      KPIs and metrics identified at a business, technical, and behavioral level for employees for continued growth

      Completed Privacy and Security Engagement Playbook

      Streamline Application Maintenance

      • Buy Link or Shortcode: {j2store}402|cart{/j2store}
      • member rating overall impact: 9.5/10 Overall Impact
      • member rating average dollars saved: 20 Average Days Saved
      • member rating average days saved: After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve.
      • Parent Category Name: Maintenance
      • Parent Category Link: /maintenance
      • Application maintenance teams are accountable for the various requests and incidents coming from a variety business and technical sources. The sheer volume and variety of requests create unmanageable backlogs.
      • The increasing complexity and reliance on technology within the business has set unrealistic expectations on maintenance teams. Stakeholders expect teams to accommodate maintenance without impact on project schedules.

      Our Advice

      Critical Insight

      • Improving maintenance’s focus and attention may mean doing less but more valuable work. Teams need to be realistic about what can be committed and be prepared to justify why certain requests have to be pushed down the backlog (e.g. lack of business value, high risks).
      • Maintenance must be treated like any other development activity. The same intake and prioritization practices and quality standards must be upheld, and best practices followed.

      Impact and Result

      • Justify the necessity of streamlined maintenance. Gain a grounded understanding of stakeholder objectives and concerns, and validate their achievability against the current state of the people, process, and technologies involved in application maintenance.
      • Strengthen triaging and prioritization practices. Obtain a holistic picture of the business and technical impacts, risks, and urgencies of each accepted maintenance requests in order to justify its prioritization and relevance within your backlog. Identify opportunities to bundle requests together or integrate them within project commitments to ensure completion.
      • Establish and govern a repeatable process. Develop a maintenance process with well-defined stage gates, quality controls, and roles and responsibilities, and instill development best practices to improve the success of delivery.

      Streamline Application Maintenance Research & Tools

      Start here – read the Executive Brief

      Read our Executive Brief to understand the common struggles found in application maintenance, their root causes, and the Info-Tech methodology to overcoming these hurdles.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Understand your maintenance priorities

      Understand the stakeholder priorities driving changes in your application maintenance practice.

      • Streamline Application Maintenance – Phase 1: Assess the Current Maintenance Landscape
      • Application Maintenance Operating Model Template
      • Application Maintenance Resource Capacity Assessment
      • Application Maintenance Maturity Assessment

      2. Instill maintenance governance

      Identify the appropriate level of governance and enforcement to ensure accountability and quality standards are upheld across maintenance practices.

      • Streamline Application Maintenance – Phase 2: Develop a Maintenance Release Schedule

      3. Enhance triaging and prioritization practices

      Build a maintenance triage and prioritization scheme that accommodates business and IT risks and urgencies.

      • Streamline Application Maintenance – Phase 3: Optimize Maintenance Capabilities

      4. Streamline maintenance delivery

      Define and enforce quality standards in maintenance activities and build a high degree of transparency to readily address delivery challenges.

      • Streamline Application Maintenance – Phase 4: Streamline Maintenance Delivery
      • Application Maintenance Business Case Presentation Document
      [infographic]

      Workshop: Streamline Application Maintenance

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Understand Your Maintenance Priorities

      The Purpose

      Understand the business and IT stakeholder priorities driving the success of your application maintenance practice.

      Understand any current issues that are affecting your maintenance practice.

      Key Benefits Achieved

      Awareness of business and IT priorities.

      An understanding of the maturity of your maintenance practices and identification of issues to alleviate.

      Activities

      1.1 Define priorities for enhanced maintenance practices.

      1.2 Conduct a current state assessment of your application maintenance practices.

      Outputs

      List of business and technical priorities

      List of the root-cause issues, constraints, and opportunities of current maintenance practice

      2 Instill Maintenance Governance

      The Purpose

      Define the processes, roles, and points of communication across all maintenance activities.

      Key Benefits Achieved

      An in-depth understanding of all maintenance activities and what they require to function effectively.

      Activities

      2.1 Modify your maintenance process.

      2.2 Define your maintenance roles and responsibilities.

      Outputs

      Application maintenance process flow

      List of metrics to gauge success

      Maintenance roles and responsibilities

      Maintenance communication flow

      3 Enhance Triaging and Prioritization Practices

      The Purpose

      Understand in greater detail the process and people involved in receiving and triaging a request.

      Define your criteria for value, impact, and urgency, and understand how these fit into a prioritization scheme.

      Understand backlog management and release planning tactics to accommodate maintenance.

      Key Benefits Achieved

      An understanding of the stakeholders needed to assess and approve requests.

      The criteria used to build a tailored prioritization scheme.

      Tactics for efficient use of resources and ideal timing of the delivery of changes.

      A process that ensures maintenance teams are always working on tasks that are valuable to the business.

      Activities

      3.1 Review your maintenance intake process.

      3.2 Define a request prioritization scheme.

      3.3 Create a set of practices to manage your backlog and release plans.

      Outputs

      Understanding of the maintenance request intake process

      Approach to assess the impact, urgency, and severity of requests for prioritization

      List of backlog management grooming and release planning practices

      4 Streamline Maintenance Delivery

      The Purpose

      Understand how to apply development best practices and quality standards to application maintenance.

      Learn the methods for monitoring and visualizing maintenance work.

      Key Benefits Achieved

      An understanding of quality standards and the scenarios for where they apply.

      The tactics to monitor and visualize maintenance work.

      Streamlined maintenance delivery process with best practices.

      Activities

      4.1 Define approach to monitor maintenance work.

      4.2 Define application quality attributes.

      4.3 Discuss best practices to enhance maintenance development and deployment.

      Outputs

      Taskboard structure and rules

      Definition of application quality attributes with user scenarios

      List of best practices to streamline maintenance development and deployment

      5 Finalize Your Maintenance Practice

      The Purpose

      Create a target state built from appropriate metrics and attainable goals.

      Consider the required items and steps for the implementation of your optimization initiatives.

      Key Benefits Achieved

      A realistic target state for your optimized application maintenance practice.

      A well-defined and structured roadmap for the implementation of your optimization initiatives.

      Activities

      5.1 Refine your target state maintenance practices.

      5.2 Develop a roadmap to achieve your target state.

      Outputs

      Finalized application maintenance process document

      Roadmap of initiatives to achieve your target state

      Create a Buyer Persona and Journey

      • Buy Link or Shortcode: {j2store}558|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Marketing Solutions
      • Parent Category Link: /marketing-solutions
      • Contacts fail to convert to leads because messaging fails to resonate with buyers.
      • Products fail to reach targets given shallow understanding of buyer needs.
      • Sellers' emails go unopened and attempts at discovery fail due to no understanding of buyer challenges, pain points, and needs.

      Our Advice

      Critical Insight

      • Marketing leaders in possession of well-researched and up-to-date buyer personas and journeys dramatically improve product market fit, lead gen, and sales results.
      • Success starts with product, marketing, and sales alignment on targeted personas.
      • Speed to deploy is enabled via initial buyer persona attribute discovery internally.
      • However, ultimate success requires buyer interviews, especially for the buyer journey.
      • Leading marketers update journey maps every six months as disruptive events such as COVID-19 and new media and tech platform advancements require continual innovation.

      Impact and Result

      • Reduce time and treasure wasted chasing the wrong prospects.
      • Improve product-market fit.
      • Increase open and click-through rates in your lead gen engine.
      • Perform more effective sales discovery and increase eventual win rates.

      Create a Buyer Persona and Journey Research & Tools

      Start here – read the Executive Brief

      Our Executive Brief summarizes the challenges faced when buyer persona and journeys are ill-defined. It describes the attributes of, and the benefits that accrue from, a well-defined persona and journey and the key steps to take to achieve success.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Drive an aligned initial draft of buyer persona

      Define and align your team on target persona, outline steps to capture and document a robust buyer persona and journey, and capture current team buyer knowledge.

      • Buyer Persona Creation Template
      • Buyer Persona and Journey Interview Guide and Data Capture Tool

      2. Interview buyers and validate persona and journey

      Hold initial buyer interviews, test initial results, and continue with interviews.

      3. Prepare communications and educate stakeholders

      Consolidate interview findings, present to product, marketing, and sales teams. Work with them to apply to product design, marketing launch/campaigning, and sales and customer success enablement.

      • Buyer Persona and Journey Summary Template
      [infographic]

      Workshop: Create a Buyer Persona and Journey

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Align Team, Identify Persona, and Document Current Knowledge

      The Purpose

      Organize, drive alignment on target persona, and capture initial views.

      Key Benefits Achieved

      Steering committee and project team roles and responsibilities clarified.

      Product, marketing, and sales aligned on target persona.

      Build initial team understanding of persona.

      Activities

      1.1 Outline a vision for buyer persona and journey creation and identify stakeholders.

      1.2 Identify buyer persona choices and settle on an initial target.

      1.3 Document team knowledge about buyer persona (and journey where possible).

      Outputs

      Documented steering committee and working team

      Executive Brief on personas and journey

      Personas and initial targets

      Documented team knowledge

      2 Validate Initial Work and Identify Buyer Interviewees

      The Purpose

      Build list of buyer interviewees, finalize interview guide, and validate current findings with analyst input.

      Key Benefits Achieved

      Interview efficiently using 75-question interview guide.

      Gain analyst help in persona validation, reducing workload.

      Activities

      2.1 Share initial insights with covering industry analyst.

      2.2 Hear from industry analyst their perspectives on the buyer persona attributes.

      2.3 Reconcile differences; update “current understanding.”

      2.4 Identify interviewee types by segment, region, etc.

      Outputs

      Analyst-validated initial findings

      Target interviewee types

      3 Schedule and Hold Buyer Interviews

      The Purpose

      Validate current persona hypothesis and flush out those attributes only derived from interviews.

      Key Benefits Achieved

      Get to a critical mass of persona and journey understanding quickly.

      Activities

      3.1 Identify actual list of 15-20 interviewees.

      3.2 Hold interviews and use interview guides over the course of weeks.

      3.3 Hold review session after initial 3-4 interviews to make adjustments.

      3.4 Complete interviews.

      Outputs

      List of interviewees; calls scheduled

      Initial review – “are you going in the right direction?”

      Completed interviews

      4 Summarize Findings and Provide Actionable Guidance to Colleagues

      The Purpose

      Summarize persona and journey attributes and provide activation guidance to team.

      Key Benefits Achieved

      Understanding of product market fit requirements, messaging, and marketing, and sales asset content.

      Activities

      4.1 Summarize findings.

      4.2 Create action items for supporting team, e.g. messaging, touch points, media spend, assets.

      4.3 Convene steering committee/executives and working team for final review.

      4.4 Schedule meetings with colleagues to action results.

      Outputs

      Complete findings

      Action items for team members

      Plan for activation

      5 Measure Impact and Results

      The Purpose

      Measure results, adjust, and improve.

      Key Benefits Achieved

      Activation of outcomes; measured results.

      Activities

      5.1 Review final copy, assets, launch/campaign plans, etc.

      5.2 Develop/review implementation plan.

      5.3 Reconvene team to review results.

      Outputs

      Activation review

      List of suggested next steps

      Further reading

      Create a Buyer Persona and Journey

      Make it easier to market, sell, and achieve product-market fit with deeper buyer understanding.

      EXECUTIVE BRIEF

      Executive Summary

      Your Challenge

      B2B marketers without documented personas and journeys often experience the following:

      • Contacts fail to convert to leads because messaging fails to resonate with buyers.
      • Products fail to reach targets given shallow understanding of buyer needs.
      • Sellers’ emails go unopened, and attempts at discovery fail due to no understanding of buyer challenges, pain points, and needs.

      Without a deeper understanding of buyer needs and how they buy, B2B marketers will waste time and precious resources targeting the incorrect personas.

      Common Obstacles

      Despite being critical elements, organizations struggle to build personas due to:

      • A lack of alignment and collaboration among marketing, product, and sales.
      • An internal focus; or a lack of true customer centricity.
      • A lack of tools and techniques for building personas and buyer journeys.

      In today’s Agile development environment, combined with the pressure to generate revenues quickly, high tech marketers often skip the steps necessary to go deeper to build buyer understanding.

      SoftwareReviews’ Approach

      With a common framework and target output, clients will:

      • Align marketing, sales, and product, and collaborate together to share current knowledge on buyer personas and journeys.
      • Target 12-15 customers and prospects to interview and validate insights. Share that with customer-facing staff.
      • Activate the insights for more customer-centric lead generation, product development, and selling.

      Clients who activate findings from buyer personas and journeys will see a 50% results improvement.

      SoftwareReviews Insight:
      Buyer personas and buyer journeys are essential ingredients in go-to-market success, as they inform for product, marketing, sales, and customer success who we are targeting and how to engage with them successfully.

      Buyer personas and journeys: A go-to-market critical success factor

      Marketers – large and small – will fail to optimize product-market fit, lead generation, and sales effectiveness without well-defined buyer personas and a buyer journey.

      Critical Success Factors of a Successful G2M Strategy:

      • Opportunity size and business case
      • Buyer personas and journey
      • Competitively differentiated product hypothesis
      • Buyer-validated commercial concept
      • Sales revenue plan and program cost budget
      • Consolidated communications to steering committee

      Jeff Golterman, Managing Director, SoftwareReviews Advisory

      “44% of B2B marketers have already discovered the power of Personas.”
      – Hasse Jansen, Boardview.io!, 2016

      Documenting buyer personas enables success beyond marketing

      Documenting buyer personas has several essential benefits to marketing, sales, and product teams:

      • Achieve a better understanding of your target buyer – by building a detailed buyer persona for each type of buyer and keeping it fresh, you take a giant step toward becoming a customer-centric organization.
      • Team alignment on a common definition – will happen when you build buyer personas collaboratively and among those teams that touch the customer.
      • Improved lead generation – increases dramatically when messaging and marketing assets across your lead generation engine better resonate with buyers because you have taken the time to understand them deeply.
      • More effective selling – is possible when sellers apply persona development output to their interactions with prospects and customers.
      • Better product-market fit – increases when product teams more deeply understand for whom they are designing products. Documenting buyer challenges, pain points, and unmet needs gives product teams what they need to optimize product adoption.

      “It’s easier buying gifts for your best friend or partner than it is for a stranger, right? You know their likes and dislikes, you know the kind of gifts they’ll have use for, or the kinds of gifts they’ll get a kick out of. Customer personas work the same way, by knowing what your customer wants and needs, you can present them with content targeted specifically to their wants and needs.”
      – Emma Bilardi, Product Marketing Alliance, 2020

      Buyer understanding activates just about everything

      Without the deep buyer insights that persona and journey capture enables, marketers are suboptimized.

      Buyer Persona and Journey

      • Product design
      • Customer targeting
      • Personalization
      • Messaging
      • Content marketing
      • Lead gen & scoring
      • Sales Effectiveness
      • Customer retention

      “Marketing eutopia is striking the all-critical sweet spot that adds real value and makes customers feel recognized and appreciated, while not going so far as to appear ‘big brother’. To do this, you need a deep understanding of your audience coming from a range of different data sets and the capability to extract meaning.”
      – Plexure, 2020

      Does your organization need buyer persona and journey updating?

      “Yes,” if experiencing one or more key challenges:

      • Sales time is wasted on unqualified leads
      • Website abandon rates are high
      • Lead gen engine click-through rates are low
      • Ideal customer profile is ill defined
      • Marketing asset downloads are low
      • Seller discovery with prospects is ineffective
      • Sales win/loss rates drop due to poor product-market fit
      • Higher than desired customer churn

      SoftwareReviews Advisory Insight:
      Marketers developing buyer personas and journeys that lack agreement among Marketing, Sales, and Product of personas to target will squander precious time and resources throughout the customer targeting and acquisition process.

      Outcomes and benefits

      Building your buyer persona and journey using our methodology will enable:

      • Greater stakeholder alignment – when marketing, product, and sales agree on personas, less time is wasted on targeting alternate personas.
      • Improved product-market fit – when buyers see both pain-relieving features and value-based pricing, “because you asked vs. guessed,” win rates increase.
      • Greater open and click-through rates – because you understood buyer pain points and motivations for solution seeking, you’ll see higher visits and engagement with your lead gen engine, and because you asked “what asset types do you find most helpful” your CTAs become ”lead-gen magnets” because you’ve offered the right asset types in your content marketing strategy.
      • More qualified leads – because you defined a more accurate ideal customer profile (ICP) and your lead scoring algorithm has improved, sellers see more qualified leads.
      • Increased sales cycle velocity – since you learned from personas their content and engagement preferences and what collateral types they need during the down-funnel sales discussions, sales calls are more productive and sales cycles shrink.

      Our methodology for buyer persona and journey creation

      1. Document Team Knowledge of Buyer Persona and Drive Alignment 2. Interview Target Buyer Prospects and Customers 3. Create Outputs and Apply to Marketing, Sales, and Product
      Phase Steps
      1. Outline a vision for buyer persona and journey creation and identify stakeholders.
      2. Pull stakeholders together, identify initial buyer persona, and begin to document team knowledge about buyer persona (and journey where possible).
      3. Validate with industry and marketing analyst’s initial buyer persona, and identify list of buyer interviewees.
      1. Hold interviews and document and share findings.
      2. Validate initial drafts of buyer persona and create initial documented buyer journey. Review findings among key stakeholders, steering committee, and supporting analysts.
      3. Complete remaining interviews.
      1. Summarize findings.
      2. Convene steering committee/exec. and working team for final review.
      3. Communicate to key stakeholders in product, marketing, sales, and customer success for activation.
      Phase Outcomes
      1. Steering committee and team selection
      2. Team insights about buyer persona documented
      3. Buyer persona validation with industry and marketing analysts
      4. Sales, marketing, and product alignment
      1. Interview guide
      2. Target interviewee list
      3. Buyer-validated buyer persona
      4. Buyer journey documented with asset types, channels, and “how buyers buy” fully documented
      1. Education deck on buyer persona and journey ready for use with all stakeholders: product, field marketing, sales, executives, customer success, partners
      2. Activation will update product-market fit, optimize lead gen, and improve sales effectiveness

      Our approach provides interview guides and templates to help rebuild buyer persona

      Our methodology will enable you to align your team on why it’s important to capture the most important attributes of buyer persona including:

      • Functional – helps you find and locate your target personas
      • Emotive – deepens team understanding of buyer initiatives, motivations for seeking alternatives, challenges they face, pain points for your offerings to address, and terminology that describes the “space”
      • Solution – enables greater product market fit
      • Behavioral – clarifies how to communicate with personas and understand their content preferences
      Functional – “to find them”
      Job Role Title Org. Chart Dynamics Buying Center Firmographics
      Emotive – “what they do and jobs to be done”
      Initiatives: What programs/projects the persona is tasked with and their feelings and aspirations about these initiatives. Motivations? Build credibility? Get promoted? Challenges: Identify the business issues, problems, and pain points that impede attainment of objectives. What are their fears, uncertainties, and doubts about these challenges? Buyer Need: They may have multiple needs; which need is most likely met with the offering? Terminology: What are the keywords/phrases they organically use to discuss the buyer need or business issue?
      Decision Criteria – “how they decide”
      Buyer Role: List decision-making criteria and power level. The five common buyer roles are champion, influencer, decision maker, user, and ratifier (purchaser/negotiator). Evaluation and Decision Criteria: Which lens – strategic, financial, or operational – does the persona evaluate the impact of purchase through?
      Solution Attributes – “what does the ideal solution look like”
      Steps in “Jobs to Be Done” Elements of the “Ideal Solution” Business outcomes from ideal solution Opportunity scope; other potential users Acceptable price for value delivered Alternatives that see consideration Solution sourcing: channel, where to buy
      Behavioral Attributes – “how to approach them successfully”
      Content Preferences: List the persona’s content preferences – blog, infographic, demo, video – vs. long-form assets (e.g. white paper, presentation, analyst report). Interaction Preferences: Which are preferred among in-person meetings, phone calls, emails, videoconferencing, conducting research via Web, mobile, and social? Watering Holes: Which physical or virtual places do they go to network or exchange info with peers (e.g. LinkedIn)?

      Buyer journeys are constantly shifting

      If you didn’t remap buyer journeys in 2021, you may be losing to competitors that did. Leaders remap buyer journey frequently.

      • The multi-channel buyer journey is constantly changing. Today’s B2B buyer uses industry research sites, vendor content marketing assets, software reviews sites, contacts with vendor salespeople, events participation, peer networking, consultants, emails, social media sites, and electronic media to research purchasing decisions.
      • COVID-19 has dramatically decreased face-to-face interaction. We estimate a B2B buyer spent 20-25% more time online in 2021 than pre-COVID-19 researching software buying decisions. This has diminished the importance of face-to-face selling and given dramatic rise to digital selling and outbound marketing.
      • Content marketing has exploded, but without mapping the buyer journey and knowing where – by channel –and when – by buyer journey step – to offer content marketing assets, we will fail to convert prospects into buyers.

      “~2/3 of [B2B] buyers prefer remote human interactions or digital self-service.” And during Aug. ‘20 to Feb. ‘21, use of digital self-service to interact with sales reps leapt by more than 10% for both researching and evaluating new suppliers.”
      – Liz Harrison, Dennis Spillecke, Jennifer Stanley, and Jenny Tsai McKinsey & Company, 2021

      SoftwareReviews Advisory Insight:
      Marketers are advised to update their buyer journey annually and with greater frequency when the human vs. digital mix is affected due to events such as COVID-19 and as emerging media such as AR shifts asset-type usage and engagement options.

      Our approach helps you define the buyer journey

      Because marketing leaders need to reach buyers through the right channel with the right message at the right time during their decision cycle, you’ll benefit by using questionnaires that enable you to build the below easily and quickly.

      You’ll be more successful by following our overall guidance

      Overarching insight

      Buyer personas and buyer journeys are essential ingredients in go-to-market success, as they inform for product, marketing, sales, and customer success who we are targeting and how to engage with them successfully.

      Align Your Team

      Marketers developing buyer personas and journeys that lack agreement among Marketing, Sales, and Product of personas to target will squander precious time and resources throughout the customer targeting and acquisition process.

      Jump-Start Persona Development

      Marketing leaders leverage the buyer persona knowledge not only from in-house experts in areas such as sales and executives but from analysts that speak with their buyers each and every day.

      Buyer Interviews Are a Must

      While leaders will get a fast start by interviewing sellers, executives, and analysts, you will fail to craft the right messages, build the right marketing assets, and design the best buyer journey if you skip buyer interviews.

      Watch for Disruption

      Leaders will update their buyer journey annually and with greater frequency when the human vs. digital mix is effected due to events such as COVID-19 and as emerging media such as AR and VR shifts the way buyers engage.

      Advanced Buyer Journey Discovery

      Digital marketers that ramp up lead gen engine capabilities to capture “wins” and measure engagement back through the lead gen and nurturing engines will build a more data-driven view of the buyer journey. Target to build this advanced capability in your initial design.

      Tools and templates to speed your success

      This blueprint is accompanied by supporting deliverables to help you gather team insights, interview customers and prospects, and summarize results for ease in communications.

      To support your buyer persona and journey creation, we’ve created the enclosed tools

      Buyer Persona Creation Template

      A PowerPoint template to aid the capture and summarizing of your team’s insights on the buyer persona.

      Buyer Persona and Journey Interview Guide and Data Capture Tool

      For interviewing customers and prospects, this tool is designed to help you interview personas and summarize results for up to 15 interviewees.

      Buyer Persona and Journey Summary Template

      A PowerPoint template into which you can drop your buyer persona and journey interviewees list and summary findings.

      SoftwareReviews offers two levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      The "do-it-yourself" step-by-step instructions begin with Phase 1.

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      A Guided Implementation is a series of analysts inquiries with you and your team.

      Diagnostics and consistent frameworks are used throughout each option.

      Guided Implementation

      A Guided Implementation (GI) is series of calls with a SoftwareReviews Advisory analyst to help implement our best practices in your organization.

      For guidance on marketing applications, we can arrange a discussion with an Info-Tech analyst.

      Your engagement managers will work with you to schedule analyst calls.

      What does our GI on buyer persona and journey mapping look like?

      Drive an Aligned Initial Draft of Buyer Persona

      • Call #1: Collaborate on vision for buyer persona and the buyer journey. Review templates and sample outputs. Identify your team.
      • Call #2: Review work in progress on capturing working team knowledge of buyer persona elements.
      • Call #3: (Optional) Review Info-Tech’s research-sourced persona insights.
      • Call #4: Validate the persona WIP with Info-Tech analysts. Review buyer interview approach and target list.

      Interview Buyers and Validate Persona and Journey

      • Call #5: Revise/review interview guide and final interviewee list; schedule interviews.
      • Call #6: Review interim interview finds; adjust interview guide.
      • Call #7: Use interview findings to validate/update persona and build journey map.
      • Call #8: Add supporting analysts to final stakeholder review.

      Prepare Communications and Educate Stakeholders

      • Call #9: Review output templates completed with final persona and journey findings.
      • Call #10: Add supporting analysts to stakeholder education meetings for support and help with addressing questions/issues.

      Workshop overview

      Contact your account representative for more information. workshops@infotech.com 1-888-670-8889

      Day1 Day 2 Day 3 Day 4 Day 5
      Align Team, Identify Persona, and Document Current Knowledge Validate Initial Work and Identify Buyer Interviewees Schedule and Hold Buyer interviews Summarize Findings and Provide Actionable Guidance to Colleagues Measure Impact and Results
      Activities

      1.1 Outline a vision for buyer persona and journey creation and identify stakeholders.

      1.2 Identify buyer persona choices and settle on an initial target.

      1.3 Document team knowledge about buyer persona (and journey where possible).

      2.1 Share initial insights with covering industry analyst.

      2.2 Hear from industry analyst their perspectives on the buyer persona attributes.

      2.3 Reconcile differences; update “current understanding.”

      2.4 Identify interviewee types by segment, region, etc.

      3.1 Identify actual list of 15-20 interviewees.

      A gap of up to a week for scheduling of interviews.

      3.2 Hold interviews and use interview guides (over the course of weeks).

      3.3 Hold review session after initial 3-4 interviews to make adjustments.

      3.4 Complete interviews.

      4.1 Summarize findings.

      4.2 Create action items for supporting team, e.g. messaging, touch points, media spend, assets.

      4.3 Convene steering committee/exec. and working team for final review.

      4.4 Schedule meetings with colleagues to action results.

      5.1 Review final copy, assets, launch/campaign plans, etc.

      5.2 Develop/review implementation plan.

      A period of weeks will likely intervene to execute and gather results.

      5.3 Reconvene team to review results.

      Deliverables
      1. Documented steering committee and working team
      2. Executive Brief on personas and journey
      3. Personas and initial targets
      4. Documented team knowledge
      1. Analyst-validated initial findings
      2. Target interviewee types
      1. List of interviewees; calls scheduled
      2. Initial review – “are we going in the right direction?”
      3. Completed interviews
      1. Complete findings
      2. Action items for team members
      3. Plan for activation
      1. Activation review
      2. List of suggested next steps

      Phase 1
      Drive an Aligned Initial Draft of Buyer Persona

      This Phase walks you through the following activities:

      • Develop an understanding of what comprises a buyer persona and journey, including their importance to overall go-to-market strategy and execution.
      • Sample outputs.

      This Phase involves the following stakeholders:

      • Program leadership
      • Product Marketing
      • Product Management
      • Representative(s) from Sales
      • Executive Leadership

      1.1 Establish the team and align on shared vision

      Input

      • Typically a joint recognition that buyer personas have not been fully documented.
      • Identify working team members/participants (see below), and an executive sponsor.

      Output

      • Communication of team members involved and the make-up of steering committee and working team
      • Alignment of team members on a shared vision of “Why Build Buyer Personas and Journey” and what key attributes define both.

      Materials

      • N/A

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • CMO/Sponsoring Executive Working Team – typically representatives in Product Marketing, Product Management, and Sales
      • SoftwareReviews marketing analyst

      60 minutes

      1. Schedule inquiry with working team members and walk the team through the Buyer Persona and Journey Executive Brief PowerPoint presentation.
      2. Optional: Have the (SoftwareReviews Advisory) SRA analyst walk the team through the Buyer Persona and Journey Executive Brief PowerPoint presentation as part of your session.

      Review the Create a Buyer Persona Executive Brief (Slides 3-14)

      1.2 Document team knowledge of buyer persona

      Input

      • Working team member knowledge

      Output

      • Initial draft of your buyer persona

      Materials

      • Buyer Persona Creation Template

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • CMO/Sponsoring Executive (optional)
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales

      2-3 sessions of 60 minutes each

      1. Schedule meeting with working team members and, using the Buyer Persona Template, lead the team in a discussion that documents current team knowledge of the target buyer persona.
      2. Lead the team to prioritize an initial, single, most important persona and to collaborate to complete the template (and later, the buyer journey). Once the team learns the process for working on the initial persona, the development of additional personas will become more efficient.
      3. Place the PowerPoint template in a shared drive for team collaboration. Expect to schedule several 60-minute meets. Quicken collaboration by encouraging team to “do their homework” by sharing persona knowledge within the shared drive version of the template. Your goal is to get to an initial agreed upon version that can be shared for additional validation with industry analyst(s) in the next step.

      Download the Buyer Persona Creation Template

      1.3 Validate with industry analysts

      Input

      • Identify gaps in persona from previous steps

      Output

      • Further validated buyer persona

      Materials

      • Bring your Buyer Persona Creation Template to the meeting to share with analysts

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • CMO/Sponsoring Executive (Optional)
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales
      • Info-Tech analyst covering your product category and SoftwareReviews marketing analyst

      30 minutes

      1. Schedule meeting with working team members and discuss which persona areas require further validation from an Info-Tech analyst who has worked closely with those buyers within your persona.

      60 minutes

      1. Schedule an inquiry with the appropriate Info-Tech analyst and SoftwareReviews Advisory analyst to share current findings and see:
        1. Info-Tech analyst provide content feedback given what they know about your target persona and product category.
        2. SoftwareReviews Advisory analyst provide feedback on persona approach and to coach any gaps or important omissions.
      2. Tabulate results and update your persona summary. At this point you will likely require additional validation through interviews with customers and prospects.

      1.4 Identify interviewees and prepare for interviews

      Input

      • Identify segments within which you require persona knowledge
      • Understand your persona insight gaps

      Output

      • List of interviewees

      Materials

      • Interviewee recording template on following slide
      • Interview guide questions found within the Buyer Persona and Journey Interview Guide and data Capture Tool

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales

      1-2 weeks

      1. Identify the types of customers and prospects that will best represent your target persona. Choose interviewees that when interviewed will inform key differences among key segments (geographies, company size, mix of customers and prospects, etc.).
      2. Recruit interviewees and schedule interviews for 45 minutes.
      3. Keep track of Interviewees using the slide following this one.
      4. In preparation for interviews, review the Buyer Persona and Journey Interview Guide and Data Capture Tool. Review the two sets of questions:
        1. Buyer Persona-Related – use to validate areas where you still have gaps in your persona, OR if you are starting with a blank persona and wish to build your personas entirely based on customer and prospect interviews.
        2. Buyer-Journey Related, which we will focus on in the next phase.

      Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

      The image shows a table titled ‘Interviewee List.’ A note next to the title indicates: Here you will document your interviewee list and outreach plan. A note in the Segment column indicates: Ensure you are interviewing personas across segments that will give you the insights you need, e.g. by size, by region, mix of customers and prospects. A note in the Title column reads: Vary your title types up or down in the “buying center” if you are seeking to strengthen buying center dynamics understanding. A note in the Roles column reads: Vary your role types according to decision-making roles (decision maker, influencer, ratifier, coach, user) if you are seeking to strengthen decision-making dynamics understanding.

      Phase 2
      Interview Buyers and Validate Persona and Journey

      This Phase walks you through the following activities:

      • Developing final interview guide.
      • Interviewing buyers and customers.
      • Adjusting approach.
      • Validating buyer persona.
      • Crafting buyer journey
      • Gaining analyst feedback.

      This Phase involves the following stakeholders:

      • Program leadership
      • Product Marketing
      • Representative(s) from Sales

      2.1 Hold interviews

      Input

      • List of interviewees
      • Final list of questions

      Output

      • Buyer perspectives on their personas and buyer journeys

      Materials

      • Buyer Persona and Journey Interview Guide and data Capture Tool

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales

      1-2 weeks

      1. Hold interviews and adjust your interviewing approach as you go along. Uncover where you are not getting the right answers, check with working team and analysts, and adjust.

      Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

      2.2 Use interview findings to validate what’s needed for activation

      Input

      • List of interviewees
      • Final list of questions

      Output

      • Buyer perspectives on their personas and buyer journeys
      • Stakeholder feedback that actionable insights are resulting from interviews

      Materials

      • Buyer Persona Creation Template
      • Buyer Persona and Journey Interview Guide and Data Capture Tool

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales
      • SoftwareReviews marketing analyst

      2 hours

      1. Convene your team, with marketing analysts, and test early findings: It’s wise to test initial interview results to check that you are getting the right insights to understand and validate key challenges, pain points, needs, and other vital areas pertaining to the buyer persona. Are the answers you are getting enabling you to complete the Summary slides for later communications and training for Sales?
      2. Check when doing buyer journey interviews that you are getting actionable answers that drive messaging, what asset types are needed, what the marketing channel mix is, and other vital insights to activate the results. Are the answers you are getting adequate to give guidance to campaigners, content marketers, and sales enablement?
      3. See the following slides for detailed questions that need to be answered satisfactorily by your team members that need to “activate” the results.

      Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

      2.2.1 Are you getting what you need from interviews to inform the buyer persona?

      Test that you are on the right track:

      1. Are you getting the functional answers so you can guide sellers to the right roles? Can you guide marketers/campaigners to the right “Ideal Customer Profile” for lead scoring?
      2. Are you capturing the right emotive areas that will support message crafting? Solutioning? SEM/SEO?
      3. Are you capturing insights into “how they decide” so sellers are well informed on the decision-making dynamics?
      4. Are you getting a strong understanding of content, interaction preferences, and news and information sources so sellers can outreach more effectively, you can pinpoint media spend, and content marketing can create the right assets?
      Functional – “to find them”
      Job Role Title Org. Chart Dynamics Buying Center Firmographics
      Emotive – “what they do and jobs to be done”
      Initiatives: What programs/projects the persona is tasked with and their feelings and aspirations about these initiatives. Motivations? Build credibility? Get promoted? Challenges: Identify the business issues, problems, and pain points that impede attainment of objectives. What are their fears, uncertainties, and doubts about these challenges? Buyer Need: They may have multiple needs; which need is most likely met with the offering? Terminology: What are the keywords/phrases they organically use to discuss the buyer need or business issue?
      Decision Criteria – “how they decide”
      Buyer Role: List decision-making criteria and power level. The five common buyer roles are champion, influencer, decision maker, user, and ratifier (purchaser/negotiator). Evaluation and Decision Criteria: Which lens – strategic, financial, or operational – does the persona evaluate the impact of purchase through?
      Solution Attributes – “what does the ideal solution look like”
      Steps in “Jobs to Be Done” Elements of the “Ideal Solution” Business outcomes from ideal solution Opportunity scope; other potential users Acceptable price for value delivered Alternatives that see consideration Solution sourcing: channel, where to buy
      Behavioral Attributes – “how to approach them successfully”
      Content Preferences: List the persona’s content preferences – blog, infographic, demo, video – vs. long-form assets (e.g. white paper, presentation, analyst report). Interaction Preferences: Which are preferred among in-person meetings, phone calls, emails, videoconferencing, conducting research via Web, mobile, and social? Watering Holes: Which physical or virtual places do they go to network or exchange info with peers (e.g. LinkedIn)?

      2.2.2 Are you getting what you need from interviews to support the buyer journey?

      Our approach helps you define the buyer journey

      Because marketing leaders need to reach buyers through the right channel with the right message at the right time during their decision cycle, you’ll benefit by using questionnaires that enable you to build the below easily and quickly.

      2.3 Continue interviews

      Input

      • Final adjustments to list of interview questions

      Output

      • Final buyer perspectives on their personas and buyer journeys

      Materials

      • Buyer Persona Creation Template
      • Buyer Persona and Journey Interview Guide and data Capture Tool

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales

      1-2 weeks

      1. Continue customer and prospect interviews.
      2. Ensure you are gaining the segment perspectives needed.
      3. Complete the “Summary” columns within the Buyer Persona and Journey Interview Guide and Data Capture Tool.

      Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

      Phase 3
      Prepare Communications and Educate Stakeholders

      This Phase walks you through the following activities:

      • Creating outputs for key stakeholders
      • Communicating final findings and supporting marketing, sales, and product activation.

      This Phase involves the following stakeholders:

      • Program leadership
      • Product Marketing
      • Product Management
      • Sales
      • Field Marketing/Campaign Management
      • Executive Leadership

      3.1 Summarize interview results and convene full working team and steering committee for final review

      Input

      • Buyer persona and journey interviews detail

      Output

      • Buyer perspectives on their personas and buyer journeys

      Materials

      • Buyer Persona and Journey Interview Guide and Data Capture Tool
      • Buyer Persona and Journey Summary Template

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • CMO/Sponsoring Executive (Optional)
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales
      • SoftwareReviews marketing analyst

      1-2 hours

      1. Summarize interview results within the Buyer Persona and Journey Summary Template.

      Download the Buyer Persona and Journey Interview Guide and Data Capture Tool

      Download the Buyer Persona and Journey Summary Template

      3.2 Convene executive steering committee and working team to review results

      Input

      • Buyer persona and journey interviews summary

      Output

      • Buyer perspectives on their personas and buyer journeys

      Materials

      • Buyer Persona and Journey Summary Template

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales

      1-2 hours

      1. Present final persona and journey results to the steering committee/executives and to working group using the summary slides interview results within the Buyer Persona and Journey Summary Template to finalize results.

      Download the Buyer Persona and Journey Summary Template

      3.3 Convene stakeholder meetings to activate results

      Input

      • Buyer persona and journey interviews summary

      Output

      Activation of key learnings to drive:

      • Better product –market fit
      • Lead gen
      • Sales effectiveness
      • Awareness

      Materials

      • Buyer Persona and Journey Summary Template

      Participants

      • Initiative Manager – individual leading the buyer persona and journey initiative
      • Working Team – typically representatives in Product Marketing, Product Management, and Sales
      • Stakeholder team members (see left)

      4-5 hours

      Present final persona and journey results to each stakeholder team. Key presentations include:

      1. Product team to validate product market fit.
      2. Content marketing to provide messaging direction for the creation of awareness and lead gen assets.
      3. Campaigners/Field Marketing for campaign-related messaging and to identify asset types required to be designed and delivered to support the buyer journey.
      4. Social media strategists for social post copy, and PR for other awareness-building copy.
      5. Sales enablement/training to enable updating of sales collateral, proposals, and sales training materials. Sellers to help with their targeting, prospecting, and crafting of outbound messaging and talk tracks.

      Download the Buyer Persona and Journey Summary Template

      Summary of Accomplishment

      Problem Solved

      With the help of this blueprint, you have deepened your and your colleagues’ buyer understanding at both the persona “who they are” level and the buyer journey “how do they buy” level. You are among the minority of marketing leaders that have fully documented a buyer persona and journey – congratulations!

      The benefits of having led your team through the process are significant and include the following:

      • Better alignment of customer/buyer-facing teams such as in product, marketing, sales, and customer success.
      • Messaging that can be used by marketing, sales, and social teams that will resonate with buyer initiatives, pain points, sought-after “pain relief,” and value.
      • Places in the digital and physical universe where your prospects “hang out” so you can optimize your media spend.
      • More effective use of marketing assets and sales collateral that align with the way your prospect needs to consume information throughout their buyer journey to make a decision in your solution area.

      And by capturing and documenting your buyer persona and journey even for a single buyer type, you have started to build the “institutional strength” to apply the process to other roles in the decision-making process or for when you go after new and different buyer types for new products. And finally, by bringing your team along with you in this process, you have also led your team in becoming a more customer-focused organization – a strategic shift that all organizations should pursue.

      If you would like additional support, contact us and we’ll make sure you get the professional expertise you need.

      Contact your account representative for more information.

      info@softwarereviews.com

      1-888-670-8889

      Related Software Reviews Research

      Optimize Lead Generation With Lead Scoring

      • Save time and money and improve your sales win rates when you apply our methodology to score contacts with your lead gen engine more accurately and pass better qualified leads over to your sellers.
      • Our methodology teaches marketers to develop your own lead scoring approach based upon lead/contact profile vs. your Ideal Customer Profile (ICP) and scores contact engagement. Applying the methodology to arrive at your own approach to scoring will mean reduced lead gen costs, higher conversion rates, and increased marketing-influenced wins.

      Bibliography

      Bilardi, Emma. “How to Create Buyer Personas.” Product Marketing Alliance, July 2020. Accessed Dec. 2021.

      Harrison, Liz, Dennis Spillecke, Jennifer Stanley, and Jenny Tsai. “Omnichannel in B2B sales: The new normal in a year that has been anything but.” McKinsey & Company, 15 March 2021. Accessed Dec. 2021.

      Jansen, Hasse. “Buyer Personas – 33 Mind Blowing Stats.” Boardview.io!, 19 Feb. 2016. Accessed Jan. 2022.

      Raynor, Lilah. “Understanding The Changing B2B Buyer Journey.” Forbes Agency Council, 18 July 2021. Accessed Dec. 2021.

      Simpson, Jon. “Finding Your Audience: The Importance of Developing a Buyer Persona.” Forbes Agency Council, 16 May 2017. Accessed Dec. 2021.

      “Successfully Executing Personalized Marketing Campaigns at Scale.” Plexure, 6 Jan. 2020. Accessed Dec 2020.

      Ulwick, Anthony W. JOBS TO BE DONE: Theory to Practice. E-book, Strategyn, 1 Jan. 2017. Accessed Jan. 2022.

      Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan

      • Buy Link or Shortcode: {j2store}378|cart{/j2store}
      • member rating overall impact: 7.3/10 Overall Impact
      • member rating average dollars saved: $10,756 Average $ Saved
      • member rating average days saved: 9 Average Days Saved
      • Parent Category Name: Governance, Risk & Compliance
      • Parent Category Link: /governance-risk-compliance
      • The demand for qualified cybersecurity professionals far exceeds supply. As a result, organizations are struggling to protect their data against the evolving threat landscape.
      • It is a constant challenge to know what skills will be needed in the future, and when and how to acquire them.

      Our Advice

      Critical Insight

      • Plan for the inevitable. All industries are expected to be affected by the talent gap in the coming years. Plan ahead to address your organization’s future needs.
      • Base skills acquisition decisions on the five key factors to define skill needs. Create an impact scale for the five key factors (data criticality, durability, availability, urgency, and frequency) that reflects your organizational strategy, initiatives, and pressures.
      • A skills gap will always exist to some degree. The threat landscape is constantly changing, and your workforce’s skill sets must evolve as well.

      Impact and Result

      • Organizations must align their security initiatives to talent requirements such that business objectives are achieved and the business is cyber ready.
      • Identify if there are skill gaps in your current workforce.
      • Decide how you’ll acquire needed skills based on characteristics of need for each skill.

      Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should develop a technical skills acquisition strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify skill needs for target state

      Identify what skills will be needed in your future state.

      • Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan – Phase 1: Identity Skill Needs for Target State
      • Security Initiative Skills Guide
      • Skills Gap Prioritization Tool

      2. Identify technical skill gaps

      Align role requirements with future initiative skill needs.

      • Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan – Phase 2: Identify Technical Skill Gaps
      • Current Workforce Skills Assessment
      • Technical Skills Workbook
      • Information Security Compliance Manager
      • IT Security Analyst
      • Chief Information Security Officer
      • Security Administrator
      • Security Architect

      3. Develop a sourcing plan for future work roles

      Acquire skills based on the impact of the five key factors.

      • Close the InfoSec Skills Gap: Develop a Skills Sourcing Plan for Future Work Roles – Phase 3: Develop a Sourcing Plan for Future Work Roles
      [infographic]

      Workshop: Close the InfoSec Skills Gap: Develop a Technical Skills Sourcing Plan

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify Skill Needs for Target State

      The Purpose

      Determine the skills needed in your workforce and align them to your organization’s security roadmap.

      Key Benefits Achieved

      Insight on what skills your organization will need in the future.

      Activities

      1.1 Understand the importance of aligning security initiatives skill needs with workforce requirements.

      1.2 Identify needed skills for future initiatives.

      1.3 Prioritize the initiative skill gaps.

      Outputs

      Security Initiative Skills Guide

      Skills Gap Prioritization Tool

      2 Define Technical Skill Requirements

      The Purpose

      Identify and create technical skill requirements for key work roles that are needed to successfully execute future initiatives.

      Key Benefits Achieved

      Increased understanding of the NICE Cybersecurity Workforce Framework.

      Standardization of technical skill requirements of current and future work roles.

      Activities

      2.1 Assign work roles to the needs of your future environment.

      2.2 Discuss the NICE Cybersecurity Workforce Framework.

      2.3 Develop technical skill requirements for current and future work roles.

      Outputs

      Skills Gap Prioritization Tool

      Technical Skills Workbook

      Current Workforce Skills Assessment

      3 Acquire Technical Skills

      The Purpose

      Assess your current workforce against their role’s skill requirements.

      Discuss five key factors that aid acquiring skills.

      Key Benefits Achieved

      A method to acquire skills in future roles.

      Activities

      3.1 Continue developing technical skill requirements for current and future work roles.

      3.2 Conduct Current Workforce Skills Assessment.

      3.3 Discuss methods of acquiring skills.

      3.4 Develop a plan to acquire skills.

      Outputs

      Technical Skills Workbook

      Current Workforce Skills Assessment

      Current Workforce Skills Assessment

      Technical Skills Workbook

      Current Workforce Skills Assessment

      Technical Skills Workbook

      Current Workforce Skills Assessment

      4 Plan to Execute Action Plan

      The Purpose

      Assist with communicating the state of the skill gap in your organization.

      Key Benefits Achieved

      Strategy on how to acquire skills needs of the organization.

      Activities

      4.1 Review skills acquisition plan.

      4.2 Discuss training and certification opportunities for staff.

      4.3 Discuss next steps for closing the skills gap.

      4.4 Debrief.

      Outputs

      Technical Skills Workbook

      Prepare for Post-Quantum Cryptography

      • Buy Link or Shortcode: {j2store}268|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Security Processes & Operations
      • Parent Category Link: /security-processes-and-operations
      • Fault-tolerant quantum computers, capable of breaking existing encryption algorithms and cryptographic systems, are widely expected to be available sooner than originally projected.
      • Data considered secure today may already be at risk due to the threat of harvest-now-decrypt-later schemes.
      • Many current security controls will be completely useless, including today's strongest encryption techniques.

      Our Advice

      Critical Insight

      The advent of quantum computing is closer than you think: some nations have already demonstrated capability with the potential to break current asymmetric-key encryption. Traditional encryption methods will no longer provide sufficient protection. You need to act now to begin your transformation to quantum-resistant encryption.

      Impact and Result

      • Developing quantum-resistant cryptography capabilities is crucial to maintaining data security and integrity for critical applications.
      • Organizations need to act now to begin their transformation to quantum-resistant encryption.
      • Data security (especially for sensitive data) should be an organization’s top priority. Organizations with particularly critical information need to be on top of this quantum movement.

      Prepare for Post-Quantum Cryptography Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Prepare for Post-Quantum Cryptography Storyboard – Research to help organizations to prepare and implement quantum-resistance cryptography solutions.

      Developing quantum-resistant cryptography capabilities is crucial to maintaining data security and integrity for critical applications. Organizations need to act now to begin their transformation to quantum-resistant encryption.

      • Prepare for Post-Quantum Cryptography Storyboard
      [infographic]

      Further reading

      Prepare for Post-Quantum Cryptography

      It is closer than you think, and you need to act now.

      Analyst Perspective

      It is closer than you think, and you need to act now.

      The quantum realm presents itself as a peculiar and captivating domain, shedding light on enigmas within our world while pushing the boundaries of computational capabilities. The widespread availability of quantum computers is expected to occur sooner than anticipated. This emerging technology holds the potential to tackle valuable problems that even the most powerful classical supercomputers will never be able to solve. Quantum computers possess the ability to operate millions of times faster than their current counterparts.

      As we venture further into the era of quantum mechanics, organizations relying on encryption must contemplate a future where these methods no longer suffice as effective safeguards. The astounding speed and power of quantum machines have the potential to render many existing security measures utterly ineffective, including the most robust encryption techniques used today. To illustrate, a task that currently takes ten years to crack through a brute force attack could be accomplished by a quantum computer in under five minutes.

      Amid this transition into a quantum future, the utmost priority for organizations remains data security, particularly safeguarding sensitive information. Organizations must proactively prepare for the development of countermeasures and essential resilience measures to attain a state of being "quantum safe."

      This is a picture of Alan Tang

      Alan Tang
      Principal Research Director, Security and Privacy
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Anticipated advancements in fault-tolerant quantum computers, surpassing existing encryption algorithms and cryptographic systems, are expected to materialize sooner than previously projected. The timeframe for their availability is diminishing daily.
      • Data that is presently deemed secure faces potential vulnerability due to the emergence of harvest-now-decrypt-later strategies.
      • Numerous contemporary security controls, including the most robust encryption techniques, have become obsolete and offer little efficacy.

      Common Obstacles

      • The complexity involved makes it challenging for organizations to incorporate quantum-resistant cryptography into their current IT infrastructure.
      • The endeavor of transitioning to quantum-resilient cryptography demands significant effort and time, with the specific requirements varying for each organization.
      • A lack of comprehensive understanding regarding the cryptographic technologies employed in existing IT systems poses difficulties in identifying and prioritizing systems for upgrading to post-quantum cryptography.

      Info-Tech's Approach

      • The development of quantum-resistant cryptography capabilities is essential for safeguarding the security and integrity of critical applications.
      • Organizations must proactively initiate their transition toward quantum-resistant encryption to ensure data protection.
      • Ensuring the security of corporate data assets should be of utmost importance for organizations, with special emphasis on those possessing highly critical information in light of the advancements in quantum technology.

      Info-Tech Insight

      The advent of quantum computing (QC) is closer than you think: some nations have demonstrated capability with the potential to break current asymmetric-key encryption. Traditional encryption methods will no longer be sufficient as a means of protection. You need to act now to begin your transformation to quantum-resistant encryption.

      Evolvement of QC theory and technologies

      1900-1975

      1976-1997

      1998-2018

      2019-Now

      1. 1900: Max Planck – The energy of a particle is proportional to its frequency: E = hv, where h is a relational constant.
      2. 1926: Erwin Schrödinger – Since electrons can affect each other's states, their energies change in both time and space. The total energy of a particle is expressed as a probability function.
      1. 1976: Physicist Roman Stanisław Ingarden publishes the paper "Quantum Information Theory."
      2. 1980: Paul Benioff describes the first quantum mechanical model of a computer.
      3. 1994: Peter Shor publishes Shor's algorithm.
      1. 1998: A working 2-qubit NMR quantum computer is used to solve Deutsch's problem by Jonathan A. Jones and Michele Mosca at Oxford University.
      2. 2003: DARPA Quantum Network becomes fully operational.
      3. 2011: D-Wave claims to have developed the first commercially available quantum computer, D-Wave One.
      4. 2018: the National Quantum Initiative Act was signed into law by President Donald Trump.
      1. 2019: A paper by Google's quantum computer research team was briefly available, claiming the project has reached quantum supremacy.
      2. 2020: Chinese researchers claim to have achieved quantum supremacy, using a photonic peak 76-qubit system known as Jiuzhang.
      3. 2021: Chinese researchers reported that they have built the world's largest integrated quantum communication network.
      4. 2022: The Quantinuum System Model H1-2 doubled its performance claiming to be the first commercial quantum computer to pass quantum volume 4096.

      Info-Tech Insight

      The advent of QC will significantly change our perception of computing and have a crucial impact on the way we protect our digital economy using encryption. The technology's applicability is no longer a theory but a reality to be understood, strategized about, and planned for.

      Fundamental physical principles and business use cases

      Unlike conventional computers that rely on bits, quantum computers use quantum bits or qubits. QC technology surpasses the limitations of current processing powers. By leveraging the properties of superposition, interference, and entanglement, quantum computers have the capacity to simultaneously process millions of operations, thereby surpassing the capabilities of today's most advanced supercomputers.

      A 2021 Hyperion Research survey of over 400 key decision makers in North America, Europe, South Korea, and Japan showed nearly 70% of companies have some form of in-house QC program.

      Three fundamental QC physical principles

      1. Superposition
      2. Interference
      3. Entanglement

      This is an image of two headings, Optimization; and Simulation. there are five points under each heading, with an arrow above pointing left to right, labeled Qbit Count.

      Info-Tech Insight

      Organizations need to reap the substantial benefits of QC's power, while simultaneously shielding against the same technologies when used by cyber adversaries.

      Percentage of Surveyed Companies That Have QC Programs

      • 31% Have some form of in-house QC program
      • 69% Have no QC program

      Early adopters and business value

      QC early adopters see the promise of QC for a wide range of computational workloads, including machine learning applications, finance-oriented optimization, and logistics/supply chain management.

      This is an image of the Early Adopters, and the business value drivers.

      Info-Tech Insight

      Experienced attackers are likely to be the early adopters of quantum-enabled cryptographic solutions, harnessing the power of QC to exploit vulnerabilities in today's encryption methods. The risks are particularly high for industries that rely on critical infrastructure.

      The need of quantum-safe solution is immediate

      Critical components of classical cryptography will be at risk, potentially leading to the exposure of confidential and sensitive information to the general public. Business, technology, and security leaders are confronted with an immediate imperative to formulate a quantum-safe strategy and establish a roadmap without delay.

      Case Study – Google, 2019

      In 2019, Google claimed that "Our Sycamore processor takes about 200 seconds to sample one instance of a quantum circuit a million times—our benchmarks currently indicate that the equivalent task for a state-of-the-art classical supercomputer would take approximately 10,000 years."
      Source: Nature, 2019

      Why You Should Start Preparation Now

      • The complexity with integrating QC technology into existing IT infrastructure.
      • The effort to upgrade to quantum-resilient cryptography will be significant.
      • The amount of time remaining will decrease every day.

      Case Study – Development in China, 2020

      On December 3, 2020, a team of Chinese researchers claim to have achieved quantum supremacy, using a photonic peak 76-qubit system (43 average) known as Jiuzhang, which performed calculations at 100 trillion times the speed of classical supercomputers.
      Source: science.org, 2020

      Info-Tech Insight

      The emergence of QC brings forth cybersecurity threats. It is an opportunity to regroup, reassess, and revamp our approaches to cybersecurity.

      Security threats posed by QC

      Quantum computers have reached a level of advancement where even highly intricate calculations, such as factoring large numbers into their primes, which serve as the foundation for RSA encryption and other algorithms, can be solved within minutes.

      Threat to data confidentiality

      QC could lead to unauthorized decryption of confidential data in the future. Data confidentiality breaches also impact improperly disposed encrypted storage media.

      Threat to authentication protocols and digital governance

      A recovered private key, which is derived from a public key, can be used through remote control to fraudulently authenticate a critical system.

      Threat to data integrity

      Cybercriminals can use QC technology to recover private keys and manipulate digital documents and their digital signatures.

      Example:

      Consider RSA-2048, a widely used public-key cryptosystem that facilitates secure data transmission. In a 2021 survey, a majority of leading authorities believed that RSA-2048 could be cracked by quantum computers within a mere 24 hours.
      Source: Quantum-Readiness Working Group, 2022

      Info-Tech Insight

      The development of quantum-safe cryptography capabilities is of utmost importance in ensuring the security and integrity of critical applications' data.

      US Quantum Computing Cybersecurity Preparedness Act

      The US Congress considers cryptography essential for the national security of the US and the functioning of the US economy. The Quantum Computing Cybersecurity Preparedness Act was introduced on April 18, 2022, and became a public law (No: 117-260) on December 21, 2022.

      Purpose

      The purpose of this Act is to encourage the migration of Federal Government information technology systems to quantum-resistant cryptography, and for other purposes.

      Scope and Exemption

      • Scope: Systems of government agencies.
      • Exemption: This Act shall not apply to any national security system.

      Main Obligations

      Responsibilities

      Requirements
      Inventory Establishment Not later than 180 days after the date of enactment of this Act, the Director of OMB, shall issue guidance on the migration of information technology to post-quantum cryptography.
      Agency Reports "Not later than 1 year after the date of enactment of this Act, and on an ongoing basis thereafter, the head of each agency shall provide to the Director of OMB, the Director of CISA, and the National Cyber Director— (1) the inventory described in subsection (a)(1); and (2) any other information required to be reported under subsection (a)(1)(C)."
      Migration and Assessment "Not later than 1 year after the date on which the Director of NIST has issued post-quantum cryptography standards, the Director of OMB shall issue guidance requiring each agency to— (1) prioritize information technology described under subsection (a)(2)(A) for migration to post-quantum cryptography; and (2) develop a plan to migrate information technology of the agency to post-quantum cryptography consistent with the prioritization under paragraph (1)."

      "It is the sense of Congress that (1) a strategy for the migration of information technology of the Federal Government to post-quantum cryptography is needed; and (2) the government wide and industry-wide approach to post- quantum cryptography should prioritize developing applications, hardware intellectual property, and software that can be easily updated to support cryptographic agility." – Quantum Computing Cybersecurity Preparedness Act

      The development of post-quantum encryption

      Since 2016, the National Institute of Standards and Technology (NIST) has been actively engaged in the development of post-quantum encryption standards. The objective is to identify and establish standardized cryptographic algorithms that can withstand attacks from quantum computers.

      NIST QC Initiative Key Milestones

      Date Development
      Dec. 20, 2016 Round 1 call for proposals: Announcing request for nominations for public-key post-quantum cryptographic algorithms
      Nov. 30, 2017 Deadline for submissions – 82 submissions received
      Dec. 21, 2017 Round 1 algorithms announced (69 submissions accepted as "complete and proper")
      Jan. 30, 2019 Second round candidates announced (26 algorithms)

      July 22, 2020

      Third round candidates announced (7 finalists and 8 alternates)

      July 5, 2022

      Announcement of candidates to be standardized and fourth round candidates
      2022/2024 (Plan) Draft standards available

      Four Selected Candidates to be Standardized

      CRYSTALS – Kyber

      CRYSTALS – Dilithium

      FALCON

      SPHINCS+

      NIST recommends two primary algorithms to be implemented for most use cases: CRYSTALS-KYBER (key-establishment) and CRYSTALS-Dilithium (digital signatures). In addition, the signature schemes FALCON and SPHINCS+ will also be standardized.

      Info-Tech Insight

      There is no need to wait for formal NIST PQC standards selection to begin your post-quantum mitigation project. It is advisable to undertake the necessary steps and allocate resources in phases that can be accomplished prior to the finalization of the standards.

      Prepare for post-quantum cryptography

      The advent of QC is closer than you think: some nations have demonstrated capability with the potential to break current asymmetric-key encryption. Traditional encryption methods will no longer be sufficient as a means of protection. You need to act now to begin your transformation to quantum-resistant encryption.

      This is an infographic showing the three steps: Threat is Imminent; Risks are Profound; and Take Acton Now.

      Insight summary

      Overarching Insight

      The advent of QC is closer than you think as some nations have demonstrated capability with the potential to break current asymmetric-key encryption. Traditional encryption methods will no longer be sufficient as a means of protection. You need to act now to begin your transformation to quantum-resistant encryption.

      Business Impact Is High

      The advent of QC will significantly change our perception of computing and have a crucial impact on the way we protect our digital economy using encryption. The technology's applicability is no longer a theory but a reality to be understood, strategized about, and planned for.

      It's a Collaborative Effort

      Embedding quantum resistance into systems during the process of modernization requires collaboration beyond the scope of a Chief Information Security Officer (CISO) alone. It is a strategic endeavor shaped by leaders throughout the organization, as well as external partners. This comprehensive approach involves the collective input and collaboration of stakeholders from various areas of expertise within and outside the organization.

      Leverage Industry Standards

      There is no need to wait for formal NIST PQC standards selection to begin your post-quantum mitigation project. It is advisable to undertake the necessary steps and allocate resources in phases that can be accomplished prior to the finalization of the standards.

      Take a Holistic Approach

      The advent of QC poses threats to cybersecurity. It's a time to regroup, reassess, and revamp.

      Blueprint benefits

      IT Benefits

      Business Benefits

      • This blueprint will help organizations to discover and then prioritize the systems to be upgraded to post-quantum cryptography.
      • This blueprint will enable organizations to integrate quantum-resistant cryptography into existing IT infrastructure.
      • Developing quantum-resistant cryptography capabilities is crucial to maintaining data security and integrity for critical applications.
      • This blueprint will help organizations to save effort and time needed upgrade to quantum-resilient cryptography.
      • Organizations will reap the substantial benefits of QC's power, while simultaneously shielding against the same technologies when used by cyber adversaries.
      • Avoid reputation and brand image by preventing data breach and leakage.
      • This blueprint will empower organizations to protect corporate data assets in the post-quantum era.
      • Be compliant with various security and privacy laws and regulations.

      Info-Tech Project Value

      Time, value, and resources saved to obtain buy-in from senior leadership team using our research material:

      1 FTEs*10 days*$100,000/year = $6,000

      Time, value, and resources saved to implement quantum-resistant cryptography using our research guidance:

      2 FTEs* 30 days*$100,000/year = $24,000

      Estimated cost and time savings from this blueprint:

      $6,000 + $24,000 =$30,000

      Get prepared for a post-quantum world

      The advent of sufficiently powerful quantum computers poses a risk of compromising or weakening traditional forms of asymmetric and symmetric cryptography. To safeguard data security and integrity for critical applications, it is imperative to undertake substantial efforts in migrating an organization's cryptographic systems to post-quantum encryption. The development of quantum-safe cryptography capabilities is crucial in this regard.

      Phase 1 - Prepare

      • Obtain buy-in from leadership team.
      • Educate your workforce about the upcoming transition.
      • Create defined projects to reduce risks and improve crypto-agility.

      Phase 2 - Discover

      • Determine the extent of your exposed data, systems, and applications.
      • Establish an inventory of classical cryptographic use cases.

      Phase 3 - Assess

      • Assess the security and data protection risks posed by QC.
      • Assess the readiness of transforming existing classical cryptography to quantum-resilience solutions.

      Phase 4 - Prioritize

      • Prioritize transformation plan based on criteria such as business impact, near-term technical feasibility, and effort, etc.
      • Establish a roadmap.

      Phase 5 - Mitigate

      • Implement post-quantum mitigations.
      • Decommissioning old technology that will become unsupported upon publication of the new standard.
      • Validating and testing products that incorporate the new standard.

      Phase 1 – Prepare: Protect data assets in the post-quantum era

      The rise of sufficiently powerful quantum computers has the potential to compromise or weaken conventional asymmetric and symmetric cryptography methods. In anticipation of a quantum-safe future, it is essential to prioritize crypto-agility. Consequently, organizations should undertake specific tasks both presently and in the future to adequately prepare for forthcoming quantum threats and the accompanying transformations.

      Quantum-resistance preparations must address two different needs:

      Reinforce digital transformation initiatives

      To thrive in the digital landscape, organizations must strengthen their digital transformation initiatives by embracing emerging technologies and novel business practices. The transition to quantum-safe encryption presents a unique opportunity for transformation, allowing the integration of these capabilities to evolve business transactions and relationships in innovative ways.

      Protect data assets in the post-quantum era

      Organizations should prioritize supporting remediation efforts aimed at ensuring the quantum safety of existing data assets and services. The implementation of crypto-agility enables organizations to respond promptly to cryptographic vulnerabilities and adapt to future changes in cryptographic standards. This proactive approach is crucial, as the need for quantum-safe measures existed even before the complexities posed by QC emerged.

      Preparation for the post-quantum world has been recommended by the US government and other national bodies since 2016.

      In 2016, NIST, the National Security Agency (NSA), and Central Security Service stated in their Commercial National Security Algorithm Suite and QC FAQ: "NSA believes the time is now right [to start preparing for the post-quantum world] — consistent with advances in quantum computing."
      Source: Cloud Security Alliance, 2021

      Phase 1 – Prepare: Key tasks

      Preparing for quantum-resistant cryptography goes beyond simply acquiring knowledge and conducting experiments in QC. It is vital for senior management to receive comprehensive guidance on the challenges, risks, and potential mitigations associated with the post-quantum landscape. Quantum and post-quantum education should be tailored to individuals based on their specific roles and the impact of post-quantum mitigations on their responsibilities. This customized approach ensures that individuals are equipped with the necessary knowledge and skills relevant to their respective roles.

      Leadership Buy-In

      • Get senior management commitment to post-quantum project.
      • Determine the extent of exposed data, systems, and applications.
      • Identify near-term, achievable cryptographic maturity goals, creating defined projects to reduce risks and improve crypto-agility.

      Roles and Responsibilities

      • The ownership should be clearly defined regarding the quantum-resistant cryptography program.
      • This should be a cross-functional team within which members represent various business units.

      Awareness and Education

      • Senior management needs to understand the strategic threat to the organization and needs to adequately address the cybersecurity risk in a timely fashion.
      • Educate your workforce about the upcoming transition. All training and education should seek to achieve awareness of the following items with the appropriate stakeholders.

      Info-Tech Insight

      Embedding quantum resistance into systems during the process of modernization requires collaboration beyond the scope of a CISO alone. It is a strategic endeavor shaped by leaders throughout the organization, as well as external partners. This comprehensive approach involves the collective input and collaboration of stakeholders from various areas of expertise within and outside the organization.

      Phase 2 – Discover: Establish a data protection inventory

      During the discovery phase, it is crucial to locate and identify any critical data and devices that may require post-quantum protection. This step enables organizations to understand the algorithms in use and their specific locations. By conducting this thorough assessment, organizations gain valuable insights into their existing infrastructure and cryptographic systems, facilitating the implementation of appropriate post-quantum security measures.

      Inventory Core Components

      1. Description of devices and/or data
      2. Location of all sensitive data and devices
      3. Criticality of the data
      4. How long the data or devices need to be protected
      5. Effective cryptography in use and cryptographic type
      6. Data protection systems currently in place
      7. Current key size and maximum key size
      8. Vendor support timeline
      9. Post-quantum protection readiness

      Key Things to Consider

      • The accuracy and thoroughness of the discovery phase are critical factors that contribute to the success of a post-quantum project.
      • It is advisable to conduct this discovery phase comprehensively across all aspects, not solely limited to public-key algorithms.
      • Performing a data protection inventory can be a time-consuming and challenging phase of the project. Breaking it down into smaller subtasks can help facilitate the process.
      • Identifying all information can be particularly challenging since data is typically scattered throughout an organization. One approach to begin this identification process is by determining the inputs and outputs of data for each department and team within the organization.
      • To ensure accountability and effectiveness, it is recommended to assign a designated individual as the ultimate owner of the data protection inventory task. This person should have the necessary responsibilities and authority to successfully accomplish the task.

      Phase 3 – Assess: The workflow

      Quantum risk assessment entails evaluating the potential consequences of QC on existing security measures and devising strategies to mitigate these risks. This process involves analyzing the susceptibility of current systems to attacks by quantum computers and identifying robust security measures that can withstand QC threats.

      Risk Assessment Workflow

      This is an image of the Risk Assessment Workflow

      By identifying the security gaps that will arise with the advent of QC, organizations can gain insight into the substantial vulnerabilities that core business operations will face when QC becomes a prevalent reality. This proactive understanding enables organizations to prepare and implement appropriate measures to address these vulnerabilities in a timely manner.

      Phase 4 – Prioritize: Balance business value, security risks, and effort

      Organizations need to prioritize the mitigation initiatives based on various factors such as business value, level of security risk, and the effort needed to implement the mitigation controls. In the diagram below, the size of the circle reflects the degree of effort. The bigger the size, the more effort is needed.

      This is an image of a chart where the X axis represents Security Risk level, and the Y axis is Business Value.

      QC Adopters Anticipated Annual Budgets

      This is an image of a bar graph showing the Anticipated Annual Budgets for QC Adopters.
      Source: Hyperion Research, 2022

      Hyperion's survey found that the range of expected budget varies widely.

      • The most selected option, albeit by only 38% of respondents, was US$5 million to US$15 million.
      • About one-third of respondents foresaw annual budgets that exceeded US$15 million, and one-fifth expected budgets to exceed US$25 million.

      Build your risk mitigation roadmap

      2 hours

      1. Review the quantum-resistance initiatives generated in Phase 3 – Assessment.
      2. With input from all stakeholders, prioritize the initiatives based on business value, security risks, and effort using the 2x2 grid.
      3. Review the position of all initiatives and adjust accordingly considering other factors such as dependency, etc.
      4. Place prioritized initiatives to a wave chart.
      5. Assign ownership and target timeline for each initiative.

      This is an image the Security Risk Vs. Business value graph, above an image showing Initiatives Numbered 1-7, divided into Wave 1; Wave 2; and Wave 3.

      Input

      • Data protection inventory created in phase 2
      • Risk assessment produced in phase 3
      • Business unit leaders' and champions' understanding (high-level) of challenges posed by QC

      Output

      • Prioritization of quantum-resistance initiatives

      Materials

      • Whiteboard/flip charts
      • Sticky notes
      • Pen/whiteboard markers

      Participants

      • Quantum-resistance program owner
      • Senior leadership team
      • Business unit heads
      • Chief security officer
      • Chief privacy officer
      • Chief information officer
      • Representatives from legal, risk, and governance

      Phase 5 – Mitigate: Implement quantum-resistant encryption solutions

      To safeguard against cybersecurity risks and threats posed by powerful quantum computers, organizations need to adopt a robust defense-in-depth approach. This entails implementing a combination of well-defined policies, effective technical defenses, and comprehensive education initiatives. Organizations may need to consider implementing new cryptographic algorithms or upgrading existing protocols to incorporate post-quantum encryption methods. The selection and deployment of these measures should be cost-justified and tailored to meet the specific needs and risk profiles of each organization.

      Governance

      Implement solid governance mechanisms to promote visibility and to help ensure consistency

      • Update policies and documents
      • Update existing acceptable cryptography standards
      • Update security and privacy audit programs

      Industry Standards

      • Stay up to date with newly approved standards
      • Leverage industry standards (i.e. NIST's post-quantum cryptography) and test the new quantum-safe cryptographic algorithms

      Technical Mitigations

      Each type of quantum threat can be mitigated using one or more known defenses.

      • Physical isolation
      • Replacing quantum-susceptible cryptography with quantum-resistant cryptography
      • Using QKD
      • Using quantum random number generators
      • Increasing symmetric key sizes
      • Using hybrid solutions
      • Using quantum-enabled defenses

      Vendor Management

      • Work with key vendors on a common approach to quantum-safe governance
      • Assess vendors for possible inclusion in your organization's roadmap
      • Create acquisition policies regarding quantum-safe cryptography

      Research Contributors and Experts

      This is a picture of Adib Ghubril

      Adib Ghubril
      Executive Advisor, Executive Services
      Info-Tech Research Group

      This is a picture of Erik Avakian

      Erik Avakian
      Technical Counselor
      Info-Tech Research Group

      This is a picture of Alaisdar Graham

      Alaisdar Graham
      Executive Counselor
      Info-Tech Research Group

      This is a picture of Carlos Rivera

      Carlos Rivera
      Principal Research Advisor
      Info-Tech Research Group

      This is a picture of Hendra Hendrawan

      Hendra Hendrawan
      Technical Counselor
      Info-Tech Research Group

      This is a picture of Fritz Jean-Louis

      Fritz Jean-Louis
      Principal Cybersecurity Advisor
      Info-Tech Research Group

      Bibliography

      117th Congress (2021-2022). H.R.7535 - Quantum Computing Cybersecurity Preparedness Act. congress.gov, 21 Dec 2022.
      Arute, Frank, et al. Quantum supremacy using a programmable superconducting processor. Nature, 23 Oct 2019.
      Bernhardt, Chris. Quantum Computing for Everyone. The MIT Press, 2019.
      Bob Sorensen. Quantum Computing Early Adopters: Strong Prospects For Future QC Use Case Impact. Hyperion Research, Nov 2022.
      Candelon, François, et al. The U.S., China, and Europe are ramping up a quantum computing arms race. Here's what they'll need to do to win. Fortune, 2 Sept 2022.
      Curioni, Alessandro. How quantum-safe cryptography will ensure a secure computing future. World Economic Forum, 6 July 2022.
      Davis, Mel. Toxic Substance Exposure Requires Record Retention for 30 Years. Alert presented by CalChamber, 18 Feb 2022.
      Eddins, Andrew, et al. Doubling the size of quantum simulators by entanglement forging. arXiv, 22 April 2021.
      Gambetta, Jay. Expanding the IBM Quantum roadmap to anticipate the future of quantum-centric supercomputing. IBM Research Blog, 10 May 2022.
      Golden, Deborah, et al. Solutions for navigating uncertainty and achieving resilience in the quantum era. Deloitte, 2023.
      Grimes, Roger, et al. Practical Preparations for the Post-Quantum World. Cloud Security Alliance, 19 Oct 2021.
      Harishankar, Ray, et al. Security in the quantum computing era. IBM Institute for Business Value, 2023.
      Hayat, Zia. Digital trust: How to unleash the trillion-dollar opportunity for our global economy. World Economic Forum, 17 Aug 2022.
      Mateen, Abdul. What is post-quantum cryptography? Educative, 2023.
      Moody, Dustin. Let's Get Ready to Rumble—The NIST PQC 'Competition.' NIST, 11 Oct 2022.
      Mosca, Michele, Dr. and Dr. Marco Piani. 2021 Quantum Threat Timeline Report. Global Risk Institute, 24 Jan 2022.
      Muppidi, Sridhar and Walid Rjaibi. Transitioning to Quantum-Safe Encryption. Security Intelligence, 8 Dec 2022.
      Payraudeau, Jean-Stéphane, et al. Digital acceleration: Top technologies driving growth in a time of crisis. IBM Institute for Business Value, Nov 2020.
      Quantum-Readiness Working Group (QRWG). Canadian National Quantum-Readiness- Best Practices and Guidelines. Canadian Forum for Digital Infrastructure Resilience (CFDIR), 17 June 2022.
      Rotman, David. We're not prepared for the end of Moore's Law. MIT Technology Review, 24 Feb 2020.
      Saidi, Susan. Calculating a computing revolution. Roland Berger, 2018.
      Shorter., Ted. Why Companies Must Act Now To Prepare For Post-Quantum Cryptography. Forbes.com, 11 Feb 2022.
      Sieger, Lucy, et al. The Quantum Decade, Third edition. IBM, 2022.
      Sorensen, Bob. Broad Interest in Quantum Computing as a Driver of Commercial Success. Hyperion Research, 17 Nov 2021.
      Wise, Jason. How Much Data is Created Every Day in 2022? Earthweb, 22 Sept 2022.
      Wright, Lawrence. The Plague Year. The New Yorker, 28 Dec 2020.
      Yan, Bao, et al. Factoring integers with sublinear resources on a superconducting quantum processor. arXiv, 23 Dec 2022.
      Zhong, Han-Sen, et al. Quantum computational advantage using photons. science.org, 3 Dec 2020.

      Portfolio Management

      • Buy Link or Shortcode: {j2store}47|cart{/j2store}
      • Related Products: {j2store}47|crosssells{/j2store}
      • member rating overall impact: 9.6/10
      • member rating average dollars saved: $40,234
      • member rating average days saved: 30
      • Parent Category Name: Applications
      • Parent Category Link: /applications

      The challenge

      • Typically your business wants much more than your IT development organization can deliver with the available resources at the requested quality levels.
      • Over-damnd has a negative influence on delivery throughput. IT starts many projects (or features) but has trouble delivering most of them within the set parameters of scope, time, budget, and quality. Some requested deliverables may even be of questionable value to the business.
      • You may not have the right project portfolio management (PPM) strategy to bring order in IT's delivery activities and to maximize business value.

      Our advice

      Insight

      • Many in IT mix PPM and project management. Your project management playbook does not equate to the holistic view a real PPM practice gives you.
      • Some organizations also mistake PPM for a set of processes. Processes are needed, but a real strategy works towards tangible goals.
      • PPM works at the strategic level of the company; hence executive buy-in is critical. Without executive support, any effort to reconcile supply and demand will be tough to achieve.

      Impact and results 

      • PPM is a coherent business-aligned strategy that maximizes business value creation across the entire portfolio, rather than in each project.
      • Our methodology tackles the most pressing challenge upfront: get executive buy-in before you start defining your goals. With senior management behind the plan, implementation will become easier.
      • Create PPM processes that are a cultural fit for your company. Define your short and long-term goals for your strategy and support them with fully embedded portfolio management processes.

      The roadmap

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Get started.

      Read our executive brief to understand why you should develop a PPM strategy and understand how our methodology can help you. We show you how we can support you.

      Obtain executive buy-in for your strategy

      Ensure your strategy is a cultural fit or cultural-add for your company.

      • Develop a Project Portfolio Management Strategy – Phase 1: Get Executive Buy-In for Your PPM Strategy (ppt)
      • PPM High-Level Supply-Demand Calculator (xls)
      • PPM Strategic Plan Template (ppt)
      • PPM Strategy-Process Goals Translation Matrix Template (xls)

      Align the PPM processes to your company's strategic goals

      Use the advice and tools in this stage to align the PPM processes.

      • Develop a Project Portfolio Management Strategy – Phase 2: Align PPM Processes to Your Strategic Goals (ppt)
      • PPM Strategy Development Tool (xls)

      Refine and complete your plan

      Use the inputs from the previous stages and add a cost-benefit analysis and tool recommendation.

      • Streamline Application Maintenance – Phase 3: Optimize Maintenance Capabilities (ppt)

      Streamline your maintenance delivery

      Define quality standards in maintenance practices. Enforce these in alignment with the governance you have set up. Show a high degree of transparency and open discussions on development challenges.

      • Develop a Project Portfolio Management Strategy – Phase 3: Complete Your PPM Strategic Plan (ppt)
      • Project Portfolio Analyst / PMO Analyst (doc)

       

       

      Generative AI: Market Primer

      • Buy Link or Shortcode: {j2store}349|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management
      • Much of the organization remains in the dark for understanding what Gen AI is, complicated by ambiguous branding from vendors claiming to provide Gen AI solutions.
      • Searching the market for a Gen AI platform is nearly impossible, owing to the sheer number of vendors.
      • The evaluative criteria for selecting a Gen AI platform are unclear.

      Our Advice

      Critical Insight

      • You cannot rush Gen AI selection and implementation. Organizations with (1) FTEs devoted to making Gen AI work (including developers and business intelligence analysts), (2) trustworthy and regularly updated data, and (3) AI governance are just now reaching PoC testing.
      • Gen AI is not a software category – it is an umbrella concept. Gen AI platforms will be built on different foundational models, be trained in different ways, and provide varying modalities. Do not expect Gen AI platforms to be compared against the same parameters in a vendor quadrant.
      • Bad data is the tip of the iceberg for Gen AI risks. While Gen AI success will be heavily reliant on the quality of data it is fine-tuned on, there are independent risks organizations must prepare for, from Gen AI hallucinations and output reliability to infrastructure feasibility and handling high-volume events.
      • Prepare for ongoing instability in the Gen AI market. If your organization is unsure about where to start with Gen AI, the secure route is to examine what your enterprise providers are offering. Use this as a learning platform to confidently navigate which specialized Gen AI provider will be viable for meeting your use cases.

      Impact and Result

      • Consensus on Gen AI scope and key Gen AI capabilities
      • Identification of your readiness to leverage Gen AI applications
      • Agreement on Gen AI evaluative criteria
      • Knowledge of vendor viability

      Generative AI: Market Primer Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Generative AI: Market Primer – Contextualize the marketspace and prepare for generative AI selection.

      Use Info-Tech’s best practices for setting out a selection roadmap and evaluative criteria for narrowing down vendors – both enterprise and specialized providers.

      • Generative AI: Market Primer Storyboard
      • Data Governance Policy
      • AI Governance Storyboard
      • AI Architecture Assessment and Project Planning Tool
      • AI Architecture Assessment and Project Planning Tool – Sample
      • AI Architecture Templates
      [infographic]

      Further reading

      Generative AI: Market Primer

      Cut through Gen AI buzzwords to achieve market clarity.

      Analyst Perspective

      The generative AI (Gen AI) marketspace is complex, nascent, and unstable.

      Organizations need to get clear on what Gen AI is, its infrastructural components, and the governance required for successful platform selection.

      Thomas Randall

      The urge to be fast-moving to leverage the potential benefits of Gen AI is understandable. There are plenty of opportunities for Gen AI to enrich an organization’s use cases – from commercial to R&D to entertainment. However, there are requisites an organization needs to get right before Gen AI can be effectively applied. Part of this is ensuring data and AI governance is well established and mature within the organization. The other part is contextualizing Gen AI to know what components of this market the organization needs to invest in.

      Owing to its popularity surge, OpenAI’s ChatGPT has become near synonymous with Gen AI. However, Gen AI is an umbrella concept that encompasses a variety of infrastructural architecture. Organizations need to ask themselves probing questions if they are looking to work with OpenAI: Does ChatGPT rest on the right foundational model for us? Does ChatGPT offer the right modalities to support our organization’s use cases? How much fine-tuning and prompt engineering will we need to perform? Do we require investment in on-premises infrastructure to support significant data processing and high-volume events? And do we require FTEs to enable all this infrastructure?

      Use this market primer to quickly get up to speed on the elements your organization might need to make the most of Gen AI.

      Thomas Randall

      Advisory Director, Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Much of the organization remains in the dark for understanding what Gen AI is, complicated by ambiguous branding from vendors claiming to provide Gen AI solutions.
      • Searching the market for a Gen AI platform is near impossible, owing to the sheer number of vendors.
      • The evaluative criteria for selecting a Gen AI platform is unclear.

      Common Obstacles

      • Data governance is immature within the organization. There is no source of truth or regularly updated organizational process assets.
      • AI functionality is not well understood within the organization; there is little AI governance for monitoring and controlling its use.
      • The extent of effort and resources required to make Gen AI a success remains murky.

      Info-Tech's Solution

      This market primer for Gen AI will help you:

      1. Contextualize the Gen AI market: Learn what components of Gen AI an organization should consider to make Gen AI a success.
      2. Prepare for Gen AI selection: Use Info-Tech’s best practices for setting out a selection roadmap and evaluative criteria for narrowing down vendors – both enterprise and specialized providers.

      “We are entering the era of generative AI.
      This is a unique time in our history where the benefits of AI are easily accessible and becoming pervasive with co-pilots emerging in the major business tools we use today. The disruptive capabilities that can potentially drive dramatic benefits also introduces risks that need to be planned for.”

      Bill Wong, Principal Research Director – Data and BI, Info-Tech Research Group

      Who benefits from this project?

      This research is designed for:

      • Senior IT, developers, data staff, and project managers who:
        • Have received a mandate from their executives to begin researching the Gen AI market.
        • Need to quickly get up to speed on the state of the Gen AI market, given no deep prior knowledge of the space.
        • Require an overview of the different components to Gen AI to contextualize how vendor comparisons and selections can be made.
        • Want to gain an understanding of key trends, risks, and evaluative criteria to consider in their selection process.

      This research will help you:

      • Articulate the potential business value of Gen AI to your organization.
      • Establish which high-value use cases could be enriched by Gen AI functionality.
      • Assess vendor viability for enterprise and specialized software providers in the Gen AI marketspace.
      • Collect information on the prerequisites for implementing Gen AI functionality.
      • Develop relevant evaluative criteria to assist differentiating between shortlisted contenders.

      This research will also assist:

      • Executives, business analysts, and procurement teams who are stakeholders in:
        • Contextualizing the landscape for learning opportunities.
        • Gathering and documenting requirements.
        • Building deliverables for software selection projects.
        • Managing vendors, especially managing the relationships with incumbent enterprise software providers.

      This research will help you:

      • Identify examples of how Gen AI applications could be leveraged for your organization’s core use cases.
      • Verify the extent of Gen AI functionality an incumbent enterprise provider has.
      • Validate accuracy of Gen AI language and architecture referenced in project deliverables.

      Insight Summary

      You cannot speedrun Gen AI selection and implementation.

      Organizations with (1) FTEs devoted to making Gen AI work (including developers and business intelligence analysts), (2) trustworthy and regularly updated data, and (3) AI governance are just now reaching PoC testing.

      Gen AI is not a software category – it is an umbrella concept.

      Gen AI platforms will be built on different foundational models, be trained in different ways, and provide varying modalities. Do not expect to compare Gen AI platforms to the same parameters in a vendor quadrant.

      Bad data is the tip of the iceberg for Gen AI risks.

      While Gen AI success will be heavily reliant on the quality of data it is fine-tuned on, there are independent risks organizations must prepare for: from Gen AI hallucinations and output reliability to infrastructure feasibility to handle high-volume events.

      Gen AI use may require changes to sales incentives.

      If you plan to use Gen AI in a commercial setting, review your sales team’s KPIs. They are rewarded for sales velocity; if they are the human-in-the-loop to check for hallucinations, you must change incentives to ensure quality management.

      Prepare for ongoing instability in the Gen AI market.

      If your organization is unsure about where to start with Gen AI, the secure route is to examine what your enterprise providers are offering. Use this as a learning platform to confidently navigate which specialized Gen AI provider will be viable for meeting your use cases.

      Brace for a potential return of on-premises infrastructure to power Gen AI.

      The market trend has been for organizations to move to cloud-based products. Yet, for Gen AI, effective data processing and fine-tuning may call for organizations to invest in on-premises infrastructure (such as more GPUs) to enable their Gen AI to function effectively.

      Info-Tech’s methodology for understanding the Gen AI marketspace

      Phase Steps

      1. Contextualize the Gen AI marketplace

      1. Define Gen AI and its components.
      2. Explore Gen AI trends.
      3. Begin deriving Gen AI initiatives that align with business capabilities.

      2. Prepare for and understand Gen AI platform offerings

      1. Review Gen AI selection best practices and requisites for effective procurement.
      2. Determine evaluative criteria for Gen AI solutions.
      3. Explore Gen AI offerings with enterprise and specialized providers.
      Phase Outcomes
      1. Achieve consensus on Gen AI scope and key Gen AI capabilities.
      2. Identify your readiness to leverage Gen AI applications.
      3. Hand off to Build Your Generative AI Roadmap to complete pre-requisites for selection.
      1. Determine whether deeper data and AI governance is required; if so, hand off to Create an Architecture for AI.
      2. Gain consensus on Gen AI evaluative criteria.
      3. Understand vendor viability.

      Guided Implementation

      Phase 1

      Phase 2

      • Call #1: Discover if Gen AI is right for your organization. Understand what a Gen AI platform is and discover the art of the possible.
      • Call #2: To take advantage of Gen AI, perform a business capabilities analysis to begin deriving Gen AI initiatives.
      • Call #3: Explore whether Gen AI initiatives can be achieved either with incumbent enterprise players or via procurement of specialized solutions.
      • Call #4: Evaluate vendors and perform final due diligence.

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      The Gen AI market evaluation process should be broken into segments:

      1. Gen AI market education with this primer
      2. Structured approach to selection
      3. Evaluation and final due diligence

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful"

      Guided Implementation

      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop

      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting

      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Software selection engagement

      Five advisory calls over a five-week period to accelerate your selection process

      • Receive expert analyst guidance over five weeks (on average) to select and negotiate software.
      • Save money, align stakeholders, speed up the process, and make better decisions.
      • Use a repeatable, formal methodology to improve your application selection process.
      • Get better, faster results guaranteed, included in membership.
      Software selection process timeline. Week 1: Awareness - 1 hour call, Week 2: Education & Discovery - 1 hour call, Week 3: Evaluation - 1 hour call, Week 4: Selection - 1 hour call, Week 5: Negotiation & Configuration - 1 hour call.

      Click here to book your selection engagement.

      Software selection workshops

      40 hours of advisory assistance delivered online.

      Select better software, faster.

      • 40 hours of expert analyst guidance
      • Project and stakeholder management assistance
      • Save money, align stakeholders, speed up the process, and make better decisions
      • Better, faster results guaranteed; 25K standard engagement fee
      Software selection process timeline. Week 1: Awareness - 5 hours of Assistance, Week 2: Education & Discovery - 10 hours of assistance, Week 3: Evaluation - 10 hours of assistance, Week 4: Selection - 10 hours of assistance, Week 5: Negotiation & Configuration - 10 hours of assistance.

      Click here to book your workshop engagement.

      Make Your IT Governance Adaptable

      • Buy Link or Shortcode: {j2store}359|cart{/j2store}
      • member rating overall impact: 8.0/10 Overall Impact
      • member rating average dollars saved: $123,499 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: IT Governance, Risk & Compliance
      • Parent Category Link: /it-governance-risk-and-compliance
      • People don’t understand the value of governance, seeing it as a hindrance to productivity and efficiency.
      • Governance is delegated to people and practices that don’t have the ability or authority to make these decisions.
      • Decisions are made within committees that don’t meet frequently enough to support business velocity.
      • It is difficult to allocate time and resources to build or execute governance effectively.

      Our Advice

      Critical Insight

      • IT governance applies not just to the IT department but to all uses of information and technology.
      • IT governance works against you if it no longer aligns with or supports your organizational direction, goals, and work practices.
      • Governance doesn’t have to be bureaucratic or control based.
      • Your governance model should be able to adapt to changes in the organization’s strategy and goals, your industry, and your ways of working.
      • Governance can be embedded and automated into your practices.

      Impact and Result

      • You will produce more value from IT by developing a governance framework optimized for your current needs and context, with the ability to adapt as your needs shift.
      • You will create the foundation and ability to delegate and empower governance to enable agile delivery.
      • You will identify areas where governance does not require manual oversight and can be embedded into the way you work.

      Make Your IT Governance Adaptable Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Make Your IT Governance Adaptable Deck – A document that walks you through how to design and implement governance that fits the context of your organization and can adapt to change.

      Our dynamic, flexible, and embedded approach to governance will help drive organizational success. The three-phase methodology will help you identify your governance needs, select and refine your governance model, and embed and automate governance decisions.

      • Make Your IT Governance Adaptable – Phases 1-3

      2. Adaptive and Controlled Governance Model Templates and Workbook – Documents that gather context information about your organization to identify the best approach for governance.

      Use these templates and workbook to identify the criteria and design factors for your organization and the design triggers to maintain fit. Upon completion this will be your new governance framework model.

      • Controlled Governance Models Template
      • IT Governance Program Overview
      • Governance Workbook

      3. Implementation Plan and Workbook – Tools that help you build and finalize your approach to implement your new or revised governance model.

      Upon completion you will have a finalized implementation plan and a visual roadmap.

      • Governance Implementation Plan
      • Governance Roadmap Workbook

      4. Governance Committee Charter Templates – Base charters that can be adapted for communication.

      Customize these templates to create the committee charters or terms of reference for the committees developed in your governance model.

      • IT PMO Committee Charter
      • IT Risk Committee Charter for Controlled Governance
      • IT Steering Committee Charter for Controlled Governance
      • Program Governance Committee Charter
      • Architecture Review Board Charter
      • Data Governance Committee Charter
      • Digital Governance Committee Charter

      5. Governance Automation Criteria Checklist and Worksheet – Tools that help you determine which governance decisions can be automated and work through the required logic and rules.

      The checklist is a starting point for confirming which activities and decisions should be considered for automation or embedding. Use the worksheet to develop decision logic by defining the steps and information inputs involved in making decisions.

      • Governance Automation Criteria Checklist
      • Governance Automation Worksheet

      Infographic

      Workshop: Make Your IT Governance Adaptable

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Develop Your Guiding Star

      The Purpose

      Establish the context for your governance model.

      Key Benefits Achieved

      Core understanding of the context that will enable us to build an optimal model

      Activities

      1.1 Confirm mission, vision, and goals.

      1.2 Define scope and principles.

      1.3 Adjust for culture and finalize context.

      Outputs

      Governance principles

      Governance context and goals

      2 Define the Governance Model

      The Purpose

      To select and adapt a governance model based on your context.

      Key Benefits Achieved

      A selected and optimized governance model

      Activities

      2.1 Select and refine governance model.

      2.2 Confirm and adjust the structure.

      2.3 Review and adapt governance responsibilities and activities.

      2.4 Validate governance mandates and membership.

      Outputs

      IT governance model and adjustment triggers

      IT governance structure, responsibilities, membership, and cadence

      Governance committee charters

      3 Build Governance Process and Policy

      The Purpose

      Refine your governance practices and associate policies properly.

      Key Benefits Achieved

      A completed governance model that can be implemented with clear update triggers and review timing

      Policy alignment with the right levels of authority

      Activities

      3.1 Update your governance process.

      3.2 Align policies to mandate.

      3.3 Adjust and confirm your model.

      3.4 Identify and document update triggers and embed into review cycle.

      Outputs

      IT governance process and information flow

      IT governance policies

      Finalized governance model

      4 Embed and Automate Governance

      The Purpose

      Identify options to automate and embed governance activities and decisions.

      Key Benefits Achieved

      Simply more consistent governance activities and automate them to enhance speed and support governance delegation and empowerment

      Activities

      4.1 Identify decisions and standards that can be automated. Develop decision logic.

      4.2 Plan verification and validation approach.

      4.3 Build implementation plan.

      4.4 Develop communication strategy and messaging.

      Outputs

      Selected automation options, decision logic, and business rules

      Implementation and communication plan

      Further reading

      Make Your IT Governance Adaptable

      Governance isn't optional, so keep it simple and make it flexible.

      Table of Contents

      4 Analyst Perspective

      5 Executive Summary

      13 Governance Stages

      14 Info-Tech’s IT Governance Thought Model

      19 Info-Tech’s Approach

      23 Insight Summary

      30 Phase 1: Identify Your Governance Needs

      54 Phase 2: Select and Refine Your Governance Model

      76 Phase 3: Embed and Automate

      94 Summary of Accomplishment

      95 Additional Support

      97 Contributors

      98 Bibliography

      Make Your IT Governance Adaptable

      Governance isn't optional, so keep it simple and make it flexible.

      EXECUTIVE BRIEF

      Analyst Perspective

      Governance will always be part of the fabric of your organization. Make it adaptable so it doesn’t constrain your success.

      Photo of Valence Howden, Principal Research Director, Info-Tech Research Group

      Far too often, the purpose of information and technology (I&T) governance is misunderstood. Instead of being seen as a way to align the organization’s vision to its investment in information and technology, it has become so synonymous with compliance and control that even mentioning the word “governance” elicits a negative reaction.

      Success in modern digital organizations depends on their ability to adjust for velocity and uncertainty, requiring a dynamic and responsive approach to governance – one that is embedded and automated in your organization to enable new ways of working, innovation, and change.

      Evolutionary theory describes adaptability as the way an organism adjusts to fit a new environment, or changes to its existing environment, to survive. Applied to organizations, adaptable governance is critical to the ability to survive and succeed.

      If your governance doesn’t adjust to enable your changing business environment and customer needs, it will quickly become misaligned with your goals and drive you to failure.

      It is critical that people build an approach to governance that is effective and relevant today while building in adaptability to keep it relevant tomorrow.

      Valence Howden
      Principal Research Director, Info-Tech Research Group

      Executive Summary

      Your Challenge

      • People don’t understand the value of governance, seeing it as a hindrance to productivity and efficiency.
      • Governance is delegated to people and practices that don’t have the ability or authority to make decisions.
      • Decisions are made within committees that don’t meet frequently enough to support business velocity.
      • It is difficult to allocate time and resources to build or execute governance effectively

      Common Obstacles

      • You are unable to clearly communicate how governance adds value to your organization.
      • Your IT governance approach no longer aligns with or supports your organizational direction, goals, and work practices.
      • Governance is seen and performed as a bureaucratic control-based exercise.
      • Governance activities are not transparent.
      • The governance committee gets too deeply involved with project deep dives and daily management, derailing its effectiveness and ability to produce value.

      Info-Tech’s Approach

      • Use Info-Tech’s IT governance models to identify a base model similar to the way you are organized. Confirm your current and future placement in governance execution.
      • Adjust the model based on industry needs, your principles, regulatory requirements, and your future direction.
      • Identify where to embed or automate decision making and compliance and what is required to do so effectively.
      • Implement your governance model for success.

      Info-Tech Insight

      IT governance must be embedded and automated, where possible, to effectively meet the needs and velocity of digital organizations and modern practices and to drive success and value.

      What is governance?

      IT governance is a critical and embedded practice that ensures that information and technology investments, risks, and resources are aligned in the best interests of the organization and produce business value.

      Effective governance ensures that the right technology investments are made at the right time to support and enable your organization’s mission, vision, and goals.

      5 KEY OUTCOMES OF GOOD GOVERNANCE

      STRATEGIC ALIGNMENT

      Technology investments and portfolios are aligned with the organization's strategic objectives.

      RISK OPTIMIZATION

      Organizational risks are understood and addressed to minimize impact and optimize opportunities.

      VALUE DELIVERY

      IT investments and initiatives deliver their expected benefits.

      RESOURCE OPTIMIZATION

      Resources (people, finances, time) are appropriately allocated across the organization to optimal organizational benefit.

      PERFORMANCE MEASUREMENT

      The performance of technology investments is monitored and used to determine future courses of action and to confirm achievement of success.

      ‹–EVALUATE–DIRECT–MONITOR–›

      Why is this necessary?

      • Governance is not simply a committee or an activity that you perform at a specific point in time; it is a critical and continuously active practice that drives the success of your organization. It is part of your organization’s DNA and is just as unique, with some attributes common to all (IT governance elements), some specific to your family (industry refinements), and some specific to you (individual organization).
      • Your approach to governance needs to change over time in order to remain relevant and continue to enable value and success, but organizations rarely want to change governance once it’s in place.
      • To meet the speed and flow of practices like Lean, DevOps, and Agile, your IT governance needs to be done differently and become embedded into the way your organization works. You must adjust your governance model based on key moments of change – organizational triggers – to maintain the effectiveness of your model.

      Info-Tech Insight

      Build an optimal model quickly and implement the core elements using an iterative approach to ensure the changes provide the most value.

      The Technology Value Trinity

      Delivery of Business Value & Strategic Needs

      • DIGITAL & TECHNOLOGY STRATEGY
        The identification of objectives and initiatives necessary to achieve business goals.
      • IT OPERATING MODEL
        The model for how IT is organized to deliver on business needs and strategies.
      • INFORMATION & TECHNOLOGY GOVERNANCE
        The governance to ensure the organization and its customers get maximum value from the use of information and technology.

      All three elements of the Technology Value Trinity work in harmony to deliver business value and meet strategic needs. As one changes, the others need to change as well.

      • Digital and IT Strategy tells you what you need to achieve to be successful.
      • IT Operating Model and Organizational Design is the alignment of resources to deliver on your strategy and priorities.
      • Information & Technology Governance is the confirmation that IT’s goals and strategy align with the business’ strategy. It is the mechanism by which you continuously prioritize work to ensure that what you deliver is in line with the strategy. This oversight involves evaluating, directing, and monitoring the delivery of outcomes to ensure that the use of resources results in achieving the organization’s goals.

      Too often strategy, operating model and organizational design, and governance are considered separate practices. As a result, “strategic documents” end up being wish lists, and projects continue to be prioritized based on who shouts the loudest rather than on what is in the best interest of the organization.

      Where information & technology governance fits within an organization

      An infographic illustrating where Governance fits within an organization. The main section is titled 'Enterprise Governance and Strategy' and contains 'Value Outcomes', 'Mission and Vision', 'Goals and Objectives', and 'Guiding Principles'. These all feed into the highlighted 'Information & Technology Governance', which then contributes to 'IT Strategy', which lies outside the main section.

      I&T governance hasn’t achieved its purpose

      Governance is the means by which IT ensures that information and technology delivery and spend is aligned to business goals and delivers business outcomes. However, most CEOs continue to perceive IT as being poorly aligned to the business’ strategic goals, which indicates that governance is not implemented or executed properly.

      For I&T governance to be effective you need a clear understanding of the things that drive your organization and its success. This understanding becomes your guiding star, which is critical for effective governance. It also requires participation by all parts of the organization, not just IT.

      Info-Tech CIO/CEO Alignment Diagnostics (N=124)

      43% of CEOs believe that business goals are going unsupported by IT.

      60% of CEOs believe that improvement is required around IT’s understanding of business goals.

      80% of CIOs/CEOs are misaligned on the target role for IT.

      30% of business stakeholders are supporters (N=32,536) of their IT departments

      Common causes of poor governance

      Key causes of poor or misaligned governance

      1. Governance and its value to your organization is not well understood, often being confused or integrated with more granular management activities.
      2. Business executives fail to understand that IT governance is a function of the business and not the IT department.
      3. Poor past experiences have made “governance” a bad word in the organization. People see it as a constraint and barrier that must be circumvented to get work done.
      4. There is misalignment between accountability and authority throughout the organization, and the wrong people are involved in governance practices.
      5. There is an unwillingness to change a governance approach that has served the organization well in the past, leading to challenges when the organization starts to change practices and speed of delivery.
      6. There is a lack of data and data-related capabilities required to support good decision making and the automation of governance decisions.
      7. The goals and strategy of the organization are not known or understood, leaving nothing for IT governance to orient around.

      Key symptoms of ineffective governance committees

      1. No actions or decisions are generated. The committee produces no value and makes no decisions after it meets. The lack of value output makes the usefulness of the committee questionable.
      2. Resources are overallocated. There is a lack of clear understanding of capacity and value in work to be done, leading to consistent underestimation of required resources and poor resource allocation.
      3. Decisions are changed outside of committee. Decisions made or initiatives approved by the committee are later changed when the proper decision makers are involved or the right information becomes available.
      4. Governance decisions conflict with organizational direction. This shows an obvious lack of alignment and behavioral disconnect that work against organizational success. It is often due to not accounting for where power really exists within the structure.
      5. Consistently poor outcomes are produced from governance direction. Committee members’ lack of business acumen, relevant data, or understanding of organizational goals results in decisions that fail to drive successful measured outcomes.

      Mature your governance by transitioning from ad hoc to automated

      Organizations should look to progress in their governance stages. Ad hoc and controlled governance practices tend to be more rigid, making these a poor fit for organizations requiring higher velocity delivery or using more agile and adaptive practices.

      The goal as you progress through these stages is to delegate governance and empower teams based on your fit and culture, enabling teams where needed to make optimal decisions in real time, ensuring that they are aligned with the best interests of the organization.

      Automate governance for optimal velocity while mitigating risks and driving value.

      This puts your organization in the best position to be adaptive, able to react effectively to volatility and uncertainty.

      A graph illustrating the transition from Ad Hoc to Automated. The y-axis is 'Process Integration' and x-axis is 'Trust & Empowerment'. 'Ad Hoc: Inconsistent Decision Making' lies close to the origin, ranking low on both axes' values. 'Controlled: Authoritarian, Highly Structured' ranks slightly higher on both axes. 'Agile: Distributed & Empowered' ranks 2nd highest on both axes. 'Automated: High Velocity, Embedded & Flexible' ranks highest on both axes.

      Stages of governance

      Adaptive
      Data-Centric


      ˆ


      ˆ


      ˆ


      ˆ


      ˆ
      Traditional
      (People- and Document-Centric)

      4

      Automated Governance
      • Entrenched into organizational processes and product/service design
      • Empowered and fully delegated to maintain fit and drive organizational success and survival

      3

      Agile Governance
      • Flexible enough to support different needs in the organization and respond quickly to change
      • Driven by principles and delegated throughout the company

      2

      Controlled Governance
      • Focused on compliance and hierarchy-based authority
      • Levels of authority defined and often driven by regulatory requirements

      1

      Ad Hoc Governance
      • Not well defined or understood within the organization
      • Occurs out of necessity but often not done by the right people or bodies

      Make Governance Adaptable and Automated to Drive Success and Value

      Governance adaptiveness ensures the success of digital organizations and modern practice implementation.

      THE PROBLEM

      • The wrong people are making decisions.
      • Organizations don't understand what governance is or why it's done.
      • Governance scope and design is a bad fit, damaging the organization.
      • People think governance is optional.

      THE SOLUTION

      ESTABLISH YOUR GUIDING PRINCIPLES

      Define and establish the guiding principle that drive your organization toward success.

      • Mission & Vision
      • Business Goals & Success Criteria
      • Operating Model & Work Practices
      • Governance Scope
      • Principles
      SELECT AND REFINE YOUR MODEL

      Use Info-Tech's IT Governance Models to identify a base model similar to the way you are organized. Confirm your current and future placement in governance execution.

      IDENTIFY MODEL UPDATE TRIGGERS

      Adjust the model based on industry needs, your principles, regulatory requirements, and future direction.

      • Principles
        Select principles that allow the organization to be adaptive while still ensuring the governance continues to stay on course with pursuing its guiding star.
      • Responsibilities
        Decide on the governance responsibilities related to Oversight Level, Strategic Alignment, Value Delivery, Risk Optimization, Resource Optimization, and Performance Management.
      • Structure
        Determine at which structured level governance is appropriate: Enterprise, Strategic, Tactical, or Operational.
      • Processes
        Establish processes that will enable governance to occur such as: Embed the processes required for successful governance.
      • Membership
        Identify the Responsibility & Accountability of those who should be involved in governance processes, policies, guidelines, and responsibilities.
      • Policies
        Confirm any governing policies that need to be adhered to and considered to manage risk.
      DETERMINE AUTOMATION OPTIONS AND DECISION RULES

      Identify where to embed or automate decision making and compliance and what is required to do so effectively.

      STAGES OF GOVERNANCE

        Traditional (People- and document-centric)
      1. AD HOC GOVERNANCE
        Governance that is not well defined or understood within the organization. It occurs out of necessity but often not by the right people or bodies.
      2. CONTROLLED GOVERNANCE
        Governance focused on compliance and hierarchy-based, authority-driven control of decisions. Levels of Authority are defined and often driven by regulatory requirements.
      3. Adaptive (Data Centric)
      4. AGILE GOVERNANCE
        Governance that is flexible to support different needs and quick responses in the organization. Driven by principles and delegated throughout the company.
      5. AUTOMATED GOVERNANCE
        Governance that is entrenched and automated into the organizational processes and product/service design. Empowered and fully delegated governance to maintain fit and drive organizational success and survival.

      KEY INSIGHT

      Governance must actively adapt to changes in your organization, environment, and practices or it will drive you to failure.

      Developing governance principles

      Governance principles support the move from controlled to automated governance by providing guardrails that guide your decisions. They provide the ethical boundaries and cultural perspectives that contextualize your decisions and keep you in line with organizational values. Determining principles are global in nature.

      CONTROLLED CHANGE ACTIONS AND RATIONALE AUTOMATED
      Disentangle governance and management Move from governance focused on evaluating, directing, and monitoring strategic decisions around information and technology toward defining and automating rules and principles for decision making into processes and practices, empowering the organization and driving adaptiveness. Delegate and empower
      Govern toward value Move from identifying the organization’s mission, goals, and key drivers toward orienting IT to align with those value outcomes and embedding value outcomes into design and delivery practices. Deliver to defined outcomes
      Make risk-informed decisions Move from governance bodies using risk information to manually make informed decisions based on their defined risk tolerance toward having risk information and attestation baked into decision making across all aspects and layers of the IT organization – from design to sustainment. Embed risk decision making into processes and practices
      Measure to drive improvement Move from static lagging metrics that validate that the work being done is meeting the organization’s needs and guide future decision making toward automated governance with more transparency driven by data-based decision making and real-time data insights. Trust through real-time reporting
      Enforce standards and behavior Move from enforcing standards and behavior and managing exceptions to ensure that there are consistent outcomes and quality toward automating standards and behavioral policies and embedding adherence and changes in behavior into the organization’s natural way of working. Automate standards through automated decision rules, verification, and validation

      Find your guiding star

      MISSION AND VISION –› GOALS AND OBJECTIVES –› GUIDING PRINCIPLES –›

      VALUE

      Why your organization exists and what value it aims to provide. The purpose you build a strategy to achieve. What your organization needs be successful at to fulfill its mission. Key propositions and guardrails that define and guide expected organizational behavior and beliefs.

      Your mission and vision define your goals and objectives. These are reinforced by your guiding principles, including ethical considerations, your culture, and expected behaviors. They provide the boundaries and guardrails for enabling adaptive governance, ensuring you continue to move in the right direction for organizational success.

      To paraphrase Lewis Carroll, “If you don't know where you want to get to, it doesn't much matter which way you go.” Once you know what matters, where value resides, and which considerations are necessary to make decisions, you have consistent directional alignment that allows you to delegate empowered governance throughout the organization, taking you to the places you want to go.

      Understand governance versus management

      Don’t blur the lines between governance and management; each has a unique role to play. Confusing them results in wasted time and confusion around ownership.

      Governance

      I&T governance defines WHAT should be done and sets direction through prioritization and decision making, monitoring overall IT performance.

      Governance aligns with the mission and vision of the organization to guide IT.

      A cycle of processes split into two halves, 'Governance Processes' and 'Management Processes'. Beginning on the Management side, the processes are 'Plan', 'Build', 'Run', 'Monitor', then to the Governance side, 'Evaluate', 'Direct', 'Monitor', and back to the beginning.

      Management

      Management focuses on HOW to do things to achieve the WHAT. It is responsible for executing on, operating, and monitoring activities as determined by I&T governance.

      Management makes decisions for implementation based on governance direction.

      Data is critical to automating governance

      Documents and subjective/non-transparent decisions do not create sufficient structure to allow for the true automation of governance. Data related to decisions and aggregated risk allow you to define decision logic and rules and algorithmically embed them into your organization.

      People- and Document-Centric

      Governance drives activities through specific actors (individuals/committees) and unstructured data in processes and documents that are manually executed, assessed, and revised. There are often constraints caused by gaps or lack of adequate and integrated information in support of good decisions.

      Data-Centric

      Governance actors provide principles, parameters, and decision logic that enable the creation of code, rulesets, and algorithms that leverage organizational data. Attestation is automatic – validated and managed within the process, product, or service.

      Info-Tech’s Approach

      Define your context and build your model

      ESTABLISH YOUR GUIDING PRINCIPLES

      Define and establish the guiding principle that drive your organization toward success.

      • Mission & Vision
      • Business Goals & Success Criteria
      • Operating Model & Work Practices
      • Governance Scope
      • Principles
      SELECT AND REFINE YOUR MODEL

      Use Info-Tech's IT Governance Models to identify a base model similar to the way you are organized. Confirm your current and future placement in governance execution.

      MODEL UPDATE TRIGGERS

      Adjust the model based on industry needs, your principles, regulatory requirements, and future direction.

      • Principles
        Select principles that allow the organization to be adaptive while still ensuring the governance continues to stay on course with pursuing its guiding star.
      • Responsibilities
        Decide on the governance responsibilities related to Oversight Level, Strategic Alignment, Value Delivery, Risk Optimization, Resource Optimization, and Performance Management.
      • Structure
        Determine at which structured level governance is appropriate: Enterprise, Strategic, Tactical, or Operational.
      • Processes
        Establish processes that will enable governance to occur such as: Embed the processes required for successful governance.
      • Membership
        Identify the Responsibility & Accountability of those who should be involved in governance processes, policies, guidelines, and responsibilities.
      • Policies
        Confirm any governing policies that need to be adhered to and considered to manage risk.
      AUTOMATION OPTIONS AND DECISION RULES

      Identify where to embed or automate decision making and compliance and what is required to do so effectively.

      The Info-Tech Difference

      Define your context and build your model

      1. Quickly identify the organizational needs driving governance and your guiding star.
      2. Select and refine a base governance model based on our templates.
      3. Define and document the key changes in your organization that will trigger a need to update or revise your governance.
      4. Determine where you might be able to automate aspects of your governance.
      5. Design your decision rules where appropriate to support automated and adaptive governance.

      How to use this research

      Where are you in your governance optimization journey?

      MY GOVERNANCE IS AD HOC AND WE’RE STARTING FROM SCRATCH I NEED TO BUILD A NEW GOVERNANCE STRUCTURE OUR GOVERNANCE APPROACH IS INEFFECTIVE AND NEEDS IMPROVEMENT I NEED TO LOOK AT OPTIONS FOR AUTOMATING GOVERNANCE PRACTICES
      Step 1.1: Define Your Governance Context Step 1.2: Structure Your IT Governance Phase 2: Select and Refine Your Model Phase 3: Embed and Automate

      IT governance is about ensuring that the investment decisions made around information and technology drive the optimal organizational value, not about governing the IT department.

      In this section we will clarify your organizational context for governance and define your guiding star to orient your governance design and inform your structure.

      There is no need to start from scratch! Start with Info-Tech’s best-practice IT governance models and customize them based on your organizational context.

      The research in this section will help you to select the right base model to work from and provide guidance on how to refine it.

      Governance practices eventually stop being a good fit for a changing organization, and things that worked before become bottlenecks.

      Governing roles and committees don’t adjust well, don’t have consistent practices, and lack the right information to make good decisions.

      The research in this section will help you improve and realign your governance practices.

      Once your governance is controlled and optimized you are ready to investigate opportunities to automate.

      This phase of the blueprint will help you determine where it’s feasible to automate and embed governance, understand key governance automation practices, and develop governing business rules to move your journey forward.

      Related Research:

      If you are looking for details on specific associated practices, please see our related research:

      1. I need to establish data governance.
      2. I need to manage my project portfolio, from intake to confirmation of value.
      3. I need better risk information to support decision making.
      4. I need to ensure I am getting the expected outcomes and benefits from IT spend.
      5. I need to prioritize my product backlog or service portfolio.

      Info-Tech’s methodology for building and embedding adaptive governance

      1. Identify Your Governance Needs 2. Select and Refine Your Governance Model 3. Embed and Automate
      Phase Steps
      1. Confirm Mission, Vision, and Goals
      2. Define Scope and Principles
      3. Adjust for Culture and Finalize Context
      1. Select and Refine Your Governance Model
      2. Identify and Document Your Governance Triggers
      3. Build Your Implementation Plan
      1. Identify Decisions to Embed and Automate
      2. Plan Validation and Verification
      3. Update Implementation Plan
      Phase Outcomes
      • Governance context, guiding star, and principles
      • Completed governance model with associated decisions and policies
      • Implementation plan
      • List of automation options
      • Decision logic, rules, and rulesets
      • Validation and verification approach
      • Finalized implementation plan

      Insight summary

      Value

      To remain valuable, I&T governance must actively adapt to changes in your organization, environment, and practices, or it will drive you to failure instead of success.

      Focus

      I&T governance does not focus on the IT department. Rather, its intent is to ensure your organization makes sound decisions around investment in and use of information and technology.

      Maturity

      Your governance approach progresses in stages from ad hoc to automated as your organization matures. Your stage depends on your organizational needs and ways of working.

      Good governance

      Good governance does not equate to control and does not stifle innovation.

      Automation

      Automating governance must be done in stages, based on your capabilities, level of maturity, and amount of usable data.

      Strategy

      Establish the least amount of governance required to allow you to achieve your goals.

      Guiding star

      If you don’t establish a guiding star to align the different stakeholders in your organization, governance practices will create conflict and confusion.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Key Deliverable:
      Governance Framework Model

      The governance framework model provides the design of your new governance model and the organizational context to retain stakeholder alignment and organizational satisfaction with governance.

      The model includes the structures, practices, and responsibilities to drive effective governance in your organization.

      Sample of the key blueprint deliverable 'Governance Framework Model'.

      Governance Implementation Plan

      This roadmap lays out the changes required to implement the governance model, the cultural items that need to be addressed, and anticipated timing.

      Sample of the blueprint deliverable 'Governance Implementation Plan'.

      Governance Committee Charters

      Develop a detail governance charter or term of reference for each governing body. Outline the mandate, responsibilities, membership, process, and associated policies for each.

      Sample of the blueprint deliverable 'Governance Committee Charters'.

      Blueprint benefits

      IT Benefits

      • Stronger, traceable alignment of IT decisions and initiatives to business needs.
      • Improved ability for IT to meet the changing demands and velocity of the business.
      • Better support and enablement of innovation – removing constraints and barriers.
      • Optimized governance that supports and enables modern work practices.
      • Increased value generation from IT initiatives and optimal use of IT resources.
      • Designed adaptability to ensure you remain in alignment as your business and IT environments change.

      Business Benefits

      • Clear transparent focus of IT initiatives on generating strategic business value.
      • Improved ability to measure the value and contribution of IT to business goals.
      • Alignment and integration of business/IT strategy.
      • Optimized development and use of IT capabilities to meet business needs.
      • Improved integration with corporate/enterprise governance.

      Executive Brief Case Study

      INDUSTRY Manufacturing
      SOURCE Info-Tech analyst experience

      Improving the governance approach and delegating decision making to support a change in business operation

      Challenge

      The large, multi-national organization has locations across the world but has two primary headquarters, in Europe and the United States.

      Market shifts drove an organizational shift in strategy, leading to a change in operating models, a product focus, and new work approaches across the organization.

      Much of the implementation and execution was done in isolation, and effectiveness was slowed by poor integration and conflicting activities that worked against each other.

      The product owner role was not well defined.

      Solution

      After reviewing the organization’s challenges and governance approach, we redefined and realigned its organizational and regional goals and identified outcomes that needed to be driven into their strategies.

      We also reviewed their span of control and integration requirements and properly defined decisions that could be made regionally versus globally, so that decisions could be made to support new work practices.

      We defined the product and service owner roles and the decisions each needed to make.

      Results

      We saw an improvement in the alignment of organizational activities and the right people and bodies making decisions.

      Work and practices were aimed at the same key outcomes and alignment between teams toward organizational goal improved.

      Within one year, the success rate of the organization’s initiatives increased by 22%, and the percentage of product-related decisions made by product owners increased by 50%.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 5 and 8 calls over the course of 2 to 3 months.

      What does a typical GI on this topic look like?

        Phase 1: Identify Your Governance Needs

      • Call #1: Confirm your organization’s mission and vision and review your strategy and goals.
      • Call #2: Identify considerations and governance needs. Develop your guiding star and governing principles.
      • Phase 2: Select and Refine Your Model

      • Call #3: Select your base model and optimize it to meet your governance needs.
      • Call #4: Define your adjustment triggers and develop your implementation plan.
      • Phase 3: Embed and Automate

      • Call #5: Identify decisions and standards you can automate and where to embed them.
      • Call #6: Confirm levels of authority and data requirements. Establish your approach and update the implementation plan.

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com1-888-670-8889

      Session 1 Session 2 Session 3 Session 4 Session 5
      Activities
      Develop Your Guiding Star

      1.1 Confirm mission, vision, and goals

      1.2 Define scope and principles

      1.3 Adjust for culture and finalize context

      Define the Governance Model

      2.1 Select and refine governance model

      2.2 Confirm and adjust the structure

      2.3 Review and adapt governance responsibilities and activities

      2.4 Validate governance mandates and membership

      Build Governance Process and Policy

      3.1 Update your governance process

      3.2 Align policies to mandate

      3.3 Adjust and confirm your governance model

      3.4 Identify and document your update triggers

      3.5 Embed triggers into review cycle

      Embed and Automate Governance

      4.1 Identify decisions and standards to automate

      4.2 Plan verification and validation approach

      4.3 Build implementation plan

      4.4 Develop communication strategy and messaging

      Next Steps and Wrap-Up

      5.1 Complete in-progress outputs from previous four sessions

      5.2 Set up review time for workshop outputs and to discuss next steps

      Outcomes
      1. Governance context and goals
      2. Governance principles
      1. IT governance model and adjustment triggers
      2. IT governance structure, responsibilities, membership, and cadence
      3. Governance committee charters
      1. IT governance process and information flow
      2. IT governance policies
      3. Finalized governance model
      1. Selected automation options, decision logic, and business rules
      2. Implementation and communication plan
      1. Governance context and principles
      2. Finalized governance model and charters
      3. Finalized implementation plan

      Make Your IT Governance Adaptable

      Phase 1

      Identify your Governance Needs

      Phase 1

      • 1.1 Define Your Guiding Star
      • 1.2 Define Scope and Principles
      • 1.3 Adjust for Culture and Finalize Context

      Phase 2

      • 2.1 Choose and Adapt Your Model
      • 2.2. Identify and Document Your Governance Triggers
      • 2.3 Build Your Implementation Approach

      Phase 3

      • 3.1 Identify Decisions to Embed and Automate
      • 3.2 Plan Validation and Verification
      • 3.3 Update Implementation Plan

      This phase will walk you through the following activities:

      Identify the organization’s goals, mission, and vision that will guide governance.

      Define the scope of your governance model and the principles that will guide how it works.

      Account for organizational attitudes, behaviors, and culture related to governance and finalize your context.

      This phase involves the following participants:

      • Senior IT leadership
      • Governance leads

      Step 1.1

      Define Your Guiding Star

      Activities
      • 1.1.1 Document and interpret your strategy, mission, and vision
      • 1.1.2 Document and interpret the business and IT goals and outcomes
      • 1.1.3 Identify your operating model and work processes

      This step will walk you through the following activities:

      Review your business and IT strategy, mission, and vision to ensure understanding of organizational direction.

      Identify the business and IT goals that governance needs to align.

      Confirm your operating model and any work practices that need to be accounted for in your model.

      This step involves the following participants:

      • Senior IT leadership
      • Governance leads

      Outcomes of this step

      Identified guiding star outcomes to align governance outcomes with

      Defined operating model type and work style that impact governance design

      Identify Your Governance Needs

      Step 1.1 – Define your Guiding Star Step 1.2 – Define Scope and Principles Step 1.3 – Adjust for Culture and Finalize Context

      Govern by intent

      Find the balance for your designed governance approach

      Organic governance occurs during the formation of an organization and shifts with challenges, but it is rarely transparent and understood. It changes your culture in uncontrolled ways. Intentional governance is triggered by changes in organizational needs, working approaches, goals, and structures. It is deliberate and changes your culture to enable success.
      Stock photo of a weight scale.

      Info-Tech Insight

      Your approach to governance needs to be designed, even if your execution of governance is adaptable and delegated.

      What is your guiding star?

      Your guiding star is a combination of your organization’s mission, vision, and strategy and the goals that have been defined to meet them.

      It provides you with a consistent focal point around which I&T-related activities and projects orbit, like planets around a star.

      It generates the gravity that governance uses to keep things from straying too far away from the goal of achieving relevant value.

      1. Mission & Vision
      2. Business Goals & Success Criteria
      3. Operating Model & Work Practices
      4. Governance Scope
      5. Principles

      1.1.1 Document and interpret your strategy, mission, and vision

      30 minutes

      Input: Business strategy, IT strategy, Mission and vision statements

      Output: Updated Governance Workbook, Documented strategic outcomes and organizational aims that governance needs to achieve

      Materials: Whiteboard/flip charts, Governance Workbook

      Participants: IT senior leadership

      1. Gather your available business, digital, and IT strategy, mission, and vision information and document everything in your Governance Workbook. It’s ok if you don’t have all of it.
      2. Review and your mission and vision as a group. Discuss and document key points, including:
        • Which activities do you perform as an organization that embody your vision?
        • What key decisions and behaviors are required to ensure that your mission and vision are achievable?
        • What do you require from leadership to enable you to govern effectively?
        • What are the implications of the mission and vision on how the organization needs to work? What are the implications on decisions around opportunities and risks?

      Download the Governance Workbook

      1.1.2 Document and interpret the business and IT goals and outcomes

      60 minutes

      Input: Business strategy, Business and IT goals and related initiatives

      Output: Required success outcomes for goals, Links between IT and business goals that governance needs to align

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Document the business and IT goals that have been created to achieve the mission and vision.
      2. Discuss if there are any gaps between the goals and the mission and vision. Ask yourself – if we accomplish these goals will we have successfully achieved the mission?
      3. For each goal, define what successful achievement of the goal looks like. Starting with one goal or objective, ask:
        • How would I know I am on the right path and how will I know I have gotten there?
        • How would I know if I am not on the right path and what does a bad result look like?
      4. Document your success criteria.
      5. Brainstorm some examples of decisions that support or constrain the achievement of your goals.
      6. Repeat this exercise for your remaining goals.
      7. As a group, map IT goals to business goals.

      What is your operating model and why is it important?

      An IT operating model is a visual representation of the way your IT organization needs to be designed and the capabilities it requires to deliver on the business mission, strategic objectives, and technological ambitions.

      The model is critical in the optimization and alignment of the IT organization’s structure in order to deliver the capabilities required to achieve business goals. It is a key determinant of how governance needs to be designed and where it is implemented.

      Little visualizations of different operating models: 'Centralized', 'Decentralized', and 'Hybrid'.

      1.1.3 Identify your operating model and work practices

      60 minutes

      Input: Organizational structure, Operating model (if available)

      Output: Confirmed operating approach, Defined work practices

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Identify the way your organization functions:
        • How do we currently operate? Are we centralized, decentralized or a hybrid? Are we focused on delivering products and services? Do we provide service ourselves or do we use vendors for delivery?
        • Can we achieve our mission, goals, and strategies, if we continue to operate this way? What would we have to change in how we operate to be successful in the future?
      2. Identify your governance needs. Do we need to be more structured or more flexible to support our future ways of working?
        • If you operate in a more traditional way, consider whether you are implementing or moving toward more modern practices (e.g. Agile, DevOps, enterprise service management). Do you need to make more frequent but lower-risk decisions?
        • Is your organization ready to delegate governance culturally and in terms of business understanding? Is there enough available information to support adaptive decisions and actions?
      3. Document your operating style, expected changes in work style, and cultural readiness. You will need to consider the implications on design.

      Step 1.2

      Define Scope and Principles

      Activities
      • 1.2.1 Determine the proper scope for your governance
      • 1.2.2 Confirm your determining governing principles
      • 1.2.3 Develop your specific governing principles

      This step will walk you through the following activities:

      Identify what is included and excluded within the scope of your governance.

      Develop the determining and specific principles that provide guardrails for governance activities and decisions.

      This step involves the following participants:

      • Senior IT leadership
      • Governance leads

      Outcomes of this step

      Documented governance scope and principles to apply

      Identify Your Governance Needs

      Step 1.1 – Define your Guiding Star Step 1.2 – Define Scope and Principles Step 1.3 – Adjust for Culture and Finalize Context

      Define the context for governance

      Based on the goals and principles you defined and the operating model you selected, confirm where oversight will be necessary and at what level. Focus on the necessity to expedite and clear barriers to the achievement of goals and on the ownership of risks and compliance. Some key considerations:

      • Where in the organization will you need to decide on work that needs to be done?
      • What type of work will you need to do?
      • In what areas could there be conflicts in prioritization/resource allocation to address?
      • Who is accountable for risks to the organization and its objectives?
      • Where are your regional or business-unit-specific concerns that require focused local attention?
      • Are we using more agile, rapid delivery methods to produce work?

      Understand your governance scope

      Your governance scope helps you define the boundaries of what your governance model and practices will cover. This includes key characteristics of your organization that impact what governance needs to address.

      Sample Considerations

      • Organizational Span
        • The geographical area the organization operates within. Regional laws and requirements will affect governance delegation and standards/policy development.
      • Level of Regulation
        • Higher levels of regulation create more standards and controls for risk and compliance, impacting how authority can be delegated or automated.
      • Sourcing Model
        • Changing technology sourcing introduces additional vendor governance requirements and may impact compliance and audit.
      • Risk Posture
        • The appetite for risk organizationally, and in pockets, impacts the level of uncertainty you are willing to work within and impact decision-making authority positioning.
      • Size
        • The size of your organization impacts the approach to governance, practice implementation, and delegation of authority.
      • What Is Working Today?
        • Which elements of your current governance approach should be retained, and what are the biggest pain points that need to be addressed?
      (Source: COBIT 2019)

      1.2.1 Determine the proper scope for your governance

      60 minutes

      Input: Context information from Activity 1.1, Scoping areas

      Output: Defined scope and span of control

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Determine the scope/span of control required for your governance by:
        • Reviewing your key IT capabilities. Identify the ones where the responsibilities and decisions require oversight to ensure they meet the needs of the organization.
        • Identify what works well or poorly in your current governance approach.
        • Discuss and document the level and type of knowledge and business understanding required.
        • Identify and document any regulations, standards, or laws that apply to your organization/industry and how broadly they have to be applied.
        • Identify the organization’s risk appetite, where known, and areas where acceptable thresholds of risk have been defined. Where are key risk and opportunity decisions made? Who owns risk in your organization?
        • Identify and document the perceived role of the IT group in your organization (e.g. support, innovator, partner) and sourcing model (e.g. insource, outsource).
        • Is there sufficient information and data available in your organization to support effective decision making?

      How should your governance be structured?

      Organizations often have too many governance bodies, creating friction without value. Where that isn’t the case, the bodies are often inefficient, with gaps or overlaps in accountability and authority. Structure your governance to optimize its effectiveness, designing with the intent to have the fewest number of governing bodies to be effective, but no less than is necessary.

      Start with your operating model.

      • Understand what’s different about your governance based on whether your organization in centralized, distributed, or a different model (e.g. hybrid, product).
      • Identify and include governance structures that are mandatory due to regulation or industry.
      • Based on your context, identify how many of your governance activities should be performed together.

      Determine whether your governance should be controlled or adaptive.

      • Do you have the capability to distribute governance and is your organization empowered enough culturally?
      • Do you have sufficient standards and data to leverage? Do you have the tools and capabilities?
      • Identify governance structures that are required due to regulation or industry.

      Info-Tech Insight

      Your approach to governance needs to be designed and structured, even if your execution of governance is adaptable and delegated.

      Identify and Refine your Principles

      Confirm your defining principles based on your selection of controlled or adaptive governance. Create specific principles to clarify boundaries or provide specific guidance for teams within the organization.

      Controlled Adaptive
      Disentangle governance and management Delegate and empower
      Govern toward value Deliver to defined outcomes
      Make risk-informed decisions Embed risk into decision making
      Measure to drive improvement Trust though real-time reporting
      Enforce standards and behavior Automate decision making though established standards

      Determining Principle: Delegate and empower.

      Specific Principle: Decisions should be made at the lowest reasonable level of the organization with clarity.

      Rationale: To govern effectively with the velocity required to address business needs, governance needs to be executed deeper into the organization and organizational goals need to be clearly understood everywhere.

      Implication: Decision making needs to be delegated throughout the organization, so information and data requirements need to be identified, decision-making approach and principles need to be shared, and authority needs to be delegated clearly.

      1.2.2 Confirm your determining governance principles

      30-45 minutes

      Input: Governance Framework Model– Governance Principles

      Output: Governance workbook - Finalized list of determining principles

      Materials: Whiteboard/flip charts, Governance Workbook

      Participants: IT senior leadership

      1. Review the IT governance principles in your Governance Workbook.
      2. Within your IT senior leadership team (or IT governance working group) assign one or two principles to teams of two to three participants. Have each team identify what this would mean for your organization. Answering the questions:
        • In what ways do our current governance practices support this?
        • What are some examples of changes that would need to be made to make this a reality?
        • How would applying this principle improve your governance?
      3. Have each team present their results and compile the findings and implications in the Governance Workbook to use for future communication of the change.

      Specific governing principles

      Specific governing principles are refined principles derived from a determining principle, when additional specificity and detail is necessary. It allows you to define an approach for specific behaviors and activities. Multiple specific principles may underpin the determining one.

      A visualization of a staircase with stairs labelled, bottom to top, 'Determining Principle', 'Rationale', 'Implications', 'Specific Principles'.

      Specific Principles – Related principles that may be required to ensure the implications of the determining principal are addressed within the organization. They may be specific to individual areas and may be addressed in policies.

      Implications – The implications of this principle on the organization, specific to how and where governance is executed and the level of information and authority that would be necessary.

      Rationale – The reason(s) driving the determining principle.

      Determining Principle – A core overarching principle – a defining aspect of your governance model.

      1.2.3 Develop your specific governing principles

      30 minutes

      Input: Updated determining principles

      Output: List of specific principles linked to determining principles

      Materials: Whiteboard/flip charts, Governance Workbook

      Participants: IT senior leadership

      1. Confirm the determining principles for your governance model based on your previous discussions.
      2. Identify where to apply the principles. This is based on:
        1. Your governance scope (how much is within your span of control)
        2. The amount of data you have available
        3. Your cultural readiness for delegation
      3. Create specific principles to support the determining principles:
        1. Document the rationale driving the determining principles.
        2. Identify the implications.
        3. Create specific principles that will support the success in achieving the goals of each determining principle.
      4. Document all information on the “Governance guiding star” slide in the Governance Workbook.

      Download the Governance Workbook

      Step 1.3

      Adjust for Culture and Finalize Context

      Activities
      • 1.3.1 Identify and address the impact of attitude, behavior, and culture
      • 1.3.2 Finalize your context

      This step will walk you through the following activities:

      Identify your organizational attitude, behavior, and culture related to governance.

      Identify positives that can be leveraged and develop means to address negatives.

      Finalize the context that your model will leverage and align to.

      This step involves the following participants:

      • Senior IT leadership
      • Governance leads

      Outcomes of this step

      Downloaded tool ready to select the base governance model for your organization

      Identify Your Governance Needs

      Step 1.1 – Define your Guiding Star Step 1.2 – Define Scope and Principles Step 1.3 – Adjust for Culture and Finalize Context

      Understanding attitude, behavior, and culture

      A

      ttitude

      What people think and feel. It can be seen in their demeanor and how they react to change initiatives, colleagues, and users. This manifests in the belief that governance is a constraint that needs to be avoided or ignored – often with unintended consequences.

      A stock photo of a lightbulb over a person's head and a blackboard behind them reading 'New Mindset - data-verified= New Results'.">

      Any form of organizational change involves adjusting people’s attitudes to create buy-in and commitment.

      You need to identify and address attitudes that can lead to negative behaviors and actions or that are counter-productive.

      Understanding attitude, behavior, and culture

      B

      ehavior

      What people do. This is influenced by attitude and the culture of the organization. In governance, this manifests as people’s willingness to be governed, who pushes back, and who tries to bypass it.

      A stock photo of someone walking up a set of stairs into the distant sunlight.

      To implement change within IT, especially at a tactical and strategic level, organizational behavior needs to change.

      This is relevant because people gravitate toward stability and will resist change in an active or passive way unless you can sell the need, value, and benefit of changing their behavior and way of working.

      Understanding attitude, behavior, and culture

      C

      ulture

      The accepted and understood ways of working in an organization. The values and standards that people find normal and what would be tacitly identified to new resources. In governance terms, this is how decisions are really made and where responsibility really exists rather than what is identified formally.

      A stock photo of a compass pointing to 'VALUES'.

      The impact of the organizational or corporate “attitude” on employee behavior and attitude is often not fully understood.

      Culture is an invisible element, which makes it difficult to identify, but it has a strong impact and must be addressed to successfully embed governance models. In the case of automating governance, cultural readiness for automation is a critical success factor.

      1.3.1 Identify and address the impact of attitude, behavior, and culture

      45 minutes

      Input: Senior leadership knowledge

      Output: Updated Governance Workbook

      Materials: Governance Workbook

      Participants: IT senior leadership

      1. Break into three groups. Each group will discuss and document the positive and negative aspects of one of attitude, behavior, or culture related to governance in your organization.
      2. Each group will present and explain their list to the group.
      3. Add any additional suggestions in each area that are identified by the other groups.
      4. Identify the positive elements of attitude, behavior, and culture that would help with changing or implementing your updated governance model.
      5. Identify any challenges that will need to be addressed for the change to be successful.
      6. As a group, brainstorm some mitigations or solutions to these challenges. Document them in the Governance Workbook to be incorporated into the implementation plan.

      Download the Governance Workbook

      Attitude, behavior, and culture

      Evaluate the organization across the three contexts. The positive items represent opportunities for leveraging these characteristics with the implementation of the governance model, while the negative items must be considered and/or mitigated.

      Attitude Behavior Culture
      Positive
      Negative
      Mitigation

      1.3.2 Finalize your governance context

      30 minutes

      Input: Documented governance principles and scope from previous exercises

      Output: Finalized governance context in the Governance Workbook

      Materials: Whiteboard/flip charts, Governance Workbook

      Participants: IT senior leadership

      1. Use the information that has been gathered throughout this section to update and finalize your IT governance context.
      2. Document it in your Governance Workbook.

      Download the Governance Workbook

      Make Your IT Governance Adaptable

      Phase 2

      Select and Refine Your Governance Model

      Phase 1

      • 1.1 Define Your Guiding Star
      • 1.2 Define Scope and Principles
      • 1.3 Adjust for Culture and Finalize Context

      Phase 2

      • 2.1 Choose and Adapt Your Model
      • 2.2. Identify and Document Your Governance Triggers
      • 2.3 Build Your Implementation Approach

      Phase 3

      • 3.1 Identify Decisions to Embed and Automate
      • 3.2 Plan Validation and Verification
      • 3.3 Update Implementation Plan

      This phase will walk you through the following activities:

      Select a base governance model and refine it to suit your organization.

      Identify scenarios and changes that will trigger updates to your governance model.

      Build your implementation plan.

      This phase involves the following participants:

      • Senior IT leadership
      • Governance resources

      Step 2.1

      Choose and Adapt Your Model

      Activities
      • 2.1.1 Choose your base governance model
      • 2.1.2 Confirm and adjust the structure of your model
      • 2.1.3 Define the governance responsibilities
      • 2.1.4 Validate the governance mandates and membership
      • 2.1.5 Update your committee processes
      • 2.1.6 Adjust your associated policies
      • 2.1.7 Adjust and confirm your governance model

      This step will walk you through the following activities:

      Review and selecting your base governance model.

      Adjust the structure, responsibilities, policies, mandate, and membership to best support your organization.

      This step involves the following participants:

      • Senior IT leadership
      • Governance leads

      Outcomes of this step

      Downloaded tool ready to select the base governance model for your organization

      Select and Refine Your Governance Model

      Step 2.1 – Choose and Adapt Your Model Step 2.2 – Identify and Document Your Governance Triggers Step 2.3 – Build Implementation Approach

      Your governance framework has six key components

      GOVERNANCE FRAMEWORK

      • GUIDELINES
        The key behavioral factors that ground your governance framework
      • MEMBERSHIP
        Formalization of who has authority and accountability to make specific governance decisions
      • RESPONSIBILITIES
        The definition of which decisions and outcomes your governance structure and each governance body is accountable for
      • STRUCTURE
        Which governance bodies and roles are in place to articulate where decisions are made in the organization
      • PROCESS
        Identification of the how your governance will be executed, how decisions are made, and the inputs, outputs, and connections to related processes
      • POLICY
        Set of principles established to address risk and drive expected and required behavior

      4 layers of governance bodies

      There are traditionally 4 layers of governance in an enterprise, and organizations have governing bodies or individuals at each level

      RESPONSIBILITIES AND TYPICAL MEMBERSHIP
      ENTERPRISE Defines organizational goals. Directs or regulates the performance and behavior of the enterprise, ensuring it has the structure and capabilities to achieve its goals.

      Membership: Business executives, Board

      STRATEGIC Ensures IT initiatives, products, and services are aligned to organizational goals and strategy and provide expected value. Ensure adherence to key principles.

      Membership: Business executives, CIO, CDO

      TACTICAL Ensures key activities and planning are in place to execute strategic initiatives.

      Membership: Authorized division leadership, related IT leadership

      OPERATIONAL Ensures effective execution of day-to-day functions and practices to meet their key objectives.

      Membership: Service/product owners, process owners, architecture leadership, directors, managers

      2.1.1 Choose your base governance model

      30 minutes

      Input: Governance models templates

      Output: Selected governance model

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Download Info-Tech’s base governance models (Controlled Governance Models Template and IT Governance Program Overview) and review them to find a template that most closely matches your context from Phase 1. You can start with a centralized, decentralized, or product/service hybrid IT organization. Remove unneeded models.
      2. If you do not have documented governance today, start with a controlled model as your foundation. Continue working through this phase if you have a documented governance framework you wish to optimize using our best practices or move to Phase 3 if you are looking to automate or embed your governance activities.

      Controlled Governance Models Template

      Adaptive Governance Models Template

      2.1.2 Confirm and adjust the structure of your model

      30-45 minutes

      Input: Selected base governance model, Governance context/scope

      Output: Updated governance bodies and relationships

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Validate your selected governance body structural model.
        • Are there any governing bodies you must maintain that should replace the ones listed? In part or in full?
        • Are there any missing bodies? Look at alternative committees for examples.
        • Document the adjustments.
      2. Are there any governing bodies that are not required?
        • Based on your size and needs, can they be done within one committee?
        • Is the capability or data not in place to perform the work?
        • Document the required changes.

      There are five key areas of governance responsibility

      A cyclical visualization of the five keys areas of governance responsibility, 'Strategic Alignment', 'Value Delivery', 'Risk Management', 'Resource Management', and 'Performance Measurement'.

      STRATEGIC ALIGNMENT
      Ensures that technology investments and portfolios are aligned with the organization’s needs.

      VALUE DELIVERY
      Reviews the outcomes of technology investments and portfolios to ensure benefits realization.

      RISK MANAGEMENT
      Defines and owns the risk thresholds and register to ensure that decisions made are in line with the posture of the organization.

      RESOURCE MANAGEMENT
      Ensures that people, financial knowledge, and technology resources are appropriately allocated across the organization.

      PERFORMANCE MEASUREMENT
      Monitors and directs the performance or technology investments to determine corrective actions and understand successes.

      2.1.3 Define the governance responsibilities

      Ensure you have the right responsibilities in the right place

      45-60 minutes

      Input: Selected governance base model, Governance context

      Output: Updated responsibilities and activities, Updated activities for selected governance bodies, New or removed governing bodies

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Based on your context and model, review the responsibilities identified for each committee and confirm that they align with the mandate and the stated outcome.
      2. Identify and highlight any responsibilities and activities that would not be involved in informing and enabling the mandate of the committee.
      3. Adjust the wording of confirmed responsibilities and activities to reflect your organizational language.
      4. Review each highlighted “bad fit” activity and move it to a committee whose mandate it would support or remove it if it’s not performed in your organization.
      5. If an additional committee is required, define the mandate and scope, then include any additional responsibilities that might have been a bad fit elsewhere

      2.1.4 Validate the governance mandates and membership

      30 minutes

      Input: Selected governance base model, Updated structure and responsibilities

      Output: Adjusted mandates and refined committee membership

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Review the mandate and membership slides in your selected governance model.
      2. Adjust the mandate to ensure that it aligns to and conveys:
        1. The outcome that the committee is meant to generate for the organization.
        2. Its scope/span of control.
      3. Discuss the type of information members would require for the committee to be successful in achieving its mandate.
      4. Document the member knowledge requirement in the mandate slide of the model template.

      Determine the right membership for your governance

      One of the biggest benefits of governance committees is the perspective provided by people from various parts of the organization, which helps to ensure technology investments are aligned with strategic goals. However, having too many people – or the wrong people – involved prevents the committee from being effective. Avoid this by following these principles.

      Three principles for selecting committee membership

      1. Determine membership based on responsibilities and required knowledge.
        Organizations often make the mistake of creating committees and selecting members before defining what they will do. This results in poor governance because members don’t have the knowledge required to make decisions. Define the mandate of the committee to determine which members are the right fit.
      2. Ensure members are accountable and authorized to make the decisions.
        Effective governance requires the members to have the authority and accountability to make decisions. This ensures meetings achieve their outcome and produce value, which improves the committee’s chances of survival.
      3. Select leaders who see the big picture.
        Often committee decisions and responsibilities become tangled in the web of organizational politics. Include people, often C-level, whose attendance is critical and who have the requisite knowledge, mindset, and understanding to put business needs ahead of their own.

      2.1.5 Update your committee processes

      20 minutes

      Input: Selected governance base model, Updated structure and responsibilities

      Output: Updated committee processes

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Review the committee details based on the changes you have made in goals, mandate, and responsibilities.
      2. Identify and document changes required to the committee outputs (outcomes) and adjust the consumer of the outputs to match.
      3. Review the high-level process steps required to get to the modified output. Add required activities or remove unnecessary ones. Review the process flow. Does it make sense? Are there unnecessary steps?
      4. Review and update inputs required for the process steps and update the information/data sources.
      5. Adjust the detailed process steps to reflect the work that needs to be done to support each high-level process step that changed.

      2.1.6 Adjust your associated policies

      20 minutes

      Input: Selected governance base model, Updated structure and responsibilities

      Output: Adjusted mandates and refined committee membership

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Review the policies associated with the governing bodies in your base model. Identify the policies that apply to your organization, those that are missing, and those that are not necessary.
      2. Confirm the policies that you require.
      3. Make sure the policies and policy purposes (or risks and related behaviors the policy addresses) are matched to the governance committee that has responsibilities in that area. Move policies to the right committee.

      2.1.7 Adjust and confirm your governance model

      1. Confirm the adjustment of governance bodies, structure, and input/output linkages.
      2. Confirm revisions to decisions and responsibilities.
      3. Confirm policy and regulation/standards associations.
      4. Select related governance committee charters from the provided set and revise the charters to reflect the elements defined in your updated model.
      5. Finalize your governance model.

      Samples of slides related to adjusting and confirming governance models in the Governance Workbook.

      Step 2.2

      Identify and Document Your Governance Triggers

      Activities
      • 2.2.1 Identify and document update triggers
      • 2.2.2 Embed triggers into the review cycle

      This step will walk you through the following activities:

      Identify scenarios that will create a need to review or change your governance model.

      Update your review/update approach to receiving trigger notifications.

      This step involves the following participants:

      • Senior IT leadership
      • Governance leads

      Outcomes of this step

      Downloaded tool ready to select the base governance model for your organization

      Select and Refine Your Governance Model

      Step 2.1 – Choose and Adapt Your Model Step 2.2 – Identify and Document Your Governance Triggers Step 2.3 – Build Implementation Approach

      What are governance triggers

      Governance triggers are organizational or environmental changes within or around an organization that are inflection points that start the review and revision of governance models to maintain their fit with the organization. This is the key to adaptive governance design.

      A target with five arrows sticking out of the bullseye, 'Operating Model', 'Business Strategy', 'Mandate Change', 'Management Practices', and 'Digital Transformation'.

      2.2.1 Identify and document update triggers

      30 minutes

      Input: Governance Workbook

      Output: Updated workbook with defined and documented governance triggers, points of origin, and integration

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Open the Governance Workbook to the “Triggers” slides.
      2. Review the list of governance triggers. Retain the ones that apply to your organization, remove those you feel are unnecessary, and add any change scenarios you feel should be included.
      3. Identify where you would receive notifications of these changes and the related processes or activities that would generate these notifications, if applicable.
      4. Document any points of integration required between governance processes and the source process. Highlight any where the integration is not currently in place.

      Sample of the 'Triggers' slide in the Governance Workbook.

      2.2.2 Embed triggers into the review cycle

      30 minutes

      Input: Governance model

      Output: Review cycle update

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. Identify which triggers impact the entire governance model and which impact specific committees.
      2. Add an activity for triggered review of the impacted governance model into your governance committee process.

      Step 2.3

      Build Your Implementation Approach

      Activities
      • 2.3.1 Identify and document your implementation plan
      • 2.3.2 Build your roadmap
      • 2.3.3 Build your sunshine diagram

      This step will walk you through the following activities:

      Transfer changes to the Governance Implementation Plan Template.

      Determine the timing for the implementation phases.

      This step involves the following participants:

      • Senior IT leadership
      • Governance process owner

      Outcomes of this step

      Implementation plan for adaptive governance framework model

      Select and Refine Your Governance Model
      Step 2.1 – Choose and Adapt Your Model Step 2.2 – Identify and Document Your Governance Triggers Step 2.3 – Build Implementation Approach

      2.3.1 Identify and document your implementation plan

      60 minutes

      Input: Governance model, Guiding principles, Update triggers, Cultural factors and mitigations

      Output: Implementation roadmap

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. As a group, discuss the changes required to implement the governance model, the cultural items that need to be addressed, and the anticipated timing.
      2. Document the implementation activities and consolidate them into groupings/themes based on similarities or shared outcomes.
      3. Name the grouped themes for clarity and identify key dependencies between activities in each area and across themes.
      4. Identify and document your approach (e.g. continuous, phased) and high-level timeline for implementation.
      5. Document the themes and initiatives in the Governance Implementation Plan.

      Download the Governance Implementation Plan

      Illustrate the implementation plan using roadmaps

      Info-Tech recommends two different methods to roadmap the initiatives in your Governance Implementation Plan.

      Gantt Chart
      Sample of a Gantt Chart.

      This type of roadmap depicts themes, related initiatives, the associated goals, and exact start and end dates for each initiative. This diagram is useful for outlining a larger number of activities and initiatives and has an easily digestible and repeatable format.

      Sunshine Diagram
      Sample of a Sunshine Diagram.

      This type of roadmap depicts themes and their associated initiatives. The start and end dates for the initiatives are approximated based on years or phases. This diagram is useful for highlighting key initiatives on one page.

      2.3.2 Build your roadmap

      30 minutes

      Input: Governance themes and initiatives

      Output: roadmap visual

      Materials: Governance Roadmap Workbook, Governance Workbook

      Participants: CIO, IT senior leadership

      1. Open the Governance Implementation Plan and review themes and initiatives.
      2. Open the Governance Roadmap Workbook.
      3. Discuss whether the implementation roadmap should be developed as a Gantt chart, a sunshine diagram, or both.
        For the Gantt chart:
        • Input the roadmap start year and date.
        • Change the months and year in the Gantt chart to reflect the same roadmap start year.
        • Input and populate the planned start and end dates for the list of high-priority initiatives.

      Develop your Gantt chart in the Governance Roadmap Workbook

      2.3.3 Build your sunshine diagram

      30 minutes

      Input: Governance themes and initiatives

      Output: Sunshine diagram visual

      Materials: Whiteboard/flip charts, Markers, Governance Implementation Plan

      Participants: CIO, IT senior leadership

      1. Review your list of themes and initiatives.
      2. Build a model with “rays” radiating out from a central theme or objective.
      3. Using curved arcs, break the grid into timeline periods or phases.
      4. Complete your sunshine diagram in the Governance Implementation Plan.

      Customize your sunshine diagram in the Governance Implementation Plan

      Make Your IT Governance Adaptable

      Phase 3

      Embed and Automate

      Phase 1

      • 1.1 Define Your Guiding Star
      • 1.2 Define Scope and Principles
      • 1.3 Adjust for Culture and Finalize Context

      Phase 2

      • 2.1 Choose and Adapt Your Model
      • 2.2. Identify and Document Your Governance Triggers
      • 2.3 Build Your Implementation Approach

      Phase 3

      • 3.1 Identify Decisions to Embed and Automate
      • 3.2 Plan Validation and Verification
      • 3.3 Update Implementation Plan

      This phase will walk you through the following activities:

      Identify which decisions you are ready to automate.

      Identify standards and policies that can be embedded and automated.

      Identify integration points.

      Confirm data requirements to enable success.

      This phase involves the following participants:

      • IT senior leadership
      • Governance process owner
      • Product and service owners
      • Policy owners

      Step 3.1

      Identify Decisions to Embed and Automate

      Activities
      • 3.1.1 Review governance decisions and standards and the required level of authority
      • 3.1.2 Build your decision logic
      • 3.1.3 identify constraints and mitigation approaches
      • 3.1.4 Develop decision rules and principles

      This step will walk you through the following activities:

      Identify your key decisions.

      Develop your decision logic.

      Confirm decisions that could be automated.

      Identify and address constraints.

      Develop decision rules and principles.

      This step involves the following participants:

      • IT senior leadership

      Outcomes of this step

      Developed decision rules, rulesets, and principles that can be leveraged to automate governance

      Defined integration points

      Embed and Automate

      Step 3.1 – Identify Decisions to Embed and Automate Step 3.2 – Plan Validation and Verification Step 3.3 – Update Implementation Plan

      What is decision automation?

      Decision automation is the codifying of rules that connect the logic of how decisions are made with the data required to make those decisions. This is then embedded and automated into processes and the design of products and services.

      • It is well suited to governance where the same types of decisions are made on a recurring basis, using the same set of data. It requires clean, high-quality data to be effective.
      • Improvements in artificial intelligence (AI) and machine learning (ML) have allowed the creation of scenarios where a hybrid of rules and learning can improve decision outcomes.

      Key Considerations

      • Data Availability
      • Legality
      • Contingencies
      • Decision Transparency
      • Data Quality
      • Auditability

      How complexity impacts decisions

      Decision complexity impacts the type of rule(s) you create and the amount of data required. It also helps define where or if decisions can be automated.

      1. SIMPLE
        Known and repeatable with consistent and familiar outcomes – structured, causal, and easy to standardize and automate.
      2. COMPLICATED
        Less known and outcomes are not consistently repeatable. Expertise can drive standards and guidelines that can be used to automate decisions.
      3. COMPLEX
        Unknown and new, highly uncertain in terms of outcomes, impact, and data. Requires more exploration and data. Difficult to automate but can be built into the design of products and services.
      4. CHAOTIC
        Unstructured and unknown situation. Requires adaptive and immediate action without active data – requires retained human governance
      5. (Based on Dave Snowden’s Cynefin framework)

      Governance Automation Criteria Checklist

      The Governance Automation Criteria Checklist provides a view of key considerations for determining whether a governing activity or decision is a good candidate for automation.

      The criteria identify key qualifiers/disqualifiers to make it easier to identify eligibility.

      Sample of the Governance Automation Criteria Checklist.

      Download the Governance Automation Criteria Checklist

      Governance Automation Worksheet

      Sample of the Governance Automation Worksheet.

      The Governance Automation Worksheet provides a way to document your governance and systematically identify information about the decisions to help determine if automation is possible.

      From there, decision rules, logic, and rulesets can be designed in support of building a structure flow to allow for automation.

      Download the Governance Automation Worksheet

      3.1.1 Review governance decisions and standards and the required level of authority

      30 minutes

      Input: Automation Criteria Checklist, Governance Automation Worksheet, Updated governance model

      Output: Documented decisions and related authority, Selected options for automation, Updated Governance Automation Worksheet

      Materials: Whiteboard/flip charts, Governance Automation Worksheet

      Participants: IT senior leadership

      1. Identify the decisions that are made within each committee in your updated governance model and document them in the Governance Automation Worksheet.
      2. Confirm the level of authority required to make each decision.
      3. Review the automation checklist to confirm whether each decision is positioned well for automation.
      4. Select and document the decisions that are the strongest options for automation/embedding and document them in the Governance Automation Worksheet.

      What are decision rules?

      Decision rules provide specific instructions and constraints that must be considered in making decisions and are critical for automating governance.

      They provide the logical path to assess governance inputs to make effective decisions with positive business outputs.

      Inputs would include key information such as known risks, your defined prioritization matrix, portfolio value scoring, and compliance controls.

      Individual rules can be leveraged in different places.

      Some decision rule types are listed here.

      1. Statement Rules
        Natural expression of logical progression, written through logical elements
      2. Decision Tree Rules
        Decision tree with two axes that overlap to generate a decision
      3. Sequential Rules
        A sequence of decisions that move from one step to the next
      4. Expression Rule
        A particular set of rules triggered by a particular rule condition being met
      5. Truth table rules
        Combines many decision factors into one place; produces different outputs

      What are decision rulesets

      Rulesets are created to make complex decisions. Individual rule types are combined to create rulesets that are applied together to generate effective decisions. One rule will provide contextual information required for additional rules to execute in a Rule-Result-Rule-Result-Rule-Decision flow.

      A visualization of two separate rulesets made up of the decision rules on the previous slide. 'Ruleset 1' contains '1) Statement Rules', '2) Decision Tree Rules', and 5) Truth Table Rules'. 'Ruleset 2' contains '3) Sequential Rules' and '4) Expression Rule'.

      3.1.2 Build your decision logic

      30 minutes

      Input: Governance Automation Worksheet

      Output: Documented decision logic to support selected decision types and data requirements

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      1. For each selected decision, identify the principles that drive the considerations around the decision.
      2. For each decision, develop the decision logic by defining the steps and information inputs involved in making the decision and documenting the flow from beginning to end.
      3. Determine whether this is one specific decision or a combination of different decisions (in sequence or based on decisions).
      4. Name your decision rule.

      Sample of the Governance Automation Worksheet.

      3.1.3 Identify constraints and mitigation approaches

      60 minutes
      1. Document constraints to automation of decisions related to:
        • Availability of decision automation tools
        • Decision authority change requirements
        • Data constraints
        • Knowledge requirements
        • Process adjustment requirements
        • Product/service design levels
      2. Brainstorm and identify approaches to mitigate constraints and score based on likelihood of success.
      3. Identify mitigation owners and initial timeline expectations.
      4. Document the constraints and mitigations in the Governance Workbook on the constraints and mitigations slide.

      Sample of the 'Constraints and mitigations' slide of the 'Governance Workbook'.

      3.1.4 Develop decision rules and principles

      1.5-2 hours

      Input: Governance Automation Worksheet

      Output: Defined decision integration points, Confirmed data availability sets, Decision rules, rulesets, and principles with control indicators

      Materials: Whiteboard/flip charts, Governance Automation Worksheet

      Participants: IT senior leadership

      1. Review the decision logic for those decisions that you have confirmed for automation. Identify the processes where the decision should be executed.
      2. Associate each decision with specific process steps or stages or how it would be included in software/product design.
      3. For each selected decision, identify the availability of data required to support the decision logic and the level of complexity and apply governing principles.
      4. Create the decision rules and identify data gaps.
      5. Define the decision flow and create rulesets as needed.
      6. Confirm automation requirements and define control indicators.

      Step 3.2

      Plan Validation and Verification

      Activities
      • 3.2.1 Define verification approach for embedded and automated governance
      • 3.2.2 Define validation approach for embedded and automated governance

      This step will walk you through the following activities:

      Define how decision outcomes will be measured.

      Determine how the effectiveness of automated governance will be reported.

      This step involves the following participants:

      • IT senior leadership

      Outcomes of this step

      Tested and verified automation of decisions

      Embed and Automate

      Step 3.1 – Identify Decisions to Embed and Automate Step 3.2 – Plan Validation and Verification Step 3.3 – Update Implementation Plan

      Decision rule relationship through to verification

      1. Rules

      Focus on clear decision logic

      Often represented in simple statement types and supported by data:

      IF – THEN

      IF – AND – THEN

      IF – AND NOT – THEN

      2. Rulesets

      Aggregate rules for more complex decisions

      Integrated flows between different required rules:
      Rule 1:
      (Output 1) – Rule 2
      (Output 2) – Rule 6
      Rule 6: (Output 1) – Rule 7
      3. Rule Attestation

      Verify success of automated decisions

      Attestation of embedded and automated rules with key control indicators embedded within process and products.

      Principles embedded into automated software controls.

      3.2.1 Define verification approach for embedded and automated governance

      60 minutes

      Input: Governance rules and rulesets as defined in the Governance Automation Worksheet, Defined decision outcomes

      Output: A defined measurement of effective decision outcomes, Approach to automate and/or report the effectiveness of automated governance

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      Verify

      1. Confirm expected outcome of rules.
      2. Select a sampling of new required decisions or recently performed decisions related to areas of automation.
      3. Run the decisions through the decision rules or rule groupings that were developed and compare to parallel decisions made using the traditional approach. (These must be segregated activities.)
      4. Review the outcome of the rules and adjust based on the output. Identify areas of adjustment. Confirm that the automation meets your requirements.

      3.2.2 Define validation approach for embedded and automated governance

      60 minutes

      Input: Governance rules and rulesets as defined in the Governance Automation Worksheet, Defined decision outcomes

      Output: Defined assurance and attestation requirements, Key control indicators that can be automated

      Materials: Whiteboard/flip charts

      Participants: IT senior leadership

      Validate

      1. Develop an approach to measure automated decisions. Align success criteria to current governance KPIs and metrics.
      2. If no such metrics exist, define expected outcome. Define key risk indicators based on the expected points of automation.
      3. Establish quality assurance checkpoints within the delivery lifecycles to adjust for variance.
      4. Create triggers back to rule owners to drive changes and improvements to rules and rule groupings.

      Step 3.3

      Update Implementation Plan

      Activities
      • 3.3.1 Finalize the implementation plan

      This step will walk you through the following activities:

      Review implications and mitigations to make sure all have been considered.

      Finalize the implementation plan and roadmap.

      This step involves the following participants:

      • Senior IT leadership

      Outcomes of this step

      Completed Governance implementation plan and roadmap

      Embed and Automate

      Step 3.1 – Identify Decisions to Embed and Automate Step 3.2 – Plan Validation and Verification Step 3.3 – Update Implementation Plan

      3.3.1 Finalize the implementation plan

      30 minutes

      Input: Governance workbook, Updated governance model, Draft implementation plan and roadmap

      Output: Finalized implementation plan and roadmap

      Materials: Whiteboard/flip charts, Governance Implementation Plan

      Participants: IT senior leadership

      1. Document automation activities within phases in a governance automation theme in the Governance Implementation Plan.
      2. Review timelines in the implementation plan and where automation fits within the roadmap.
      3. Updated the implementation plan and roadmap.

      Governance Implementation Plan

      Summary of Accomplishment

      Problem Solved

      Through this project we have:

      • Improved your governance model to ensure a better fit for your organization, while creating adaptivity for the future.
      • Ensured your governance operates as an enabler of success with the proper bodies and levels of authority established.
      • Established triggers to ensure your governance model is actively adjusted to maintain its fit.
      • Developed a plan to embed and automate governance.
      • Created decision rules and principles and identified where to embed them within your practices.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      Additional Support

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Photo of Valence Howden.

      Contact your account representative for more information.

      workshops@infotech.com 1-888-670-8889

      To accelerate this project, engage your IT team in an Info-Tech workshop with an Info-Tech analyst team.

      Info-Tech analysts will join you and your team at your location or welcome you to Info-Tech’s historic Toronto office to participate in an innovative onsite workshop.

      Related Info-Tech Research

      Improve IT Governance to Drive Business Results

      Avoid bureaucracy and achieve alignment with a minimalist approach. Align with your organizational context.

      Establish Data Governance

      Establish data trust and accountability with strong governance.

      Maximize Business Value From IT Through Benefits Realization

      Embed value and alignment confirmation into your governance to ensure you optimize IT value achievement for resource spend.

      Build a Better Product Owner

      Strengthen the product/service owner role in your organization by focusing on core capabilities and proper alignment.

      Research contributors and experts

      Photo of Sidney Hodgson, Senior Director, Industry, Info-Tech Research Group. Sidney Hodgson
      Senior Director, Industry
      Info-Tech Research Group
      • Sidney has over 30 years of experience in IT leadership roles as CIO of three organizations in Canada and the US as well as international consulting experience in the US and Asia.
      • Sid has a breadth of knowledge in IT governance, project management, strategic and operational planning, enterprise architecture, business process re-engineering, IT cost reduction, and IT turnaround management.
      Photo of David Tomljenovic, Principal Research Advisor, Industry, Info-Tech Research Group. David Tomljenovic
      Principal Research Advisor, Industry
      Info-Tech Research Group
      • David brings extensive experience from the Financial Services sector, having worked 25 years on Bay Street. Most recently he was a Corporate Finance and Strategy Advisor for Infiniti Labs (Toronto/Hong Kong), Automotive, and Smart City Accelerator, where he provided financial and mergers & acquisitions advisory services to accelerator participants with a focus on early-stage fundraising activities.

      Research contributors and experts

      Photo of Cole Cioran, Practice Lead, Applications and Agile Development, Info-Tech Research Group. Cole Cioran
      Practice Lead, Applications and Agile Development
      Info-Tech Research Group
      • Over the past 25 years, Cole has developed software; designed data, infrastructure, and software solutions; defined systems and enterprise architectures; delivered enterprise-wide programs; and managed software development, infrastructure, and business systems analysis practices.
      Photo of Crystal Singh, Research Director, Applications – Data and Information Management, Info-Tech Research Group. Crystal Singh
      Research Director, Applications – Data and Information Management
      Info-Tech Research Group
      • Crystal brings a diverse and global perspective to her role, drawing from her professional experiences in various industries and locations. Prior to joining Info-Tech, Crystal led the Enterprise Data Services function at Rogers Communications, one of Canada’s leading telecommunications companies.

      Research contributors and experts

      Photo of Carlene McCubbin, Practice Lead, CIO, Info-Tech Research Group. Carlene McCubbin
      Practice Lead, CIO
      Info-Tech Research Group
      • Carlene covers key topics in organization and leadership and specializes in governance, organizational design, relationship management, and human capital development. She led the development of Info-Tech’s Organization and Leadership practice.
      Photo of Denis Goulet, Senior Workshop Director, Info-Tech Research Group. Denis Goulet
      Senior Workshop Director
      Info-Tech Research Group
      • Denis is a transformational leader and experienced strategist who focuses on helping clients communicate, relate, and adapt for success. Having developed Governance Model and IT strategies in organizations ranging from small to billion-dollar multi-nationals, he firmly believes in a collaborative value-driven approach to work.

      Bibliography

      “2020 State of Data Governance and Automation Report.” Erwin.com, 28 Jan. 2020. Web.

      “Adaptive IT Governance.” Google search, 15 Nov. 2020.

      “Adaptive IT Governance Framework.” CIO Index, 3 Nov. 2011. Accessed 15 Nov. 2020.

      “Agile Governance Made Easy.” Agilist, n.d. Accessed 15 Nov. 2020.

      “Automating Governance — Our Work.” Humanising Machine Intelligence, n.d. Accessed 15 Nov. 2020.

      “Automation – Decisions.” IBM, 2020. Accessed 15 Oct. 2020.

      Chang, Charlotte. “Accelerating Agile through effective governance.” Medium, 22 Sept. 2020. Web.

      “COBIT 5: Enabling Processes.” ISACA, 2012. Web. Oct. 2016.

      COBIT 2019. ISACA, Dec. 2018. Web.

      Curtis, Blake. “The Value of IT Governance.” ISACA, 29 June 2020. Accessed 15 Nov. 2020.

      De Smet, Aaron. “Three Keys to Faster, Better Decisions.” McKinsey & Company, 1 May 2019. Accessed 15 Nov. 2020.

      “Decision Rules and Decision Analysis.” Navex Global, 2020. Web.

      “Decisions Automation with Business Rules Management Solution.” Sumerge, 4 Feb. 2020. Accessed 15 Nov. 2020.

      “DevGovOps – Key factors for IT governance for enterprises in a DevOps world.” Capgemini, 27 Sept. 2019. Web.

      Eisenstein, Lena. “IT Governance Checklist.” BoardEffect, 19 Feb. 2020. Accessed 15 Nov. 2020.

      “Establishing Effective IT and Data Governance.” Chartered Professional Accountants Canada, n.d. Accessed 15 Nov. 2020.

      Gandzeichuk, Ilya. “Augmented Analytics: From Decision Support To Intelligent Decision-Making.” Forbes, 8 Jan. 2020. Accessed 15 Nov. 2020.

      Georgescu, Vlad. “What Is IT Governance? Understanding From First Principles.” Plutora, 18 Oct. 2019. Web.

      Goodwin, Bill. “IT Governance in the Era of Shadow IT.” ComputerWeekly, 5 Aug. 2014. Accessed 15 Nov. 2020.

      “Governance of IT, OT and IOT.” ISACA Journal, 2019. Web.

      Gritsenko, Daria, and Matthew Wood. “Algorithmic Governance: A Modes of Governance Approach.” Regulation & Governance, 10 Nov. 2020. Web.

      Hansert, Philipp. “Adaptive IT Governance with Clausmark’s Bee4IT.” Bee360, 25 Oct. 2019. Accessed 15 Nov. 2020.

      Havelock, Kylie. “What Does Good Product Governance Look Like?” Medium. 8 Jan. 2020. Web.

      Haven, Dolf van der. “Governance of IT with ISO 38500 - A More Detailed View” LinkedIn article, 24 Oct. 2016. Accessed 15 Nov. 2020.

      Hong, Sounman, and Sanghyun Lee. “Adaptive Governance and Decentralization: Evidence from Regulation of the Sharing Economy in Multi-Level Governance.” Government Information Quarterly, vol. 35, no. 2, April 2018, pp. 299–305. Web.

      ISACA. “Monthly Seminar & Networking Dinner: CIO Dashboard.” Cvent, Feb. 2012. Accessed 15 Nov. 2020.

      ISO/IEC 38500, ISO, 2018 and ongoing.

      “IT Governance.” Kenway Consulting, n.d. Accessed 15 Nov. 2020.

      “IT Governance in the Age of COVID 19.” Union of Arab Banks Webinar, 19-21 Oct. 2020. Accessed 15 Nov. 2020.

      Jaffe, Dennis T. “Introducing the Seven Pillars of Governance.” Triple Pundit, 15 Nov. 2011. Accessed 15 Nov. 2020.

      Janssen, Marijn, and Haiko van der Voort. “Agile and Adaptive Governance in Crisis Response: Lessons from the COVID-19 Pandemic.” International Journal of Information Management, vol. 55, December 2020. Web.

      Jodya, Tiffany. “Automating Enterprise Governance within Delivery Pipelines.” Harness.io, 14 May 2020. Web.

      Kumar, Sarvesh. “AI-Based Decision-Making Automation.” Singular Intelligence, 17 June 2019. Web.

      “Lean IT Governance.” Disciplined Agile, n.d. Accessed 15 Nov. 2020.

      Lerner, Mark. “Government Tech Projects Fail by Default. It Doesn’t Have to Be This Way.” Belfer Center for Science and International Affairs, 21 Oct. 2020. Accessed 15 Nov. 2020.

      Levstek, Aleš, Tomaž Hovelja, and Andreja Pucihar. “IT Governance Mechanisms and Contingency Factors: Towards an Adaptive IT Governance Model.” Organizacija, vol. 51, no. 4, Nov. 2018. Web.

      Maccani, Giovanni, et al. “An Emerging Typology of IT Governance Structural Mechanisms in Smart Cities.” Government Information Quarterly, vol. 37, no. 4, Oct. 2020. Web.

      Magowan, Kirstie. “IT Governance vs IT Management: Mastering the Differences.” BMC Blogs, 18 May 2020. Accessed 15 Nov. 2020.

      Mazmanian, Adam. “Is It Time to Rethink IT Governance? ” Washington Technology, 26 Oct. 2020. Accessed 15 Nov. 2020.

      Mukherjee, Jayanto. “6 Components of an Automation (DevOps) Governance Model.” Sogeti, n.d. Accessed 15 Nov. 2020.

      Ng, Cindy. “The Difference Between Data Governance and IT Governance.” Inside Out Security, updated 17 June 2020. Web.

      Pearson, Garry. “Agile or Adaptive Governance Required?” Taking Care of the Present (blog), 30 Oct. 2020. Accessed 15 Nov. 2020.

      Peregrine, Michael, et al. “The Long-Term Impact of the Pandemic on Corporate Governance.” Harvard Law School Forum on Corporate Governance, 16 July 2020. Web.

      Raymond, Louis, et al. “Determinants and Outcomes of IT Governance in Manufacturing SMEs: A Strategic IT Management Perspective.” International Journal of Accounting Information Systems, vol. 35, December 2019. Web.

      Rentrop, Christopher. “Adaptive IT Governance – Foundation of a Successful Digitalization.” Business IT Cooperation Coordination Controlling (blog). May 2, 2018. Web.

      Schultz, Lisen, et al. “Adaptive Governance, Ecosystem Management, and Natural Capital.” Proceedings of the National Academy of Sciences, vol. 112, no. 24, 2015, pp. 7369–74. Web.

      Selig, Gad J. Implementing IT Governance: A Practical Guide to Global Best Practices in IT Management. Van Haren Publishing, 2008. Accessed 15 Nov. 2020.

      Sharma, Chiatan. “Rule Governance for Enterprise-Wide Adoption of Business Rules: Why Does a BRMS Implementation Need a Governance Framework?” Business Rules Journal, vol. 13, no. 4, April 2012. Accessed 15 Nov. 2020.

      Smallwood, Robert. “Information Governance, IT Governance, Data Governance – What’s the Difference?” The Data Administration Newsletter, 3 June 2020. Accessed 15 Nov. 2020.

      Snowden, Dave. "Cynefin – weaving sense-making into the fabric of our world", Cognitive Edge, 20 October 2020.

      “The Place of IT Governance in the Enterprise Governance.” Institut de la Gouvernance des Systemes d’Information, 2005. Accessed 15 Nov. 2020.

      Thomas, Mark. “Demystifying IT Governance Roles in a Dynamic Business Environment.” APMG International, 29 Oct. 2020. Webinar. Accessed 15 Nov. 2020.

      “The Four Pillars of Governance Best Practice.” The Institute of Directors in New Zealand, 4 Nov. 2019. Web.

      Wang, Cancan, Rony Medaglia, and Lei Zheng. “Towards a Typology of Adaptive Governance in the Digital Government Context: The Role of Decision-Making and Accountability.” Government Information Quarterly, vol. 35, no. 2, April 2018, pp. 306–22.

      Westland, Jason. “IT Governance: Definitions, Frameworks and Planning.” ProjectManager.com, 17 Dec. 2019. Web.

      Wilkin, Carla L., and Jon Riddett. “IT Governance Challenges in a Large Not-for-Profit Healthcare Organization: The Role of Intranets.” Electronic Commerce Research vol. 9, no. 4, 2009, pp. 351-74. Web.

      Zalnieriute, Monika, et al. “The Rule of Law and Automation of Government Decision Making.” Modern Law Review, 25 Feb. 2019. Web.

      Availability and Capacity Management

      • Buy Link or Shortcode: {j2store}10|cart{/j2store}
      • Related Products: {j2store}10|crosssells{/j2store}
      • Up-Sell: {j2store}10|upsells{/j2store}
      • member rating overall impact: 8.0/10.0
      • member rating average dollars saved: $2,950
      • member rating average days saved: 10
      • Parent Category Name: Resilient IT Operations
      • Parent Category Link: /resilience/resilient-operations-and-it
      Develop your availability and capacity management plant and align it with exactly what the business expects.

      Craft a Customer-Driven Market Strategy With Unbiased Data

      • Buy Link or Shortcode: {j2store}611|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Selection & Implementation
      • Parent Category Link: /selection-and-implementation
      • Market strategies are informed by gut feel and endless brainstorming instead of market data to take their product from concept to customer.
      • Hiring independent market research firms results in a lack of unbiased third-party data. Research firms tell vendors what they want to hear instead of offering an agnostic view of software trends.
      • Dissatisfied customers don’t tell you directly why they are leaving, so there is no feedback loop back into product improvements.
      • Often a market strategy is built after a product is developed to force the product’s fit in the market. The product marketing team has no say in the product vision or future improvements.

      Our Advice

      Critical Insight

      • Adopt the 5 P’s to building a winning market strategy: Proposition, Product, Pricing, Placement, and Promotion.
      • You can’t be everything to everyone. Testing your proposition in the market to see what sticks is a risky move. Promise future value using past successes by gaining a deeper understanding of which customers and submarkets truly align to your product.
      • Customers have learned to avoid shiny new objects but still expect rapid feature releases. Differentiating features require a closer look at the underpinning vendor capabilities. Having intentional feature releases requires a feedback loop into the product roadmap and increases influence by the product marketing team.
      • Price transparency and sensitivity should drive what you offer to customers. Negotiating solely on price is a race to the bottom.

      Impact and Result

      • Leverage this report to gain insights on the software selection process and what top vendors do best.
      • Gain a bird’s-eye view on customer purchasing behavior using over 40,000 data points on satisfaction and importance collected directly from the source.
      • Build a winning market strategy influenced by real customer data that drives vendor success.

      Craft a Customer-Driven Market Strategy With Unbiased Data Research & Tools

      Read the storyboard

      Read our storyboard to find out why you should leverage SoftwareReviews data to craft your market strategy, review Info-Tech’s methodology, and understand unbiased customer data on software purchasing triggers.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Craft a Customer-Driven Market Strategy With Unbiased Data Storyboard
      [infographic]

      Review and Improve Your IT Policy Library

      • Buy Link or Shortcode: {j2store}193|cart{/j2store}
      • member rating overall impact: 9.3/10 Overall Impact
      • member rating average dollars saved: $34,724 Average $ Saved
      • member rating average days saved: 14 Average Days Saved
      • Parent Category Name: IT Governance, Risk & Compliance
      • Parent Category Link: /it-governance-risk-and-compliance
      • Your policies are out of date, disorganized, and complicated. They don’t reflect current regulations and don’t actually mitigate your organization’s current IT risks.
      • Your policies are difficult to understand, aren’t easy to find, or aren’t well monitored and enforced for compliance. As a result, your employees don’t care about your policies.
      • Policy issues are taking up too much of your time and distracting you from the real issues you need to address.

      Our Advice

      Critical Insight

      A dynamic and streamlined policy approach will:

      1. Right-size policies to address the most critical IT risks.
      2. Clearly lay out a step-by-step process to complete daily tasks in compliance.
      3. Obtain policy adherence without having to be “the police.”

      To accomplish this, the policy writer must engage their audience early to gather input on IT policies, increase policy awareness, and gain buy-in early in the process.

      Impact and Result

      • Develop more effective IT policies. Clearly express your policy goals and objectives, standardize the approach to employee problem solving, and write policies your employees will actually read.
      • Improve risk coverage. Ensure full coverage on the risk landscape, including legal regulations, and establish a method for reporting, documenting, and communicating risks.
      • Improve employee compliance. Empathize with your employees and use policy to educate, train, and enable them instead of restricting them.

      Review and Improve Your IT Policy Library Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how to write better policies that mitigate the risks you care about and get the business to follow them, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Assess

      Assess your risk landscape and design a plan to update your policy network based on your most critical risks.

      • Review and Improve Your IT Policy Library – Phase 1: Assess
      • Policy Management RACI Chart Template
      • Policy Management Tool
      • Policy Action Plan

      2. Draft and implement

      Use input from key stakeholders to write clear, consistent, and concise policies that people will actually read and understand. Then publish them and start generating policy awareness.

      • Review and Improve Your IT Policy Library – Phase 2: Draft and Implement
      • Policy Template
      • Policy Communication Plan Template

      3. Monitor, enforce, revise

      Use your policies to create a compliance culture in your organization, set KPIs, and track policy effectiveness.

      • Review and Improve Your IT Policy Library – Phase 3: Monitor, Enforce, Revise
      [infographic]

      Workshop: Review and Improve Your IT Policy Library

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Establish & Assess

      The Purpose

      Identify the pain points associated with IT policies.

      Establish the policy development process.

      Begin formulating a plan to re-design the policy network.

      Key Benefits Achieved

      Establish the policy process.

      Highlight key issues and pain points regarding policy.

      Assign roles and responsibilities.

      Activities

      1.1 Introduce workshop.

      1.2 Identify the current pain points with policy management.

      1.3 Establish high-level goals around policy management.

      1.4 Select metrics to measure achievement of goals.

      1.5 Create an IT policy working group (ITPWG).

      1.6 Define the scope and purpose of the ITPWG.

      Outputs

      List of issues and pain points for policy management

      Set of six to ten goals for policy management

      Baseline and target measured value

      Amended steering committee or ITPWG charter

      Completed RACI chart

      Documented policy development process

      2 Assess Your Risk Landscape & Map Policies to Risks; Create a Policy Action Plan

      The Purpose

      Identify key risks.

      Develop an understanding of which risks are most critical.

      Design a policy network that best mitigates those risks.

      Key Benefits Achieved

      Use a risk-driven approach to decide which policies need to be written or updated first.

      Activities

      2.1 Identify risks at a high level.

      2.2 Assess each identified risk scenario on impact and likelihood.

      2.3 Map current and required policies to risks.

      2.4 Assess policy effectiveness.

      2.5 Create a policy action plan.

      2.6 Select policies to be developed during workshop.

      Outputs

      Ranked list of IT’s risk scenarios

      Prioritized list of IT risks (simplified risk register)

      Policy action plan

      3 Develop Policies

      The Purpose

      Outline what key features make a policy effective and write policies that mitigate the most critical IT risks.

      Key Benefits Achieved

      Write policies that work and get them approved.

      Activities

      3.1 Define the policy audience, constraints, and in-scope and out-of-scope requirements for a policy.

      3.2 Draft two to four policies

      Outputs

      Drafted policies

      4 Create a Policy Communication and Implementation Plan and Monitor & Reassess the Portfolio

      The Purpose

      Build an understanding of how well the organization’s value creation activities are being supported.

      Key Benefits Achieved

      Identify an area or capability that requires improvement.

      Activities

      4.1 Review draft policies and update if necessary.

      4.2 Create a policy communication plan.

      4.3 Select KPIs.

      4.4 Review root-cause analysis techniques.

      Outputs

      Final draft policies

      Policy communications plan

      KPI tracking log

      Get Started With IT Project Portfolio Management

      • Buy Link or Shortcode: {j2store}443|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $7,599 Average $ Saved
      • member rating average days saved: 46 Average Days Saved
      • Parent Category Name: Portfolio Management
      • Parent Category Link: /portfolio-management
      • Most companies are struggling to get their project work done. This is due in part to the fact that many prescribed remedies are confusing, disruptive, costly, or ineffective.
      • While struggling to find a solution, within the organization, project requests never stop and all projects continue to all be treated the same. Resources are requested for multiple projects without any visibility into their project capacity. Projects lack proper handoffs from closure to ongoing operational work. And the benefits are never tracked.
      • If you have too many projects, limited resources, ineffective communications, or low post-project adoption, keep reading. Perhaps you should spend a bit more on project, portfolio, and organizational change management.

      Our Advice

      Critical Insight

      • Successful project outcomes are not built by rigorous project processes: Projects may be the problem, but project management rigor is not the solution.
      • Don’t fall into the common trap of thinking high-rigor project management should be every organization’s end goal.
      • Instead, understand that it is better to spend time assessing the portfolio to determine what projects should be prioritized.

      Impact and Result

      Begin by establishing a few foundational practices that will work to drive project throughput.

      • Capacity Estimation: Understand what your capacity is to do projects by determining how much time is allocated to doing other things.
      • Book of Record: Establish a basic but sustainable book of record so there is an official list of projects in flight and those waiting in a backlog or funnel.
      • Simple Project Management Processes: Align the rigor of your project management process with what is required, not what is prescribed by the PMP designation.
      • Impact Assessment: Address the impact of change at the beginning of the project and prepare stakeholders with the right level of communication.

      Get Started With IT Project Portfolio Management Research & Tools

      Start here – read the Executive Brief

      Begin by establishing a few foundational practices that will work to drive project throughput. Most project management problems are resolved with portfolio level solutions. This blueprint will address the eco-system of project, portfolio, and organizational change management.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Project portfolio management

      Estimate project capacity, determine what needs to be tracked on an ongoing basis, and determine what criteria is necessary for prioritizing projects.

      • Project Portfolio Supply-Demand Analysis Tool
      • Project Value Scorecard Development Tool
      • Project Portfolio Book of Record

      2. Project management

      Develop a process to inform the portfolio of the project status, create a plan that can be maintained throughout the project lifecycle, and manage the scope through a change request process.

      • Light Project Change Request Form Template

      3. Organizational change management

      Perform a change impact assessment and identify the obvious and non-obvious stakeholders to develop a message canvas accordingly.

      • Organizational Change Management Triage Tool

      4. Develop an action plan

      Develop a roadmap for how to move from the current state to the target state.

      • PPM Wireframe
      • Project Portfolio Management Foundations Stakeholder Communication Deck
      [infographic]

      Workshop: Get Started With IT Project Portfolio Management

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Project Portfolio Management

      The Purpose

      Establish the current state of the portfolio.

      Organize the portfolio requirements.

      Determine how projects are prioritized.

      Key Benefits Achieved

      Understand project capacity supply-demand.

      Build a portfolio book of record.

      Create a project value scorecard.

      Activities

      1.1 Conduct capacity supply-demand estimation.

      1.2 Determine requirements for portfolio book of record.

      1.3 Develop project value criteria.

      Outputs

      Clear project capacity

      Draft portfolio book of record

      Project value scorecard

      2 Project Management

      The Purpose

      Feed the portfolio with the project status.

      Plan the project work with a sustainable level of granularity.

      Manage the project as conditions change.

      Key Benefits Achieved

      Develop a process to inform the portfolio of the project status.

      Create a plan that can be maintained throughout the project lifecycle and manage the scope through a change request process.

      Activities

      2.1 Determine necessary reporting metrics.

      2.2 Create a work structure breakdown.

      2.3 Document your project change request process.

      Outputs

      Feed the portfolio with the project status

      Plan the project work with a sustainable level of granularity

      Manage the project as conditions change

      3 Organizational Change Management

      The Purpose

      Discuss change accountability.

      Complete a change impact assessment.

      Create a communication plan for stakeholders.

      Key Benefits Achieved

      Complete a change impact assessment.

      Identify the obvious and non-obvious stakeholders and develop a message canvas accordingly.

      Activities

      3.1 Discuss change accountability.

      3.2 Complete a change impact assessment.

      3.3 Create a communication plan for stakeholders.

      Outputs

      Assign accountability for the change

      Assess the change impact

      Communicate the change

      4 Develop an Action Plan

      The Purpose

      Summarize current state.

      Determine target state.

      Create a roadmap.

      Key Benefits Achieved

      Develop a roadmap for how to move from the current state to the target state.

      Activities

      4.1 Summarize current state and target state.

      4.2 Create a roadmap.

      Outputs

      Stakeholder Communication Deck

      MS Project Wireframe

      Exit Plans: Escape from the black hole

      • Large vertical image:
      • member rating overall impact: Highly Valued
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A

      In early April, I already wrote about exit plans and how they are the latest burning platform.

      As of the end of May 2025, we have both Microsoft and Google reassuring European clients about their sovereign cloud solutions. There are even air-gapped options for military applications. These messages come as a result of the trade war between the US and the rest of the world.

      There is also the other, more mundane example of over-reliance on a single vendor: the Bloomberg-terminal outage of May 21st, 2025. That global outage severely disrupted financial markets. It caused traders to lose access to real-time data, analytics, and pricing information for approximately 90 minutes. This widespread system failure delayed critical government bond auctions in the UK, Portugal, Sweden, and the EU.

      It serves as a reminder of the heavy reliance on the Bloomberg Terminal, which is considered an industry standard despite its high annual cost. While some Bloomberg services like instant messaging remained functional, allowing limited communication among traders, the core disruption led to significant frustration and slowed down trading activities.

      You want to think about this for a moment. Bloomberg is, just like Google and Microsoft are, cornerstones in their respective industries. MS, Google, and Amazon even in many more industries. 

      So the issue goes beyond the “panic of the day.” Every day, there will be some announcement that sends markets reeling and companies fearing. Granted, the period we go through today can have grave consequences, but at the same time, it may be over in the coming months or years.

      Contractual cover

      Let's take a step back and see if we can locate the larger issue at stake. I dare to say that the underlying issue is trust. We are losing trust in one another at a fast pace. Not between business partners, meaning companies who are, in a transaction or relationship, are more or less equal. Regardless of their geolocation, people are keen to do business together in a predictable, mutually beneficial way. And as long as that situation is stable, there is little need, beyond compliance and normal sound practices, to start to distrust each other.

      Trouble brews when other factors come into play. I want to focus on two of them in this article.

      1. Market power
      2. Government interference

      Market Power

      The past few years have seen a large increase in power of the cloud computing platforms. The pandemic of 2019 through to 2023 changed our way of working and gave a big boost to these platforms. Of course, they were already establishing their dominance in the early 2010s.

      Amazon launched SQS in 2004 with S3 (storage)  and EC2 (compute) in 2006. Azure launched in 2008 as a PaaS platform for .NET developers, and became really available in 2010. Since then, it grew into the IaaS (infrastructure as a service) platform we know today. Google's Cloud Platform (GCP) launched in 2008 and added components such as BigQuery, Compute Engine and Storage in the 2010s.

      Since the pandemic, we've seen another boost to their popularity. These platforms solidified their lead through several vectors:

      • Remote working
      • Business continuity and resilience promises
      • Acceleration of digital transformation
      • Scalability
      • Cost optimization 

      Companies made decisions on these premises. A prime example is the use of native cloud functions. These make life easier for developers. Native functions allow for serverless functionality to be made available to clients, and to do so in a non-infra-based way. It gives the impression of less complexity to the management. They are also easily scalable. 

      This comes at a cost, however. The cost is vendor lock-in. And with vendor lock-in, comes increased pricing power for the vendor.

      For a long time, it seems EU companies' attitude was: “It won't be such an issue, after all, there are multiple cloud vendors and if all else fails, we just go back.” The reality is much starker, I suspect that cloud providers with this level of market power will increase their pricing significantly.

       Government interference

      in come two elements:

      • EU laws
      • US laws and unpredictability
      EU laws

       The latest push to their market power came as an unintended consequence of EU Law: DORA. That EU law requires companies to have testable exit plans in place. But it goes well beyond this. The EU has increased the regulatory burden on companies significantly. BusinessEurope, a supranational organization, estimates that in the past five years, the Eu managed to release over 13,000 legislative acts. This is compared to 3,500 in the US.

      Coming back to DORA, this law requires EU companies to actually test their exit plans and show proof of it to the EU ESAs (European Supervisory Agency).  The reaction I have seen in industry representative organizations is complacency. 

      The cost of compliance is significant; hence, companies try to limit their exposure to the law as much as possible. They typically do this by limiting the applicability scope of the law to their business, based on the wording of the law. And herein lies the trap. This is not lost on the IT providers. They see that companies do the heavy lifting for them. What do I mean by that?  Several large providers are looked at by the EU as systemic providers. They fall under direct supervision by the ESAs. 

      For local EU providers, it is what it is, but for non-EU providers, they get to show their goodwill, using sovereign IT services.  I will come back to this in the next point, US unpredictability and laws. But the main point is: we are giving them more market power, and we have less contractual power. Why? Because we are showing them that we will go to great lengths to keep using their services.

      US laws and unpredictability

      US companies must comply with US law. So far, so good. Current US legislation also already requires US companies to share data on non-US citizens.

      • Foreign Intelligence Surveillance Act (FISA), particularly Section 702
      • The CLOUD (Clarifying Lawful Overseas Use of Data) Act of 2018
      • The USA PATRIOT Act (specifically relevant sections like 215 and 314(a)/314(b))
      • Executive Order 14117 and related DOJ Final Rule (Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern)

      This last one is of particular concern. Not so much because of its contents, but because it is an Executive Order.

      We know that the current (May 2025) US government mostly works through executive orders. Let's not forget that executive orders are a legitimate way to implement policy, This means that the US government could use access to cloud services as a lever to obtain more favorable trade rules.

      The EU responds to this (the laws and executive order) by implementing several sovereignty countermeasures like GDPR, DORA, Digital markets Act (DMA), Data Governance Act (DGA), Cybersecurity Act and the upcoming European Health Data Act (EHDS). This is called the “Brussels Effect.”

      EU Answers

      Europe is also investing in several strategic initiatives such as

      This points to a new dynamic between the EU and the US, EU-based companies simply cannot trust their US counterparts anymore to the degree they could before. The sad thing is, that there is no difference on the interpersonal level. It is just that companies must comply with their respective laws.

      Hence, Microsoft, Google, and AWS and any other US provider cannot legally provide sovereign cloud services. In a strict legal sense, Microsoft and Google cannot absolutely guarantee that they can completely insulate EU companies and citizens from all US law enforcement requests for data, despite their robust efforts and sovereign cloud offerings. This is because they are US companies, subject to US law and US jurisdiction. The CLOUD act and FISA section 702 compel US companies to comply. 

      Moreover, there is the nature of sovereign cloud offerings:

      • Increased Control, Not Absolute Immunity: Services like Microsoft's EU Data Boundary and Google's Cloud for Sovereignty are designed to provide customers with greater control over data residency, administrative access (e.g., limiting access to EU-based personnel), and encryption keys
      • Customer-Managed Keys (CMEK): If an EU customer controls their encryption keys, and the data remains encrypted at rest and in transit, it theoretically makes it harder for the cloud provider to provide plaintext data if compelled. However, metadata and other operational data might still be accessible, and the extent to which US authorities could compel a US company to decrypt data remains a point of contention and legal ambiguity.
      • Partnerships and Local Entities: Some “sovereign cloud” models involve partnerships with local EU entities (e.g., Google's partnership with S3NS in France, or Microsoft's with Capgemini and Orange). While this might create a legal buffer, if the core cloud infrastructure and controlling entity are still ultimately US-based, the risk of US legal reach persists.
      • “Limited Security Instances”: Even with the EU Data Boundary, Microsoft explicitly states, “in limited security instances that require a coordinated global response, essential data may be transferred with robust protections that safeguard customer data.” This phrasing acknowledges that some data may still leave the EU boundary under certain circumstances.

       And lastly, there are the legal challenges to the EU data privacy Framework (DPF)

      • Ongoing Scrutiny: The DPF is the current legal basis for EU-US data transfers, but it is under continuous scrutiny and is highly likely to face further legal challenges in the CJEU (a “Schrems III” case is widely anticipated). This uncertainty means that the current framework's longevity and robustness are not guaranteed.
      • Fundamental Conflict: The core legal conflict between the broad scope of US surveillance laws and the EU's fundamental right to privacy has not been fully resolved by the DPF, according to many EU legal experts and privacy advocates.

      This all means that while the cloud providers are doing everything they can, and I'm assuming they are acting in good faith. The fact that they are US entities means however that they are subject to all US legislation and executive orders.  And we cannot trust this last part. Again, this is why the EU is pursuing its digital sovereignty initiatives and why some highly sensitive EU public sector entities are gravitating towards truly EU-owned and operated cloud solutions.

      Bankruptcy

      If your provider goes bankrupt, you do not have a leg to stand on. Most jurisdictions, including the EU and US, have the following elements regarding bankruptcy:

      • Automatic Stay: Upon a bankruptcy filing (in most jurisdictions, including the US and EU), an “automatic stay” is immediately imposed. This is a court order that stops most collection activities against the debtor. For you as a customer, this can mean you might be prevented from:

        • Terminating the contract immediately, even if your contract allows it.
        • Initiating legal proceedings against the provider.
        • Trying to recover your data directly without court permission.
      • Debtor's Estate and Creditor Priority

        • Property of the Estate: All the bankrupt provider's assets become part of the “bankruptcy estate,” to be managed by a court-appointed trustee or receiver. The crucial question becomes: Is your data considered the property of the estate, or does ownership remain unequivocally with you? While most cloud contracts explicitly state that the customer owns their data, a bankruptcy court might still view the possession of that data by the provider as an asset of the estate, potentially subject to monetization to pay off creditors.
        • Secured vs. Unsecured Creditors: You, as a customer seeking to retrieve your data or continue services, are likely to be an “unsecured creditor.” Secured creditors (e.g., banks with liens on assets) get paid first. Your claim for data or service continuity will be far down the priority list, meaning you might recover little, if anything, in compensation.
      • Executory contracts and the Trustee's power
        • Assumption or Rejection: Bankruptcy law generally allows the trustee (or debtor in possession in a Chapter 11 case) to assume (continue) or reject (terminate) “executory contracts” – those where both parties still have significant performance obligations.
        • Trustee's Discretion: The trustee will make this decision based on what benefits the bankruptcy estate and the creditors. If your contract is loss-making for the provider, or if continuing it is not in the best interest of the creditors, the trustee can reject it, even if it has a termination clause unfavorable to them.
        • No Customer Right to Demand Continuation: You typically cannot compel the trustee to continue the service if they choose to reject the contract. Your recourse would then be a claim for damages, which, as noted, is usually a low-priority claim.
      • The practical challenges of data retrieval
          • Even if your contract has strong data return clauses, the practicalities of a bankrupt provider make enforcement difficult. The provider's staff might be laid off, systems might be shut down, and there might be no one left with the technical knowledge or resources to facilitate data export. Not to mention that the trustee may simply refuse to honor the agreement (which is completely within the legal rights of the trustee.)
          • The receiver's priority is liquidation and asset sale, not customer service. They may limit data export speeds or volumes, or prioritize the sale of the business, which might include your data, making retrieval a slow and arduous process.

      Conclusion

      So, while I understand the wait and see stance in regard to exit plans, given where we are, it is in my opinion the wrong thing to do. Companies must make actionable exit plans and prepare beforehand for the exit. That means that you have to:

      1. Design your architecture so that you can port your applications to somewhere else.
      2. Prioritize your data portability and data ownership.
      3. Develop and practice your exit strategy and plans.
      4. Maintain your in-house expertise, especially for all critical business services.
      5. Continuously monitor your vendors and update your risk assessments.

        If you want more detailed steps on how to get there, feel free to contact me.

      Select a Sourcing Partner for Your Development Team

      • Buy Link or Shortcode: {j2store}508|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Application Development
      • Parent Category Link: /application-development
      • You have identified that a change to your sourcing strategy is required, based on market and company factors.
      • You are ready to select a new sourcing partner to drive innovation, time to market, increased quality, and improved financial performance.
      • Taking on a new partner is a significant investment and risk, and you must get it right the first time.
      • You need to make a change now to prevent losing clients and falling further behind your performance targets and your market.

      Our Advice

      Critical Insight

      Selecting a sourcing partner is a function of matching complex factors to your own firm. It is not a simple RFP exercise; it requires significant introspection, proactive planning, and in-depth investigation of potential partners to choose the right fit.

      Impact and Result

      Choosing the right sourcing partner is a four-step process:

      1. Assess your companies' skills and processes in the key areas of risk to sourcing initiatives.
      2. Based on the current situation, define a profile for the matching sourcing partner.
      3. Seek matching partners from the market, either in terms of vendor partners or in terms of sourcing locations.
      4. Based on the choice of partner, build a plan to implement the partnership, define metrics to measure success, and a process to monitor.

      Select a Sourcing Partner for Your Development Team Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Select a Sourcing Partner for Your Development Team Storyboard – Use this presentation to select a partner to best fit your sourcing needs and deliver long-term value.

      This project helps select a partner for sourcing of your development team so that you can realize the benefits from changing your sourcing strategy.

      • Select a Sourcing Partner for Your Development Team Storyboard

      2. Select a Sourcing Partner for Your Development Team Presentation Template – Use this template to build a presentation to detail your decision on a sourcing partner for your development team.

      This presentation template is designed to capture the results from the exercises within the storyboard and allow users to build a presentation to leadership showing how selection was done.

      • Select a Sourcing Partner for Your Development Team Presentation Template

      3. Select a Sourcing Partner for Your Development Team Presentation Example – Use this as a completed example of the template.

      This presentation template portrays what the completed template looks like by showing sample data in all tables. It allows members to see how each exercise leads to the final selection of a partner.

      • Select a Sourcing Partner for Your Development Team Example Template
      [infographic]

      Further reading

      Select a Sourcing Partner for Your Application Development Team

      Choose the right partner to enable your firm to maximize the value realized from your sourcing strategy.

      Analyst Perspective

      Selecting the right partner for your sourcing needs is no longer a cost-based exercise. Driving long-term value comes from selecting the partner who best matches your firm on a wide swath of factors and fits your needs like a glove.

      Sourcing in the past dealt with a different kind of conversation involving two key questions:

      Where will the work be done?

      How much will it cost?

      How people think about sourcing has changed significantly. People are focused on gaining a partner, and not just a vendor to execute a single transaction. They will add skills your team lacks, and an ability to adapt to your changing needs, all while ensuring you operate within any constraints based on your business.

      Selecting a sourcing partner is a matching exercise that requires you to look deep into yourself, understand key factors about your firm, and then seek the partner who best meets your profile.

      The image contains a picture of Dr. Suneel Ghei.

      Dr. Suneel Ghei
      Principal Research Director, Application Development
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Common Obstacles

      Info-Tech’s Approach

      • You have identified that a change to your sourcing strategy is required based on market and company factors.
      • You are ready to select a new sourcing partner to drive innovation, time to market, increased quality, and improve financial performance.
      • Taking on a new partner is a significant investment and risk, and you must get it right the first time.
      • You need to make a change now to avoid falling further behind your performance targets and your market, and losing clients.

      Almost half of all sourcing initiatives do not realize the projected savings, and the biggest reason is the choice of partner.

      The market for Application Development partners has become more diverse, increasing choice and the risk of making a costly mistake by choosing the wrong partner.

      Firms struggle with how best to support the sourcing partner and allocate resources with the right skills to maximize success, increasing the cost and time to implement, and limiting benefits.

      Making the wrong choice means inferior products, and higher costs and losing both clients and reputation.

      • Choosing the right sourcing partner is a four-step process:
      1. Assess your company's skills and processes in the key areas of risk to sourcing initiatives.
      2. Based on the current situation, define a profile for the matching sourcing partner.
      3. Seek matching partners from the market, either in terms of vendor partners or in terms of sourcing locations.
      4. Based on your choice of partner, build a plan to implement the partnership, and define metrics to measure success and a process to monitor.

      Info-Tech Insight

      Successfully selecting a sourcing partner is not a simple RFP exercise to choose the lowest cost. It is a complex process of introspection, detailed examination of partners and locations, and matching the fit. It requires you to seek a partner that is the Yin to your Yang, and failure is not an option.

      You need a new source for development resources

      You are facing immediate challenges that require a new approach to development resourcing.

      • Your firm is under fire; you are facing pressures financially from clients and your competitors.
      • Your pace of innovation and talent sourcing is too slow and too limiting.
      • Your competition is moving faster and your clients are considering their options.
      • Revenues and costs of development are trending in the wrong direction.
      • You need to act now to avoid spiraling further.

      Given how critical our applications are to the business and our clients, there is no room for error in choosing our partner.

      A study of 121 firms outsourcing various processes found that 50% of those surveyed saw no gains from the outsourcing arrangement, so it is critical to make the right choice the first time.

      Source: Zhang et al

      Big challenges await you on the journey

      The road to improving sourcing has many potholes.

      • In a study of 121 firms who moved development offshore, almost 50% of all outsourcing and offshoring initiatives do not achieve the desired results.
      • In another study focused on large corporations, it was shown that 70% of respondents saw negative outcomes from offshoring development.
      • Globalization of IT Services and the ability to work from anywhere have contributed to a significant increase in the number of development firms to choose from.
      • Choosing and implementing a new partner is costly, and the cost of choosing the wrong partner and then trying to correct your course is significant in dollars and reputation:
        • Costs to find a new partner and transition
        • Lost revenue due to product issues
        • Loss of brand and reputation due to poor choice
      • The wrong choice can also cost you in terms of your own resources, increasing the risk of losing more knowledge and skills.

      A survey of 25 large corporate firms that outsourced development offshore found that 70% of them had negative outcomes.

      (Source: University of Oregon Applied Information Management, 2019)

      Info-Tech’s approach

      Selecting the right partner is a matching exercise.

      Selecting the right partner is a complex exercise with many factors

      1. Look inward. Assess your culture, your skills, and your needs.
      • Market
      • People
      • Culture
      • Technical aspects
    • Create a profile for the perfect partner to fit your firm.
      • Sourcing Strategy
      • Priorities
      • Profile
    • Find the partner that best fits your needs
      • Define RFx
      • Target Partners
      • Evaluate
    • Implement the partner and put in metrics and process to manage.
      • Contract Partner
      • Develop Goals
      • Create Process and Metrics

      The Info-Tech difference:

      1. Assess your own organization’s characteristics and capabilities in four key areas.
      2. Based on these characteristics and the sourcing strategy you are seeking to implement, build a profile for your perfect partner.
      3. Define an RFx and assessment matrix to survey the market and select the best partner.
      4. Implement the partner with process and controls to manage the relationship, built collaboratively and in place day 1.

      Insight summary

      Overarching insight

      Successfully selecting a sourcing partner is not a simple RFP exercise to choose the lowest cost. It is a complex process of introspection, detailed examination of partners and locations, and matching the fit. It requires you to seek a partner that is the Yin to your Yang, and failure is not an option.

      Phase 1 insight

      Fitting each of these pieces to the right partner is key to building a long-term relationship of value.

      Selecting a partner requires you to look at your firm in depth from a business, technical, and organizational culture perspective.

      Phase 2 insight

      The factors we have defined serve to build us a profile for the ideal partner to engage in sourcing our development team. This profile will lead us to be able to define our RFP / RFI and assess respondents.

      Phase 3/4 insight

      Implement the relationship the same way you want it to work, as one team. Work together on contract mechanism, shared goals, metrics, and performance measurement. By making this transparent you hasten the development of a joint team, which will lead to long-term success.

      Tactical insight

      Ensure you assess not just where you are but where you are going, in choosing a partner. For example, you must consider future markets you might enter when choosing the right sourcing, or outsourcing location to maintain compliance.

      Tactical insight

      Sourcing is not a replacement for your full team. Skills must be maintained in house as well, so the partner must be willing to work with the in-house team to share knowledge and collaborate on deliverables.

      Addressing the myth – Single country offshoring or outsourcing

      Research shows that a multi-country approach has a higher chance of success.

      • Research shows that firms trying their own captive development centers fail 20% of the time. ( Journal of Information Technology, 2008)
      • Further, the overall cost of ownership for an offshore center has shown to be significantly higher than the cost of outsourcing, as the offshore center requires more internal management and leadership.
      • Research shows that offshoring requires the offshore location to also house business team members to allow key relationships to be built and ensure more access to expertise. (Arxiv, 2021)
      • Given the specificity of employment laws, cultural differences, and leadership needs, it is very beneficial to have a Corporate HR presence in countries where an offshore center is being set up. (Arxiv, 2021)
      • Lastly, given the changing climate on security, geopolitical changes, and economic factors, our research with service providers and corporate clients shows a need to have more diversity in provider location than a single center can provide.

      Info-Tech Insight

      Long-term success of sourcing requires more than a development center. It requires a location that houses business and HR staff to enable the new development team to learn and succeed.

      Addressing the myth – Outsourcing is a simple RFP for skills and lowest cost

      Success in outsourcing is an exercise in finding a match based on complex factors.

      • In the past, outsourcing was a simple RFP exercise to find the cheapest country with the skills.
      • Our research shows this is no longer true; the decision is now more complex.
      • Competition has driven costs higher, while time business integration and security constraints have served to limit the markets available.
      • Company culture fit is key to the ability to work as one team, which research shows is a key element in delivery of long-term value. (University of Oregon, 2019).
      • These are some of the many factors that need to be considered as you choose your outsourcing partner.
      • The right decision is to find the vendor that best matches the current state of your culture, meets your market constraints, and will allow for best integration to your team – it's not about cheapest or pure skills. (IEEE Access, 2020)

      Info-Tech Insight

      Finding the right outsourcing vendor is an exercise in knowing yourself and then finding the best match to align with your key traits. It's not just costs and skills, but the partner who best matches with your ability to mitigate the risks of outsourcing.

      Phase 1

      Look inward to gain insight on key factors

      Introspection

      1.1 Assess your market factors

      1.2 Determine your people factors

      1.3 Review your current culture

      1.4 Document your technical factors

      Profiling

      2.1 Recall your sourcing strategy

      2.2 Prioritize your company factors

      2.3 Create target profile

      Partner selection

      3.1 Review your RFx

      3.2 Identify target vendors

      3.3 Evaluate vendor

      responses

      Implementation

      4.1 Engage partner to choose contract mechanism

      4.2 Engage partner team to define goals

      4.3 Choose your success

      metrics

      This phase will walk you through assessing and documenting the key driving factors about your firm and the current situation.

      By defining these factors, you will be able to apply this information in the matching process to select the best fit in a partner.

      This phase involves the following participants:

      Line of Business leaders

      Technology leaders

      Key criteria to assess your firm

      Research shows firms must assess themselves in different areas.

      Market factors

      • Who are your clients and your competitors, and what legal constraints do you face?

      People / Process factors

      • What employee skills are you seeking, what is your maturity in product management and stakeholder engagement, and what languages are spoken most predominantly?

      Cultural factors

      • What is your culture around communications, collaboration, change management, and conflict resolution?

      Technical factors

      • What is your current / future technical platform, and what is the maturity of your applications?

      Info-Tech Best Practice

      When assessing these areas, consider where you are today and where you want to go tomorrow, as choosing a partner is a long-term endeavor.

      Step 1.1

      Assess your market factors

      Activities

      1.1.1 Review your client list and future projections to determine your market factors.

      1.1.2 Review your competitive analysis to determine your competitive factors

      This step involves the following participants:

      Business leaders

      Product Owners

      Technology leaders

      Outcomes of this step

      Details of key market factors that will drive the selection of the right partner.

      Market factors

      The Market has a lot to say about the best match for your application development partner.

      Research in the space has defined key market-based factors that are critical when selecting a partner.

      1. Market sectors you service or plan to service – This is critical, as many market sectors have constraints on where their data can be accessed or stored. These restrictions also change over time, so they must be consistently reviewed.
      • E.g. Canadian government data must be stored and only accessed in Canada.
      • E.g. US Government contracts require service providers to avoid certain countries.
    • Your competitors – Your competitors can often seize on differences and turn them to differentiators; for example, offshoring to certain countries can be played up as a risk by a competitor who does all their work in a particular country.
    • Your clients – Research shows that clients can have very distinct views on services being performed in certain countries due to perceived risk, culture, and geopolitical factors. Understanding the views of major clients on globalization of services is a key factor in maintaining client satisfaction.
    • Info-Tech Insight

      Understanding your current and future market factors ensure that your business can not only be successful with the chosen partner today, but also in the future.

      1.1.1 Assess your market factors

      30 min

      Market factors

      1. Group your current client list into three categories:
        1. Those that have no restrictions on data security, privacy or location.
        2. Those that ask for assurances on data security, privacy and location.
        3. Those clients who have compliance restrictions related to data security, privacy, and location.
      2. Categorize future markets into the same three categories.
      3. Based on revenue projections, estimate the revenue from each category as a percentage of your total revenue.

      Download the Select a Sourcing Partner Presentation Template

      Input Output
      • Current client list
      • Future market plans
      • Competitive analysis
      • Completion of the Market Factors chart in the Select a Sourcing Partner for Your Development Team template
      Materials Participants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Product owners
      • Line of business leaders
      • Finance leaders

      Assess your market factors

      Market and sector

      Market share and constraints

      Market category

      Sector – Public, private or both

      Market share of category

      Key areas of concern

      Not constrained by data privacy, security or location

      Private

      50%

      Require assurances on data security, privacy or location

      Public

      45%

      Data access

      Have constraints that preclude choices related to data security, privacy and location

      Public

      5%

      Data residency

      1.1.2 Review your competitive factors

      30 min

      Competitive factors

      1. List your largest competitors.
      2. Document their sourcing strategies for their development team – are they all onshore or nearshore? Do they outsource?
      3. Based on this, identify competitive threats based on changing sourcing strategies.

      Download the Select a Sourcing Partner Presentation Template

      Input Output
      • Current client list
      • Future market plans
      • Competitive analysis
      • Completion of the Market Factors chart in the Select a Sourcing Partner for Your Development Team template
      Materials Participants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Product owners
      • Line of business leaders
      • Finance leaders

      Review your competitive factors

      Competitors

      Competitor sourcing strategy

      Competitive threats

      Competitor

      Where is the market?

      Is this onshore / near shore / offshore?

      Data residency

      How could competitors take advantage of a change in our sourcing strategy?

      Competitor X

      Canada / US

      All work done in house and onshore

      Kept in Canada / US

      If we source offshore, we will face a Made in Canada / US threat

      Step 1.2

      Consider your people-related factors

      Activities

      1.2.1 Define your people factors

      1.2.2 Assess your process factors

      This step involves the following participants:

      Technical leaders

      Outcomes of this step

      Details of key people factors that will drive the selection of the right partner.

      People / process factors

      People and process have a large hand in the success or failure of a partner relationship.

      • Alignment of people and process are critical to the success of the partner relationship over the long term.
      • In research on outsourcing / offshoring, Rahman et al identified ten factors that directly impact success or failure in offshoring or outsourcing of development.
      • Key among them are the following:
        • Employee skills
        • Project management
        • Maturity of process concerning product and client management
        • Language barrier

      Info-Tech Insight

      People are a critical resource in any sourcing strategy. Making sure the people and the processes will mesh seamlessly is how to ensure success.

      1.2.1 Define your people factors

      30 min

      Skills Inventory

      1. List skills needed in the development team to service current needs.
      2. Based on future innovation and product direction, add skills you foresee needing in the next 12-24 months. Where do you see a new technology platform (e.g. move from .NET to Java) or innovation (addition of Mobile)?
      3. List current skills present in the team.
      4. Identify skills gaps.

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Product plans for current and future products
      • Technology platform plans for current products
      • Future innovation plans
      • People- and process-related factors that influence sourcing decisions
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Product owners
      • Solution architects

      Assess your people - Skills inventory

      Skills required

      Strategic value

      Skills present

      Skill you are seeking

      Required today or in the future

      Rate the skill level required in this area

      Is this a strategic focus for the firm for future targets?

      Is this skill present in the team today?

      Rate current skill level (H/M/L)

      Java Development

      Future

      High

      Yes

      No

      Low

      .Net Development

      Today

      Med

      No

      Yes

      High

      1.2.2 Assess your process factors

      30 min

      Process factors

      1. Do you have a defined product ownership practice?
      2. How mature is the product ownership for the product you are seeking to change sourcing for (H/M/L)?
      3. Do you have project management principles and governance in place for software releases?
      4. What is the relative maturity / skill in the areas you are seeking sourcing for (H/M/L)?

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Product plans for current and future products
      • Technology platform plans for current products
      • Future innovation plans
      • People- and process-related factors that influence sourcing decisions
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Product owners
      • Solution architects

      Assess your process factors

      Product ownership

      Project management

      Product where sourcing is being changed

      Product ownership in place?

      Skills / maturity rating (H/M/L)

      Project management / governance in place for software releases

      Rate current maturity / skill level (H/M/L)

      ABC

      Yes

      High

      Yes

      High

      SQW

      No

      Low

      Yes

      High

      Step 1.3

      Review your current culture

      Activities

      1.3.1 Assess your communications factors

      1.3.2 Assess your conflict resolution factors

      This step involves the following participants:

      Technical leaders

      Product owners

      Project managers

      Outcomes of this step

      Details of key culture factors that will drive the selection of the right partner.

      Cultural factors

      Organization culture fit is a driver of collaboration between the teams, which drives success.

      • In their study of country attractiveness for sourcing development, Kotlarsky and Oshri point to the ability of the client and their sourcing partner to work as one team as a key to success.
      • This requires synergies in many cultural factors to avoid costly miscommunications and misinterpretations that damage collaboration.
      • Key factors in achieving this are:
        • Communications methodology and frequency; managing and communicating to the teams as one team vs two, and communicating at all levels, vs top down.
        • Managing the team as one integrated team, with collaboration enabled between all resources, rather than the more adversarial client vs partner approach.
        • Conflict resolution strategies must align so all members of the extended team work together to resolve conflict vs the traditional “Blame the Contractors”.
        • Strong change management is required to keep all team members aligned.

      Info-Tech Insight

      Synergy of culture is what enables a good partner selection to become a long-term relationship of value.

      1.3.1 Assess your communications factors

      30 min

      1. List all the methods you use to communicate with your development team – face to face, email, conference call, written.
      2. For each form of communication confirm frequency, medium, and audience (team vs one-on-one)
      3. Confirm if these communications take into account External vs Internal resources and different time zones, languages, and cultures.
      4. Is your development team broken up into teams by function, by location, by skill, etc., or do you operate as one team?

      Download the Select a Sourcing Partner Presentation Template

      Input Output
      • Communication process with existing development team
      • Examples of how external staff have been integrated into the process
      • Examples of conflicts and how they were resolved
      • Documentation of key cultural characteristics that need to be part of provider profiling
      Materials Participants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Product owners
      • Project managers

      Assess your communications strategy

      Communications

      Type

      Frequency

      Audience

      One communication or one per audience?

      Level of two-way dialogue

      Face-to-face team meetings

      Weekly

      All developers

      One

      High

      Daily standup

      Daily

      Per team

      One per audience

      Low

      1.3.2 Assess your conflict resolution factors

      30 min

      1. How does your organization handle the following types of conflict? Rate from 1-5, with 1 being hierarchical and 5 being openly collaborative.
        1. Developers on a team disagree.
        2. Development team disagrees with manager.
        3. Development team disagrees with product owner.
        4. Development team disagrees with line of business.
      2. Rate each conflict resolution strategy based on effectiveness.
      3. Confirm if this type of strategy is used for internal and external resources, or internal only.

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Communication process with existing development team
      • Examples of how external staff have been integrated into the process
      • Examples of conflicts and how they were resolved
      • Documentation of key cultural characteristics that need to be part of provider profiling
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Product owners
      • Project managers

      Assess your conflict resolution strategy

      Conflict

      Resolution strategy

      Effectiveness

      Audience

      Conflict type

      Rate the resolution strategy from hierarchical to collaborative (1-5)

      How effective is this method of resolution from 1-5?

      Is this strategy used for external parties as well as internal?

      Developer to product owner

      44

      Yes

      Developer to manager

      12

      Yes

      Step 1.4

      Document your technical factors

      Activities

      1.4.1 Document your product / platform factors

      1.4.2 Document your environment details

      This step involves the following participants:

      Technical leaders

      Product owners

      Outcomes of this step

      Details of key technical factors that will drive the selection of the right partner.

      Technical factors

      Technical factors are still the foundation for a Development sourcing relationship.

      • While there are many organizational factors to consider, the matching of technological factors is still the root on which the sourcing relationship is built; the end goal is to build better software.
      • Key technical Items that need to be aligned based on the research are:
        • Technical infrastructure
        • Development environments
        • Development methodology and tools
        • Deployment methodology and tools
        • Lack of/poor-quality technical documentation
      • Most RFPs focus purely on skills, but without alignment on the above items, work becomes impossible to move forward quickly, limiting the chances of success.

      Info-Tech Insight

      Technical factors are the glue that enables teams to function together. Ensuring that they are fully integrated is what enables team integration; seams in that integration represent failure points.

      1.4.1 Document your product / platform factors

      30 mins

      1. How many environments does each software release go through from the start of development through release to production?
      2. What is the infrastructure and development platform?

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Development process
      • Deployment process
      • Operations process
      • IT security policies
      • Documentation of key technical characteristics that need to be part of provider profiling
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Development leaders
      • Deployment team leaders
      • Infrastructure leaders
      • IT operations leaders
      • Product owners
      • Project managers

      Document your product / platform

      Product / Platform

      Product you are seeking a sourcing solution for

      What is the current infrastructure platform?

      How many environments does the product pass through?

      What is the current development toolset?

      ABC

      Windows

      Dev – QA – Preprod - Prod

      .Net / Visual Studio

      1.4.2 Document your environment details

      30 min

      For each environment detail the following:

      1. Environment on premises or in cloud
      2. Access allowed to external parties
      3. Production data present and unmasked
      4. Deployment process: automated or manual
      5. Tools used for automated deployment
      6. Can the environment be restored to last known state automatically?
      7. Does documentation exist on the environment, processes and procedures?

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Development process
      • Deployment process
      • Operations process
      • IT security policies
      • Documentation of key technical characteristics that need to be part of provider profiling
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Development leaders
      • Deployment team leaders
      • Infrastructure leaders
      • IT operations leaders
      • Product owners
      • Project managers

      Document Your Environment Details

      Environment

      Location

      Access

      Deployment

      Data

      Name of Environment

      Is the environment on premises or in the cloud (which cloud)?

      Is external access allowed?

      Is deployment automated or manual?

      Tool used for deployment

      Is reset automated?

      Does the environment contain unmasked production data?

      Dev

      Cloud

      Yes

      Automated

      Azure DevOps

      Yes

      No

      QA

      Cloud

      Yes

      Automated

      Azure DevOps

      Yes

      No

      Preprod

      On Premises

      No

      Manual

      N/A

      No

      Yes

      Phase 2

      Introspection

      1.1 Assess your market factors

      1.2 Determine your people factors

      1.3 Review your current culture

      1.4 Document your technical factors

      Profiling

      2.1 Recall your sourcing strategy

      2.2 Prioritize your company factors

      2.3 Create target profile

      Partner selection

      3.1 Review your RFx

      3.2 Identify target vendors

      3.3 Evaluate vendor

      responses

      Implementation

      4.1 Engage partner to choose contract mechanism

      4.2 Engage partner team to define goals

      4.3 Choose your success

      metrics

      This phase will help you to build a profile of the partner you should target in your search for a sourcing partner.

      This phase involves the following participants:

      Technology leaders

      Procurement leaders

      Product owners

      Project managers

      Build a profile for the right partner

      • Finding the perfect partner is a puzzle to solve, an exercise between the firm and the partners.
      • It is necessary to be able to prioritize and to identify opportunities where you can adapt to create a fit.
      • You must also bring forward the sourcing model you are seeking and prioritize factors based on that; for example, if you are seeking a nearshore partner, language may be less of a factor.

      Review factors based on sourcing choice

      Different factors are more important depending on whether you are insourcing or outsourcing.

      Key risks for insourcing

      • Alignment on communication strategy and method
      • Ability to align culturally
      • Need for face-to-face relationship building
      • Need for coaching skills

      Key risks for outsourcing

      • Giving control to the vendor
      • Legal and regulatory issues
      • Lack of knowledge at the vendor
      • Language and cultural fit

      Assessing your firm's position

      • The model you derived from the Sourcing Strategy research will inform the prioritization of factors for matching partners.

      Info-Tech Insight

      To find the best location for insourcing, or the best vendor for outsourcing, you need to identify your firm's positions on key risk areas.

      Step 2.1

      Recall your sourcing strategy

      Activities

      2.1.1 Define the key factors in your sourcing strategy

      This step involves the following participants:

      Technology Leaders

      Outcomes of this step

      Documentation of the Sourcing Strategy you arrived at in the Define a Sourcing Strategy exercises

      Choosing the right model

      The image contains a screenshot of the legend that will be used down below. The legend contains circles, from the left there is a empty circle, a one quarter filled circle, half filled circle, three-quarter filled circle , and a fully filled in circle.

      Determinant

      Key Questions to Ask

      Onshore

      Nearshore

      Offshore

      Outsource role(s)

      Outsource team

      Outsource product(s)

      Business dependence

      How much do you rely on business resources during the development cycle?

      The image contains a screenshot of the filled in whole circle to demonstrate high. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the half filled circle to demonstrate medium. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the empty circle to demonstrate low.

      Absorptive capacity

      How successful has the organization been at bringing outside knowledge back into the firm?

      The image contains a screenshot of the empty circle to demonstrate low. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the half filled circle to demonstrate medium. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the filled in whole circle to demonstrate high.

      Integration complexity

      How many integrations are required for the product to function – fewer than 5, 5-10, or more than 10?

      The image contains a screenshot of the filled in whole circle to demonstrate high. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the half filled circle to demonstrate medium. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the empty circle to demonstrate low.

      Product ownership

      Do you have full-time product owners in place for the products? Do product owners have control of their roadmaps?

      The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the half filled circle to demonstrate medium. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the half filled circle to demonstrate medium. The image contains a screenshot of the filled in whole circle to demonstrate high. The image contains a screenshot of the filled in whole circle to demonstrate high.

      Organization culture fit

      What are your organization’s communication and conflict resolution strategies? Is your organization geographically dispersed?

      The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the filled in whole circle to demonstrate high.

      Vendor mgmt skills

      What is your skill level in vendor management? How old are your longest-standing vendor relationships?

      The image contains a screenshot of the empty circle to demonstrate low. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the one-quarter filled circle to demonstrate medium low. The image contains a screenshot of the half filled circle to demonstrate medium. The image contains a screenshot of the three-quarter filled circle to demonstrate medium high. The image contains a screenshot of the filled in whole circle to demonstrate high.

      2.1.1 Define the key factors in your sourcing strategy

      30 min

      For each product you are seeking a sourcing strategy for, document the following:

      1. Product or team name.
      2. Sourcing strategy based on Define a Sourcing Strategy.
      3. The primary drivers that led to this selection – Business Dependence, Absorptive Capacity, Integration Complexity, Product Ownership, Culture or Vendor Management.
      4. The reasoning for the selection based on that factor – e.g. we chose nearshoring based on high business dependence by our development team.

      Download the Select a Sourcing Partner Presentation Template

      Input Output
      • Sourcing Strategy from Define a Sourcing Strategy for your Development Team
      • Reasoning that drove the sourcing strategy selection
      Materials Participants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leadership

      Define sourcing strategy factors

      Sourcing strategy

      Factors that led to selection

      Product you are seeking a sourcing solution for

      Strategy defined

      Key factors that led to that choice

      Reasoning

      ABC

      Outsourcing - Offshore

      • Product ownership
      • Business integration
      • Product maturity
      • Technical environment

      Mature product ownership and low requirement for direct business involvement.

      Mature product with lower environments in cloud.

      Step 2.2

      Prioritize your company factors

      Activities

      2.2.1 Prioritize the factors from your sourcing strategy and confirm if mitigation or adaptation are possible.

      This step involves the following participants:

      IT Leadership team

      Outcomes of this step

      Prioritized list of key factors

      2.2.1 Prioritize your sourcing strategy factors

      30 min

      1. For each of the factors listed in exercise 2.1, prioritize them by importance to the firm.
      2. For each factor, please confirm if there is room to drive change internally to overcome the lack of a match – for example, if the culture being changed in language and conflict resolution is an option, then say Yes for that factor.

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Sourcing Strategy factors from 2.1
      • Prioritized list of sourcing strategy factors
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders

      Sourcing strategy factors and priority

      Sourcing strategy

      Factors that led to selection

      Priority of factor in decision

      Change possible

      Product you are seeking a sourcing solution for

      Strategy defined

      Key factors that led to your choice

      Reasoning

      Priority of factor 1-x

      Is there an opportunity to adapt this factor to a partner?

      ABC

      Outsourcing - offshore

      • Product ownership
      • Business integration
      • Product maturity
      • Technical environment

      Mature product ownership

      Low requirement for direct business involvement

      Mature product with lower environments in cloud

      2

      1

      3

      N

      N

      Y

      Step 2.3

      Create target profile

      Activities

      2.3.1 Profile your best fit

      This step involves the following participants:

      IT Leadership team

      Outcomes of this step

      Profile of the target partner

      Profiling your best fit

      Creating a target profile will help you determine which partners should be included in the process.

      Given the complexity of all the factors and trying to find the best fit from a multitude of partners, Info-Tech recommends forming a target profile for your best fit of partner.

      This profile provides a detailed assessment matrix to use to review potential partners.

      Profile should be created based on priority; "must haves" are high priority, while properties that have mitigation opportunities are optional or lower priority.

      Criteria

      Priority

      Some US Govt contracts – data and staff in NATO

      1

      Windows environment – Azure DEVOPS

      2

      Clients in FS

      3

      Agile SDLC

      4

      Collaborative communication and conflict resolution

      5

      Mature product management

      6

      Languages English and Spanish

      7

      Partner Profile

      • Teams in NATO and non-NATO countries
      • Windows skills with Azure
      • Financial Services experience
      • Utilize Agile and willing to plug into our teams
      • Used to collaborating with clients in one team environment
      • One centre in Latin / South America

      Info-Tech Insight

      The factors we have defined serve to build us a profile for the ideal partner to engage in sourcing our development team. This profile will lead us to be able to define our RFP / RFI and assess respondents.

      Case study: Cognizant is partnering with clients on product development

      INDUSTRY: Technology Services

      SOURCE: Interview with Jay MacIsaac, Cognizant

      Cognizant is driving quality solutions for clients

      • Strives to be primarily an industry-aligned organization that delivers multiple service lines in multiple geographies.
      • Seeks to carefully consider client culture to create one team.
      • Value proposition is a consultative approach bringing thought leadership and mutually adding value to the relationship vs the more traditional order taker development partner
      • Wants to share in solution development to facilitate shared successes. Geographic alignment drives knowledge of the client and their challenges, not just about time zone and supportability.
      • Offers one of the largest offshore capabilities in the world, supported by local and nearshore resources to drive local knowledge.
      • Realizes today’s clients don’t typically want a black box, they are sophisticated and want transparency around the process and solution, to have a partner.
      • Understands that clients do want to know where the work is being delivered from and how it's being delivered, and want to help manage expectations and overall risk.

      Synergy with Info-Tech’s approach

      • Best relationship comes when teams operate as one.
      • Clients are seeking value, not a development black box.
      • Clients want to have a partner they can engage with, not just an order taker.
      • Goal is a one-team culture with shared goals and delivering business value.
      • Ideal is a partner that will add to their thinking, not echo it.

      Results of this approach

      • Cognizant is continuing to deliver double-digit growth and continues to strive for top quartile performance.
      • Growth in the client base has seen the company grow to over 340,000 associates worldwide.

      Case study: Cabot Technology Solutions uses industry knowledge to drive successful partnerships

      INDUSTRY: Technology Services

      SOURCE: Interview with Shibu Basheer, Cabot Technology Solutions

      Cabot Technology Solutions findings

      • Cabot Technology Solutions looks to partner with clients and deliver expertise and value, not just application development.
        • Focus on building deep knowledge in their chosen vertical, Healthcare.
        • Focus on partnering with clients in this space who are seeking a partner to provide industry knowledge and use this to propel them forward.
        • Look to work with clients seeking a one team philosophy.
        • Avoid clients looking for a cheap provider.
      • Recognizing the initial apprehension to India as a location, they have built a practice in Ontario that serves as a bridge for their offshore team.
      • Cabot overcame initial views and built trust, while integrating the India team in parallel.

      Synergy with Info-Tech approach

      • Preference is partners, not a client/vendor relationship.
      • Single country model is set aside in favor of mix of near and offshore.
      • Culture is a one team approach, not the more adversarial order-taker approach.
      • Goal is to build long-term relationships of value, not task management.

      Results of this approach

      • Cabot is a recognized as a top software development company in many markets across the USA.
      • Cabot continues to drive growth and build referenceable client relationships across North America.

      2.3.1 Profile your best fit

      30 min

      1. Document the list of skills you are seeking from the People Factors – Skills Inventory in Section 1.2 – these represent the skills you are seeking in a partner.
      2. Document the culture you are looking for in a partner with respect to communications and conflict resolution in the culture section of the requirements – this comes from Section 1.3.
      3. Confirm the type of partner you are seeking – nearshore, offshore, or outsourcing based on the sourcing strategy priorities in Section 2.2.
      4. Confirm constraints that the partner must work under based on constraints from your market and competitor factors in Section 1.1.
      5. Confirm your technical requirements in terms of environments, tools, and processes that the vendor must align to from Section 1.4.

      Download the Select a Sourcing Partner Presentation Template

      Input Output

      All exercises done in Steps 11-1.4 and 2.1-2.2

      Profile of a target partner to drive the RFx Criteria

      Materials Participants

      Select a Sourcing Partner for Your Development Team Presentation template

      Development leaders

      Deployment team leaders

      Infrastructure leaders

      IT operations leaders

      Product owners

      Project managers

      RFP skills requirement

      People skills required

      Product ownership

      Project management

      Skill

      Skill level required

      Tools / platform requirement

      Details of product management methodology and skills

      Details of firm's project management methodology

      .NET

      Medium

      Windows

      Highly mature, high skill

      Highly mature, high skill

      Java

      High

      Windows

      Low

      High

      RFx cultural characteristics

      Communication strategy

      Conflict resolution

      Organization / management

      Communication mediums supported

      Frequency of meetings expected

      Conflict resolutions strategies used at the firm

      Management methodology

      Face to face

      Weekly

      Collaborative

      Online

      Daily

      Hierarchical with manager

      Hierarchical

      RFx market constraints

      Constraints

      Partner proposal

      Constraint type

      Restrictions

      Market size required for

      Reasoning

      Data residency

      Data must stay in Canada for Canadian Gov't clients

      5% Canada public sector

      Competitive

      Offshoring dev means competition can take advantage

      95% Clients

      Need strategy to show data and leadership in NA, but delivering more innovation at lower cost by going offshore

      RFx technical requirements

      Technical environments

      Infrastructure

      Alignment of SDLC

      Tools required for development team

      Access control software required

      Infrastructure location

      Number of environments from development to production

      .Net Visual Studio

      Microsoft

      Azure

      4

      RFx scope of services

      Work being sourced

      Team sizing

      Work being sourced

      Skill level required

      Average size of release

      Releases per year

      Java development of new product

      High

      3-month development

      6

      .NET staff augmentation

      Medium

      ½-month development

      12

      Phase 3

      Choose the partner that will best enable you to move forward as one integrated team.

      Introspection

      1.1 Assess your market factors

      1.2 Determine your people factors

      1.3 Review your current culture

      1.4 Document your technical factors

      Profiling

      2.1 Recall your sourcing strategy

      2.2 Prioritize your company factors

      2.3 Create target profile

      Partner selection

      3.1 Review your RFx

      3.2 Identify target vendors

      3.3 Evaluate vendor

      responses

      Implementation

      4.1 Engage partner to choose contract mechanism

      4.2 Engage partner team to define goals

      4.3 Choose your success

      metrics

      For more details on Partner Selection, please refer to our research blueprint entitled Select an ERP Partner

      This phase will help you define your RFx for your provider search

      This phase involves the following participants:

      Vendor Management Team

      IT Leadership

      Finance Team

      Finding the right fit should always come before rates to determine value

      The right fit

      Determined in previous activities

      Negotiating will eventually bring the two together

      Value

      Rates

      Determined by skill and location

      Statement of Work (SOW) quality

      A quality SOW is the result of a quality RFI/RFP (RFx).

      The process up to now has been gathering the materials needed to build a quality RFx. Take this opportunity to review the outputs of the preceding activities to ensure that:

      • All the right stake holders have been engaged.
      • The requirements are complete.

      Info-Tech’s RFP Review as a Service looks for key items to ensure your RFx will generate quality responses and SOWs.

      • Is it well-structured with a consistent use of fonts and bullets?
      • Is it laid out in sections that are easily identifiable and progress from high-level to more detailed information?
      • Can a vendor quickly identify the ten (or fewer) things that are most important to you?

      The image contains a screenshot of the Request for Proposal Review as a Service.

      Step 3.1

      Review your RFx

      Activities

      3.1.1 Select your RFx template

      3.1.2 Finalize your RFx

      3.1.3 Weight each evaluation criteria

      This step involves the following participants:

      • Project team
      • Evaluation team
      • Vendor management team
      • CIO

      Outcomes of this step

      • Completed RFx

      Info-Tech’s RFI/RFP process

      Info-Tech has well-established vendor management templates and practices

      • Identify Need
      • Define Business Requirements
      • Gain Business Authorization
      • Perform RFI/RFP
      • Negotiate Agreement
      • Purchase Goods and Services
      • Assess and Measure Performance

      Info-Tech Best Practice

      You’ll want to customize templates for your organization, but we strongly suggest that you take whatever you feel best meets your needs from both the long- and short-form RFPs presented in this blueprint.

      The secret to managing an RFP is to make it manageable. And the secret to making an RFP manageable is to treat it like any other aspect of business – by developing a process. With a process in place, you are better able to handle whatever comes your way, because you know the steps you need to follow to produce a top-notch RFP.

      Your RFP process should be tailored to fit the needs and specifics of your organization and IT.

      Info-Tech Insight

      Create a better RFP process using Info-Tech’s well-established templates and methodology.

      Create a Better RFP Process

      In a hurry? Consider an enhanced RFI instead of an RFP.

      While many organizations rarely use RFIs, they can be an effective tool in the vendor manager’s toolbox when used at the right time in the right way. RFIs can be deployed in competitive targeted negotiations. An enhanced RFI (ERFI) is a two-stage strategy that speeds up the typical RFP process. The first stage is like an RFI on steroids, and the second stage is targeted competitive negotiation.

      Stage 1:

      Create an RFI with all the customary components. Next, add a few additional RFP-like requirements (e.g. operational and technical requirements). Make sure you include a request for budgetary pricing and provide any significant features and functionality requirements so that the vendors have enough information to propose solutions. In addition, allow the vendors to ask questions through your single point of coordination and share answers with all the vendors. Finally, notify the vendors that you will not be doing an RFP – this is it!

      Stage 2:

      Review the vendors’ proposals and select the best two. Negotiate with both vendors and then make your decision.

      The ERFI shortens the typical RFP process, maintains leverage for your organization, and works great with low- to medium-spend items (however your organization defines them). You’ll get clarification on vendors’ competencies and capabilities, obtain a fair market price, and meet your internal clients’ aggressive timelines while still taking steps to protect your organization.

      RFI Template

      The image contains a screenshot of the RFI Template.

      Use this template to create your RFI baseline template. Be sure to modify and configure the template to your organization’s specifications.

      Request for Information Template

      Long-Form RFP Template

      Configure Info-Tech’s Long-Form RFP Template for major initiatives

      The image contains a screenshot of the long-form RFP Template.

      A long-form or major RFP is an excellent tool for more complex and complicated requirements. This example is for a baseline RFP.

      It starts with best-in-class RFP terms and conditions that are essential to maintaining your control throughout the RFP process. The specific requirements for the business, functional, technical, and pricing areas should be included in the exhibits at the end of the template. That makes it easier to tailor the RFP for each deal, since you and your team can quickly identify specific areas that need modification. Grouping the exhibits together also makes it convenient for both your team to review, and the vendors to respond.

      You can use this sample RFP as the basis for your template RFP, taking it all as is or picking and choosing the sections that best meet the mission and objectives of the RFP and your organization.

      Source: Info-Tech’s The Art of Creating a Quality RFP

      Short-Form RFP Template

      Configure Info-Tech’s Short-Form RFP Template for minor or smaller initiatives

      The image contains a screenshot of the Short-Form RFP Template.

      This example is for a less complex RFP that has relatively basic requirements and perhaps a small window in which the vendors can respond. As with the long-form RFP, exhibits are placed at the end of the RFP, an arrangement that saves time for both your team and the vendors. Of course, the short-form RFP contains fewer specific instructions, guidelines, and rules for vendors’ proposal submissions.

      We find that short-form RFPs are a good choice when you need to use something more than a request for quote (RFQ) but less than an RFP running 20 or more pages. It’s ideal, for example, when you want to send an RFP to only one vendor or to acquire items such as office supplies, contingent labor, or commodity items that require significant vendor's risk assessment.

      Source: The Art of Creating a Quality RFP

      3.1.1 Select your RFx template

      1-3 hours

      1. As a group, download the RFx templates from the previous three slides.
      2. Review your RFx process as a group. Be sure to include the vendor management team.
      3. Be sure to consider organization-specific procurement guidelines. These can be included. The objective here is to find the template that is the best fit. We will finalize the template in the next activity.
      4. Determine the best template for this project.
      Input Output
      • RFx templates
      • The RFx template that will be used for this project
      Materials Participants
      • Info-Tech’s Enhanced RFI Template, Long-Form RFP Template, and Short-Form RFP Template
      • Vendor management team
      • Project team
      • Project manager

      Finalize your RFx

      Key insights

      Leverage the power of the RFP

      • Too often RFPs fail to achieve their intended purposes, and your organization feels the effects of a poorly created RFP for many years.
      • If you are faced with a single source vendor, you can perform an RFP to one to create the competitive leverage.

      Make the response and evaluation process easier

      • Being strategic in your wording and formatting makes it easier on both parties – easier for the vendors to submit meaningful proposals, and easier for customer teams to evaluate.
      • Create a level playing field to encourage competition. Without multiple proposals, your options are limited and your chances for a successful project plummet.

      Maximize the competition

      • Leverage a pre-proposal conference to resolve vendor questions and to ensure all vendors receive the same answers to all questions. No vendor should have an information advantage.

      Do’s

      • Leverage your team’s knowledge.
      • Document and explain your RFP process to stakeholders and vendors.
      • Include contract terms in your RFP.
      • Measure and manage performance after contract award.
      • Seek feedback from the RFP team on your process and improve it as necessary.

      Don'ts

      • Reveal your budget.
      • Do an RFP in a vacuum.
      • Send an RFP to a vendor your team is not willing to award the business to.
      • Hold separate conversations with candidate vendors during your RFP process.
      • Skimp on the requirements definition to speed the process.
      • Tell the vendor they are selected before negotiating.

      3.1.2 Finalize your RFx

      1-3 hours

      1. As a group, review the selected RFI or RFP template.
      2. This is YOUR document. Modify it to suit the needs of the organization and even add sections from the other RFP templates that are relevant to your project.
      3. Use the Supplementary RFx Material as a guide.
      4. Add the content created in Steps 1 and 2.
      5. Add any organization-specific clauses or requirements.
      6. Have the project team review and comment on the RFP.
      7. Optional: Use Info-Tech’s RFP Review Concierge Service.

      Download the RFx Vendor Evaluation Tool

      Download the Supplementary RFx Material

      InputOutput
      • RFx template
      • Organizational specific guidelines
      • Materials from Steps 1 and 2
      • Supplementary RFx Material
      • Finalized RFx
      MaterialsParticipants
      • Electronic RFP document for editing
      • Vendor management team
      • Project team
      • Project manager

      3.1.2 Bring it all together

      Supplementary RFx Material

      The image contains a screenshot of Supplementary RFx Material.

      Review the sample content to get a feel for how to incorporate the results of the activities you have worked through into the RFx template.

      RFx Templates

      Use one of our templates to build a ready-for-distribution implementation partner RFx tailored to the unique success factors of your implementation.

      Exercises in Steps 1 and 2

      The image contains a screenshot of Exercises in Steps 1 and 2

      Use the material gathered during each activity to inform and populate the implementation partner requirements that are specific for your organization and project.

      The image contains a screenshot of the Long Form RFx template.The image contains a screenshot of the Short Form RFx template.

      3.1.3 Weight each evaluation criteria

      1-3 hours

      1. As a group, review the selected RFI or RFP template.
      2. This is your document. Modify it to suit the needs of the organization and even add sections from the other RFP templates that are relevant to your project.
      3. Use the Supplementary RFx Material as a guide.
      4. Utilize the content defined in Steps 1 and 2.
      5. Add any organization-specific clauses or requirements.
      6. Have the project team review and comment on the RFP.
      7. Optional: Use Info-Tech’s RFP Review Concierge Service.

      Download the Supplementary RFx Material

      InputOutput

      RFx Vendor Evaluation Tool

      Exercises from Steps 1 and 2

      • Weighted scoring tool to evaluate responses
      MaterialsParticipants
      • RFx Vendor Evaluation Tool
      • Supplementary RFx Material
      • Vendor management team
      • Project team
      • Project manager

      3.1.3 Apply weight to each evaluation criteria

      Use this tool to weight each critical success factor based on results of the activities within the vendor selection workbook for later scoring results.

      The image contains a screenshot of the RFx Vendor Evaluation Tool.

      Download the RFx Vendor Evaluation Tool

      Step 3.2

      Identify target vendors

      Activities

      3.2.1 Identify target vendors

      3.2.2 Define your RFx timeline

      This step involves the following participants:

      • Project team
      • Vendor management team

      Outcomes of this step

      • Targeted vendor list
      • Initial RFx timeline

      3.2.1 Identify target vendors

      1-3 hours

      1. Based on the profile defined in Step 2.3, research potential partners that fit the profile, starting with those you may have used in the past. From this, build your initial list of vendors to target with your RFx.
      2. Break into smaller groups (or continue as a single group if it is already small) and review each shortlisted vendor to see if they will likely respond to the RFx.
      Input Output
      • Websites
      • Peers
      • Advisory groups
      • A shortlist of vendors to target with your RFx
      Materials Participants
      • RFx Vendor Evaluation Tool
      • CIO
      • Vendor management team
      • Project team
      • Evaluation team

      Download the RFx Vendor Evaluation Tool

      Define your RFx timeline

      Provider RFx timelines need to be clearly defined to keep the project and participants on track. These projects and processes can be long. Set yourself up for success by identifying the time frames clearly and communicating them to participants.

      1. Current
      • Concurrent ERP product selection
      • RFx preparation
      • Release of RFX
    • Near-term
      • Responses received
      • Scoring responses
      • Shortlisting providers
      • Provider interviews
      • Provider selection
      • Provider contract negotiations
      • Contract with provider
    • Future
      • Initiation of knowledge transfer
      • Joint development period
      • Cutover to provider team

      89% of roadmap views have at least some representation of time. (Roadmunk, n.d.)

      Info-Tech Insight

      The true value of time horizons is in dividing your timeline and applying different standards and rules, which allows you to speak to different audiences and achieve different communication objectives.

      3.2.2 Define your RFx timeline

      1-3 hours

      1. As a group identify an appropriate timeline for your RFP process. Info-Tech recommends no less than three months from RFx release to contract signing.

        Keep in mind that you need to allow for time to engage the team and perform some level of knowledge transfer, and to seed the team with internal resources for the initial period.
      2. Leave enough time for vendor responses, interviews, and reference checks.
      3. Once the timeline is finalized, document it and communicate it to the organization.

      Download the RFx Vendor Evaluation Tool

      Input Output
      • RFx template
      • Provider RFx timeline
      Materials Participants
      • RFx Vendor Evaluation Tool
      • Vendor management team
      • Project team
      • Project manager

      Define your RFx timeline

      The image contains a screenshot of an example of an RFx timeline.

      Step 3.3

      Evaluate vendor responses

      Activities

      3.3.1 Evaluate responses

      This step involves the following participants:

      • Evaluation team

      Outcomes of this step

      • Vendor submission scores

      3.3.1 Evaluate responses

      1-3 hours

      1. Use the RFx Vendor Evaluation Tool to collect and record the evaluation team's scores for each vendor's response to your RFx.
      2. Then record and compare each team member's scores to rank the vendors' responses.
      3. The higher the score, the closer the fit.

      Download the RFx Vendor Evaluation Tool

      InputOutput
      • Vendor responses
      • Vendor presentations
      • Vendor scores
      MaterialsParticipants
      • RFx Vendor Evaluation Tool
      • Evaluation team

      3.3.1 Score vendor results

      Use the RFx Vendor Evaluation Tool to score the vendors' responses to your RFx using the weighted scale from Activity 3.1.3.

      The image contains a screenshot of the RFx Vendor Evaluation Tool.

      Download the RFx Vendor Evaluation Tool

      Phase 4

      Measuring the new relationship

      Introspection

      1.1 Assess your market factors

      1.2 Determine your people factors

      1.3 Review your current culture

      1.4 Document your technical factors

      Profiling

      2.1 Recall your sourcing strategy

      2.2 Prioritize your company factors

      2.3 Create target profile

      Partner selection

      3.1 Review your RFx

      3.2 Identify target vendors

      3.3 Evaluate vendor

      responses

      Implementation

      4.1 Engage partner to choose contract mechanism

      4.2 Engage partner team to define goals

      4.3 Choose your success

      metrics

      This phase will allow you to define the relationship with your newly chosen partner, including choosing the right contract mechanism, defining shared goals for the relationship, and selecting the metrics and processes to measure performance.

      This phase involves the following participants:

      IT leadership

      Procurement team

      Product owners

      Project managers

      Implementing the Partner

      Implementing the new partner is an exercise in collaboration

      • Successfully implementing your new partner is an exercise in working together
      1. Define a contract mechanism that is appropriate for the relationship, but is not meant as punitive, contract-based management – this sets you up for failure.
      2. Engage with your team and your partner as one team to build shared, measurable goals
      3. Work with the team to define the metrics and processes by which progress against these goals will be measured
    • Goals, metrics and process should be transparent to the team so all can see how their performance ties to success
    • Make sure to take time to celebrate successes with the whole team as one
    • Info-Tech Insight

      Implement the relationship the same way you want it to work: as one team. Work together on contract mechanism, shared goals, metrics, and performance measurement. This transparency and collaboration will build a one team view, leading to long-term success.

      Step 4.1

      Engage partner to choose contract mechanism

      Activities

      4.1.1 Confirm your contract mechanism

      This step involves the following participants:

      IT leadership

      Procurement team

      Vendor team

      Outcomes of this step

      Contract between the vendor and the firm for the services

      Negotiate agreement

      Evaluate your RFP responses to see if they are complete and if the vendor followed your instructions.

      Then:

      Plan negotiation(s) with one or more vendors based on your questions and opportunities identified during evaluation.

      Select finalist(s).

      Apply selection criteria.

      Resolve vendors' exceptions.

      Negotiate before you select your vendor:

      Negotiating with two or more vendors will maintain your competitive leverage while decreasing the time it takes to negotiate the deal.

      Perform legal reviews as necessary.

      Use sound competitive negotiations principles.

      Info-Tech Insight

      Be certain to include any commitments made in the RFP, presentations, and proposals in the agreement, as the standard for an underperforming vendor.

      Info-Tech Insight

      Providing contract terms in an RFP can dramatically reduce time for this step by understanding the vendor’s initial contractual position for negotiation.

      Leverage ITRG's negotiation process research for additional information

      For more details on this process please see our research Drive Successful Sourcing Outcomes with a Robust RFP Process

      4.1.1 Confirm your contract mechanism

      30 min

      1. Does the firm have prior experience with this type of sourcing arrangement?
      2. Does the firm have an existing services agreement with the selected partner?
      3. What contract mechanisms have been used in the past for these types of arrangements?
      4. What mechanism was proposed by the partner in their RFP response?

      Download the Select a Sourcing Partner Presentation Template

      Input Output
      • Past sourcing agreements from Procurement
      • Proposed agreement from partner
      • Agreed upon contract mechanism
      Materials Participants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Vendor management group
      • Partner leaders

      Choose the appropriate contract method

      Work being sourced

      Partner proposal

      Agreed-upon mechanism

      Work being sourced

      Vendor management experience with type

      Partner proposed contract method

      Agreed-upon contract method

      Java development team to build new product

      Similar work done with fixed price with another vendor

      Time and materials per scrum team

      Time and materials per scrum team to avoid vendor conflicts inherent in fixed price which limit innovation

      Step 4.2

      Engage partner team to define shared goals

      Activities

      4.2.1 Define your shared goals

      This step involves the following participants:

      IT leadership

      Vendor leadership

      Outcomes of this step

      Shared goals for the team

      Define success and shared goals

      Work together to define how you will measure yourselves.

      One team

      • Treating the new center and the existing team as one team is critical to long-term success.
      • Having a plan that allows for teams to meet frequently face-to-face "get to know you" and "stay connected" sessions will help the team gel.

      Shared goals

      • New group must share common goals and measurements.

      Common understanding

      • New team must have a common understanding and culture on key facets such as:
        • Measurement of quality
        • Openness to feedback and knowledge sharing
        • Culture of collaboration
        • Issue and Risk Management

      4.2.1 Define your shared goals

      30 min

      1. List each item in the scope of work for the sourcing arrangement – e.g. development of product XXX.
      2. For each scope item, detail the benefit expected by the firm – e.g. development cost expected to drop by 10% per year, or customer satisfaction improvement.
      3. For each benefit define how you will measure success – e.g. track cost of development for the development team assigned, or track Customer Satisfaction Survey results.
      4. For each measure, define a target for this year – e.g. 10% decrease over last year's cost, or customer satisfaction improvement from 6 to 7.

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Services being procured from RFx
      • Benefits expected from the sourcing strategy
      • Baseline scores for measurements
      • Shared goals agreed upon between team and partner
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Technology leaders
      • Partner leaders

      Define goals collaboratively

      Role and benefit

      Goals and objectives

      Role / work being sourced

      Benefit expected

      Measure of success

      Year over year targets

      Java development team to build new product

      New product to replace aging legacy

      Launch of new product

      Agree on launch schedule and MVP for each release / roadmap

      Step 4.3

      Choose your success metrics

      Activities

      4,3.1 Define metrics and process to monitor

      This step involves the following participants:

      IT leadership

      Product owners

      Project managers

      Vendor leaders

      Outcomes of this step

      Metrics and process to measure performance

      4.3.1 Define metrics and process to monitor

      30 min

      1. For each goal defined and measure of success, break down the measure into quantifiable, measurable factors – e.g. Development cost is defined as all the costs tracked to the project including development, deployment, project management, etc.
      2. For each factor choose the metric that can be reported on – e.g. project actuals.
      3. For each metric define the report and reporting frequency – e.g. monthly project actuals from project manager.

      Download the Select a Sourcing Partner Presentation Template

      InputOutput
      • Development process
      • Deployment process
      • Operations process
      • IT Security policies
      • Documentation of key technical characteristics that need to be part of provider profiling
      MaterialsParticipants
      • Select a Sourcing Partner for Your Development Team Presentation template
      • Development leaders
      • Deployment team leaders
      • Infrastructure leaders
      • IT operations leaders
      • Product owners
      • Project managers

      Agreed-upon metrics

      Goal

      Metrics and process

      Agreed-upon goal

      Year 1 target

      Metric to measure success

      Measurement mechanism

      Deliver roadmap of releases

      3 releases – MVP in roadmap

      Features and stories delivered

      Measure delivery of stories from Jira

      Research Contributor

      The image contains a picture of Alaisdar Graham.

      Alaisdar Graham

      Executive Counsellor

      Info-Tech Research Group

      During Alaisdar’s 35-year career in information and operational technology, Alaisdar has been CIO for public sector organizations and private sector companies. He has been an entrepreneur with his own consultancy and a founder or business advisor with four cyber-security start-ups, Alaisdar has developed experience across a broad range of industries within a number of different countries and become known for his ability to drive business benefits and improvements through the use of technology.

      Alaisdar has worked with CXO-level executives across different businesses. Whether undertaking a digital transformation, building and improving IT functions across your span of control, or helping you create and execute an integrated technology strategy, Alaisdar can provide insight while introducing you to Info-Tech Research Group’s experts. Alaisdar’s experience with organizational turn- around, governance, project, program and portfolio management, change management, risk and security will support your organization’s success.

      Research Contributor

      The image contains a picture of Richard Nachazel.

      Richard Nachazel

      Executive Counsellor

      Info-Tech Research Group

      • Richard has more than 40 years working in various Fortune 500 organizations. His specialties are collaborating with business and IT executives and senior stakeholders to define strategic goals and transform operational protocols, standards, and methodologies. He has established a reputation at multiple large companies for taking charge of critical, high-profile enterprise projects in jeopardy of failure and turning them around. Colleagues and peers recognize his ability to organize enterprise efforts, build, develop, and motivate teams, and deliver outstanding outcomes.
      • Richard has worked as a Global CISO & Head of IT Governance for a Swiss Insurance company, Richard developed and led a comprehensive Cyber-Security Framework that provided leadership and oversight of the cyber-security program. Additionally, he was responsible for their IT Governance Risk & Compliance Operation and the information data security compliance in a complex global environment. Richard’s experience with organizational turn around, governance, risk, and controls, and security supports technology delivery integration with business success. Richard’s ability to engage executive and senior management decision makers and champion vision will prove beneficial to your organization.

      Research Contributor

      The image contains a picture of Craig Broussard.

      Craig Broussard

      Executive Counsellor

      Info-Tech Research Group

      • Craig has over 35 years of IT experience including software development, enterprise system management, infrastructure, and cyber security operations. Over the last 20 years, his focus has been on infrastructure and security along with IT service management. He’s been an accomplished speaker and panelist at industry trade events over the past decade.
      • Craig has served as Global Infrastructure Director for NCH Corporation, VP of Information Technology at ATOS, and earlier in his career as the Global Head of Data Center Services at Nokia Siemens Networks. Craig also worked for MicroSolutions (a Mark Cuban Company). Additionally, Craig received formal consulting training while working for IBM Global Services.
      • Craig’s deep experience across many aspects of IT from Governance through Delivery makes him an ideal partner for Info-Tech members.

      Bibliography

      Offshore, Onshore or Hybrid–Choosing the Best IT Outsourcing Model. (n.d.).
      Offshore Dedicated Development Team – A Compelling Hiring Guide. (n.d.).
      The Three Non-Negotiables Of IT Offshoring. (n.d.). Forbes.
      Top Ten Countries For Offshoring. Forbes, 2004.
      Nearshoring in Europe: Choose the Best Country for IT Outsourcing - The World Financial Review. (n.d.).
      Select an Offshore Jurisdiction. The Best Countries for Business in 2021-2022! | InternationalWealth.info. (n.d.).
      How to Find the Best Country to Set Up an Offshore Company. (n.d.). biz30.
      Akbar, M. A., Alsanad, A., Mahmood, S., & Alothaim, A. (2021). Prioritization-based taxonomy of global software development challenges: A FAHP based analysis. IEEE Access, 9, 37961–37974
      Ali, S. (2018). Practices in Software Outsourcing Partnership: Systematic Literature Review Protocol with Analysis. Journal of Computers, (February), 839–861
      Baird Georgia, A. (2007). MISQ Research Curation on Health Information Technology 2. Progression of Health IT Research in MIS Quarterly. MIS Quarterly, 2007(June), 1–14.
      Akbar, M. A., Alsanad, A., Mahmood, S., & Alothaim, A. (2021). Prioritization-based taxonomy of global software development challenges: A FAHP based analysis. IEEE Access, 9, 37961–37974
      Ali, S. (2018). Practices in Software Outsourcing Partnership: Systematic Literature Review Protocol with Analysis. Journal of Computers, (February), 839–861
      Baird Georgia, A. (2007). MISQ Research Curation on Health Information Technology 2. Progression of Health IT Research in MIS Quarterly. MIS Quarterly, 2007(June), 1–14.
      Carmel, E., & Abbott, P. (2006). Configurations of global software development: offshore versus nearshore. … on Global Software Development for the Practitioner, 3–7.
      Hanafizadeh, P., & Zare Ravasan, A. (2018). A model for selecting IT outsourcing strategy: the case of e-banking channels. Journal of Global Information Technology Management, 21(2), 111–138.
      Ishizaka, A., Bhattacharya, A., Gunasekaran, A., Dekkers, R., & Pereira, V. (2019). Outsourcing and offshoring decision making. International Journal of Production Research, 57(13), 4187–4193.
      Jeong, J. J. (2021). Success in IT offshoring: Does it depend on the location or the company? Arxiv.
      Joanna Minkiewicz, J. E. (2009). Deakin Research Online Online. 2007, Interrelationships between Innovation and Market Orientation in SMEs, Management Research News, Vol. 30, No. 12, Pp. 878-891., 30(12), 878–891.

      Bibliography

      King, W. R., & Torkzadeh, G. (2016). Special Issue Information Systems Offshoring : Research Status and Issues. MIS Quarterly, 32(2), 205–225.
      Kotlarsky, J., & Oshri, I. (2008). Country attractiveness for offshoring and offshore outsourcing: Additional considerations. Journal of Information Technology, 23(4), 228–231.
      Lehdonvirta, V., Kässi, O., Hjorth, I., Barnard, H., & Graham, M. (2019). The Global Platform Economy: A New Offshoring Institution Enabling Emerging-Economy Microproviders. Journal of Management, 45(2), 567–599.
      Mahajan, A. (2018). Risks and Benefits of Using Single Supplier in Software Development. Oulu University of Applied Sciences. Retrieved from
      Murberg, D. (2019). IT Offshore Outsourcing: Best Practices for U.S.-Based Companies. University of Oregon Applied Information Management, 1277(800), 824–2714.
      Nassimbeni, G., Sartor, M., & Dus, D. (2012). Security risks in service offshoring and outsourcing. Industrial Management and Data Systems, 112(3), 405–440.
      Olson, G. M., & Olson, J. S. (2000). Distance matters. Human-Computer Interaction, 15(2–3), 139–178.
      Pilkova, A., & Holienka, M. (2018). Home-Based Business in Visegrad Countries: Gem Perspective. Innovation Management, Entrepreneurship and Sustainability 2018 Proceedings of the 6th International Conference.
      Rahman, H. U., Raza, M., Afsar, P., Alharbi, A., Ahmad, S., & Alyami, H. (2021). Multi-criteria decision making model for application maintenance offshoring using analytic hierarchy process. Applied Sciences (Switzerland), 11(18).
      Rahman, H. U., Raza, M., Afsar, P., Khan, H. U., & Nazir, S. (2020). Analyzing factors that influence offshore outsourcing decision of application maintenance. IEEE Access, 8, 183913–183926.
      Roadmunk. What is a product roadmap? Roadmunk, n.d. Accessed 12 Oct. 2021.
      Rottman, J. W., & Lacity, M. C. (2006). Proven practices for effectively offshoring IT work. MIT Sloan Management Review.
      Smite, D., Moe, N. B., Krekling, T., & Stray, V. (2019). Offshore Outsourcing Costs: Known or Still Hidden? Proceedings - 2019 ACM/IEEE 14th International Conference on Global Software Engineering, ICGSE 2019, 40–47.
      Welsum, D. Van, & Reif, X. (2005). Potential Offshoring: Evidence from Selected OECD Countries. Brookings Trade Forum, 2005(1), 165–194.
      Zhang, Y., Liu, S., Tan, J., Jiang, G., & Zhu, Q. (2018). Effects of risks on the performance of business process outsourcing projects: The moderating roles of knowledge management capabilities. International Journal of Project Management, 36(4), 627–639.

      2020 Applications Priorities Report

      • Buy Link or Shortcode: {j2store}159|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Optimization
      • Parent Category Link: /optimization
      • Although IT may have time to look at trends, it does not have the capacity to analyze the trends and turn them into initiatives.
      • IT does not have time to parse trends for initiatives that are relevant to them.
      • The business complains that if IT does not pursue trends the organization will get left behind by cutting-edge competitors. At the same time, when IT pursues trends, the business feels that IT is unable to deal with the basic issues.

      Our Advice

      Critical Insight

      • Take advantage of a trend by first understanding why it is happening and how it is actionable. Build momentum now. Breaking a trend into bite-sized initiatives and building them into your IT foundations enables the organization to maintain pace with competitors and make the technological leap.
      • The concepts of shadow IT and governance are critical. As it becomes easier for the business to purchase its own applications, it will be essential for IT to embrace this form of user empowerment. With a diminished focus on vendor selection, IT will drive the most value by directing its energy toward data and integration governance.

      Impact and Result

      • Determine how to explore, adopt, and optimize the technology and practice initiatives in this report by understanding which core objective(s) each initiative serves:
        • Optimize the effectiveness of the IT organization.
        • Boost the productivity of the enterprise.
        • Enable business growth through technology.

      2020 Applications Priorities Report Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief for a summary of the priorities and themes that an IT organization should focus on this year.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Read the 2020 Applications Priorities Report

      Use Info-Tech's 2020 Applications Priorities Report to learn about the five initiatives that IT should prioritize for the coming year.

      • 2020 Applications Priorities Report Storyboard
      [infographic]

      Integrate Physical Security and Information Security

      • Buy Link or Shortcode: {j2store}383|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Security Processes & Operations
      • Parent Category Link: /security-processes-and-operations

      Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Integrating physical and information security introduces challenges in:

      • Understanding the value proposition of investment in governing and managing integrated systems, including migration costs, compared to separated security systems.
      • Addressing complex risks and vulnerabilities of an integrated security system.
      • Operationalizing enhanced capabilities created by adoption of emerging and disruptive technologies.

      Our Advice

      Critical Insight

      • Integrate security in people, process, and technology to improve your overall security posture. Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.
      • Plan and engage stakeholders. Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.
      • Enhance strategy and risk management. Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.

      Impact and Result

      Info-Tech's approach is a modular, incremental, and repeatable process to integrate physical and information security to:

      • Ensure the integration will meet the business' needs and determine effort and technical requirements.
      • Establish GRC processes that include integrated risk management and compliance.
      • Design and deploy an integrated security architecture.
      • Establish security metrics of effectiveness and efficiency for senior management and leadership.

      Integrate Physical Security and Information Security Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Integrate Physical Security and Information Security Storyboard – A step-by-step document that walks you through how to integrate physical security and information security.

      Info-Tech provides a three-phased framework for integrating physical security and information security: Plan, Enhance, and Monitor & Optimize.

      • Integrate Physical Security and Information Security Storyboard

      2. Integrate Physical Security and Information Security Requirements Gathering Tool – A tool to map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals.

      This tool serves as a repository for information about security integration elements, compliance, and other factors that will influence your integration of physical security and information security.

      • Integrate Physical Security and Information Security Requirements Gathering Tool

      3. Integrate Physical Security and Information Security RACI Chart Tool – A tool to identify and understand the owners of various security integration stakeholders across the organization.

      Populating a RACI chart (Responsible, Accountable, Consulted, and Informed) is a critical step that will assist you in organizing roles for carrying out integration steps. Complete this tool to assign tasks to suitable roles.

      • Integrate Physical Security and Information Security RACI Chart Tool

      4. Integrate Physical Security and Information Security Communication Deck – A tool to present your findings in a prepopulated document that summarizes the work you have completed.

      Complete this template to effectively communicate your integrated security plan to stakeholders.

      • Integrate Physical Security and Information Security Communication Deck
      [infographic]

      Further reading

      Integrate Physical Security and Information Security

      Securing information security, physical security, or personnel security in silos may not secure much

      Analyst Perspective

      Ensure integrated security success with close and continual collaboration

      From physical access control systems (PACS) such as electronic locks and fingerprint biometrics to video surveillance systems (VSS) such as IP cameras to perimeter intrusion detection and prevention to fire and life safety and beyond: physical security systems pose unique challenges to overall security. Additionally, digital transformation of physical security to the cloud and the convergence of operational technology (OT), internet of things (IoT), and industrial IoT (IIoT) increase both the volume and frequency of security threats.

      These threats can be safety, such as the health impact when a gunfire attack downed wastewater pumps at Duke Energy Substation, North Carolina, US, in 2022. The threats can also be economic, such as theft of copper wire, or they can be reliability, such as when a sniper attack on Pacific Gas & Electric’s Metcalf Substation in California, US, damaged 17 out of 21 power transformers in 2013.

      Considering the security risks organizations face, many are unifying physical, cyber, and information security systems to gain the long-term overall benefits a consolidated security strategy provides.

      Ida Siahaan
      Ida Siahaan

      Research Director, Security and Privacy Practice
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Physical security is often managed by facilities, not by IT security, resulting in segmented security systems. Meanwhile, integrating physical and information security introduces challenges in:

      • Value proposition of investment in governing and managing integrated systems including the migration costs compared to separated security systems.
      • Addressing complex risks and vulnerabilities of an integrated security system.
      • Operationalizing on enhanced capabilities created by adoption of emerging and disruptive technologies.

      Common Obstacles

      Physical security systems integration is complex due to various components such as proprietary devices and protocols and hybrid systems of analog and digital technology. Thus, open architecture with comprehensive planning and design is important.

      However, territorial protection by existing IT and physical security managers may limit security visibility and hinder security integration.

      Additionally, integration poses challenges in staffing, training and awareness programs, and dependency on third-party technologies and their migration plans.

      Info-Tech's Approach

      Info-Tech’s approach is a modular, incremental, and repeatable process to integrate physical and information security that enables organizations to:

      • Determine effort and technical requirements to ensure the integration will meet the business needs.
      • Establish GRC processes including integrated risk management and compliance.
      • Design and deploy integrated security architecture.
      • Establish metrics to monitor the effectiveness and efficiency of the security program.

      Info-Tech Insight

      An integrated security architecture, including people, process, and technology, will improve your overall security posture. These benefits are leading many organizations to consolidate their siloed systems into a single platform across physical security, cybersecurity, HR, legal, and compliance.

      Existing information security models are not comprehensive

      Current security models do not cover all areas of security, especially if physical systems and personnel are involved and safety is also an important property required.

      • The CIA triad (confidentiality, integrity, availability) is a well-known information security model that focuses on technical policies related to technology for protecting information assets.
      • The US Government’s Five Pillars of Information Assurance includes CIA, authentication, and non-repudiation, but it does not cover people and processes comprehensively.
      • The AAA model, created by the American Accounting Association, has properties of authentication, authorization, and accounting but focuses only on access control.
      • Donn Parker expanded the CIA model with three more properties: possession, authenticity, and utility. This model, which includes people and processes, is known as the Parkerian hexad. However, it does not cover physical and personnel security.

      CIA Triad

      The CIA Triad for Information Security: Confidentiality, Integrity, Availability


      Parkerian Hexad

      The Parkerian Hexad for Security: Confidentiality, Possession, Utility, Availability, Authenticity and Integrity

      Sources: Parker, 1998; Pender-Bey, 2012; Cherdantseva and Hilton, 2015

      Adopt an integrated security model

      Adopt an integrated security model which consists of information security, physical security, personnel security, and organizational security.

      The security ecosystem is shifting from segregation to integration

      Security ecosystem is shifting from the past proprietary model to open interfaces and future open architecture

      Sources: Cisco, n.d.; Preparing for Technology Convergence in Manufacturing, Info-Tech Research Group, 2018

      Physical security includes:

      • Securing physical access,
        e.g. facility access control, alarms, surveillance cameras
      • Securing physical operations
        (operational technology – OT), e.g. programmable logic controllers (PLCs), SCADA

      Info-Tech Insight

      Why is integrating physical and information security gaining more and more traction? Because the supporting technologies are becoming more matured. This includes, for example, migration of physical security devices to IP-based network and open architecture.

      Reactive responses to physical security incidents

      April 1995

      Target: Alfred P. Murrah Federal Building, Oklahoma, US. Method: Bombing. Impact: Destroyed structure of 17 federal agencies, 168 casualties, over 800 injuries. Result: Creation of Interagency Security Committee (ISC) in Executive Order 12977 and “Vulnerability Assessment of Federal Facilities” standard.
      (Source: Office of Research Services, 2017)

      April 2013

      Target: Pacific Gas & Electric’s Metcalf Substation, California, US. Method: Sniper attack. Impact: Out of 21 power transformers, 17 were damaged. Result: Creation of Senate Bill No. 699 and NERC- CIP-014 standard.
      (Source: T&D World, 2023)

      Sep. 2022

      Target: Nord Stream gas pipelines connecting Russia to Germany, Baltic sea. Method: Detonations. Impact: Methane leaks (~300,000 tons) at four exclusive economic zones (two in Denmark and two in Sweden). Result: Sweden’s Security Service investigation.
      (Source: CNBC News, 2022)

      Dec. 2022

      Target: Duke Energy Substation, North Carolina, US. Method: Gunfire. Impact: Power outages of ~40,000 customers and wastewater pumps in sewer lift stations down. Result: State of emergency was declared.
      (Source: CBS News, 2022)

      Info-Tech Insight

      When it comes to physical security, we have been mostly reactive. Typically the pattern starts with physical attacks. Next, the impacted organization mitigates the incidents. Finally, new government regulatory measures or private sector or professional association standards are put in place. We must strive to change our pattern to become more proactive.

      Physical security market forecast and top physical security challenges

      Physical security market forecast
      (in billions USD)

      A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.

      A forecast by MarketsandMarkets projected growth in the physical security market, using historical data from 2015 until 2019, with a CAGR of 6.4% globally and 5.2% in North America.

      Source: MarketsandMarkets, 2022

      Top physical security challenges

      An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.

      An Ontic survey (N=359) found that threat data management (40%) was the top physical security challenge in 2022, up from 33% in 2021, followed by physical security threats to the C-suite and company leadership (35%), which was a slight increase from 2021. An interesting decrease is data protection and privacy (32%), which dropped from 36% in 2021.

      Source: Ontic Center for Protective Intelligence, 2022

      Info-Tech Insight

      The physical security market is growing in systems and services, especially the integration of threat data management with cybersecurity.

      Top physical security initiatives and operations integration investments

      We know the physical security challenges and how the physical security market is growing, but what initiatives are driving this growth? These are the top physical security initiatives and top investments for physical security operations integration:

      Top physical security initiatives

      The number one physical security initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration

      A survey by Brivo asked 700 security professionals about their top physical security initiatives. The number one initiative is integrating physical security systems. Other initiatives with similar concerns included data and cross-functional integration.

      Source: Brivo, 2022

      Top investments for physical security operations integration

      The number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.

      An Ontic survey (N=359) on areas of investment for physical security operations integration shows the number one investment is on access control systems with software to identify physical threat actors. Another area with similar concern is integration of digital physical security with cybersecurity.

      Source: Ontic Center for Protective Intelligence, 2022

      Evaluate security integration opportunities with these guiding principles

      Opportunity focus

      • Identify the security integration problems to solve with visible improvement possibilities
      • Don’t choose technology for technology’s sake
      • Keep an eye to the future
      • Use strategic foresight

      Piece by piece

      • Avoid taking a big bang approach
      • Test technologies in multiple conditions
      • Run inexpensive pilots
      • Increase flexibility
      • Build a technology ecosystem

      Buy-in

      • Collaborate with stakeholders
      • Gain and sustain support
      • Maintain transparency
      • Increase uptake of open architecture

      Key Recommendations:

      Focus on your master plan

      Build a technology ecosystem

      Engage stakeholders

      Info-Tech Insight

      When looking for a quick win, consider learning the best internal or external practice. For example, in 1994 IBM reorganized its security operation by bringing security professionals and non-security professionals in one single structure, which reduced costs by approximately 30% in two years.

      Sources: Create and Implement an IoT Strategy, Info-Tech Research Group, 2022; Baker and Benny, 2013; Erich Krueger, Omaha Public Power District (contributor); Doery Abdou, March Networks Corporate (contributor)

      Case Study

      4Wall Entertainment – Asset Owner

      Industry: Architecture & Engineering
      Source: Interview

      4Wall Entertainment is quite mature in integrating its physical and information security; physical security has always been under IT as a core competency.

      4Wall Entertainment is a provider of entertainment lighting and equipment to event venues, production companies, lighting designers, and others, with a presence in 18 US and UK locations.

      After many acquisitions, 4Wall Entertainment needed to standardize its various acquired systems, including physical security systems such as access control. In its integrated security approach, IT owns the integrated security, but they interface with related entities such as HR, finance, and facilities management in every location. This allows them to obtain information such as holidays, office hours, and what doors need to be accessed as inputs to the security system and to get sponsorship in budgeting.

      In the past, 4Wall Entertainment tried delegating specific physical security to other divisions, such as facilities management and HR. This approach was unsuccessful, so IT took back the responsibility and accountability.

      Currently, 4Wall Entertainment works with local vendors, and its biggest challenge is finding third-party vendors that can provide nationwide support.

      In the future, 4Wall Entertainment envisions physical security modernization such as camera systems that allow more network accessibility, with one central system to manage and IoT device integration with SIEM and MDR.

      Results

      Lessons learned in integrating security from 4Wall Entertainment include:

      • Start with forming relationships with related divisions such as HR, finance, and facilities management to build trust and encourage sponsorship across management.
      • Create policies, procedures, and standards to deploy in various systems, especially when acquiring companies with low maturity in security.
      • Select third-party providers that offer the required functionalities, good customer support, and standard systems interoperability.
      • Close skill gaps by developing training and awareness programs for users, especially for newly acquired systems and legacy systems, or by acquiring expertise from consulting services.
      • Complete cost-benefit analysis for solutions on legacy systems to determine whether to keep them and create interfacing with other systems, upgrade them, or replace them entirely with newer systems.
      • Delegate maintenance of specific highly regulated systems, such as fire alarms and water sprinklers, to facilities management.
      Integration of Physical and Information Security Framework. Inputs: Integrated Items, Stakeholders, and Security Components. Phases, Outcomes and Benefits: Plan, Enhance and Monitor & Optimize.

      Tracking progress of physical and information security integration

      Physical security is often part of facilities management. As a result, there are interdependencies with both internal departments (such as IT, information security, and facilities) and external parties (such as third-party vendors). IT leaders, security leaders, and operational leaders should keep the big picture in mind when designing and implementing integration of physical and information security. Use this checklist as a tool to track your security integration journey.

      Plan

      • Engage stakeholders and justify value for the business.
      • Define roles and responsibilities.
      • Establish/update governance for integrated security.
      • Identify integrated elements and compliance obligations.

      Enhance

      • Determine the level of security maturity and update security strategy for integrated security.
      • Assess and treat risks of integrated security.
      • Establish/update integrated physical and information security policies and procedures.
      • Update incident response, disaster recovery, and business continuity plan.

      Monitor & Optimize

      • Identify skill requirements and close skill gaps for integrating physical and information security.
      • Design and deploy integrated security architecture and controls.
      • Establish, monitor, and report integrated security metrics on effectiveness and efficiency.

      Benefits of the security integration framework

      Today’s matured technology makes security integration possible. However, the governance and management of single integrated security presents challenges. These can be overcome using a multi-phased framework that enables a modular, incremental, and repeatable integration process, starting with planning to justify the value of investment, then enhancing the integrated security based on risks and open architecture. This is followed by using metrics for monitoring and optimization.

      1. Modular

        • Implementing a consolidated security strategy is complex and involves the integration of process, software, data, hardware, and network and infrastructure.
        • A modular framework will help to drive value while putting in appropriate guardrails.
      2. Incremental

        • Integration of physical security and information security involves many components such as security strategy, risk management, and security policies.
        • An incremental framework will help track, manage, and maintain each step while providing appropriate structure.
      3. Repeatable

        • Integration of physical security and information security is a journey that can be approached with a pilot program to evaluate effectiveness.
        • A repeatable framework will help to ensure quick time to value and enable immediate implementation of controls to meet operational and security requirements.

      Potential risks of the security integration framework

      Just as medicine often comes with side effects, our Integration of Physical and Information Security Framework may introduce risks too. However, as John F. Kennedy, thirty-fifth president of the United States, once said, "There are risks and costs to a program of action — but they are far less than the long-range cost of comfortable inaction."

      Plan Phase

      • Lack of transparency in the integration process can lead to lack of trust among stakeholders.
      • Lack of support from leadership results in unclear governance or lack of budget or human resources.
      • Key stakeholders leave the organization during the engagement and their replacements do not understand the organization’s operation yet.

      Enhance Phase

      • The risk assessment conducted focuses too much on IT risk, which may not always be applicable to physical security systems nor OT systems.
      • The integrated security does not comply with policies and regulations.

      Monitor and Optimize Phase

      • Lack of knowledge, training, and awareness.
      • Different testing versus production environments.
      • Lack of collected or shared security metrics.

      Data

      • Data quality issues and inadequate data from physical security, information security, and other systems, e.g. OT, IoT.
      • Too much data from too many tools are complex and time consuming to process.

      Develop an integration of information security, physical security, and personnel security that meets your organization’s needs

      Integrate security in people, process, and technology to improve your overall security posture

      Having siloed systems running security is not beneficial. Many organizations are realizing the benefits of consolidating into a single platform across physical security, cybersecurity, HR, legal, and compliance.

      Plan and engage stakeholders

      Assemble the right team to ensure the success of your integrated security ecosystem, decide the governance model, and clearly define the roles and responsibilities.

      Enhance strategy and risk management

      Strategically, we want a physical security system that is interoperable with most technologies, flexible with minimal customization, functional, and integrated, despite the challenges of proprietary configurations, complex customization, and silos.

      Monitor and optimize

      Find the most optimized architecture that is strategic, realistic, and based on risk. Next, perform an evaluation of the security systems and program by understanding what, where, when, and how to measure and to report the relevant metrics.

      Focus on master plan

      Identify the security integration problems to solve with visible improvement possibilities, and don’t choose technology for technology’s sake. Design first, then conduct market research by comparing products or services from vendors or manufacturers.

      Build a technology ecosystem

      Avoid a big bang approach and test technologies in multiple conditions. Run inexpensive pilots and increase flexibility to build a technology ecosystem.

      Deliverables

      Each step of this framework is accompanied by supporting deliverables to help you accomplish your goals:

      Integrate Physical Security and Information Security Requirements Gathering Tool

      Map organizational goals to IT goals, facilities goals, OT goals (if applicable), and integrated security goals. Identify your security integration elements and compliance.

      Integrate Physical Security and Information Security RACI Chart Tool

      Identify various security integration stakeholders across the organization and assign tasks to suitable roles.

      Key deliverable:

      Integrate Physical Security and Information Security Communication Deck

      Present your findings in a prepopulated document that summarizes the work you have completed.

      Plan

      Planning is foundational to engage stakeholders. Start with justifying the value of investment, then define roles and responsibilities, update governance, and finally identify integrated elements and compliance obligations.

      Plan

      Engage stakeholders

      • To initiate communication between the physical and information security teams and other related divisions, it is important to identify the entities that would be affected by the security integration and involve them in the process to gain support from planning to delivery and maintenance.
      • Possible stakeholders:
        • Executive leadership, Facilities Management leader and team, IT leader, Security & Privacy leader, compliance officer, Legal, Risk Management, HR, Finance, OT leader (if applicable)
      • A successful security integration depends on aligning your security integration initiatives and migration plan to the organization’s objectives by engaging the right people to communicate and collaborate.

      Info-Tech Insight

      It is important to speak the same language. Physical security concerns safety and availability, while information security concerns confidentiality and integrity. Thus, the two systems have different goals and require alignment.

      Similarly, taxonomy of terminologies needs to be managed,1 e.g. facility management with an emergency management background may have a different understanding from a CISO with an information security background when discussing the same term. For example:

      In emergency management prevention means “actions taken to eliminate the impact of disasters in order to protect lives, property and the environment, and to avoid economic disruption.”2

      In information security prevention is “preventing the threats by understanding the threat environment and the attack surfaces, the risks, the assets, and by maintaining a secure system.”3

      Sources: 1 Owen Yardley, Omaha Public Power District (contributor); 2 Translation Bureau, Government of Canada, n.d.; 3 Security Intelligence, 2020


      Map organizational goals to integrated security goals

      Input

      • Corporate, IT, and Facilities strategies

      Output

      • Your goals for the integrated security strategy

      Materials

      • Integrate Physical Security and Information Security Requirements Gathering Tool

      Participants

      • Executive leadership
      • Facilities Management leader and team
      • IT leader
      • Security & Privacy leader
      • Compliance officer
      • Legal
      • Risk Management
      • HR & Finance
      • OT leader (if applicable)
      1. As a group, brainstorm organization goals.
        • Review relevant corporate, IT, and facilities strategies.
      2. Record the most important business goals in the “Goals Cascade” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool. Try to limit the number of business goals to no more than ten goals. This limitation will be critical to helping focus on your integrated security goals.
      3. For each goal, identify one to two security alignment goals. These should be objectives for the security strategy that will support the identified organization goals.

      Download the Integrate Physical Security and Information Security Requirements Gathering Tool.

      Record organizational goals

      A table to identify Organization, IT, OT(if applicable), Facilities, and Security Goals Definitions.

      Refer to the Integration of Physical and Information Security Framework when filling in the table.

      1. Record your identified organizational goals in the “Goals Cascade” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
      2. For each organizational goal, identify IT alignment goals.
      3. For each organizational goal, identify OT alignment goals (if applicable).
      4. For each organizational goal, identify Facilities alignment goals.
      5. For each organizational goal, select an integrated security goal from the drop-down menu.

      Justify value for the business

      Facilities in most cases have a team that is responsible for physical security installations such as access key controllers. Whenever there is an issue, they contact the provider to fix the error. However, with smart buildings and smart devices, the threat surface grows to include information security threats, and Facilities may not possess the knowledge and skills required to deal with them. At the same time, delegating physical security to IT may add more tasks to their already-too-long list of responsibilities. Consolidating security to a focused security team that covers both physical and information security can help.1 We need to develop the security integration business case beyond physical security "gates, guns, and guards" mentality.2

      An example of a cost-benefit analysis for security integration:

      Benefits

      Metrics

      Operational Efficiency and Cost Savings

      • Reduction in deployment, maintenance, and staff time in manual operations of physical security devices such as logs collection from analog cameras to be automated into digital.
      • Reduction in staffing costs by bringing physical security SOC and information security SOC in one single structure.

      Reliability Improvements

      • Reduction in field crew time by identifying hardware that can be virtualized to have a centralized remote control.
      • Improvement of operating reliability through continuous and real-time monitoring of equipment such as door access control systems and camera surveillance systems.

      Customers & Users Benefits

      • Improvement of customer safety for essential services such as access to critical locations only by authorized personnel.
      • Improvement of reliability of services and address human factor in adoption of change by introducing change as a friendly activity.

      Cost

      Metrics

      Equipment and Infrastructure

      • Upgrade of existing physical security equipment, e.g. replacement of separated access control, video management system (VMS), and physical access control system (PACS) with a unified security platform.
      • Implementation of communication network equipment and labor to install, configure, and maintain the new network component.

      Software and Commission

      • The software and maintenance fee as well as upgrade implementation project cost.
      • Labor cost of field commissioning and troubleshooting.
      • Integration with security systems, e.g. event and log management, continuous monitoring, and investigation.

      Support and Resources

      • Cost to hire/outsource security FTEs for ongoing management and operation of security devices, e.g. SOC, MSSP.
      • Cost to hire/outsource FTEs to analyze, design, and deploy the integrated security architecture, e.g. consulting fee.

      Sources: 1 Andrew Amaro, KLAVAN Security Services (contributor); 2 Baker and Benny, 2013;
      Industrial Control System Modernization, Info-Tech Research Group, 2023; Lawrence Berkeley National Laboratory, 2021

      Plan

      Define roles and responsibilities

      Input

      • List of relevant stakeholders

      Output

      • Roles and responsibilities for the integration of physical and information security program

      Materials

      • Integrate Physical Security and Information Security RACI Chart Tool

      Participants

      • Executive leadership
      • Facilities Management leader and team
      • HR & Finance
      • IT leader and team
      • OT leader and team
      • Security & Privacy leader and team

      Many factors impact an organization’s level of effectiveness as it relates to integration of physical and information security. How the team interacts, what skill sets exist, the level of clarity around roles and responsibilities, and the degree of executive support and alignment are only a few. Thus, we need to identify stakeholders that are:

      • Responsible: The person(s) who does the work to accomplish the activity; they have been tasked with completing the activity and/or getting a decision made.
      • Accountable: The person(s) who is accountable for the completion of the activity. Ideally, this is a single person and is often an executive or program sponsor.
      • Consulted: The person(s) who provides information. This is usually several people, typically called subject matter experts (SMEs).
      • Informed: The person(s) who is updated on progress. These are resources that are affected by the outcome of the activities and need to be kept up to date.

      Download the Integrate Physical Security and Information Security RACI Chart Tool

      Define RACI chart

      Define Responsible, Accountable, Consulted, Informed (RACI) stakeholders.

      1. Customize the Work Units to best reflect your operation with applicable stakeholders.
      2. Customize the Action rows as required.

      Integrate Physical Security and Information Security RACI Chart

      Sources: ISC, 2015; ISC, 2021

      Info-Tech Insight

      The roles and responsibilities should be clearly defined. For example, IT Security should be responsible for the installation and configuration of all physical access controllers and devices, and facility managers should be responsible for the physical maintenance including malfunctioning such as access device jammed or physically broken.

      Plan

      Establish/update governance for integrated security

      HR & Finance

      HR provides information such as new hires and office hours as input to the security system. Finance assists in budgeting.

      Security & Privacy

      The security and privacy team will need to evaluate solutions and enforce standards on various physical and information security systems and to protect data privacy.

      Business Leaders

      Business stakeholders will provide clarity for their strategy and provide input into how they envision security furthering those goals.

      IT Executives

      IT stakeholders will be a driving force, ensuring all necessary resources are available and funded.

      Facilities/ Operations

      Operational plans will include asset management, monitoring, and support to meet functional goals and manage throughout the asset lifecycle.

      Infrastructure & Enterprise Architects

      Each solution added to the environment will need to be chosen and architected to meet business goals and security functions.

      Info-Tech Insight

      Assemble the right team to ensure the success of your integrated security ecosystem and decide the governance model, e.g. security steering committee (SSC) or a centralized single structure.

      Adapted from Create and Implement an IoT Strategy, Info-Tech Research Group, 2022

      What does the SSC do?

      Ensuring proper governance over your security program is a complex task that requires ongoing care and feeding from executive management to succeed.

      Your SSC should aim to provide the following core governance functions for your security program:

      1. Define Clarity of Intent and Direction

        How does the organization’s security strategy support the attainment of the business, IT, facilities management, and physical and information security strategies? The SSC should clearly define and communicate strategic linkage and provide direction for aligning security initiatives with desired outcomes.
      2. Establish Clear Lines of Authority

        Security programs contain many important elements that need to be coordinated. There must be clear and unambiguous authority, accountability, and responsibility defined for each element so lines of reporting/escalation are clear and conflicting objectives can be mediated.
      3. Provide Unbiased Oversight

        The SSC should vet the organization’s systematic monitoring processes to ensure there is adherence to defined risk tolerance levels and that monitoring is appropriately independent from the personnel responsible for implementing and managing the security program.
      4. Optimize Security Value Delivery

        Optimized value delivery occurs when strategic objectives for security are achieved and the organization’s acceptable risk posture is attained at the lowest possible cost. This requires constant attention to ensure controls are commensurate with any changes in risk level or appetite.

      Adapted from Improve Security Governance With a Security Steering Committee , Info-Tech Research Group, 2018

      Plan

      Identify integrated elements and compliance obligations

      To determine what elements need to be integrated, it’s important to scope the security integration program and to identify the consequences of integration for compliance obligations.

      INTEGRATED ELEMENTS

      What are my concerns?

      Process integrations

      Determine which processes need to be integrated and how

      • Examples: Security prevention, detection, and response; risk assessment

      Software and data integration

      Determine which software and data need to be integrated and how

      • Examples: Threat management tools, SIEM, IDPS, security event logs

      Hardware integration

      Determine which hardware needs to be integrated and how

      • Examples: Sensors, alarms, cameras, keys, locks, combinations, and card readers

      Network and infrastructure

      Determine which network and infrastructure components need to be integrated and how

      • Example: Network segmentation for physical access controllers.

      COMPLIANCE

      How can I address my concerns?

      Regulations

      Adhere to mandatory laws, directives, industry standards, specific contractual obligations, etc.

      • Examples: NERC CIP (North American Utilities), Network and Information Security (NIS) Directive (EU), Health and Safety at Work etc Act 1974 (UK), Occupational Safety and Health Act, 1970 (US), Emergency Management Act, 2007 (Canada)

      Standards

      Adhere to voluntary standards and obligations

      • Examples: NIST Cybersecurity Framework (CSF), The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard (US), Cybersecurity Maturity Model Certification (CMMC), Service Organization Control (SOC 1 and 2)

      Guidelines

      Adopt guidelines that can improve the integrated security program

      • Examples: Best Practices for Planning and Managing Physical Security Resources (US Interagency Security Committee), Information Security Manual - Guidelines for Physical Security (Australian Cyber Security Centre), 1402-2021-Guide for Physical Security of Electric Power Substations (IEEE)

      Record integrated elements

      Scope and Boundaries from the Integrate Physical Security and Information Security Requirements Gathering Tool.

      Refer to the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool when filling in the following elements.

      1. Record your integrated elements, i.e. process integration, software and data integration, hardware integration, network and infrastructure, and physical scope of your security integration, in the “Scope” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.
      2. For each of your scoping give the rationale for including them in the Comments column. Careful attention should be paid to any elements that are not in scope.

      Record your compliance obligations

      Refer to the “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.

      1. Identify your compliance obligations. These can include both mandatory and voluntary obligations. Mandatory obligations include:
        • Laws
        • Government regulations
        • Industry standards
        • Contractual agreements
        Voluntary obligations include standards that the organization has chosen to follow for best practices and any obligations that are required to maintain certifications. Organizations will have many different compliance obligations. For the purposes of your integrated security, include those that include physical security requirements.
      2. Record your compliance obligations, along with any notes, in your copy of the Integrate Physical Security and Information Security Requirements Gathering Tool.
      3. Refer to the “Compliance DB” tab for lists of standards/regulations/ guidelines.
      The “Compliance Obligations” tab of the Integrate Physical Security and Information Security Requirements Gathering Tool.

      Remediate third-party compliance gaps

      If you have third-party compliance gaps, there are four primary ways to eliminate them:

      1. Find a New, Compliant Partner

        Terminate existing contract and find another organization to partner with.
      2. Bring the Capability In-House

        Expense permitting, this may be the best way to protect yourself.
      3. Demand Compliance

        Tell the third party they must become compliant. Make sure you set a deadline.
      4. Accept Noncompliance and Assume the Risk

        Sometimes remediation just isn’t cost effective and you have no choice.

      Follow Contracting Best Practices to Mitigate the Risk of Future Third-Party Compliance Gaps

      1. Perform Initial Due Diligence: Request proof of third-party compliance prior to entering into a contract.
      2. Perform Ongoing Due Diligence: Request proof of third-party contractor compliance annually.
      3. Contract Negotiation: Insert clauses requesting periodic assertions of compliance.

      View a sample contract provided by the US Department of Health and Human Services.

      Source: Take Control of Compliance Improvement to Conquer Every Audit, Info-Tech Research Group, 2015

      Pitfalls to avoid when planning security integration

      • No Resources Lineups

        Integration of security needs support from leadership, proper planning, and clear and consistent communication across the organization.
      • Not Addressing Holistic Security

        Create policies and procedures and follow standards that are holistic and based on threats and risks, e.g. consolidated access control policies.
      • Lack of Governance

        While the IT department is a critical partner in cybersecurity, the ownership of such a role sits squarely in the organizational C-suite, with regular reporting to the board of directors (if applicable).
      • Overlooking Business Continuity Effort

        IT and physical security are integral to business continuity and disaster recovery strategies.
      • Not Having Relevant Training and Awareness

        Provide a training and awareness program based on relevant attack vectors. Trained employees are key assets to the development of a safe and secure environment. They must form the base of your security culture.
      • Overbuilding or Underbuilding

        Select third-party providers that offer systems interoperability with other security tools. The intent is to promote a unified approach to security to avoid a cumbersome tooling zoo.

      Sources: Real Time Networks, 2022; Andrew Amaro, KLAVAN Security Services (contributor)

      Enhance

      Enhancing is the development of an integrated security strategy, policies, procedures, BCP, DR, and IR based on the organization’s risks.

      Enhance

      Determine the level of security maturity and update the security strategy

      • Before updating your security strategies, you need to understand the organization’s business strategies, IT strategies, facilities strategies, and physical and information security strategies. The goal is to align your integrated security strategies to contribute to your organization’s success.
      • The integrated security leaders need to understand the direction of the organization. For example:
        • Growth expectation
        • Expansions or mergers anticipation
        • Product or service changes
        • Regulatory requirements
      • Wise security investments depend on aligning your security initiatives to the organization’s objectives by supporting operational performance and ensuring brand protection and shareholder values.
      Integrated security strategies. Consists of an organization’s business strategies, IT strategies, facilities strategies, and physical and information security strategies.

      Sources: Amy L. Meger, Platte River Power Authority (contributor); Baker and Benny, 2013; IFSEC Global, 2023; Security Priorities 2023, Info-Tech Research Group, 2023; Build an Information Security Strategy, Info-Tech Research Group, 2020; ISC, n.d.

      Understanding security maturity

      Maturity models are very effective for determining security states. This table provides examples of general descriptions for physical and information security maturity levels.

      Determine which framework is suitable and select the description that most accurately reflects the ideal state for security in your organization.

      Level 1

      Level 2

      Level 3

      Level 4

      Level 5

      Minimum security with simple physical barriers. Low-level security to prevent and detect some unauthorized external activity. Medium security to prevent, detect, and assess most unauthorized external activity and some unauthorized internal activity. High-level security to prevent, detect, and assess most unauthorized external and internal activity. Maximum security to prevent, detect, assess, and neutralize all unauthorized external and internal activity.

      Physical security maturity level1

      Initial/Ad hoc security programs are reactive. Developing security programs can be effective at what they do but are not holistic. A defined security program is holistic, documented, and proactive. Managed security programs have robust governance and metrics processes. An optimized security program is based on strong risk management practices, including the production of key risk indicators (KRIs).

      Information security maturity level2

      Sources: 1 Fennelly, 2013; 2 Build an Information Security Strategy, Info-Tech Research Group, 2020

      Enhance

      Assess and treat integrated security risks

      The risk assessment conducted consists of analyzing existing inherent risks, existing pressure to the risks such as health and safety laws and codes of practice, new risks from the integration process, risk tolerance, and countermeasures.

      • Some organizations already integrate security into corporate security that consists of risk management, compliance, governance, information security, personnel security, and physical security. However, some organizations are still separating security components, especially physical security and information security, which limits security visibility and the organization’s ability to complete a comprehensive risks assessment.
      • Many vendors are also segregating physical security and information security solutions because their tools do well only on certain aspects. This forces organizations to combine multiple tools, creating a complex environment.
      • Additionally, risks related to people such as mental health issues must be addressed properly. The prevalence of hybrid work post-pandemic makes this aspect especially important.
      • Assess and treat risks based on the organization’s requirements, including its environments. For example, the US federal facility security organization is required to conduct risk assessments at least every five years for Level I (lowest risk) and Level II facilities and at least every three years for Level III, IV, and V (highest risk) facilities.

      Sources: EPA, n.d.; America's Water Infrastructure Act (AWIA), 2018; ISC, 2021

      “In 2022, 95% of US companies are consolidating into a single platform across physical security, cybersecurity, HR, legal and compliance.”

      Source: Ontic Center for Protective Intelligence, 2022; N=359

      Example risk levels

      The risk assessment conducted is based on a combination of physical and information security factors such as certain facilities factors. The risk level can be used to determine the baseline level of protection (LOP). Next, the baseline LOP is customized to the achievable LOP. The following is an example for federal facilities determined by Interagency Security Committee (ISC).

      Risk factor, points and score. Facility security level (FSL), level of risk, and baseline level of protection.

      Source: ISC, 2021

      Example assets

      It is important to identify the organization’s requirements, including its environments (IT, IoT, OT, facilities, etc.), and to measure and evaluate its risks and threats using an appropriate risk framework and tools with the critical step of identifying assets prior to acquiring solutions.

      Organizational requirements including its environments(IT, loT, OT, facilities, etc.)

      Info-Tech Insight

      Certain exceptions must be identified in risk assessment. Usually physical barriers such as gates and intrusion detection sensors are considered as countermeasures,1 however, under certain assessment, e.g. America's Water Infrastructure Act (AWIA),2 physical barriers are also considered assets and as such must also be assessed.

      Compromising a fingerprint scanner

      An anecdotal example of why physical security alone is not sufficient.

      Biometrics: secure access and data security.

      Image by Rawpixel.com on Freepik

      Lessons learned from using fingerprints for authentication:

      • Fingerprint scanners can be physically circumvented by making a copy an authorized user’s fingerprint with 3D printing or even by forcefully amputating an authorized user’s finger.
      • Authorized users may not be given access when the fingerprint cannot be recognized, e.g. if the finger is covered by bandage due to injury.
      • Integration with information security may help detect unauthorized access, e.g. a fingerprint being scanned in a Canadian office when the same user was scanned at a close time interval from an IP in Europe will trigger an alert of a possible incident.

      Info-Tech Insight

      In an ideal world, we want a physical security system that is interoperable with all technologies, flexible with minimal customization, functional, and integrated. In the real world, we may have physical systems with proprietary configurations that are not easily customized and siloed.

      Source: Robert Dang, Info-Tech Research Group

      Use case: Microchip implant

      Microchip implants can be used instead of physical devices such as key cards for digital identity and access management. Risks can be assessed using quantitative or qualitative approaches. In this use case a qualitative approach is applied to impact and likelihood, and a quantitative approach is applied to revenue and cost.

      Asset: Microchip implant

      Benefits

      Impact

      • Improve user satisfaction by removing the need to carry key cards, IDs, etc.
      • Improve operating reliability by reducing the likelihood of losing physical devices such as key cards.
      • Improve reliability of services through continuous and real-time connection with other systems such as payment system.

      Likelihood

      • Improve user satisfaction: High
      • Improve operating reliability: High
      • Improve reliability of services: High

      Revenue

      • Acquire new customers or retain existing customers by making daily lives easier with no need to carry key cards, IDs, etc.
      • Cost reduction in staffing of security personnel, e.g. reducing the staffing of building guards or receptionist.

      Risks

      Impact

      • Security: issues such as biohacking of wearable technology and interconnected devices.
      • Safety: issues such as infections or reactions in the body's immune system.
      • Privacy: issues such as unauthorized surveillance and tracking of activities.

      Likelihood

      • Biohacking: Medium
      • Infections: Low
      • Surveillance: High

      Cost

      • Installation costs and hardware costs.
      • Overall lifecycle cost including estimated software and maintenance costs.
      • Estimated cost of training and estimated increase in productivity.

      Sources: Business Insider, 2018; BBC News, 2022; ISC, 2015

      Enhance

      Update integrated security policies and procedures

      Global policies with local implementation

      This model works for corporate groups with a parent company. In this model, global security policies are developed by a parent company and local policies are applied to the unique business that is not supported by the parent company.

      Update of existing security policies

      This model works for organizations with sufficient resources. In this model, integrated security policies are derived from various policies. For example, physical security in smart buildings/devices (sensors, automated meters, HVAC, etc.) and OT systems (SCADA, PLCs, RTUs, etc.) introduce unique risk exposures, necessitating updates to security policies.

      Customization of information security policies

      This model works for smaller organizations with limited resources. In this model, integrated security policies are derived from information security policies. The issue is when these policies are not applicable to physical security systems or other environments, e.g. OT systems.

      Sources: Kris Krishan, Waymo (contributor); Isabelle Hertanto, Info-Tech Research Group (contributor); Physical and Environmental Security Policy Template, Info-Tech Research Group, 2022.

      Enhance

      Update BCP, DR, IR

      • Physical threats such as theft of material, vandalism, loitering, and the like are also part of business continuity threats.
      • These threats can be carried out by various means such as vehicles breaching perimeter security, bolt cutters used for cutting wire and cable, and ballistic attack.
      • Issues may occur when security operations are owned separately by physical security or information security, thus lacking consistent application of best practices.
      • To overcome this issue, organizations need to update BCP, DR, and IR holistically based on a cost-benefit analysis and the level of security maturity, which can be defined based on the suitable framework.

      Sources: IEEE, 2021; ISC, 2021

      “The best way to get management excited about a disaster plan is to burn down the building across the street.”

      Source: Dan Erwin, Security Officer, Dow Chemical Co., in Computerworld, 2022

      Optimize

      Optimizing means working to make the most effective and efficient use of resources, starting with identifying skill requirements and closing skill gaps, followed by designing and deploying integrated security architecture and controls, and finally monitoring and reporting integrated security metrics.

      Optimize

      Identify skill requirements and close skill gaps

      • The pandemic changed how people work and where they choose to work, and most people still want a hybrid work model. Our survey in July 2022 (N=516) found that 55.8% of employees have the option to work offsite 2-3 days per week, 21.0% can work offsite 1 day per week, and 17.8% can work offsite 4 days per week.
      • The investment (e.g. on infrastructure and networks) to initiate remote work was huge, and the costs didn’t end there; organizations needed to maintain the secure remote work infrastructure to facilitate the hybrid work model.
      • Moreover, roles are evolving due to convergence and modernization. These new roles require an integrative skill set. For example, the grid security and ops team might consist of an IT security specialist, a SCADA technician/engineer, and an OT/IIOT security specialist, where OT/IIOT security specialist is a new role.
      Identify skill gaps that hinder the successful execution of the hybrid work security strategy. Use the identified skill gaps to define the technical skill requirements for current and future work roles. Conduct a skills assessment on your current workforce to identify employee skill gaps. Decide whether to train (including certification), hire, contract, or outsource to close each skill gap.

      Strategic investment in internal security team

      Internal security governance and management using in-house developed tools or off-the-shelf solutions, e.g. security information and event management (SIEM).

      Security management using third parties

      Internal security management using third-party security services, e.g. managed security service providers (MSSPs).

      Outsourcing security management

      Outsourcing the entire security functions, e.g. using managed detection and response (MDR).

      Sources: Info-Tech Research Group’s Security Priorities 2023, Close the InfoSec Skills Gap, Build an IT Employee Engagement Program, and Grid Modernization

      Select the right certifications

      What are the options?

      • One issue in security certification is the complexity of relevancy in topics with respect to roles and levels.
      • The European Union Agency for Cybersecurity (ENISA) takes the approach of analyzing existing certifications of ICS/SCADA professionals' cybersecurity skills by orientation, scope, and supporting bodies that are grouped into specific certifications, relevant certifications, and safety certifications (ENISA, 2015).
      • This approach can also be applied to integrated security certifications.

      Physical security certification

      • Examples: Industrial Security Professional Certification (NCMS-ISP); Physical Security Professional (ASIS-PSP); Physical Security Certification (CDSE-PSC); ISC I-100, I-200, I-300, and I-400

      Cyber physical system security certification

      • Examples: Certified SCADA Security Architect (CSSA), EC-Council ICS/SCADA Cybersecurity Training Course

      Information security certification

      • Examples: Network and Information Security (NIS) Driving License, ISA/IEC 62443 Cybersecurity Certificate Program, GIAC Global Industrial Cyber Security Professional (GICSP)

      Safety Certifications

      • Examples: Board of Certified Safety Professionals (BCSP), European Network of Safety and Health Professional Organizations (ENSHPO)
      Table showing options for Certification orientation, scope and supporting bodies.

      Optimize

      Design and deploy integrated security architecture and controls

      • A survey by Brivo found that 38% of respondents have partly centralized security platforms, 25% have decentralized platforms, and 36% have centralized platforms (Brivo, 2022; N=700).
      • If your organization’s security program is still decentralized or partly centralized and your organization is planning to establish an integrated security program, then the recommendation is to perform a holistic risk assessment based on probability and impact assessments on threats and vulnerabilities.
      • The impacted factors, for example, are customers served, criticality of services, equipment present inside the building, personnel response time for operational recovery and the mitigation of hazards, and costs.
      • Frameworks such as Sherwood Applied Business Security Architecture (SABSA), Control Objectives for Information and Related Technologies (COBIT), and The Open Group Architecture Framework (TOGAF) can be used to build security architecture that aligns security goals with business goals.
      • Finally, analyze the security design against the design criteria.

      Sources: ISA and Honeywell Integrated Security Technology Lab, n.d.; IEEE, 2021

      “As long as organizations treat their physical and cyber domains as separate, there is little hope of securing either one.”

      Source: FedTech magazine, 2009

      Analyze architecture design

      Cloud, on-premises, or hybrid? During the pandemic, many enterprises were under tight deadlines to migrate to the cloud. Many did not refactor data and applications correctly for cloud platforms during migration, with the consequence of high cloud bills. This happened because the migrated applications cannot take advantage of on-premises capabilities such as autoscaling. Thus, in 2023, it is plausible that enterprises will bring applications and data back on-premises.

      Below is an example of a security design analysis of platform architecture. Design can be assessed using quantitative or qualitative approaches. In this example, a qualitative approach is applied using high-level advantages and disadvantages.

      Design criteria

      Cloud

      Hybrid

      On-premises

      Effort

      Consumer effort is within a range, e.g. < 60%

      Consumer effort is within a range e.g. < 80%

      100% organization

      Reliability

      High reliability

      High reliability

      Medium reliability that depends on data centers

      Cost

      High cost when data and applications are not correctly designed for cloud

      Optimized cost when data and applications are correctly designed either for cloud or native

      Medium cost when data and applications take advantage of on-prem capabilities

      Info-Tech Insight

      It is important for organizations to find the most optimized architecture to support them, for example, a hybrid architecture of cloud and on-premises based on operations and cost-effectiveness. To help design a security architecture that is strategic, realistic, and based on risk, see Info-Tech’s Identify the Components of Your Cloud Security Architecture research.

      Sources: InfoWorld, 2023; Identify the Components of Your Cloud Security Architecture , Info-Tech Research Group, 2021

      Analyze equipment design

      Below is an example case of a security design analysis of electronic security systems. Design can be assessed using quantitative or qualitative approaches. In this example a qualitative approach is applied using advantages and disadvantages.

      Surveillance design criteria

      Video camera

      Motion detector

      Theft of security system equipment

      Higher economic loss Lower economic loss

      Reliability

      Positive detection of intrusion Spurious indication and lower reliability

      Energy savings and bandwidth

      Only record when motion is detected Detect and process all movement

      Info-Tech Insight

      Once the design has been analyzed, the next step is to conduct market research to analyze the solutions landscape, e.g. to compare products or services from vendors or manufacturers.

      Sources: IEEE, 202; IEC, n.d.; IEC, 2013

      Analyze off-the-shelf solutions

      Criteria to consider when comparing solutions:

      Criteria to consider when comparing solutions: 1 - Visibility and asset management. 2 - Threat detection, mitigation and response. 3 - Risk assessment and vulnerability management. 4 - Usability, architecture, Cost.

      Visibility and Asset Management

      Passively monitoring data using various protocol layers, actively sending queries to devices, or parsing configuration files of physical security devices, OT, IoT, and IT environments on assets, processes, and connectivity paths.

      Threat Detection, Mitigation, and Response (+ Hunting)

      Automation of threat analysis (signature-based, specification-based, anomaly-based, flow-based, content-based, sandboxing) not only in IT but also in relevant environments, e.g. physical, IoT, IIoT, and OT on assets, data, network, and orchestration with threat intelligence sharing and analytics.

      Risk Assessment and Vulnerability Management

      Risk scoring approach (qualitative, quantitative) based on variables such as behavioral patterns and geolocation. Patching and vulnerability management.

      Usability, Architecture, Cost

      The user and administrative experience, multiple deployment options, extensive integration capabilities, and affordability.

      Source: Secure IT/OT Convergence, Info-Tech Research Group, 2022

      Optimize

      Establish, monitor, and report integrated security metrics

      Security metrics serve various functions in a security program.1 For example:

      • As audit requirements. For integrated security, the requirements are derived from mandatory or voluntary compliance, e.g. NERC CIP.
      • As an indicator of maturity level. For integrated security, maturity level is used to measure the state of security, e.g. C2M2, CMMC.
      • As a measurement of effectiveness and efficiency. Security metrics consist of operational metrics, financial metrics, etc.

      Safety

      Physical security interfaces with the physical world. Thus, metrics based on risks related to safety are crucial. These metrics motivate personnel by making clear why they should care about security.
      Source: EPRI, 2017

      Business Performance

      The impact of security on the business can be measured with various metrics such as operational metrics, service level agreements (SLAs), and financial metrics.
      Source: BMC, 2022

      Technology Performance

      Early detection leads to faster remediation and less damage. Metrics such as maximum tolerable downtime (MTD) and mean time to recovery (MTR) indicate system reliability.
      Source: Dark Reading, 2022

      Security Culture

      Measure the overall quality of security culture with indicators such as compliance and audit, vulnerability management, and training and awareness.

      Info-Tech Insight

      Security failure can be avoided by evaluating the security systems and program. Security evaluation requires understanding what, where, when, and how to measure and to report the relevant metrics.

      Related Info-Tech Research

      Secure IT/OT Convergence

      The previously entirely separate OT ecosystem is migrating into the IT ecosystem, primarily to improve access via connectivity and to leverage other standard IT capabilities for economic benefit.

      Hence, IT and OT need to collaborate, starting with communication to build trust and to overcome their differences and followed by negotiation on components such as governance and management, security controls on OT environments, compliance with regulations and standards, and establishing metrics for OT security.

      Preparing for Technology Convergence in Manufacturing

      Information technology (IT) and operational technology (OT) teams have a long history of misalignment and poor communication.

      Stakeholder expectations and technology convergence create the need to leave the past behind and build a culture of collaboration.

      Build an Information Security Strategy

      Info-Tech has developed a highly effective approach to building an information security strategy – an approach that has been successfully tested and refined for over seven years with hundreds of organizations.

      This unique approach includes tools for ensuring alignment with business objectives, assessing organizational risk and stakeholder expectations, enabling a comprehensive current-state assessment, prioritizing initiatives, and building a security roadmap.

      Bibliography

      "1402-2021 - IEEE Guide for Physical Security of Electric Power Substations." IEEE, 2021. Accessed 25 Jan. 2023.

      "2022 State of Protective Intelligence Report." Ontic Center for Protective Intelligence, 2022. Accessed 16 Jan. 2023.

      "8 Staggering Statistics: Physical Security Technology Adoption." Brivo, 2022. Accessed 5 Jan. 2023.

      "America's Water Infrastructure Act of 2018." The United States' Congress, 2018. Accessed 19 Jan. 2023.

      Baker, Paul and Daniel Benny. The Complete Guide to Physical Security. Auerbach Publications. 2013

      Bennett, Steve. "Physical Security Statistics 2022 - Everything You Need to Know." WebinarCare, 4 Dec. 2022. Accessed 30 Dec. 2022.

      "Best Practices for Planning and Managing Physical Security Resources: An Interagency Security Committee Guide." Interagency Security Committee (ISC), Dec. 2015. Accessed 23 Jan. 2023.

      Black, Daniel. "Improve Security Governance With a Security Steering Committee." Info-Tech Research Group, 23 Nov. 2018. Accessed 30 Jan. 2023.

      Borg, Scott. "Don't Put Up Walls Between Your Security People." FedTech Magazine, 17 Feb. 2009. Accessed 15 Dec. 2022.

      Burwash, John. “Preparing for Technology Convergence in Manufacturing.” Info-Tech Research Group, 12 Dec. 2018. Accessed 7 Dec. 2022.

      Carney, John. "Why Integrate Physical and Logical Security?" Cisco. Accessed 19 Jan. 2023.

      "Certification of Cyber Security Skills of ICS/SCADA Professionals." European Union Agency for Cybersecurity (ENISA), 2015. Accessed 27 Sep. 2022.

      Cherdantseva, Yulia and Jeremy Hilton. "Information Security and Information Assurance. The Discussion about the Meaning, Scope and Goals." Organizational, Legal, and Technological Dimensions of IS Administrator, Almeida F., Portela, I. (eds.), pp. 1204-1235. IGI Global Publishing, 2013.

      Cobb, Michael. "Physical security." TechTarget. Accessed 8 Dec. 2022.

      “Conduct a Drinking Water or Wastewater Utility Risk Assessment.” United States Environmental Protection Agency (EPA), n.d. Web.

      Conrad, Sandi. "Create and Implement an IoT Strategy." Info-Tech Research Group, 28 July 2022. Accessed 7 Dec. 2022.

      Cooksley, Mark. "The IEC 62443 Series of Standards: A Product Manufacturer's Perspective." YouTube, uploaded by Plainly Explained, 27 Apr. 2021. Accessed 26 Aug. 2022.

      "Cyber and physical security must validate their value in 2023." IFSEC Global, 12 Jan. 2023. Accessed 20 Jan. 2023.

      "Cybersecurity Evaluation Tool (CSET®)." Cybersecurity and Infrastructure Security Agency (CISA). Accessed 23 Jan. 2023.

      "Cybersecurity Maturity Model Certification (CMMC) 2.0." The United States' Department of Defense (DOD), 2021. Accessed 29 Dec. 2022.

      “Cyber Security Metrics for the Electric Sector: Volume 3.” Electric Power Research Institute (EPRI), 2017.

      Czachor, Emily. "Mass power outage in North Carolina caused by gunfire, repairs could take days." CBS News, 5 Dec. 2022. Accessed 20 Jan. 2023.

      Dang, Robert, et al. “Secure IT/OT Convergence.” Info-Tech Research Group, 9 Dec. 2022. Web.

      "Emergency Management Act (S.C. 2007, c. 15)." The Government of Canada, 2007. Accessed 19 Jan. 2023.

      "Emergency management vocabulary." Translation Bureau, Government of Canada. Accessed 19 Jan. 2023.

      Fennelly, Lawrence. Effective physical security. Butterworth-Heinemann, 2013.

      Ghaznavi-Zadeh, Rassoul. "Enterprise Security Architecture - A Top-down Approach." The Information Systems Audit and Control Association (ISACA). Accessed 25 Jan. 2023.

      "Good Practices for Security of Internet of Things." European Union Agency for Cybersecurity (ENISA), 2018. Accessed 27 Sep. 2022.

      "Health and Safety at Work etc Act 1974." The United Kingdom Parliament. Accessed 23 Jan. 2023.

      Hébert, Michel, et al. “Security Priorities 2023.” Info-Tech Research Group, 1 Feb. 2023. Web.

      "History and Initial Formation of Physical Security and the Origin of Authority." Office of Research Services (ORS), National Institutes of Health (NIH). March 3, 2017. Accessed 19 Jan. 2023.

      "IEC 62676-1-1:2013 Video surveillance systems for use in security applications - Part 1-1: System requirements - General." International Electrotechnical Commission (IEC), 2013. Accessed 9 Dec. 2022.

      "Incident Command System (ICS)." ICS Canada. Accessed 17 Jan. 2023.

      "Information Security Manual - Guidelines for Physical Security." The Australian Cyber Security Centre (ACSC), Dec. 2022. Accessed 13 Jan. 2023.

      "Integrated Physical Security Framework." Anixter. Accessed 8 Dec. 2022.

      "Integrating Risk and Security within a TOGAF® Enterprise Architecture." TOGAF 10, The Open Group. Accessed 11 Jan. 2023.

      Latham, Katherine. "The microchip implants that let you pay with your hand." BBC News, 11 Apr. 2022. Accessed 12 Jan. 2023.

      Linthicum, David. "2023 could be the year of public cloud repatriation." InfoWorld, 3 Jan. 2023. Accessed 10 Jan. 2023.

      Ma, Alexandra. "Thousands of people in Sweden are embedding microchips under their skin to replace ID cards." Business Insider, 14 May 2018. Accessed 12 Jan. 2023.

      Mendelssohn, Josh and Dana Tessler. "Take Control of Compliance Improvement to Conquer Every Audit." Info-Tech Research Group, 25 March 2015. Accessed 27 Jan. 2023.

      Meredith, Sam. "All you need to know about the Nord Stream gas leaks - and why Europe suspects 'gross sabotage'." CNBC, 11 Oct. 2022. Accessed 20 Jan. 2023.

      Nicaise, Vincent. "EU NIS2 Directive: what’s changing?" Stormshield, 20 Oct. 2022. Accessed 17 Nov. 2022.

      "NIST SP 800-53 Rev. 5 Security and Privacy Controls for Information Systems and Organizations." The National Institute of Standards and Technology (NIST), 13 Jul. 2022. Accessed 27 Jan. 2023.

      "North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) Series." NERC. Accessed 23 Jan. 2023.

      "North America Physical Security Market - Global Forecast to 2026." MarketsandMarkets, June 2021. Accessed 30 Dec. 2022.

      "NSTISSI No. 4011 National Training Standard For Information Systems Security (InfoSec) Professionals." The United States Committee on National Security Systems (CNSS), 20 Jun. 1994. Accessed 23 Jan. 2023.

      "Occupational Safety and Health Administration (OSH) Act of 1970." The United States Department of Labor. Accessed 23 Jan. 2023.

      Palter, Jay. "10 Mistakes Made in Designing a Physical Security Program." Real Time Networks, 7 Sep. 2022. Accessed 6 Jan. 2023.

      Parker, Donn. Fighting Computer Crime. John Wiley & Sons, 1998.

      Pathak, Parag. "What Is Threat Management? Common Challenges and Best Practices." Security Intelligence, 2020. Accessed 5 Jan. 2023.

      Pender-Bey, Georgie. "The Parkerian Hexad." Lewis University, 2012. Accessed 24 Jan. 2023.

      Philippou, Oliver. "2023 Trends to Watch: Physical Security Technologies." Omdia. Accessed 20 Jan. 2023.

      Phinney, Tom. "IEC 62443: Industrial Network and System Security." ISA and Honeywell Integrated Security Technology Lab. Accessed 30 Jan. 2023.

      "Physical Security Market, with COVID-19 Impact Analysis - Global Forecast to 2026." MarketsandMarkets, Jan. 2022. Accessed 30 Dec. 2022.

      "Physical Security Professional (PSP)" ASIS International. Accessed 17 Jan. 2023.

      "Physical Security Systems (PSS) Assessment Guide" The United States' Department of Energy (DOE), Dec. 2016. Accessed 23 Jan. 2023.

      "Policies, Standards, Best Practices, Guidance, and White Papers." Interagency Security Committee (ISC). Accessed 23 Jan. 2023.

      "Profiles, Add-ons and Specifications." ONVIF. Accessed 9 Dec. 2022.

      "Protective Security Policy Framework (PSPF)." The Australian Attorney-General's Department (AGD). Accessed 13 Jan. 2023.

      "Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.

      ""Satellites detect methane plume in Nord Stream leak." The European Space Agency (ESA), 6 oct. 2022. Accessed 23 Jan. 2023.

      Satgunananthan, Niru. "Challenges in Security Convergence?" LinkedIn, 8 Jan. 2022. Accessed 20 Dec. 2022.

      Sooknanan, Shastri and Isaac Kinsella. "Identify the Components of Your Cloud Security Architecture." Info-Tech Research Group, 12 March 2021. Accessed 26 Jan. 2023.

      "TC 79 Alarm and electronic security systems." International Electrotechnical Commission (IEC), n.d. Accessed 9 Dec. 2022.

      "The Risk Management Process for Federal Facilities: An Interagency Security Committee Standard." Interagency Security Committee (ISC), 2021. Accessed 26 Jan. 2023.

      "The Short Guide to Why Security Programs Can Fail." CyberTalk, 23 Sep. 2021. Accessed 30 Dec. 2022.

      Verton, Dan. "Companies Aim to Build Security Awareness." Computerworld, 27 Nov. 2022. Accessed 26 Jan. 2023.

      "Vulnerability Assessment of Federal Facilities." The United States' Department of Justice, 28 Jun. 1995. Accessed 19 Jan. 2023.

      "What is IEC 61508?" 61508 Association. Accessed 23 Jan. 2023.

      Wolf, Gene. "Better Include Physical Security With Cybersecurity." T&D World 5 Jan. 2023. Accessed 19 Jan. 2023.

      Wood, Kate, and Isaac Kinsella. “Build an Information Security Strategy.” Info-Tech Research Group, 9 Sept. 2020. Web.

      Woolf, Tim, et al. "Benefit-Cost Analysis for Utility-Facing Grid Modernization Investments: Trends, Challenges, and Considerations." Lawrence Berkeley National Laboratory, Feb. 2021. Accessed 15 Nov. 2022.

      "Work Health and Safety Act 2011." The Australian Government. Accessed 13 Jan. 2023.

      Wu, Jing. “Industrial Control System Modernization: Unlock the Value of Automation in Utilities.” Info-Tech Research Group, 6 April 2023. Web.

      Research Contributors and Experts

      Amy L. Meger, IGP

      Information and Cyber Governance Manager
      Platte River Power Authority

      Andrew Amaro

      Chief Security Officer (CSO) & Founder
      KLAVAN Security

      Bilson Perez

      IT Security Manager
      4Wall Entertainment

      Dan Adams

      VP of Information Technology
      4Wall Entertainment

      Doery Abdou

      Senior Manager
      March Networks Corporate

      Erich Krueger

      Manager of Security Engineering
      Omaha Public Power District

      Kris Krishan

      Head of IT
      Waymo

      Owen Yardley

      Director, Facilities Security Preparedness
      Omaha Public Power District

      Establish a Sustainable ESG Reporting Program

      • Buy Link or Shortcode: {j2store}194|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: IT Governance, Risk & Compliance
      • Parent Category Link: /it-governance-risk-and-compliance

      Consistent, high-quality disclosure of ESG practices is the means by which organizations can demonstrate they are acting responsibly and in the best interest of their customers and society. Organizations may struggle with these challenges when implementing an ESG reporting program:

      • Narrowing down ESG efforts to material ESG issues
      • Building a sustainable reporting framework
      • Assessing and solving for data gaps and data quality issues
      • Being aware of the tools and best practices available to support regulatory and performance reporting

      Our Advice

      Critical Insight

      • A tactical approach to ESG reporting will backfire. The reality of climate change and investor emphasis is not going away. For long-term success, organizations need to design an ESG reporting program that is flexible, interoperable, and digital.
      • Implementing a robust reporting program takes time. Start early, remain focused, and make plans to continually improve data quality and collection and performance metrics.
      • The “G” in ESG may not be capturing the limelight under ESG legislation yet, but there are key factors within the governance component that are under the regulatory microscope, including data, cybersecurity, fraud, and diversity and inclusion. Be sure you stay on top of these issues and include performance metrics in your internal and external reporting frameworks.

      Impact and Result

      • Successful organizations recognize that transparent ESG disclosure is necessary for long-term corporate performance.
      • Taking the time up front to design a robust and proactive ESG reporting program will pay off in the long run.
      • Future-proof your ESG reporting program by leveraging new tools, technologies, and software applications.

      Establish a Sustainable ESG Reporting Program Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish a Sustainable ESG Reporting Program Storyboard – A comprehensive framework to define an ESG reporting program that supports your ESG goals and reporting requirements.

      This storyboard provides a three-phased approach to establishing a comprehensive ESG reporting framework to drive sustainable corporate performance. It will help you identify what to report, understand how to implement your reporting program, and review in-house and external software and tooling options.

      • Establish a Sustainable ESG Reporting Program Storyboard

      2. ESG Reporting Workbook – A tool to document decisions, rationale, and implications of key activities to support your ESG reporting program.

      The workbook allows IT and business leaders to document decisions as they work through the steps to establish a comprehensive ESG reporting framework.

      • ESG Reporting Workbook

      3. ESG Reporting Implementation Plan – A tool to document tasks required to deliver and address gaps in your ESG reporting program.

      This planning tool guides IT and business leaders in planning, prioritizing, and addressing gaps to build an ESG reporting program.

      • ESG Reporting Implementation Plan Template

      4. ESG Reporting Presentation Template – A guide to communicate your ESG reporting approach to internal stakeholders.

      Use this template to create a presentation that explains the drivers behind the strategy, communicates metrics, demonstrates gaps and costs, and lays out the timeline for the implementation plan.

      • ESG Reporting Presentation Template

      Infographic

      Workshop: Establish a Sustainable ESG Reporting Program

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Determine Material ESG Factors

      The Purpose

      Determine material ESG factors.

      Key Benefits Achieved

      Learn how to identify your key stakeholders and material ESG risks.

      Activities

      1.1 Create a list of stakeholders and applicable ESG factors.

      1.2 Create a materiality map.

      Outputs

      List of stakeholders and applicable ESG factors

      Materiality map

      2 Define Performance and Reporting Metrics

      The Purpose

      Define performance and reporting metrics.

      Key Benefits Achieved

      Align your ESG strategy with key performance metrics.

      Activities

      2.1 Create a list of SMART metrics.

      2.2 Create a list of reporting obligations.

      Outputs

      SMART metrics

      List of reporting obligations

      3 Assess Data and Implementation Gaps

      The Purpose

      Assess data and implementation gaps.

      Key Benefits Achieved

      Surface data and technology gaps.

      Activities

      3.1 Create a list of high-priority data gaps.

      3.2 Summarize high-level implementation considerations.

      Outputs

      List of high-priority data gaps

      Summary of high-level implementation considerations

      4 Consider Software and Tooling Options

      The Purpose

      Select software and tooling options and develop implementation plan.

      Key Benefits Achieved

      Complete your roadmap and internal communication document.

      Activities

      4.1 Review tooling and technology options.

      4.2 Prepare ESG reporting implementation plan.

      4.3 Prepare the ESG reporting program presentation.

      Outputs

      Selected tooling and technology

      ESG reporting implementation plan

      ESG reporting strategy presentation

      Further reading

      Establish a Sustainable ESG Reporting Program

      Strengthen corporate performance by implementing a holistic and proactive reporting approach.

      Analyst Perspective

      The shift toward stakeholder capitalism cannot be pinned on one thing; rather, it is a convergence of forces that has reshaped attitudes toward the corporation. Investor attention on responsible investing has pushed corporations to give greater weight to the achievement of corporate goals beyond financial performance.

      Reacting to the new investor paradigm and to the wider systemic risk to the financial system of climate change, global regulators have rapidly mobilized toward mandatory climate-related disclosure.

      IT will be instrumental in meeting the immediate regulatory mandate, but their role is much more far-reaching. IT has a role to play at the leadership table shaping strategy and assisting the organization to deliver on purpose-driven goals.

      Delivering high-quality, relevant, and consistent disclosure is the key to unlocking and driving sustainable corporate performance. IT leaders should not underestimate the influence they have in selecting the right technology and data model to support ESG reporting and ultimately support top-line growth.

      Photo of Yaz Palanichamy

      Yaz Palanichamy
      Senior Research Analyst
      Info-Tech Research Group

      Photo of Donna Bales

      Donna Bales
      Principal Research Director
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      Your organization needs to define a ESG reporting strategy that is driven by corporate purpose.

      Climate-related disclosure mandates are imminent; you need to prepare for them by building a sustainable reporting program now.

      There are many technologies available to support your ESG program plans. How do you choose the one that is right for your organization?

      Common Obstacles

      Knowing how to narrow down ESG efforts to material ESG issues for your organization.

      Understanding the key steps to build a sustainable ESG reporting program.

      Assessing and solving for data gaps and data quality issues.

      Being aware of the tools and best practices available to support regulatory and performance reporting.

      Info-Tech’s Approach

      Learn best-practice approaches to develop and adopt an ESG reporting program approach to suit your organization’s unique needs.

      Understand the key features, tooling options, and vendors in the ESG software market.

      Learn through analyst insights, case studies, and software reviews on best-practice approaches and tool options.

      Info-Tech Insight

      Implementing a robust reporting program takes time. Start early, remain focused, and plan to continually improve data quality and collection and performance metrics

      Putting “E,” “S,” and “G” in context

      Corporate sustainability depends on managing ESG factors well

      Environmental, social, and governance are the components of a sustainability framework that is used to understand and measure how an organization impacts or is affected by society as a whole.

      Human activities, particularly fossil fuel burning since the middle of the twentieth century, have increased greenhouse gas concentration, resulting in observable changes to the atmosphere, ocean, cryosphere, and biosphere. The “E” in ESG relates to the positive and negative impacts an organization may have on the environment, such as the energy it takes in and the waste it discharges.

      The “S” in ESG is the most ambiguous component in the framework, as social impact relates not only to risks but also to prosocial behavior. It’s the most difficult to measure but can have significant financial and reputational impact on corporations if material and poorly managed.

      The “G” in ESG is foundational to the realization of “S” and “E.” It encompasses how well an organization integrates these considerations into the business and how well the organization engages with key stakeholders, receives feedback, and is transparent with its intentions.

      A diagram that shows common examples of ESG issues.

      The impact of ESG factors on investment decisions

      Alleviate Investment Risk

      Organizational Reputation: Seventy-four percent of those surveyed were concerned that failing to improve their corporate ESG performance would negatively impact their organization’s branding and overall reputation in the market (Intelex, 2022).

      Ethical Business Compliance: Adherence to well-defined codes of business conduct and implementation of anti-corruption and anti-bribery practices is a great way to distinguish between organizations with good/poor governance intentions.

      Shifting Consumer Preferences: ESG metrics can also largely influence consumer preferences in buying behavior intentions. Research from McKinsey shows that “upward of 70 percent” of consumers surveyed on purchases in multiple industries said they would pay an additional 5 percent for a green product if it met the same performance standards as a nongreen alternative (McKinsey, 2019).

      Responsible Supply Chain Management: The successful alignment of ESG criteria with supply chain operations can lead to several benefits (e.g. producing more sustainable product offerings, maintaining constructive relationships with more sustainability-focused suppliers).

      Environmental Stewardship: The growing climate crisis has forced companies of all sizes to rethink how they plan their corporate environmental sustainability practices.

      Compliance With Regulatory Guidelines: An increasing emphasis on regulations surrounding ESG disclosure rates may result in some institutional investors taking a more proactive stance toward ESG-related initiatives.

      Sustaining Competitive Advantage: Given today’s globalized economy, many businesses are constantly confronted with environmental issues (e.g. water scarcity, air pollution) as well as social problems (e.g. workplace wellness issues). Thus, investment in ESG factors is simply a part of maintaining competitive advantage.

      Leaders increasingly see ESG as a competitive differentiator

      The perceived importance of ESG has dramatically increased from 2020 to 2023

      A diagram that shows the perceived importance of ESG in 2020 and 2023.

      In a survey commissioned by Schneider Electric, researchers categorized the relative importance of ESG planning initiatives for global IT business leaders. ESG was largely identified as a critical factor in sustaining competitive advantage against competitors and maintaining positive investor/public relations.
      Source: S&P Market Intelligence, 2020; N=825 IT decision makers

      “74% of finance leaders say investors increasingly use nonfinancial information in their decision-making.”
      Source: EY, 2020

      Regulatory pressure to report on carbon emission is building globally

      The Evolving Regulatory Landscape

      Canada

      • Canadian Securities Administrators (CSA) NI 51-107 Disclosure of Climate-related Matters

      United States

      • Securities and Exchange Commission (SEC) 33-11042 – The Enhancement and Standardization of Climate-Related Disclosures for Investors
      • SEC 33-11038 Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
      • Nasdaq Board Diversity Rule (5605(f))

      Europe

      • European Commission Sustainable Finance Disclosure Regulation (SFDR)
      • European Commission EU Supply Chain Act
      • The German Supply Chain Act (GSCA)
      • Financial Conduct Authority UK Proposal (DP 21/4) Sustainability Disclosure Requirements and investment labels
      • UK Modern Slavery Act, 2015

      New Zealand

      • The Financial Sector (Climate-related Disclosures and Other Matters) Amendment Act 2021

      Accurate ESG reporting will be critical to meet regulatory requirements

      ESG reporting is the disclosure of environmental, social, and governance (ESG) data via qualitative and quantitative reports.

      It is how organizations make their sustainability commitments and strategies transparent to stakeholders.

      For investors it provides visibility into a company's ESG activities, enabling them to align investments to their values and avoid companies that cause damage to the environment or are offside on social and governance issues.

      Despite the growing practice of ESG reporting, reporting standards and frameworks are still evolving and the regulatory approach for climate-related disclosure is inconsistent across jurisdictions, making it challenging for organizations to develop a robust reporting program.

      “Environmental, social and governance (ESG) commitments are at the core a data problem.”

      Source: EY, 2022

      However, organizations will struggle to meet reporting requirements

      An image that shows 2 charts: How accurately can your organization report on the impact of its ESG Initiatives; and More specifically, if it was required to do so, how accurately could your organization report on its carbon footprint.

      Despite the commitment to support an ESG Initiative, less than a quarter of IT professionals say their organization can accurately report on the impact of its ESG initiatives, and 44% say their reporting on impacts is not accurate.

      Reporting accuracy was even worse for reporting on carbon footprint with 46% saying their organization could not report on its carbon footprint accurately. This despite most IT professionals saying they are working to support environmental mandates.

      Global sustainability rankings based on ESG dimensions

      Global Country Sustainability Ranking Map

      An image of Global Country Sustainability Ranking Map, with a score of 0 to 10.

      Country Sustainability Scores (CSR) as of October 2021
      Scores range from 1 (poor) to 10 (best)
      Source: Robeco, 2021

      ESG Performance Rankings From Select Countries

      Top ESG and sustainability performer

      Finland has ranked consistently as a leading sustainability performer in recent years. Finland's strongest ESG pillar is the environment, and its environmental ranking of 9.63/10 is the highest out of all 150 countries.

      Significant score deteriorations

      Brazil, France, and India are among the countries whose ESG score rankings have deteriorated significantly in the past three years.

      Increasing political tensions and risks as well as aftershock effects of the COVID-19 pandemic (e.g. high inequality and insufficient access to healthcare and education) have severely impacted Brazil’s performance across the governance and social pillars of the ESG framework, ultimately causing its overall ESG score to drop to a CSR value of 5.31.

      Largest gains and losses in ESG scores

      Canada has received worse scores for corruption, political risk, income inequality, and poverty over the past three years.

      Taiwan has seen its rankings improve in terms of overall ESG scores. Government effectiveness, innovation, a strong semiconductor manufacturing market presence, and stronger governance initiatives have been sufficient to compensate for a setback in income and economic inequality.

      Source: Robeco, 2021

      Establish a Sustainable Environmental, Social, and Governance (ESG) Reporting Program

      A diagram of establishing a sustainable ESG reporting program.

      Blueprint benefits

      Business Benefits

      • Clarity on technical and organizational gaps in the organization’s ability to deliver ESG reporting strategy.
      • Transparency on the breadth of the change program, internal capabilities needed, and accountable owners.
      • Reduced likelihood of liability.
      • Improved corporate performance and top-line growth.
      • Confidence that the organization is delivering high-quality, comprehensive ESG disclosure.

      IT Benefits

      • Understanding of IT’s role as strategic enabler for delivering high-quality ESG disclosure and sustainable corporate performance.
      • Transparency on primary data gaps and technology and tools needed to support the ESG reporting strategy.
      • Clear direction of material ESG risks and how to prioritize implementation efforts.
      • Awareness of tool selection options.

      Blueprint deliverables

      Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

      Photo of Executive Presentation.

      Key deliverable: Executive Presentation

      Leverage this presentation deck to improve corporate performance by implementing a holistic and proactive ESG reporting program.

      Photo of Workbook

      Workbook

      As you work through the activities, use this workbook to document decisions and rationale and to sketch your materiality map.

      Photo of Implementation Plan

      Implementation Plan

      Use this implementation plan to address organizational, technology, and tooling gaps.

      Photo of RFP Template

      RFP Template

      Leverage Info-Tech’s RFP Template to source vendors to fill technology gaps.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit
      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

      Guided Implementation
      "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

      Workshop
      "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

      Consulting
      "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks are used throughout all four options.

      Guided Implementation

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is 8 to 12 calls over the course of 4 to 6 months.

      What does a typical GI on this topic look like?

      A diagram that shows Guided Implementation in 3 phases.

      Workshop Overview

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Activities

      Determine Material ESG Factors

      1.1 Review ESG drivers.
      1.2 Identify key stakeholders and what drives their behavior.
      1.3 Discuss materiality frameworks options and select baseline model.
      1.4 Identify material risks and combine and categorize risks.
      1.5 Map material risks on materiality assessment map.

      Define Performance and Reporting Metrics

      2.1 Understand common program metrics for each ESG component.
      2.2 Consider and select program metrics.
      2.3 Discuss ESG risk metrics.
      2.4 Develop SMART metrics.
      2.5 Surface regulatory reporting obligations.

      Assess Data and Implementation Gaps

      3.1 Assess magnitude and prioritize data gaps.
      3.2 Discuss high-level implementation considerations and organizational gaps.

      Software and Tooling Options

      4.1 Review technology options.
      4.2 Brainstorm technology and tooling options and the feasibility of implementing.
      4.3 Prepare implementation plan.
      4.4 Draft ESG reporting program communication.
      4.5 Optional – Review software selection options.

      Next Steps and Wrap-Up (offsite)

      5.1 Complete in-progress deliverables from previous four days.
      5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. Customized list of key stakeholders and material ESG risks
      2. Materiality assessment map

      1. SMART metrics
      2. List of regulatory reporting obligations

      1. High-priority data gaps
      2. High-level implementation considerations

      1. Technology and tooling opportunities
      2. Implementation Plan
      3. ESG Reporting Communication

      1. ESG Reporting Workbook
      2. Implementation Plan

      Contact your account representative for more information.
      workshops@infotech.com
      1-888-670-8889

      Phase 1

      Explore ESG Reporting

      A diagram that shows phase 1 to 3 of establishing ESG reporting program.

      This phase will walk you through the following:

      • Define key stakeholders and material ESG factors.
      • Identify material ESG issues.
      • Develop SMART program metrics.
      • List reporting obligations.
      • Surface high-level data gaps.
      • Record high-level implementation considerations.

      This phase involves the following participants: CIO, CCO, CSO, business leaders, legal, marketing and communications, head of ESG reporting, and any dedicated ESG team members

      Practical steps for ESG disclosure

      Measuring and tracking incremental change among dimensions such as carbon emissions reporting, governance, and diversity, equity, and inclusion (DEI) requires organizations to acquire, analyze, and synthesize data from beyond their internal organizational ecosystems

      A diagram that shows 5 steps of identify, assess, implement, report & communicate, and monitor & improve.

      1.1 Ensure your reporting requirements are comprehensive

      A diagram of reporting lifecycle.

      This section will walk you through some key considerations for establishing your ESG reporting strategy. The first step in this process is to identify the scope of your reporting program.

      Defining the scope of your reporting program

      1. Stakeholder requirements: When developing a reporting program consider all your stakeholder needs as well as how they want to consume the information.
      2. Materiality assessment: Conduct a materiality assessment to identify the material ESG issues most critical to your organization. Organizations will need to report material risks to internal and external stakeholders.
      3. Purpose-driven goals: Your ESG reporting must include metrics to measure performance against your purpose-driven strategy.
      4. Regulatory requirements & industry: Work with your compliance and legal teams to understand which reporting requirements apply. Don’t forget requirements under the “S” and “G” components. Some jurisdictions require DEI reporting, and the Securities and Exchange Commission (SEC) in the US recently announced cybersecurity disclosure of board expertise and management oversight practices.

      Factor 1: Stakeholder requirements

      Work with key stakeholders to determine what to report

      A diagram that shows internal and external stakeholders.

      Evaluate your stakeholder landscape

      Consider each of these areas of the ESG Stakeholder Wheel and identify your stakeholders. Once stakeholders are identified, consider how the ESG factors might be perceived by delving into the ESG factors that matter to each stakeholder and what drives their behavior.

      A diagram of ESG impact, including materiality assessment, interviews, benchmark verses competitors, metrics and trend analysis.

      Determine ESG impact on stakeholders

      Review materiality assessment frameworks for your industry to surface ESG factors for your segment and stakeholder group(s).

      Perform research and analysis of the competition and stakeholder trends, patterns, and behavior

      Support your findings with stakeholder interviews.

      Stakeholders will prioritize ESG differently. Understanding their commitment is a critical success factor.

      Many of your stakeholders care about ESG commitments…

      27%: Support for social and environmental proposals at shareholder meetings of US companies rose to 27% in 2020 (up from 21% in 2017).
      Source: Sustainable Investments Institute, 2020.

      79%: of investors consider ESG risks and opportunities an important factor in investment decision making.
      Source: “Global Investor Survey,” PwC, 2021.

      ...Yet

      33%: of survey respondents cited that a lack of attention or support from senior leadership was one of the major barriers preventing their companies from making any progress on ESG issues.
      Source: “Consumer Intelligence Survey,” PwC, 2021.

      Info-Tech Insight

      To succeed with ESG reporting it is essential to understand who we hold ourselves accountable to and to focus ESG efforts in areas with the optimal balance between people, the planet, and profits

      Activity 1: Define stakeholders

      Input: Internal documentation (e.g. strategy, annual reports), ESG Stakeholder Wheel
      Output: List of key stakeholders and applicable ESG factors
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Head of ESG Reporting, Business leaders

      2 hours

      1. Using the ESG Stakeholder Wheel as a baseline, consider the breadth of your organization’s value chain and write down all your stakeholders.
      2. Discuss what drives their behavior. Be as detailed as you can be. For example, if it’s a consumer, delve into their age group and the factors that may drive their behavior.
      3. List the ESG factors that may be important to each stakeholder.
      4. Write down the communication channels you expect to use to communicate ESG information to this stakeholder group.
      5. Rate the priority of this stakeholder to your organization.
      6. Record this information in ESG Reporting Workbook.
      7. Optional – consider testing the results with a targeted survey.

      Download the ESG Reporting Workbook

      Activity 1: Example

      An example of activity 1 (defining stakeholders)

      Factor 2: Materiality assessments

      Conduct a materiality assessment to inform company strategy and establish targets and metrics for risk and performance reporting

      The concept of materiality as it relates to ESG is the process of gaining different perspectives on ESG issues and risks that may have significant impact (both positive and negative) on or relevance to company performance.

      The objective of a materiality assessment is to identify material ESG issues most critical to your organization by looking at a broad range of social and environmental factors. Its purpose is to narrow strategic focus and enable an organization to assess the impact of financial and non-financial risks aggregately.

      It helps to make the case for ESG action and strategy, assess financial impact, get ahead of long-term risks, and inform communication strategies.

      Organizations can use assessment tools from Sustainalytics or GRI, SASB Standards, or guidance and benchmarking information from industry associations to help assess ESG risks .

      An image of materiality matrix to understand ESG exposure

      Info-Tech Insight

      The materiality assessment informs your risk management approach. Material ESG risks identified should be integrated into your organization’s risk reporting framework.

      Supplement your materiality assessment with stakeholder interviews

      A diagram that shows steps of stakeholder interviews.

      How you communicate the results of your ESG assessment may vary depending on whether you’re communicating to internal or external stakeholders and their communication delivery preferences.

      Using the results from your materiality assessment, narrow down your key stakeholders list. Enhance your strategy for disclosure and performance measurement through direct and indirect stakeholder engagement.

      Decide on the most suitable format to reach out to these stakeholders. Smaller groups lend themselves to interviews and forums, while surveys and questionnaires work well for larger groups.

      Develop relevant questions tailored to your company and the industry and geography you are in.

      Once you receive the results, decide how and when you will communicate them.

      Determine how they will be used to inform your strategy.

      Steps to determine material ESG factors

      Step 1

      Select framework

      A diagram of framework

      Review reporting frameworks and any industry guidance and select a baseline reporting framework to begin your materiality assessment.

      Step 2

      Begin to narrow down

      A diagram of narrowing down stakeholders

      Work with stakeholders to narrow down your list to a shortlist of high-priority material ESG issues.

      Step 3

      Consolidate and group

      A diagram of ESG grouping

      Group ESG issues under ESG components, your company’s strategic goals, or the UN’s Sustainable Development Goals.

      Step 4

      Rate the risks of ESG factors

      A diagram of rating the risks of ESG factors

      Assign an impact and likelihood scale for each risk and assign your risk threshold.

      Step 5

      Map

      A diagram of material map

      Use a material map framework such as GRI or SASB or Info-Tech’s materiality map to visualize your material ESG risks.

      Materiality assessment

      The materiality assessment is a strategic tool used to help identify, refine, and assess the numerous ESG issues in the context of your organization.

      There is no universally accepted approach to materiality assessments. Although the concept of materiality is often embedded within a reporting standard, your approach to conducting the materiality assessment does not need to link to a specific reporting standard. Rather, it can be used as a baseline to develop your own.

      To arrive at the appropriate outcome for your organization, careful consideration is needed to tailor the materiality assessment to meet your organization’s objectives.

      When defining the scope of your materiality assessment consider:

      • Your corporate ESG purpose and sustainability strategy
      • Your audience and what drives their behavior
      • The relevance of the ESG issues to your organization. Do they impact strategy? Increase risk?
      • The boundaries of your materiality assessment (e.g. regions or business departments, supply chains it will cover)
      • Whether you want to assess from a double materiality perspective

      A diagram of framework

      Consider your stakeholders and your industry when selecting your materiality assessment tool – this will ensure you provide relevant disclosure information to the stakeholders that need it.

      Double materiality is an extension of the financial concept of materiality and considers the broader impact of an organization on the world at large – particularly to people and climate.

      Prioritize and categorize

      A diagram of narrowing down stakeholders

      Using internal information (e.g. strategy, surveys) and external information (e.g. competitors, industry best practices), create a longlist of ESG issues.

      Discuss and narrow down the list. Be sure to consider opportunities – not just material risks!

      A diagram of ESG grouping

      Group the issues under ESG components or defined strategic goals for your organization. Another option is to use the UN’s Sustainable Development Goals to categorize.

      Differentiate ESG factors that you already measure and report.

      The benefit of clustering is that it shows related topics and how they may positively or negatively influence one another.

      Internal risk disclosure should not be overlooked

      Bank of America estimates ESG disputes have cost S&P companies more than $600 billion in market capitalization in the last seven years alone.

      ESG risks are good predictors of future risks and are therefore key inputs to ensure long-term corporate success.

      Regardless of the size of your organization, it’s important to build resilience against ESG risks.

      To protect an organization against an ESG incident and potential liability risk, ESG risks should be treated like any other risk type and incorporated into risk management and internal reporting practices, including climate scenario analysis.

      Some regulated entities will be required to meet climate-related financial disclosure expectations, and sound risk management practices will be prescribed through regulatory guidance. However, all organizations should instill sound risk practices.

      ESG risk management done right will help protect against ESG mishaps that can be expensive and damaging while demonstrating commitment to stakeholders that have influence over all corporate performance.

      Source: GreenBiz, 2022.

      A diagram of risk landscape.

      IT has a role to play to provide the underlying data and technology to support good risk decisions.

      Visualize your material risks

      Leverage industry frameworks or use Info-Tech’s materiality map to visualize your material ESG risks.

      GRI’s Materiality Matrix

      A photo of GRI’s Materiality Matrix

      SASB’s Materiality Map

      A photo of SASB’s Materiality Map

      Info-Tech’s Materiality Map

      A diagram of material map

      Activity 2: Materiality assessment

      Input: ESG corporate purpose or any current ESG metrics; Customer satisfaction or employee engagement surveys; Materiality assessment tools from SASB, Sustainalytics, GRI, or industry frameworks; Outputs from stakeholder outreach/surveys
      Output: Materiality map, a list of material ESG issues
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Head of ESG Reporting, Business leaders, Participants from marketing and communications

      2-3 hour

      1. Begin by reviewing various materiality assessment frameworks to agree on a baseline framework. This will help to narrow down a list of topics that are relevant to your company and industry.
      2. As a group, discuss the potential impact and start listing material issues. At first the list will be long, but the group will work collectively to prioritize and consolidate the list.
      3. Begin to combine and categorize the results by aligning them to your ESG purpose and strategic pillars.
      4. Treat each ESG issue as a risk and map against the likelihood and impact of the risk.
      5. Map the topics on your materiality map. Most of the materiality assessment tools have materiality maps – you may choose to use their map.
      6. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      Case Study: Novartis

      Logo of Novartis

      • INDUSTRY: Pharmaceuticals
      • SOURCE: Novartis, 2022

      Novartis, a leading global healthcare company based in Switzerland, stands out as a leader in providing medical consultancy services to address the evolving needs of patients worldwide. As such, its purpose is to use science and technologically innovative solutions to address some of society’s most debilitating, challenging, and ethically significant healthcare issues.

      The application of Novartis’ materiality assessment process in understanding critical ESG topics important to their shareholders, stakeholder groups, and society at large enables the company to better quantify references to its ESG sustainability metrics.

      Novartis applies its materiality assessment process to better understand relevant issues affecting its underlying business operations across its entire value chain. Overall, employing Novartis’s materiality assessment process helps the company to better manage its societal, environmental, and economic impacts, thus engaging in more socially responsible governance practices.

      Novartis’ materiality assessment is a multitiered process that includes three major elements:

      1. Identifying key stakeholders, which involves a holistic analysis of internal colleagues and external stakeholders.
      2. Collecting quantitative feedback and asking relevant stakeholders to rank a set of issues (e.g. climate change governance, workplace culture, occupational health and safety) and rate how well Novartis performs across each of those identified issues.
      3. Eliciting qualitative insights by coordinating interviews and workshops with survey participants to better understand why the issues brought up during survey sessions were perceived as important.

      Results

      In 2021, Novartis had completed its most recent materiality assessment. From this engagement, both internal and external stakeholders had ranked as important eight clusters that Novartis is impacting on from an economic, societal, and environmental standpoint. The top four clusters were patient health and safety, access to healthcare, innovation, and ethical business practices.

      Factor 3: ESG program goals

      Incorporate ESG performance metrics that support your ESG strategy

      Another benefit of the materiality assessment is that it helps to make the case for ESG action and provides key information for developing a purpose-led strategy.

      An internal ESG strategy should drive toward company-specific goals such as green-house gas emission targets, use of carbon neutral technologies, focus on reusable products, or investment in DEI programs.

      Most organizations focus on incremental goals of reducing negative impacts to existing operations or improving the value to existing stakeholders rather than transformative goals.

      Yet, a strategy that is authentic and aligned with key stakeholders and long-term goals will bring sustainable value.

      The strategy must be supported by an accountability and performance measurement framework such as SMART metrics.

      A fulsome reporting strategy should include performance metrics

      A photo of SMART metrics: Specific, Measurable, Actionable, Realistic, Time-bound.

      Activity 3: SMART metrics

      Input: ESG corporate purpose or any current ESG metrics, Outputs from activities 1 and 2, Internally defined metrics (i.e. risk metrics or internal reporting requirements)
      Output: SMART metrics
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Chief Risk officer/Risk leaders, Head of ESG Reporting, Business leaders, Participants from marketing and communications

      1-2 hours

      1. Document a list of appropriate metrics to assess the success of your ESG program.
      2. Use the sample metrics listed in the table on the next slide as a starting point.
      3. Fill in the chart to indicate the:
        1. Name of the success metric
        2. Method for measuring success
        3. Baseline measurement
        4. Target measurement
        5. Actual measurements at various points throughout the process of improving the risk management program
        6. A deadline for each metric to meet the target measurement
      4. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      Sample ESG metrics

      Leverage industry resources to help define applicable metrics

      Environmental

      • Greenhouse gas emissions – total corporate
      • Carbon footprint – percent emitted and trend
      • Percentage of air and water pollution
      • Renewable energy share per facility
      • Percentage of recycled material in a product
      • Ratio of energy saved to actual use
      • Waste creation by weight
      • Circular transition indicators

      Social

      • Rates of injury
      • Lost time incident rate
      • Proportion of spend on local suppliers
      • Entry-level wage vs. local minimum wage
      • Percentage of management who identify with specific identity groups (i.e. gender and ethnic diversity)
      • Percentage of suppliers screened for accordance to ESG vs. total number of suppliers
      • Consumer responsiveness

      Governance

      • Annual CEO compensation compared to median
      • Percentage of employees trained in conflict-of-interest policy
      • Number of data breaches using personally identifiable information (PII)
      • Number of incidents relating to management corruption
      • Percentage of risks with mitigation plans in place

      Activity 3: Develop SMART project metrics

      1-3 hours

      Attach metrics to your goals to gauge the success of the ESG program.

      Sample Metrics

      An image of sample metrics

      Factor 4: Regulatory reporting obligations

      Identify your reporting obligations

      High-level overview of reporting requirements:

      An image of high-level reporting requirements in Canada, the United Kingdom, Europe, and the US.

      Refer to your legal and compliance team for the most up-to-date and comprehensive requirements.

      The focus of regulators is to move to mandatory reporting of material climate-related financial information.

      There is some alignment to the TCFD* framework, but there is a lack of standardization in terms of scope across jurisdictions.
      *TCFD is the Task Force on Climate-Related Financial Disclosures.

      Activity 4: Regulatory obligations

      Input: Corporate strategy documents; Compliance registry or internal governance, risk, and compliance (GRC) tool
      Output: A list of regulatory obligations
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Chief Legal Officer, Head of ESG Reporting, Business leaders

      1-2 hours

      1. Begin by listing the jurisdictions in which you operate or plan to operate.
      2. For each jurisdiction, list any known current or future regulatory requirements. Consider all ESG components.
      3. Log whether the requirements are mandatory or voluntary and the deadline to report.
      4. Write any details about reporting framework; for example, if a reporting framework such as TCFD is prescribed.
      5. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      1.2 Assess impact and weigh options

      A diagram of reporting lifecycle.

      Once the scope of your ESG reporting framework has been identified, further assessment is needed to determine program direction and to understand and respond to organizational impact.

      Key factors for further assessment and decisions include

      1. Reporting framework options. Consider mandated reporting frameworks and any industry standards when deciding your baseline reporting framework. Strive to have a common reporting methodology that serves all your reporting needs: regulatory, corporate, shareholders, risk reporting, etc.
      2. Perform gap analysis. The gap analysis will reveal areas where data may need to be sourced or where tools or external assistance may be needed to help deliver your reporting strategy.
      3. Organizational impact and readiness. The gap analysis will help to determine whether your current operating model can support the reporting program or whether additional resources, tools, or infrastructure will be needed.

      1.2.1 Decide on baseline reporting framework

      1. Determine the appropriate reporting framework for your organization

      Reporting standards are available to enable relevant, high-quality, and comparable information. It’s the job of the reporting entity to decide on the most suitable framework for their organization.

      The most established standard for sustainability reporting is the Global Reporting Initiative (GRI), which has supported sustainability reporting for over 20 years.

      The Task Force on Climate-Related Financial Disclosures (TCFD) was created by the Financial Stability Board to align ESG disclosure with financial reporting. Many global regulators support this framework.

      The International Sustainability Standards Board (ISSB) is developing high-quality, understandable, and enforceable global standards using the Sustainability Accounting Standards Board (SASB) as a baseline. It is good practice to use SASB Standards until the ISSB standards are available.

      2. Decide which rating agencies you will use and why they are important

      ESG ratings are provided by third-party agencies and are increasingly being used for financing and transparency to investors. ESG ratings provide both qualitative and quantitative information.

      However, there are multiple providers, so organizations need to consider which ones are the most important and how many they want to use.

      Some of the most popular rating agencies include Sustainalytics, MSCI, Bloomberg, Moody's, S&P Global, and CDP.

      Reference Appendix Below

      1.2.2 Determine data gaps

      The ESG reporting mandate is built on the assumption of consistent, good-quality data

      To meet ESG objectives, corporations are challenged with collecting non-financial data from across functional business and geographical locations and from their supplier base and supply chains.

      One of the biggest impediments to ESG implementation is the lack of high-quality data and of mature processes and tools to support data collection.

      An important step for delivering reporting requirements is to perform a gap analysis early on to surface gaps in the primary data needed to deliver your reporting strategy.

      The output of this exercise will also inform and help prioritize implementation, as it may show that new data sets need to be sourced or tools purchased to collect and aggregate data.

      Conduct a gap analysis to determine gaps in primary data

      A diagram of gap analysis to determine gaps in primary data.

      Activity 5: Gap analysis

      Input: Business (ESG) strategy, Data inventory (if exists), Output from Activity 1: Key stakeholders, Output from Activity 2: Materiality map, Output of Activity 3: SMART metrics, Output of Activity 4: Regulatory obligations
      Output: List of high-priority data gaps
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Chief Compliance Officer, Chief Legal Officer, Head of ESG Reporting, Business leaders, Data analysts

      1-3 hours

      1. Using the outputs from activities 1-4, list your organization’s ESG issues in order of priority. You may choose to develop your priority list by stakeholder group or by material risks.
      2. List any defined SMART metric from Activity 3.
      3. Evaluate data availability and quality of the data (if existing) as well as any impediments to sourcing the data.
      4. Make note if this is a common datapoint, i.e. would you disclose this data in more than one report?
      5. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      1.3 Take a holistic implementation approach

      Currently, 84 percent of businesses don’t integrate their ESG performance with financial and risk management reporting.

      Source: “2023 Canadian ESG Reporting Insights,” PwC.

      A diagram of reporting lifecycle.

      When implementing an ESG reporting framework, it is important not to implement in silos but to take a strategic approach that considers the evolving nature of ESG and the link to value creation and sound decision making.

      Key implementation considerations include

      1. Setting clear metrics and targets. Key performance indicators (KPIs) and key risk indicators (KRIs) are used to measure ESG factor performance. It’s essential that they are relevant and are constructed using high-quality data. Your performance metrics should be continually assessed and adapted as your ESG program evolves.
      2. Data challenges. Without good-quality data it is impossible to accurately measure ESG performance, generate actionable insights on ESG performance and risk, and provide informative metrics to investors and other stakeholders. Design your data model to be flexible and digital where possible to enable data interoperability.
      3. Architectural approach. IT will play a key role in the design of your reporting framework, including the decision on whether to build, buy, or deliver a hybrid solution. Every organization will build their reporting program to suit their unique needs; however, taking a holistic and proactive approach will support and sustain your strategy long term.

      1.3.1 Metrics and targets for climate-related disclosure

      “The future of sustainability reporting is digital – and tagged.”
      Source: “XBRL Is Coming,” Novisto, 2022.

      In the last few years, global regulators have proposed or effected legislation requiring public companies to disclose climate-related information.

      Yet according to Info-Tech’s 2023 Trends and Priorities survey, most IT professionals expect to support environmental mandates but are not prepared to accurately report on their organization’s carbon footprint.

      IT groups have a critical role to play in helping organizations develop strategic plans to meet ESG goals, measure performance, monitor risks, and deliver on disclosure requirements.

      To future-proof your reporting structure, your data should be readable by humans and machines.

      eXtensible Business Reporting Language (XBRL) tagging is mandated in several jurisdictions for financial reporting, and several reporting frameworks are adopting XBRL for sustainability reporting so that non-financial and financial disclosure frameworks are aligned.

      Example environmental metrics

      • Amount of scope 1, 2, or 3 GHG emissions
      • Total energy consumption
      • Total water consumption
      • Progress toward net zero emission
      • Percentage of recycled material in a product

      1.3.1 Metrics and targets for social disclosure

      “59% of businesses only talk about their positive performance, missing opportunities to build trust with stakeholders through balanced and verifiable ESG reporting.”
      Source: “2023 Canadian ESG Reporting Insights,” PwC.

      To date, regulatory focus has been on climate-related disclosure, although we are beginning to see signals in Europe and the UK that they are turning their attention to social issues.

      Social reporting focuses on the socioeconomic impacts of an organization’s initiatives or activities on society (indirect or direct).

      The “social” component of ESG can be the most difficult to quantify, but if left unmonitored it can leave your organization open to litigation from consumers, employees, and activists.

      Although organizations have been disclosing mandated metrics such as occupational health and safety and non-mandated activities such as community involvement for years, the scope of reporting is typically narrow and hard to measure in financial terms.

      This is now changing with the recognition by companies of the value of social reporting to brand image, traceability, and overall corporate performance.

      Example social metrics

      • Rate of injury
      • Lost time incident rate
      • Proportion of spend on local suppliers
      • Entry-level wage versus local minimum wage
      • Percentage of management within specific identity groups (i.e. gender and ethnic diversity)
      • Number of workers impacted by discrimination

      Case Study: McDonald’s Corporation (MCD)

      Logo of McDonald’s

      • INDUSTRY: Food service retailer
      • SOURCE: RBC Capital Markets, 2021; McDonald’s, 2019

      McDonald’s Corporation is the leading global food service retailer. Its purpose is not only providing burgers to dinner tables around the world but also serving its communities, customers, crew, farmers, franchisees, and suppliers alike. As such, not only is the company committed to having a positive impact on communities and in maintaining the growth and success of the McDonald's system, but it is also committed to conducting its business operations in a way that is mindful of its ESG commitments.

      An image of McDonald’s Better Together

      McDonald’s Better Together: Gender Balance & Diversity strategy and Women in Tech initiative

      In 2019, MCD launched its Better Together: Gender Balance & Diversity strategy as part of a commitment to improving the representation and visibility of women at all levels of the corporate structure by 2023.

      In conjunction with the Better Together strategy, MCD piloted a “Women in Tech” initiative through its education and tuition assistance program, Archways to Opportunity. The initiative enabled women from company-owned restaurants and participating franchisee restaurants to learn skills in areas such as data science, cybersecurity, artificial intelligence. MCD partnered with Microsoft and Colorado Technical University to carry out the initiative (McDonald’s, 2019).

      Both initiatives directly correlate to the “S” of the ESG framework, as the benefits of gender-diverse leadership continue to be paramount in assessing the core strengths of a company’s overreaching ESG portfolio. Hence, public companies will continue to face pressure from investors to act in accordance with these social initiatives.

      Results

      MCD’s Better Together and Women in Tech programs ultimately helped improve recruitment and retention rates among its female employee base. After the initialization of the gender balance and diversification strategy, McDonald’s signed on to the UN Women’s Empowerment Principles to help accelerate global efforts in addressing the gender disparity problem.

      1.3.1 Metrics and targets for governance disclosure

      Do not lose sight of regulatory requirements

      Strong governance is foundational element of a ESG program, yet governance reporting is nascent and is often embedded in umbrella legislation pertaining to a particular risk factor.

      A good example of this is the recent proposal by the Securities and Exchange Commission in the US (CFR Parts 229, 232, 239, 240, and 249, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure), which will require public companies to:

      • Disclosure of board oversight of cyber risk.
      • Disclose management’s role in managing and accessing cybersecurity-related risks.

      The "G” component includes more than traditional governance factors and acts as a catch-all for other important ESG factors such as fraud, cybersecurity, and data hygiene. Make sure you understand how risk may manifest in your organization and put safeguards in place.

      Example governance metrics

      • Annual CEO compensation compared to median
      • Percentage of employees trained in conflict-of-interest policy
      • Completed number of supplier assessments
      • Number of data breaches using PII
      • Number of material cybersecurity breaches

      Info-Tech Insight

      The "G" in ESG may not be capturing the limelight under ESG legislation yet, but there are key governance factors that are that are under regulatory radar, including data, cybersecurity, fraud, and DEI. Be sure you stay on top of these issues and include performance metrics into your internal and external reporting frameworks.

      1.3.2 Conquering data management challenges

      48% of investment decision makers, including 58% of institutional investors, say companies’ self-reported ESG performance data is “much more important” than companies’ conventional financial data when informing their investment decisions (Benchmark ESG, 2021).

      Due to the nascent nature of climate-related reporting, data challenges such as the availability, usability, comparability, and workflow integration surface early in the ESG program journey when sourcing and organizing data:

      • It is challenging to collect non-financial data across functional business and geographical locations and from supplier base and supply chains.
      • The lack of common standards leads to comparability challenges, hindering confidence in the outputs.

      In addition to good, reliable inputs, organizations need to have the infrastructure to access new data sets and convert raw data into actionable insights.

      The establishment of data model and workflow processes to track data lineage is essential to support an ESG program. To be successful, it is critical that flexibility, scalability, and transparency exist in the architectural design. Data architecture must scale to capture rapidly growing volumes of unstructured raw data with the associated file formats.

      A photo of conceptual model for data lineage.

      Download Info-Tech’s Create and Manage Enterprise Data Models blueprint

      1.3.3 Reporting architecture

      CIOs play an important part in formulating the agenda and discourse surrounding baseline ESG reporting initiatives

      Building and operating an ESG program requires the execution of a large number of complex tasks.

      IT leaders have an important role to play in selecting the right technology approach to support a long-term strategy that will sustain and grow corporate performance.

      The decision to buy a vendor solution or build capabilities in-house will largely depend on your organization’s ESG ambitions and the maturity of in-house business and IT capabilities.

      For large, heavily regulated entities an integrated platform for ESG reporting can provide organizations with improved risk management and internal controls.

      Example considerations when deciding to meet ESG reporting obligations in-house

      • Size and type of organization
      • Extent of regulatory requirements and scrutiny
      • The amount of data you want to report
      • Current maturity of data architecture, particularly your ability to scale
      • Current maturity of your risk and control program – how easy is it to enhance current processes?
      • The availability and quality of primary data
      • Data set gaps
      • In-house expertise in data, model risk, and change management
      • Current operating model – is it siloed or integrated?
      • Implementation time
      • Program cost
      • The availability of vendor solutions that may address gaps

      Info-Tech Insight

      Executive leadership should take a more holistic and proactive stance to not only accurately reporting upon baseline corporate financial metrics but also capturing and disclosing relevant ESG performance metrics to drive alternative streams of valuation across their respective organizational environments.

      Activity 6: High-level implementation considerations

      Input: Business (ESG) strategy, Data inventory (if exists), Asset inventory (if exists), Output from Activity 5
      Output: Summary of high-level implementation considerations
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Head of ESG Reporting, Business leaders, Data analysts, Data and IT architect/leaders,

      2-3 hours

      1. Review the implementation considerations on the previous slide to help determine the appropriate technology approach.
      2. For each implementation consideration, describe the current state.
      3. Discuss and draft the implications of reaching the desired future state by listing implications and organizational gaps.
      4. Discuss as a group if there is an obvious implementation approach.
      5. At this point, further analysis may be needed. Form a subcommittee or assign a leader to conduct further analysis.
      6. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      1.3.4 Ensure your implementation team has a high degree of trust and communication

      If external partners are needed, dedicate an internal resource to managing the vendor and partner relationships.

      Communication: Teams must have some type of communication strategy. This can be broken into:

      • Regularity: Having a set time each day to communicate progress and a set day to conduct retrospectives.
      • Ceremonies: Injecting awards and continually emphasizing delivery of value to encourage relationship building and constructive motivation.
      • Escalation: Voicing any concerns and having someone responsible for addressing those concerns.

      Proximity: Distributed teams create complexity as communication can break down. This can be mitigated by:

      • Location: Placing teams in proximity to close the barrier of geographical distance and time zone differences.
      • Inclusion: Making a deliberate attempt to pull remote team members into discussions and ceremonies.
      • Communication tools: Having the right technology (e.g. videoconference) to help bring teams closer together virtually.

      Trust: Members should trust other members are contributing to the project and completing their required tasks on time. Trust can be developed and maintained by:

      • Accountability: Having frequent quality reviews and feedback sessions. As work becomes more transparent, people become more accountable.
      • Role clarity: Having a clear definition of what everyone’s role is.

      1.4 Clear effective communication

      Improving investor transparency is one of the key drivers behind disclosure, so making the data easy to find and consumable is essential

      A diagram of reporting lifecycle.

      Your communication of ESG performance is intricately linked to corporate value creation. When designing your communications strategy, consider:

      • Your message – make it authentic and tell a consistent story.
      • How data will be used to support the narrative.
      • How your ESG program may impact internal and external programs and build a communication strategy that is fit for purpose. Example programs are:
        • Employee recruitment
        • New product rollout
        • New customer campaign
      • The design of the communication and how well it suits the audience. Communications may take the form of campaigns, thought leadership, infographics, etc.
      • The appropriateness of communication channels to your various audiences and the messages you want to convey. For example, social media, direct outreach, shareholder circular, etc.

      1.5 Continually evaluate

      A diagram of reporting lifecycle.

      A recent BDC survey of 121 large companies and public-sector buyers found that 82% require some disclosure from their suppliers on ESG, and that's expected to grow to 92% by 2024.
      Source: BDC, 2023

      ESG's link to corporate performance means that organizations must stay on top of ESG issues that may impact the long-term sustainability of their business.

      ESG components will continue to evolve, and as they do so will stakeholder views. It is important to continually survey your stakeholders to ensure you are optimally managing ESG risks and opportunities.

      To keep ESG on the strategy agenda, we recommend that organizations:

      • Appoint a chief sustainability officer (CSO) with a seat on executive leadership committees.
      • Embed ESG into existing governance and form a tactical ESG working group committee.
      • Ensure ESG risks are integrated into the enterprise risk management program.
      • Continually challenge your ESG strategy.
      • Regularly review risks and opportunities through proactive outreach to stakeholders.

      Download The ESG Imperative and Its Impact on Organizations

      Phase 2

      Streamline Requirements and Tool Selection

      A diagram that shows phase 1 to 3 of establishing ESG reporting program.

      This phase will walk you through the following activities:

      • Assess technology and tooling opportunities.
      • Prepare ESG reporting implementation plan.
      • Write ESG reporting presentation document.

      This phase involves the following participants: CIO, CCO, CSO, EA, IT application and data leaders, procurement, business leaders, marketing and communications, head of ESG reporting, and any dedicated ESG team members

      2.1 Streamline your requirements and tool section

      Spend the time up front to enable success and meet expectations

      Before sourcing any technology, it’s important to have a good understanding of your requirements.

      Key elements to consider:

      1. ESG reporting scope. Large enterprises will have more complex workflow requirements, but they also will have larger teams to potentially manage in-house. Smaller organizations will need easy-to-use, low-cost solutions.
      2. Industry and value chain. Look for industry-specific solutions, as they will be more tailored to your needs and will enable you to be up and running quicker.
      3. Coverage. Ensure the tool has adequate regulatory coverage to meet your current and future needs.
      4. Gap in functionality. Be clear on the problem you are trying to solve and/or the gap in workflow. Refer to the reporting lifecycle and be clear on your needs before sourcing technology.
      5. Resourcing. Factor in capacity during and after implementation and negotiate the appropriate support.

      Industry perspective

      The importance of ESG is something that will need to be considered for most, if not every decision in the future, and having reliable and available information is essential. While the industry will continue to see investment and innovation that drives operational efficiency and productivity, we will also see strong ESG themes in these emerging technologies to ensure they support both sustainable and socially responsible operations.

      With the breadth of technology Datamine already has addressing the ESG needs for the mining industry combined with our new technology, our customers can make effective and timely decisions through incorporating ESG data into their planning and scheduling activities to meet customer demands, while staying within the confines of their chosen ESG targets.

      Photo of Chris Parry

      Chris Parry
      VP of ESG, Datamine

      Photo of Datamine Photo of isystain

      Activity 7: Brainstorm tooling options

      Use the technology feature list below to identify areas along the ESG workflow where automated tools or third-party solutions may create efficiencies

      Technological Solutions Feature Bucket

      Basic Feature Description

      Advanced Feature Description

      Natural language processing (NLP) tools

      Ability to use NLP tools to track and monitor sentiment data from news and social media outlets.

      Leveraging NLP toolsets can provide organizations granular insights into workplace sentiment levels, which is a core component of any ESG strategy. A recent study by MarketPsych, a company that uses NLP technologies to analyze sentiment data from news and social media feeds, linked stock price performance to workplace sentiment levels.

      Distributed ledger technologies (DLTs)

      DLTs can help ensure greater reporting transparency, in line with stringent regulatory reporting requirements.

      DLT as an ESG enabler, with advanced capabilities such as an option to provide demand response services linked to electricity usage and supply forecasting.

      Cloud-based data management and reporting systems

      Cloud-based data management and reporting can support ESG initiatives by providing increased reporting transparency and a better understanding of diverse social and environmental risks.

      Leverage newfound toolsets such as Microsoft Cloud for Sustainability – a SaaS offering that enables organizations to seamlessly record, report, and reduce their emissions on a path toward net zero.

      IoT technologies

      Integration of IoT devices can help enhance the integrity of ESG reporting through the collection of descriptive and accurate ESG metrics (e.g. energy efficiency, indoor air quality, water quality and usage).

      Advanced management of real-time occupancy monitoring: for example, the ability to reduce energy consumption rates by ensuring energy is only used when spaces and individual cubicles are occupied.

      2.2 Vendors tools and technologies to support ESG reporting

      In a recent survey of over 1,000 global public- and private-sector leaders, 87% said they see AI as a helpful tool to fight climate change.
      Source: Boston Consulting Group

      Technology providers are part of the solution and can be leveraged to collect, analyze, disclose, track, and report on the vast amount of data.

      Increasingly organizations are using artificial intelligence to build climate resiliency:

      • AI is useful for the predictive modelling of potential climate events due to its ability to gather and analyze and synthesize large complete data sets.

      And protect organizations from vulnerabilities:

      • AI can be used to identify and assess vulnerabilities that may lead to business disruption or risks in production or the supply chain.

      A diagram of tooling, including DLT, natural language processing, cloud-based data management and IoT.

      2.3 ESG reporting software selection

      What Is ESG Reporting Software?

      Our definition: ESG reporting software helps organizations improve the transparency and accountability of their ESG program and track, measure, and report their sustainability efforts.

      Key considerations for reporting software selection:

      • While there are boutique ESG vendors in the market, organizations with existing GRC tools may first want to discuss ESG coverage with their existing vendor as it will enable better integration.
      • Ensure that the vendors you are evaluating support the requirements and regulations in your region, industry, and geography. Regulation is moving quickly – functionality needs to be available now and not just on the roadmap.
      • Determine the level of software integration support you need before meeting with vendors and ensure they will be able to provide it – when you need it!

      Adoption of ESG reporting software has historically been low, but these tools will become critical as organizations strive to meet increasing ESG reporting requirements.

      In a recent ESG planning and performance survey conducted by ESG SaaS company Diligent Corporation, it was found that over half of all organizations surveyed do not publish ESG metrics of any kind, and only 9% of participants are actively using software that supports ESG data collection, analysis, and reporting.

      Source: Diligent, 2021.

      2.3.1 Elicit and prioritize granular requirements for your ESG reporting software

      Understanding business needs through requirements gathering is the key to defining everything about what is being purchased. However, it is an area where people often make critical mistakes.

      Poorly scoped requirements

      Fail to be comprehensive and miss certain areas of scope.

      Focus on how the solution should work instead of what it must accomplish.

      Have multiple levels of detail within the requirements that are inconsistent and confusing.

      Drill all the way down into system-level detail.

      Add unnecessary constraints based on what is done today rather than focusing on what is needed for tomorrow.

      Omit constraints or preferences that buyers think are obvious.

      Best practices

      Get a clear understanding of what the system needs to do and what it is expected to produce.

      Test against the principle of MECE – requirements should be “mutually exclusive and collectively exhaustive.”

      Explicitly state the obvious and assume nothing.

      Investigate what is sold on the market and how it is sold. Use language that is consistent with that of the market and focus on key differentiators – not table stakes.

      Contain the appropriate level of detail – the level should be suitable for procurement and sufficient for differentiating vendors.

      Download Info-Tech's Improve Requirements Gathering blueprint

      2.3.1 Identify critical and nice-to-have features

      Central Data Repository: Collection of stored data from existing databases merged into one location that can then be shared, analyzed, or updated.

      Automatic Data Collection: Ability to automate data flows, collect responses from multiple sources at specified intervals, and check them against acceptance criteria.

      Automatic KPI Calculations, Conversions, and Updates: Company-specific metrics can be automatically calculated, converted, and tracked.

      Built-In Indicator Catalogs and Benchmarking: Provides common recognized frameworks or can integrate a catalog of ESG indicators.

      Custom Reporting: Ability to create reports on company emissions, energy, and asset data in company-branded templates.

      User-Based Access and Permissions: Ability to control access to specific content or data sets based on the end user’s roles.

      Real-Time Capabilities: Ability to analyze and visualize data as soon as it becomes available in underlying systems.

      Version Control: Tracking of document versions with each iteration of document changes.

      Intelligent Alerts and Notifications: Ability to create, manage, send, and receive notifications, enhancing efficiency and productivity.

      Audit Trail: View all previous activity including any recent edits and user access.

      Encrypted File Storage and Transfer: Ability to encrypt a file before transmitting it over the network to hide content from being viewed or extracted.

      Activity 7: Technology and tooling options

      Input: Business (ESG) strategy, Data inventory (if exists), Asset inventory (if exists), Output from Activity 5, Output from Activity 6,
      Output: List of tooling options
      Materials: Whiteboard/flip charts, ESG Reporting Workbook
      Participants: Chief Sustainability Officer, Head of ESG Reporting, Business leaders, Data analysts, Data and IT architect/leaders

      1-2 hours

      1. Begin by listing key requirements and features for your ESG reporting program.
      2. Use the outputs from activities 5 and 6 and the technology feature list on the previous slide to help brainstorm technology and tooling options.
      3. Discuss the availability and readiness of each option. Note that regulatory requirements will have an effective date that will impact the time to market for introducing new tooling.
      4. Discuss and assign a priority.
      5. At this point, further analysis may be needed. Form a subcommittee or assign a leader to conduct further analysis.
      6. Record this information in the ESG Reporting Workbook.

      Download the ESG Reporting Workbook

      Activity 8: Implementation plan

      Input: Business (ESG) strategy, Output from Activity 5, Output from Activity 6, Output from Activity 7
      Output: ESG Reporting Implementation Plan
      Materials: Whiteboard/flip charts, ESG Reporting Implementation Plan Template
      Participants: Chief Sustainability Officer, Head of ESG Reporting, Business leaders, Data analysts, PMO, Data and IT architect/leaders

      1-2 hours

      1. Use the outputs from activities 5 to 7 and list required implementation tasks. Set a priority for each task.
      2. Assign the accountable owner as well as the group responsible. Larger organizations and large, complex change programs will have a group of owners.
      3. Track any dependencies and ensure the project timeline aligns.
      4. Add status as well as start and end dates.
      5. Complete in the ESG Reporting Implementation Plan Template.

      Download the ESG Reporting Implementation Plan Template

      Activity 9: Internal communication

      Input: Business (ESG) strategy, ESG Reporting Workbook, ESG reporting implementation plan
      Output: ESG Reporting Presentation Template
      Materials: Whiteboard/flip charts, ESG Reporting Presentation Template, Internal communication templates
      Participants: Chief Sustainability Officer, Head of Marketing/ Communications, Business leaders, PMO

      1-2 hours

      Since a purpose-driven ESG program presents a significant change in how organizations operate, the goals and intentions need to be understood throughout the organization. Once you have developed your ESG reporting strategy it is important that it is communicated, understood, and accepted. Use the ESG Reporting Presentation Template as a guide to deliver your story.

      1. Consider your audience and discuss and agree on the key elements you want to convey.
      2. Prepare the presentation.
      3. Test the presentation with smaller group before communicating to senior leadership/board

      Download the ESG Reporting Presentation Template

      Phase 3

      Select ESG Reporting Software

      A diagram that shows phase 1 to 3 of establishing ESG reporting program.

      This phase will provide additional material on Info-Tech’s expertise in the following areas:

      • Info-Tech’s approach to RFPs
      • Info-Tech tools for software selection
      • Example ESG software assessments

      3.1 Leverage Info-Tech’s expertise

      Develop an inclusive and thorough approach to the RFP process

      An image that a process of 7 steps.

      The Info-Tech difference:

      1. The secret to managing an RFP is to make it as manageable and as thorough as possible. The RFP process should be like any other aspect of business – with a standard process in place, you are better able to handle whatever comes your way, because you know the steps you need to follow to produce a top-notch RFP.
      2. The business then identifies the need for more information about a product/service or determines that a purchase is required.
      3. A team of stakeholders from each area impacted gather all business, technical, legal, and risk requirements. What are the expectations of the vendor relationship post-RFP? How will the vendors be evaluated?
      4. Based on predetermined requirements, either an RFI or an RFP is issued to vendors with a due date.

      Info-Tech Insight

      Review Info-Tech’s process and understand how you can prevent your organization from leaking negotiation leverage while preventing vendors from taking control of your RFP.

      Software Selection Engagement

      5 Advisory Calls Over a 5-Week Period to Accelerate Your Selection Process

      Expert Analyst Guidance over5 weeks on average to select and negotiate software.

      Save Money, Align Stakeholders, Speed Up the Process & make better decisions.

      Use a Repeatable, Formal Methodology to improve your application selection process.

      Better, Faster Results, guaranteed, included in membership.

      A diagram of selection engagement over a 5-week period.

      CLICK HERE to Book Your Selection Engagement

      Leverage the Contract Review Service to level the playing field with your shortlisted vendors

      You may be faced with multiple products, services, master service agreements, licensing models, service agreements, and more.

      Use the Contract Review Service to gain insights on your agreements.

      Consider the aspects of a contract review:

      1. Are all key terms included?
      2. Are they applicable to your business?
      3. Can you trust that results will be delivered?
      4. What questions should you be asking from an IT perspective?

      Validate that a contract meets IT’s and the business’ needs by looking beyond the legal terminology. Use a practical set of questions, rules, and guidance to improve your value for dollar spent.

      A photo of Contract Review Service.

      Click here to book The Contract Review Service

      Download blueprint Master Contract Review and Negotiation for Software Agreements

      3.2 Vendor spotlight assessments

      See above for a vendor landscape overview of key ESG reporting software providers

      The purpose of this section is to showcase various vendors and companies that provide software solutions to help users manage and prioritize their ESG reporting initiatives.

      This section showcases the core capabilities of each software platform to provide Info-Tech members with industry insights regarding some of the key service providers that operate within the ESG vendor market landscape.

      Info-Tech members who are concerned with risks stemming from the inability to sort and disseminate unstructured ESG data reporting metrics or interested in learning more about software offerings that can help automate the data collection, processing, and management of ESG metrics will find high-level insights into the ESG vendor market space.

      Vendor spotlight

      A photo of Datamine Isystain

      The establishment of the Datamine ESG unit comes at the same time the mining sector is showing an increased interest in managing ESG and its component systems as part of a single scope.

      With miners collecting and dealing with ever-increasing quantities of data and looking for ways to leverage it to make data-driven decisions that enhance risk management and increase profitability, integrated software solutions are – now more than ever – essential in supporting continuous improvement and maintaining data fidelity and data integrity across the entire mining value chain.

      An example of Datamine Isystain An example of Datamine Isystain An example of Datamine Isystain

      Key Features:

      • Discover GIS for geochemical, water, erosion, and vegetation modelling and management.
      • Qmed for workforce health management, COVID testing, and vaccine administration.
      • MineMarket and Reconcilor for traceability and auditing, giving visibility to chain of custody and governance across the value chain, from resource modelling to shipping and sales.
      • Centric Mining Systems – intelligence software for real-time transparency and governance across multiple sites and systems, including key ESG performance indicator reporting.
      • Zyght – a leading health, safety, and environment solution for high-impact industries that specializes in environment, injury, risk management, safe work plans, document management, compliance, and reporting.
      • Isystain – a cloud-based platform uniquely designed to support health, safety & environment, sustainability reporting, compliance and governance, and social investment reporting. Designed for seamless integration within an organization’s existing software ecosystems providing powerful analytics and reporting capabilities to streamline the production of sustainability and performance reporting.

      Vendor spotlight

      A logo of Benchmark ESG

      Benchmark ESG provides industry-leading ESG data management and reporting software that can assist organizations in managing operational risk and compliance, sustainability, product stewardship, and ensuring responsible sourcing across complex global operations.

      An example of Benchmark ESG An example of Benchmark ESG

      Key Features:

      Vendor spotlight

      A logo of PWC

      PwC’s ESG Management Solution provides quick insights into ways to improve reporting transparency surrounding your organization’s ESG commitments.

      According to PwC’s most recent CEO survey, the number one motivator for CEOs in mitigating climate change risks is their own desire to help solve this global problem and drive transparency with stakeholders.
      Source: “Annual Global CEO Survey,” PwC, 2022.

      An example of PWC An example of PWC

      Key Features:

      • Streamlined data mining capabilities. PwC’s ESG solution provides the means to streamline, automate, and standardize the input of sustainability data based on non-financial reporting directive (NFRD) and corporate sustainability reporting directive (CSRD) regulations.
      • Company and product carbon footprint calculation and verification modules.
      • Robust dashboarding capabilities. Option to create custom-tailored sustainability monitoring dashboards or integrate existing ESG data from an application to existing dashboards.
      • Team management functionalities that allow for more accessible cross-departmental communication and collaboration. Ability to check progress on tasks, assign tasks, set automatic notifications/deadlines, etc.

      Vendor spotlight

      A logo of ServiceNow

      ServiceNow ESG Management (ESGM) and reporting platform helps organizations transform the way they manage, visualize, and report on issues across the ESG spectrum.

      The platform automates the data collection process and the organization and storage of information in an easy-to-use system. ServiceNow’s ESGM solution also develops dashboards and reports for internal user groups and ensures that external disclosure reports are aligned with mainstream ESG standards and frameworks.

      We know that doing well as a business is about more than profits. One workflow at a time, we believe we can change the world – to be more sustainable, equitable, and ethical.
      Source: ServiceNow, 2021.

      An example of ServiceNow

      Key Features:

      1. An executive dashboard to help coherently outline the status of various ESG indicators, including material topics, goals, and disclosure policies all in one centralized hub
      2. Status review modules. Ensure that your organization has built-in modules to help them better document and monitor their ESG goals and targets using a single source of truth.
      3. Automated disclosure modules. ESGM helps organizations create more descriptive ESG disclosure reports that align with industry accountability standards (e.g. SASB, GRI, CDP).

      Other key vendors to consider

      An image of other 12 key vendors

      Related Info-Tech Research

      Photo of The ESG Imperative and Its Impact on Organizations

      The ESG Imperative and Its Impact on Organizations

      Use this blueprint to educate yourself on ESG factors and the broader concept of sustainability.

      Identify changes that may be needed in your organizational operating model, strategy, governance, and risk management approach.

      Learn about Info-Tech’s ESG program approach and use it as a framework to begin your ESG program journey.

      Photo of Private Equity and Venture Capital Growing Impact of ESG Report

      Private Equity and Venture Capital Growing Impact of ESG Report

      Increasingly, new capital has a social mandate attached to it due to the rise of ESG investment principles.

      Learn about how the growing impact of ESG affects both your organization and IT specifically, including challenges and opportunities, with expert assistance.

      Definitions

      Terms

      Definition

      Corporate Social Responsibility

      Management concept whereby organizations integrate social and environmental concerns in their operations and interactions with their stakeholders.

      Chief Sustainability Officer

      Steers sustainability commitments, helps with compliance, and helps ensure internal commitments are met. Responsibilities may extend to acting as a liaison with government and public affairs, fostering an internal culture, acting as a change agent, and leading delivery.

      ESG

      An acronym that stands for environment, social, and governance. These are the three components of a sustainability program.

      ESG Standard

      Contains detailed disclosure criteria including performance measures or metrics. Standards provide clear, consistent criteria and specifications for reporting. Typically created through consultation process.

      ESG Framework

      A broad contextual model for information that provides guidance and shapes the understanding of a certain topic. It sets direction but does not typically delve into the methodology. Frameworks are often used in conjunction with standards.

      ESG Factors

      The factors or issues that fall under the three ESG components. Measures the sustainability performance of an organization.

      ESG Rating

      An aggregated score based on the magnitude of an organization’s unmanaged ESG risk. Ratings are provided by third-party rating agencies and are increasingly being used for financing, transparency to investors, etc.

      ESG Questionnaire

      ESG surveys or questionnaires are administered by third parties and used to assess an organization’s sustainability performance. Participation is voluntary.

      Key Risk Indicator (KRI)

      A measure to indicate the potential presence, level, or trend of a risk.

      Key Performance Indicator (KPI)

      A measure of deviation from expected outcomes to help a firm see how it is performing.

      Materiality

      Material topics are topics that have a direct or indirect impact on an organization's ability to create, preserve, or erode economic, environmental, and social impact for itself and its stakeholder and society as a whole.

      Materiality Assessment

      A tool to identify and prioritize the ESG issues most critical to the organization.

      Risk Sensing

      The range of activities carried out to identify and understand evolving sources of risk that could have a significant impact on the organization (e.g. social listening).

      Sustainability

      The ability of an organization and broader society to endure and survive over the long term by managing adverse impacts well and promoting positive opportunities.

      Sustainalytics

      Now part of Morningstar. Sustainalytics provides ESG research, ratings, and data to institutional investors and companies.

      UN Guiding Principles on Business and Human Rights (UNGPs)

      An essential methodological foundation for how impacts across all dimensions should be assessed.

      Reporting and standard frameworks

      Standard

      Definition and focus

      CDP
      (Formally Carbon Disclosure Project)

      CDP has created standards and metrics for comparing sustainability impact. Focuses on environmental data (e.g. carbon, water, and forests) and on data disclosure and benchmarking.

      Audience: All stakeholders

      Dow Jones Sustainability Indices (DJSI)

      Heavy on corporate governance and company performance. Equal balance of economic, environmental, and social.

      Audience: All stakeholders

      Global Reporting Initiative (GRI)

      International standards organization that has a set of standards to help organizations understand and communicate their impacts on climate change and social responsibility. The standard has a strong emphasis on transparency and materiality, especially on social issues.

      Audience: All stakeholders

      International Sustainability Standards Board (ISSB)

      Standard-setting board that sits within the International Financial Reporting Standards (IFRS) Foundation. The IFRS Foundation is a not-for-profit, public-interest organization established to develop high-quality, understandable, enforceable, and globally accepted accounting and sustainability disclosure standards.

      Audience: Investor-focused

      United Nations Sustainable Development Goals (SDGs)

      Global partnership across sectors and industries that sets out 17 goals to achieve sustainable development for all.

      Audience: All stakeholders

      Sustainability Accounting Standards Board (SASB)
      Now part of IFSR foundation

      Industry-specific standards to help corporations select topics that may impact their financial performance. Focus on material impacts on financial condition or operating performance.

      Audience: Investor-focused

      Task Force on Climate-Related Financial Disclosures (TCFD; created by the Financial Stability Board)

      Standards framework focused on the impact of climate risk on financial and operating performance. More broadly the disclosures inform investors of positive and negative measures taken to build climate resilience and make transparent the exposure to climate-related risk.

      Audience: Investors, financial stakeholders

      Bibliography

      "2021 Global Investor Survey: The Economic Realities of ESG." PwC, Dec. 2021. Accessed May 2022.

      "2023 Canadian ESG Reporting Insights." PwC, Nov. 2022. Accessed Dec. 2022.

      Althoff, Judson. "Microsoft Cloud for Sustainability: Empowering Organizations On Their Path To Net Zero." Microsoft Blog, 14 July 2021. Accessed May 2022.

      "Balancing Sustainability and Profitability." IBM, Feb. 2022. Accessed June. 2022.

      "Beyond Compliance: Consumers and Employees Want Business to Do More on ESG." PwC, Nov. 2021. Accessed July 2022.

      Bizo, Daniel. "Multi-Tenant Datacenters and Sustainability: Ambitions and Reality." S&P Market Intelligence, Sept. 2020. Web.

      Bolden, Kyle. "Aligning nonfinancial reporting with your ESG strategy to communicate long-term value." EY, 18 Dec. 2020. Web.

      Carril, Christopher, et al. "Looking at Restaurants Through an ESG Lens: ESG Stratify – Equity Research Report." RBC Capital Markets, 5 Jan. 2021. Accessed Jun. 2022.

      "Celebrating and Advancing Women." McDonald’s, 8 March 2019. Web.

      Clark, Anna. "Get your ESG story straight: A sustainability communication starter kit." GreenBiz, 20 Dec. 2022, Accessed Dec. 2022.

      Courtnell, Jane. “ESG Reporting Framework, Standards, and Requirements.” Corporate Compliance Insights, Sept. 2022. Accessed Dec. 2022.

      “Country Sustainability Ranking. Country Sustainability: Visibly Harmed by Covid-19.” Robeco, Oct. 2021. Accessed June 2022.

      “Defining the “G” in ESG Governance Factors at the Heart of Sustainable Business.” World Economic Forum, June 2022. Web.

      “Digital Assets: Laying ESG Foundations.” Global Digital Finance, Nov. 2021. Accessed April 2022.

      “Dow Jones Sustainability Indices (DJCI) Index Family.” S&P Global Intelligence, n.d. Accessed June 2022.

      "ESG in Your Business: The Edge You Need to Land Large Contracts." BDC, March 2023, Accessed April 2023.

      “ESG Performance and Its Impact on Corporate Reputation.” Intelex Technologies, May 2022. Accessed July 2022.

      “ESG Use Cases. IoT – Real-Time Occupancy Monitoring.” Metrikus, March 2021. Accessed April 2022.

      Fanter, Tom, et al. “The History & Evolution of ESG.” RMB Capital, Dec. 2021. Accessed May 2022.

      Flynn, Hillary, et al. “A guide to ESG materiality assessments.” Wellington Management, June 2022, Accessed September 2022

      “From ‘Disclose’ to ‘Disclose What Matters.’” Global Reporting Initiative, Dec. 2018. Accessed July 2022.

      “Getting Started with ESG.” Sustainalytics, 2022. Web.

      “Global Impact ESG Fact Sheet.” ServiceNow, Dec. 2021. Accessed June 2022.

      Gorley, Adam. “What is ESG and Why It’s Important for Risk Management.” Sustainalytics, March 2022. Accessed May 2022.

      Hall, Lindsey. “You Need Near-Term Accountability to Meet Long-Term Climate Goals.” S&P Global Sustainable1, Oct. 2021. Accessed April 2022.

      Henisz, Witold, et al. “Five Ways That ESG Creates Value.” McKinsey, Nov. 2019. Accessed July 2022.

      “Integrating ESG Factors in the Investment Decision-Making Process of Institutional Investors.” OECD iLibrary, n.d. Accessed July 2022.

      “Investor Survey.” Benchmark ESG, Nov. 2021. Accessed July 2022.

      Jackson, Brian. Tech Trends 2023, Info-Tech Research Group, Dec. 2022, Accessed Dec. 2022.

      Keet, Lior. “What Is the CIO’s Role in the ESG Equation?” EY, 2 Feb. 2022. Accessed May 2022.

      Lev, Helee, “Understanding ESG risks and why they matter” GreenBiz, June 2022. Accessed Dec 2022.

      Marsh, Chris, and Simon Robinson. “ESG and Technology: Impacts and Implications.” S&P Global Market Intelligence, March 2021. Accessed April 2022.

      Martini, A. “Socially Responsible Investing: From the Ethical Origins to the Sustainable Development Framework of the European Union.” Environment, Development and Sustainability, vol. 23, Nov. 2021. Web.

      Maher, Hamid, et al. “AI Is Essential for Solving the Climate Crisis.” Boston Consulting Group, 7 July 2022. Web.

      “Materiality Assessment. Identifying and Taking Action on What Matters Most.” Novartis, n.d. Accessed June. 2022.

      Morrow, Doug, et al. “Understanding ESG Incidents: Key Lessons for Investors.” Sustainalytics, July 2017. Accessed May 2022.

      “Navigating Climate Data Disclosure.” Novisto, July 2022. Accessed Nov. 2022.

      Nuttall, Robin, et al. “Why ESG Scores Are Here to Stay.” McKinsey & Company, May 2020. Accessed July 2022.

      “Opportunities in Sustainability – 451 Research’s Analysis of Sustainability Perspectives in the Data Center Industry.” Schneider Electric, Sept. 2020. Accessed May 2022.

      Peterson, Richard. “How Can NLP Be Used to Quantify ESG Analytics?” Refinitiv, Feb. 2021. Accessed June 2022.

      “PwC’s 25th Annual Global CEO Survey: Reimagining the Outcomes That Matter.” PwC, Jan. 2022. Accessed June 2022.

      “SEC Proposes Rules on Cybersecurity, Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies.” Securities and Exchange Commission, 9 May 2022. Press release.

      Serafeim, George. “Social-Impact Efforts That Create Real Value.” Harvard Business Review, Sept. 2020. Accessed May 2022.

      Sherrie, Gonzalez. “ESG Planning and Performance Survey.” Diligent, 24 Sept. 2021. Accessed July 2022.

      “Special Reports Showcase, Special Report: Mid-Year Report on Proposed SEC Rule 14-8 Change.” Sustainable Investments Institute, July 2020. Accessed April 2022.

      “State of European Tech. Executive Summary Report.” Atomico, Nov. 2021. Accessed June 2022.

      “Top Challenges in ESG Reporting, and How ESG Management Solution Can Help.” Novisto, Sept. 2022. Accessed Nov. 2022.

      Vaughan-Smith, Gary. “Navigating ESG data sets and ‘scores’.” Silverstreet Capital, 23 March 2022. Accessed Dec. 2022.

      Waters, Lorraine. “ESG is not an environmental issue, it’s a data one.” The Stack, 20 May 2021. Web.

      Wells, Todd. “Why ESG, and Why Now? New Data Reveals How Companies Can Meet ESG Demands – And Innovate Supply Chain Management.” Diginomica, April 2022. Accessed July 2022.

      “XBRL is coming to corporate sustainability Reporting.” Novisto, Aug. 2022. Accessed Dec. 2022.

      Research Contributors and Experts

      Photo of Chris Parry

      Chris Parry
      VP of ESG, Datamine

      Chris Parry has recently been appointed as the VP of ESG at Datamine Software. Datamine’s dedicated ESG division provides specialized ESG technology for sustainability management by supporting key business processes necessary to drive sustainable outcomes.

      Chris has 15 years of experience building and developing business for enterprise applications and solutions in both domestic and international markets.

      Chris has a true passion for business-led sustainable development and is focused on helping organizations achieve their sustainable business outcomes through business transformation and digital software solutions.

      Datamine’s comprehensive ESG capability supports ESG issues such as the environment, occupational health and safety, and medical health and wellbeing. The tool assists with risk management, stakeholder management and business intelligence.

      Leverage Web Analytics to Reinforce Your Web Experience Management Strategy

      • Buy Link or Shortcode: {j2store}563|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Marketing Solutions
      • Parent Category Link: /marketing-solutions
      • Organizations are unaware of the capabilities of web analytics tools and unsure how to leverage these new technologies to enhance their web experience.
      • Traditional solutions offer only information and data about the activity on the website. It is difficult for organizations to understand the customer motivations and behavioral patterns using the data.
      • In addition, there is an overwhelming number of vendors offering various solutions. Understanding which solution best fits your business needs is crucial to avoid overspending.

      Our Advice

      Critical Insight

      • Understanding organizational goals and business objectives is essential in effectively leveraging web analytics.
      • It is easy to get lost in a sea of expensive web analytical tools. Choosing tools that align with the business objectives will keep the costs of customer acquisition and retention to a minimum.
      • Beyond selection and implementation, leveraging web analytic tools requires commitment from the organization to continuously monitor key KPIs to ensure good customer web experience.

      Impact and Result

      • Understand what web analytic tools are and some key trends in the market space. Learn about top advanced analytic tools that help understand user behavior.
      • Discover top vendors in the market space and some of the top-level features they offer.
      • Understand how to use the metrics to gather critical insights about the website’s use and key initiatives for successful implementation.

      Leverage Web Analytics to Reinforce Your Web Experience Management Strategy Research & Tools

      Leverage Web Analytics to Reinforce Your Web Experience Management Strategy Storyboard – A deck outlining the importance of web analytic tools and how they can be leveraged to meet your business needs.

      This research offers insight into web analytic tools, key trends in the market space, and an introduction to advanced web analytics techniques. Follow our five-step initiative to successfully select and implement web analytics tools and identify which baseline metrics to measure and continuously monitor for best results.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Leverage Web Analytics to Reinforce Your Web Experience Management Strategy Storyboard
      [infographic]

      Further reading

      Leverage Web Analytics to Reinforce Your Web Experience Management Strategy

      Web analytics tools are the gateway to understanding customer behavior.

      EXECUTIVE BRIEF

      Analyst Perspective

      In today’s world, users want to consume concise content and information quickly. Websites have a limited time to prove their usefulness to a new user. Content needs to be as few clicks away from the user as possible. Analyzing user behavior using advanced analytics techniques can help website designers better understand their audience.

      Organizations need to implement sophisticated analytics tools to track user data from their website. However, simply extracting data is not enough to understand the user motivation. A successful implementation of a web analytics tool will comprise both understanding what a customer does on the website and why the customer does what they do.

      This research will introduce some fundamental and advanced analytics tools and provide insight into some of the vendors in the market space.

      Photo of Sai Krishna Rajaramagopalan, Research Specialist, Applications − Enterprise Applications, Info-Tech Research Group. Sai Krishna Rajaramagopalan
      Research Specialist, Applications − Enterprise Applications
      Info-Tech Research Group

      Executive Summary

      Your Challenge
      • Web analytics solutions have emerged as applications that provide extensive information and data about users visiting your webpage. However, many organizations are unaware of the capabilities of these tools and unsure how to leverage these new technologies to enhance user experience.
      Common Obstacles
      • Traditional solutions offer information and data about customers’ activity on the website but no insight into their motivations and behavioral patterns.
      • In addition, an overwhelming number of vendors are offering various solutions. Understanding which solution best fits your business needs is crucial to avoid overspending.
      Info-Tech’s Approach
      • This research is aimed to help you understand what web analytic tools are and some key trends in the market space. Learn about top advanced analytic tools that help you understand user behavior. Discover top vendors in the market space and some of the high-level features offered.
      • This research also explains techniques and metrics to gather critical insights about your website’s use and will aid in understanding users’ motivations and patterns and better predict their behavior on the website.

      Info-Tech Insight

      It is easy to get lost in a sea of expensive web analytics tools. Choose tools that align with your business objectives to keep the costs of customer acquisition and retention to a minimum.

      Ensure the success of your web analytics programs by following five simple steps

      1. ORGANIZATIONAL GOALS

      The first key step in implementing and succeeding with web analytics tools is to set clearly defined organizational goals, e.g. improving product sales.

      3. KPI METRICS

      Define key performance indicators (KPIs) that help track the organization’s performance, e.g. number of page visits, conversion rates, bounce rates.

      5. REVIEW

      Continuous improvement is essential to succeed in understanding customers. The world is a dynamic place, and you must constantly revise your organizational goals, business objectives, and KPIs to remain competitive.

      Centerpiece representing the five surrounding steps.

      2. BUSINESS OBJECTIVES

      The next step is to lay out business objectives that help to achieve the organization’s goals, e.g. to increase customer leads, increase customer transactions, increase web traffic.

      4. APPLICATION SELECTION

      Understand the web analytics tool space and which combination of tools and vendors best fits the organization’s goals.

      Web Analytics Introduction

      Understand traditional and advanced tools and their capabilities.

      Understanding web analytics

      • Web analytics is the branch of analytics that deals with the collection, reporting, and analysis of data generated by users visiting and interacting with a website.
      • The purpose of web analytics is to measure user behavior, optimize the website’s user experience and flow, and gain insights that help meet business objectives like increasing conversions and sales.
      • Web analytics allows you to see how your website is performing and how people are acting while on your website. What’s important is what you can do with this knowledge.
      • Data collected through web analytics may include traffic sources, referring sites, page views, paths taken, and conversion rates. The compiled data often forms a part of customer relationship management analytics to facilitate and streamline better business decisions.
      • Having strong web analytics is important in understanding customer behavior and fine-tuning marketing and product development approaches accordingly.
      Example of a web analytics dashboard.

      Why you should leverage web analytics

      Leveraging web analytics allows organizations to better understand their customers and achieve their business goals.

      The global web analytics market size is projected to reach US$5,156.3 million by 2026, from US$2,564 million in 2019, at a CAGR of 10.4% during 2021-2026. (Source: 360 Research Reports, 2021) Of the top 1 million websites with the highest traffic, there are over 3 million analytics technologies used. Google Analytics has the highest market share, with 50.3%. (Source: “Top 1 Million Sites,” BuiltWith, 2022)
      Of the 200 million active websites, 57.3% employ some form of web analytics tool. This trend is expected to grow as more sophisticated tools are readily available at a cheaper cost. (Source: “On the Entire Internet,” BuiltWith, 2022; Siteefy, 2022) A three-month study by Contentsquare showed a 6.9% increase in traffic, 11.8% increase in page views, 12.4% increase in transactions, and 3.6% increase in conversion rates through leveraging web analytics. (Source: Mordor Intelligence, 2022)

      Case Study

      Logo for Ryanair.
      INDUSTRY
      Aviation
      SOURCE
      AT Internet
      Web analytics

      Ryanair is a low-fare airline in Europe that receives nearly all of its bookings via its website. Unhappy with its current web analytics platform, which was difficult to understand and use, Ryanair was looking for a solution that could adapt to its requirements and provide continuous support and long-term collaboration.

      Ryanair chose AT Internet for its intuitive user interface that could effectively and easily manage all the online activity. AT was the ideal partner to work closely with the airline to strengthen strategic decision making over the long term, increase conversions in an increasingly competitive market, and increase transactions on the website.

      Results

      By using AT Internet Web Analytics to improve email campaigns and understand the behavior of website visitors, Ryanair was able to triple click-through rates, increase visitor traffic by 16%, and decrease bounce rate by 18%.

      Arrows denoting increases or decreases in certain metrics: '3x increase in click-through rates', '16% increase in visitor traffic', '18% decrease in bounce rate'.

      Use traditional web analytics tools to understand your consumer

      What does the customer do?
      • Traditional web analytics allows organizations to understand what is happening on their website and what customers are doing. These tools deliver hard data to measure the performance of a website. Some of the data measured through traditional web analytics are:
      • Visit count: The number of visits received by a webpage.
      • Bounce rate: The percentage of visitors that leave the website after only viewing the first page compared to total visitors.
      • Referrer: The previous website that sent the user traffic to a specific website.
      • CTA clicks: The number of times a user clicks on a call to action (CTA) button.
      • Conversion rate: Proportion of users that reach the final outcome of the website.
      Example of a traditional web analytics dashboard.

      Use advanced web analytics techniques to understand your consumer

      Why does the customer do what they do?
      • Traditional web analytic tools fail to explain the motivation of users. Advanced analytic techniques help organizations understand user behavior and measure user satisfaction. The techniques help answer questions like: Why did a user come to a webpage? Why did they leave? Did they find what they were looking for? Some of the advanced tools include:
      • Heatmapping: A visual representation of where the users click, scroll, and move on a webpage.
      • Recordings: A recording of the mouse movement and clicks for the entire duration of a user’s visit.
      • Feedback forms and surveys: Voice of the customer tools allowing users to give direct feedback about websites.
      • Funnel exploration: The ability to visualize the steps users take to complete tasks on your site or app.
      Example of an advanced web analytics dashboard.

      Apply industry-leading techniques to leverage web analytics

      Heatmapping
      • Heatmaps are used to visualize where users move their mouse, click, and scroll in a webpage.
      • Website heatmaps use a warm-to-cold color scheme to indicate user activity, with the warmest color indicating the highest visitor engagement and the coolest indicating the lowest visitor engagement.
      • Organizations can use this tool to evaluate the elements of the website that attract users and identify which sections require improvement to increase user engagement.
      • Website designers can make changes and compare the difference in user interaction to measure the effectiveness of the changes.
      • Scrollmaps help designers understand what the most popular scroll-depth of your webpage is – and that’s usually a prime spot for an important call to action.
      Example of a website with heatmapping overlaid.
      (Source: An example of a heatmap layered with a scrollmap from Crazy Egg, 2020)

      Apply industry-leading techniques to leverage web analytics

      Funneling

      • Funnels are graphical representations of a customer’s journey while navigating through the website.
      • Funnels help organizations identify which webpage users land on and where users drop off.
      • Organizations can capture every user step to find the unique challenges between entry and completion. Identifying what friction stands between browsing product grids and completing a transaction allows web designers to then eliminate it.
      • Designers can use A/B testing to experiment with different design philosophies to compare conversion statistics.
      • Funneling can be expanded to cross-channel analytics by incorporating referral data, cookies, and social media analytics.
      Example of a bar chart created through funneling.

      Apply industry-leading techniques to leverage web analytics

      Session recordings

      • Session recordings are playbacks of users’ interaction with the website on a single session. User interaction can vary between mouse clicks, keyboard input, and mouse scroll.
      • Recordings help organizations understand user motivation and help identify why users undertake certain tasks or actions on the webpage.
      • Playbacks can also be used to see if users are confused anywhere between the landing page and final transaction phase. This way, playbacks further help ensure visitors complete the funneling seamlessly.
      Example of a session recording featuring a line created by the mouse's journey.

      Apply industry-leading techniques to leverage web analytics

      Feedback and microsurveys

      • Feedback can be received directly from end users to help organizations improve the website.
      • Receiving feedback from users can be difficult, since not every user is willing to spend time to submit constructive and detailed feedback. Microsurveys are an excellent alternative.
      • Users can submit short feedback forms consisting of a single line or emojis or thumbs up or down.
      • Users can directly highlight sections of the page about which to submit feedback. This allows designers to quickly pinpoint areas for improvement. Additionally, web designers can play back recordings when feedback is submitted to get a clear idea about the challenges users face.
      Example of a website with a microsurvey in the corner.

      Market Overview

      Choose vendors and tools that best match your business needs.

      Top-level traditional features

      Feature Name

      Description

      Visitor Count Tracking Counts the number of visits received by a website or webpage.
      Geographic Analytics Uses location information to enable the organization to provide location-based services for various demographics.
      Conversion Tracking Measures the proportion of users that complete a certain task compared to total number of users.
      Device and Browser Analytics Captures and summarizes device and browser information.
      Bounce and Exit Tracking Calculates exit rate and bounce rate on a webpage.
      CTA Tracking Measures the number of times users click on a call to action (CTA) button.
      Audience Demographics Captures, analyzes, and displays customer demographic/firmographic data from different channels.
      Aggregate Traffic Reporting Works backward from a conversion or other key event to analyze the differences, trends, or patterns in the paths users took to get there.
      Social Media Analytics Captures information on social signals from popular services (Twitter, Facebook, LinkedIn, etc.).

      Top-level advanced features

      Feature Name

      Description

      HeatmappingShows where users have clicked on a page and how far they have scrolled down a page or displays the results of eye-tracking tests through the graphical representation of heatmaps.
      Funnel ExplorationVisualizes the steps users take to complete tasks on your site or app.
      A/B TestingEnables you to test the success of various website features.
      Customer Journey ModellingEffectively models and displays customer behaviors or journeys through multiple channels and touchpoints.
      Audience SegmentationCreates and analyzes discrete customer audience segments based on user-defined criteria or variables.
      Feedback and SurveysEnables users to give feedback and share their satisfaction and experience with website designers.
      Paid Search IntegrationIntegrates with popular search advertising services (i.e. AdWords) and can make predictive recommendations around areas like keywords.
      Search Engine OptimizationProvides targeted recommendations for improving and optimizing a page for organic search rankings (i.e. via A/B testing or multivariate testing).
      Session RecordingRecords playbacks of users scrolling, moving, u-turning, and rage clicking on your site.

      Evaluate software category leaders using SoftwareReviews’ vendor rankings and awards

      Logo for SoftwareReviews.
      Sample of SoftwareReviews' The Data Quadrant. The Data Quadrant is a thorough evaluation and ranking of all software in an individual category to compare platforms across multiple dimensions.

      Vendors are ranked by their Composite Score, based on individual feature evaluations, user satisfaction rankings, vendor capability comparisons, and likeliness to recommend the platform.

      Sample of SoftwareReviews' The Emotional Footprint. The Emotional Footprint is a powerful indicator of overall user sentiment toward the relationship with the vendor, capturing data across five dimensions.

      Vendors are ranked by their Customer Experience (CX) Score, which combines the overall Emotional Footprint rating with a measure of the value delivered by the solution.

      Speak with category experts to dive deeper into the vendor landscape

      Logo for SoftwareReviews.
      Fact-based reviews of business software from IT professionals. Top-tier data quality backed by a rigorous quality assurance process. CLICK HERE to ACCESS

      Comprehensive software reviews
      to make better IT decisions

      We collect and analyze the most detailed reviews on enterprise software from real users to give you an unprecedented view into the product and vendor before you buy.

      Product and category reports with state-of-the-art data visualization. User-experience insight that reveals the intangibles of working with a vendor.

      SoftwareReviews is powered by Info-Tech

      Technology coverage is a priority for Info-Tech and SoftwareReviews provides the most comprehensive unbiased data on today’s technology. Combined with the insight of our expert analysts, our members receive unparalleled support in their buying journey.

      Top vendors in the web analytics space

      Logo for Google Analytics. Google Analytics provides comprehensive traditional analytics tools, free of charge, to understand the customer journey and improve marketing ROI. Twenty-four percent of all web analytical tools used on the internet are provided by Google analytics.
      Logo for Hotjar. Hotjar is a behavior analytics and product experience insights service that helps you empathize with and understand your users through their feedback via tools like heatmaps, session recordings, and surveys. Hotjar complements the data and insights you get from traditional web analytics tools like Google Analytics.
      Logo for Crazy Egg. Crazy Egg is a website analytics tool that helps you optimize your site to make it more user-friendly, more engaging, and more conversion-oriented. It does this through heatmaps and A/B testing, which allow you to see how people are interacting with your site.
      Logo for Amplitude Analytics. Amplitude Analytics provides intelligent insight into customer behavior. It offers basic functionalities like measuring conversion rate and engagement metrics and also provides more advanced tools like customer journey maps and predictive analytics capabilities through AI.

      Case Study

      Logo for Miller & Smith.
      INDUSTRY
      Real Estate
      SOURCE
      Crazy Egg

      Heatmaps and playback recordings

      Challenge

      Miller & Smith had just redesigned their website, but the organization wanted to make sure it was user-friendly as well as visually appealing. They needed an analytics platform that could provide information about where visitors were coming from and measure the effectiveness of the marketing campaigns.

      Solution

      Miller & Smith turned to Crazy Egg to obtain visual insights and track user behavior. They used heatmaps and playback recordings to see user activity within webpages and pinpoint any issues with user interface. In just a few weeks, Miller & Smith gained valuable data to work with: the session recordings helped them understand how users were navigating the site, and the heatmaps allowed them to see where users were clicking – and what they were skipping.

      Results

      Detailed reports generated by the solution allowed Miller & Smith team to convince key stakeholders and implement the changes easily. They were able to pinpoint what changes needed to be made and why these changes would improve their experience.

      Within few weeks, the bounce rate improved by 7.5% and goal conversion increased by 8.5% over a similar period the previous year.

      Operationalizing Web Analytics Tools

      Execute initiatives for successful implementation.

      Ensure success of your web analytics programs by following five simple steps

      1. ORGANIZATIONAL GOALS

      The first key step in implementing and succeeding with web analytics tools is to set clearly defined organizational goals, e.g. improving product sales.

      3. KPI METRICS

      Define key performance indicators (KPIs) that help track the organization’s performance, e.g. number of page visits, conversion rates, bounce rates.

      5. REVIEW

      Continuous improvement is essential to succeed in understanding customers. The world is a dynamic place, and you must constantly revise your organizational goals, business objectives, and KPIs to remain competitive.

      Centerpiece representing the five surrounding steps.

      2. BUSINESS OBJECTIVES

      The next step is to lay out business objectives that help to achieve the organization’s goals, e.g. to increase customer leads, increase customer transactions, increase web traffic.

      4. APPLICATION SELECTION

      Understand the web analytics tool space and which combination of tools and vendors best fits the organization’s goals.

      1.1 Understand your organization’s goals

      30 minutes

      Output: Organization’s goal list

      Materials: Whiteboard, Markers

      Participants: Core project team

      1. Identify the key organizational goals for both the short term and the long term.
      2. Arrange the goals in descending order of priority.

      Example table of goals ranked by priority and labeled short or long term.

      1.2 Align business objectives with organizational goals

      30 minutes

      Output: Business objectives

      Materials: Whiteboard, Markers

      Participants: Core project team

      1. Identify the key business objectives that help attain organization goals.
      2. Match each business objective with the corresponding organizational goals it helps achieve.
      3. Arrange the objectives in descending order of priority.

      Example table of business objectives ranked by priority and which organization goal they're linked to.

      Establish baseline metrics

      Baseline metrics will be improved through:

      1. Efficiently using website elements and CTA button placement
      2. Reducing friction between the landing page and end point
      3. Leveraging direct feedback from users to continuously improve customer experience

      1.3 Establish baseline metrics that you intend to improve via your web analytics tools

      30 minutes

      Example table with metrics, each with a current state and goal state.

      Accelerate your software selection project

      Vendor selection projects often demand extensive and unnecessary documentation.

      Software Selection Insight

      Balance the effort-to-information ratio required for a business impact assessment to keep stakeholders engaged. Use documentation that captures the key data points and critical requirements without taking days to complete. Stakeholders are more receptive to formal selection processes that are friction free.

      The Software Selection Workbook

      Work through the straightforward templates that tie to each phase of the Rapid Application Selection Framework, from assessing the business impact to requirements gathering.

      Sample of the Software Selection Workbook deliverable.

      The Vendor Evaluation Workbook

      Consolidate the vendor evaluation process into a single document. Easily compare vendors as you narrow the field to finalists.

      Sample of the Vendor Evaluation Workbook deliverable.

      The Guide to Software Selection: A Business Stakeholder Manual

      Quickly explain the Rapid Application Selection Framework to your team while also highlighting its benefits to stakeholders.

      Sample of the Guide to Software Selection: A Business Stakeholder Manual deliverable.

      Revisit the metrics you identified and revise your goals

      Track the post-deployment results, compare the metrics, and set new targets for the next fiscal year.

      Example table of 'Baseline Website Performance Metrics' with the column 'Revised Target' highlighted.

      Related Info-Tech Research

      Stock image of two people going over a contract. Modernize Your Corporate Website to Drive Business Value

      Drive higher user satisfaction and value through UX-driven websites.

      Stock image of a person using the cloud on their smartphone. Select and Implement a Web Experience Management Solution

      Your website is your company’s face to the world: select a best-of-breed platform to ensure you make a rock-star impression with your prospects and customers!

      Stock image of people studying analytics. Create an Effective Web Redesign Strategy

      Ninety percent of web redesign projects, executed without an effective strategy, fail to accomplish their goals.

      Bibliography

      "11 Essential Website Data Factors and What They Mean." CivicPlus, n.d. Accessed 26 July 2022.

      “Analytics Usage Distribution in the Top 1 Million Sites.” BuiltWith, 1 Nov. 2022. Accessed 26 July 2022.

      "Analytics Usage Distribution on the Entire Internet." BuiltWith, 1 Nov. 2022. Accessed 26 July 2022.

      Bell, Erica. “How Miller and Smith Used Crazy Egg to Create an Actionable Plan to Improve Website Usability.” Crazy Egg, n.d. Accessed 26 July 2022.

      Brannon, Jordan. "User Behavior Analytics | Enhance The Customer Journey." Coalition Technologies, 8 Nov 2021. Accessed 26 July 2022.

      Cardona, Mercedes. "7 Consumer Trends That Will Define The Digital Economy In 2021." Adobe Blog, 7 Dec 2020. Accessed 26 July 2022.

      “The Finer Points.“ Analytics Features. Google Marketing Platform, 2022. Accessed 26 July 2022.

      Fitzgerald, Anna. "A Beginner’s Guide to Web Analytics." HubSpot, 21 Sept 2022. Accessed 26 July 2022.

      "Form Abandonment: How to Avoid It and Increase Your Conversion Rates." Fullstory Blog, 7 April 2022. Accessed 26 July 2022.

      Fries, Dan. "Plug Sales Funnel Gaps by Identifying and Tracking Micro-Conversions." Clicky Blog, 9 Dec 2019. Accessed 7 July 2022.

      "Funnel Metrics in Saas: What to Track and How to Improve Them?" Userpilot Blog, 23 May 2022. Accessed 26 July 2022.

      Garg, Neha. "Digital Experimentation: 3 Key Steps to Building a Culture of Testing." Contentsquare, 21 June 2021. Accessed 26 July 2022.

      “Global Web Analytics Market Size, Status and Forecast 2021-2027.” 360 Research Reports, 25 Jan. 2021. Web.

      Hamilton, Stephanie. "5 Components of Successful Web Analytics." The Daily Egg, 2011. Accessed 26 July 2022.

      "Hammond, Patrick. "Step-by-Step Guide to Cohort Analysis & Reducing Churn Rate." Amplitude, 15 July 2022. Accessed 26 July 2022.

      Hawes, Carry. "What Is Session Replay? Discover User Pain Points With Session Recordings." Dynatrace, 20 Dec 2021. Accessed 26 July 2022.

      Huss, Nick. “How Many Websites Are There in the World?” Siteefy, 8 Oct. 2022. Web.

      Nelson, Hunter. "Establish Web Analytics and Conversion Tracking Foundations Using the Google Marketing Platform.” Tortoise & Hare Software, 29 Oct 2022. Accessed 26 July 2022.

      "Product Analytics Vs Product Experience Insights: What’s the Difference?" Hotjar, 14 Sept 2021. Accessed 26 July 2022.

      “Record and watch everything your visitors do." Inspectlet, n.d. Accessed 26 July 2022.

      “Ryanair: Using Web Analytics to Manage the Site’s Performance More Effectively and Improve Profitability." AT Internet, 1 April 2020. Accessed 26 July 2022.

      Sibor, Vojtech. "Introducing Cross-Platform Analytics.” Smartlook Blog, 5 Nov 2022. Accessed 26 July 2022.

      "Visualize Visitor Journeys Through Funnels.” VWO, n.d. Accessed 26 July 2022.

      "Web Analytics Market Share – Growth, Trends, COVID-19 Impact, and Forecasts (2022-2027)." Mordor Intelligence, 2022. Accessed 26 July 2022.

      “What is the Best Heatmap Tool for Real Results?” Crazy Egg, 27 April 2020. Web.

      "What Is Visitor Behavior Analysis?" VWO, 2022. Accessed 26 July 2022.

      Zheng, Jack G., and Svetlana Peltsverger. “Web Analytics Overview.” IGI Global, 2015. Accessed 26 July 2022.

      Develop a Use Case for Smart Contracts

      • Buy Link or Shortcode: {j2store}92|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation
      • Organizations today continue to use traditional and often archaic methods of manual processing with physical paper documents.
      • These error-prone methods introduce cumbersome administrative work, causing businesses to struggle with payments and contract disputes.
      • The increasing scale and complexity of business processes has led to many third parties, middlemen, and paper hand-offs.
      • Companies remain bogged down by expensive and inefficient processes while losing sight of their ultimate stakeholder: the customer. A failure to focus on the customer is a failure to do business.

      Our Advice

      Critical Insight

      • Simplify, automate, secure. Smart contracts enable businesses to simplify, automate, and secure traditionally complex transactions.
      • Focus on the customer. Smart contracts provide a frictionless experience for customers by removing unnecessary middlemen and increasing the speed of transactions.
      • New business models. Smart contracts enable the redesign of your organization and business-to-business relationships and transactions.

      Impact and Result

      • Simplify and optimize your business processes by using Info-Tech’s methodology to select processes with inefficient transactions, unnecessary middlemen, and excessive manual paperwork.
      • Use Info-Tech’s template to generate a smart contract use case customized for your business.
      • Customize Info-Tech’s stakeholder presentation template to articulate the goals and benefits of the project and get buy-in from business executives.

      Develop a Use Case for Smart Contracts Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should leverage smart contracts in your business, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      • Develop a Use Case for Smart Contracts – Phases 1-2

      1. Understand smart contracts

      Understand the fundamental concepts of smart contract technology and get buy-in from stakeholders.

      • Develop a Use Case for Smart Contracts – Phase 1: Understand Smart Contracts
      • Smart Contracts Executive Buy-in Presentation Template

      2. Develop a smart contract use case

      Select a business process, create a smart contract logic diagram, and complete a smart contract use-case deliverable.

      • Develop a Use Case for Smart Contracts – Phase 2: Develop the Smart Contract Use Case
      • Smart Contracts Use-Case Template

      [infographic]

      Workshop: Develop a Use Case for Smart Contracts

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Understand Smart Contracts

      The Purpose

      Review blockchain basics.

      Understand the fundamental concepts of smart contracts.

      Develop smart contract use-case executive buy-in presentation.

      Key Benefits Achieved

      Understanding of blockchain basics.

      Understanding the fundamentals of smart contracts.

      Development of an executive buy-in presentation.

      Activities

      1.1 Review blockchain basics.

      1.2 Understand smart contract fundamentals.

      1.3 Identify business challenges and smart contract benefits.

      1.4 Create executive buy-in presentation.

      Outputs

      Executive buy-in presentation

      2 Smart Contract Logic Diagram

      The Purpose

      Brainstorm and select a business process to develop a smart contract use case around.

      Generate a smart contract logic diagram.

      Key Benefits Achieved

      Selected a business process.

      Developed a smart contract logic diagram for the selected business process.

      Activities

      2.1 Brainstorm candidate business processes.

      2.2 Select a business process.

      2.3 Identify phases, actors, events, and transactions.

      2.4 Create the smart contract logic diagram.

      Outputs

      Smart contract logic diagram

      3 Smart Contract Use Case

      The Purpose

      Develop smart contract use-case diagrams for each business process phase.

      Complete a smart contract use-case deliverable.

      Key Benefits Achieved

      Smart contract use-case diagrams.

      Smart contract use-case deliverable.

      Activities

      3.1 Build smart contract use-case diagrams for each phase of the business process.

      3.2 Create a smart contract use-case summary diagram.

      3.3 Complete smart contract use-case deliverable.

      Outputs

      Smart contract use case

      4 Next Steps and Action Plan

      The Purpose

      Review workshop week and lessons learned.

      Develop an action plan to follow through with next steps for the project.

      Key Benefits Achieved

      Reviewed workshop week with common understanding of lessons learned.

      Completed an action plan for the project.

      Activities

      4.1 Review workshop deliverables.

      4.2 Create action plan.

      Outputs

      Smart contract action plan

       

      Industry-Specific Digital Transformation

      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Innovation
      • Parent Category Link: /innovation

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      Infographic

      Domino – Maintain, Commit to, or Vacate?

      If you have a Domino/Notes footprint that is embedded within your business units and business processes and is taxing your support organization, you may have met resistance from the business and been asked to help the organization migrate away from the Lotus Notes platform. The Lotus Notes platform was long used by technology and businesses and a multipurpose solution that, over the years, became embedded within core business applications and processes.

      Our Advice

      Critical Insight

      For organizations that are struggling to understand their options for the Domino platform, the depth of business process usage is typically the biggest operational obstacle. Migrating off the Domino platform is a difficult option for most organizations due to business process and application complexity. In addition, migrating clients have to resolve the challenges with more than one replaceable solution.

      Impact and Result

      The most common tactic is for the organization to better understand their Domino migration options and adopt an application rationalization strategy for the Domino applications entrenched within the business. Options include retiring, replatforming, migrating, or staying with your Domino platform.

      Domino – Maintain, Commit to, or Vacate? Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Domino – Maintain, Commit to, or Vacate? – A brief deck that outlines key migration options for HCL Domino platforms.

      This blueprint will help you assess the fit, purpose, and price of Domino options; develop strategies for overcoming potential challenges; and determine the future of Domino for your organization.

      • Domino – Maintain, Commit to, or Vacate? Storyboard

      2. Application Rationalization Tool – A tool to understand your business-developed applications, their importance to business process, and the potential underlying financial impact.

      Use this tool to input the outcomes of your various application assessments.

      • Application Rationalization Tool

      Infographic

      Further reading

      Domino – Maintain, Commit to, or Vacate?

      Lotus Domino still lives, and you have options for migrating away from or remaining with the platform.

      Executive Summary

      Info-Tech Insight

      “HCL announced that they have somewhere in the region of 15,000 Domino customers worldwide, and also claimed that that number is growing. They also said that 42% of their customers are already on v11 of Domino, and that in the year or so since that version was released, it’s been downloaded 78,000 times. All of which suggests that the Domino platform is, in fact, alive and well.”
      – Nigel Cheshire in Team Studio

      Your Challenge

      You have a Domino/Notes footprint embedded within your business units and business processes. This is taxing your support organization; you are meeting resistance from the business, and you are now asked to help the organization migrate away from the Lotus Notes platform. The Lotus Notes platform was long used by technology and businesses as a multipurpose solution that, over the years, became embedded within core business applications and processes.

      Common Obstacles

      For organizations that are struggling to understand their options for the Domino platform, the depth of business process usage is typically the biggest operational obstacle. Migrating off the Domino platform is a difficult option for most organizations due to business process and application complexity. In addition, migrating clients have to resolve the challenges with more than one replaceable solution.

      Info-Tech Approach

      The most common tactic is for the organization to better understand their Domino migration options and adopt an application rationalization strategy for the Domino applications entrenched within the business. Options include retiring, replatforming, migrating, or staying with your Domino platform.

      Review

      Is “Lotus” Domino still alive?

      Problem statement

      The number of member engagements with customers regarding the Domino platform has, as you might imagine, dwindled in the past couple of years. While many members have exited the platform, there are still many members and organizations that have entered a long exit program, but with how embedded Domino is in business processes, the migration has slowed and been met with resistance. Some organizations had replatformed the applications but found that the replacement target state was inadequate and introduced friction because the new solution was not a low-code/business-user-driven environment. This resulted in returning the Domino platform to production and working through a strategy to maintain the environment.

      This research is designed for:

      • IT strategic direction decision-makers
      • IT managers responsible for an existing Domino platform
      • Organizations evaluating migration options for mission-critical applications running on Domino

      This research will help you:

      1. Evaluate migration options.
      2. Assess the fit and purpose.
      3. Consider strategies for overcoming potential challenges.
      4. Determine the future of this platform for your organization.

      The “everything may work” scenario

      Adopt and expand

      Believe it or not, Domino and Notes are still options to consider when determining a migration strategy. With HCL still committed to the platform, there are options organizations should seek to better understand rather than assuming SharePoint will solve all. In our research, we consider:

      Importance to current business processes

      • Importance of use
      • Complexity in migrations
      • Choosing a new platform

      Available tools to facilitate

      • Talent/access to skills
      • Economies of scale/lower cost at scale
      • Access to technology

      Info-Tech Insight

      With multiple options to consider, take the time to clearly understand the application rationalization process within your decision making.

      • Archive/retire
      • Application migration
      • Application replatform
      • Stay right where you are

      Eliminate your bias – consider the advantages

      “There is a lot of bias toward Domino; decisions are being made by individuals who know very little about Domino and more importantly, they do not know how it impacts business environment.”

      – Rob Salerno, Founder & CTO, Rivet Technology Partners

      Domino advantages include:

      Modern Cloud & Application

      • No-code/low-code technology

      Business-Managed Application

      • Business written and supported
      • Embrace the business support model
      • Enterprise class application

      Leverage the Application Taxonomy & Build

      • A rapid application development platform
      • Develop skill with HCL training

      HCL Domino is a supported and developed platform

      Why consider HCL?

      • Consider scheduling a Roadmap Session with HCL. This is an opportunity to leverage any value in the mission and brand of your organization to gain insights or support from HCL.
      • Existing Domino customers are not the only entities seeking certainty with the platform. Software solution providers that support enterprise IT infrastructure ecosystems (backup, for example) will also be seeking clarity for the future of the platform. HCL will be managing these relationships through the channel/partner management programs, but our observations indicate that Domino integrations are scarce.
      • HCL Domino should be well positioned feature-wise to support low-code/NoSQL demands for enterprises and citizen developers.

      Visualize Your Application Roadmap

      1. Focus on the application portfolio and crafting a roadmap for rationalization.
        • The process is intended to help you determine each application’s functional and technical adequacy for the business process that it supports.
      2. Document your findings on respective application capability heatmaps.
        • This drives your organization to a determination of application dispositions and provides a tool to output various dispositions for you as a roadmap.
      3. Sort the application portfolio into a disposition status (keep, replatform, retire, consolidate, etc.)
        • This information will be an input into any cloud migration or modernization as well as consolidation of the infrastructure, licenses, and support for them.

      Our external support perspective

      by Darin Stahl

      Member Feedback

      • Some members who have remaining Domino applications in production – while the retire, replatform, consolidate, or stay strategy is playing out – have concerns about the challenges with ongoing support and resources required for the platform. In those cases, some have engaged external services providers to augment staff or take over as managed services.
      • While there could be existing support resources (in house or on retainer), the member might consider approaching an external provider who could help backstop the single resource or even provide some help with the exit strategies. At this point, the conversation would be helpful in any case. One of our members engaged an external provider in a Statement of Work for IBM Domino Administration focused on one-time events, Tier 1/Tier 2 support, and custom ad hoc requests.
      • The augmentation with the managed services enabled the member to shift key internal resources to a focus on executing the exit strategies (replatform, retire, consolidate), since the business knowledge was key to that success.
      • The member also very aggressively governed the Domino environment support needs to truly technical issues/maintenance of known and supported functionality rather than coding new features (and increasing risk and cost in a migration down the road) – in short, freezing new features and functionality unless required for legal compliance or health and safety.
      • There obviously are other providers, but at this point Info-Tech no longer maintains a market view or scan of those related to Domino due to low member demand.

      Domino database assessments

      Consider the database.

      • Domino database assessments should be informed through the lens of a multi-value database, like jBase, or an object system.
      • The assessment of the databases, often led by relational database subject matter experts grounded in normalized databases, can be a struggle since Notes databases must be denormalized.
      Key/Value Column

      Use case: Heavily accessed, rarely updated, large amounts of data
      Data Model: Values are stored in a hash table of keys.
      Fast access to small data values, but querying is slow
      Processor friendly
      Based on amazon's Dynamo paper
      Example: Project Voldemort used by LinkedIn

      this is a Key/Value example

      Use case: High availability, multiple data centers
      Data Model: Storage blocks of data are contained in columns
      Handles size well
      Based on Google's BigTable
      Example: Hadoop/Hbase used by Facebook and Yahoo

      This is a Column Example
      Document Graph

      Use case: Rapid development, Web and programmer friendly
      Data Model: Stores documents made up of tagged elements. Uses Key/Value collections
      Better query abilities than Key/Value databases.
      Inspired by Lotus Notes.
      Example: CouchDB used by BBC

      This is a Document Example

      Use case: Best at dealing with complexity and relationships/networks
      Data model: Nodes and relationships.
      Data is processed quickly
      Inspired by Euler and graph theory
      Can easily evolve schemas
      Example: Neo4j

      This is a Graph Example

      Understand your options

      Archive/Retire

      Store the application data in a long-term repository with the means to locate and read it for regulatory and compliance purposes.

      Migrate

      Migrate to a new version of the application, facilitating the process of moving software applications from one computing environment to another.

      Replatform

      Replatforming is an option for transitioning an existing Domino application to a new modern platform (i.e. cloud) to leverage the benefits of a modern deployment model.

      Stay

      Review the current Domino platform roadmap and understand HCL’s support model. Keep the application within the Domino platform.

      Archive/retire

      Retire the application, storing the application data in a long-term repository.

      Abstract

      The most common approach is to build the required functionality in whatever new application/solution is selected, then archive the old data in PDFs and documents.

      Typically this involves archiving the data and leveraging Microsoft SharePoint and the new collaborative solutions, likely in conjunction with other software-as-a-service (SaaS) solutions.

      Advantages

      • Reduce support cost.
      • Consolidate applications.
      • Reduce risk.
      • Reduce compliance and security concerns.
      • Improve business processes.

      Considerations

      • Application transformation
      • eDiscovery costs
      • Legal implications
      • Compliance implications
      • Business process dependencies

      Info-Tech Insights

      Be aware of the costs associated with archiving. The more you archive, the more it will cost you.

      Application migration

      Migrate to a new version of the application

      Abstract

      An application migration is the managed process of migrating or moving applications (software) from one infrastructure environment to another.

      This can include migrating applications from one data center to another data center, from a data center to a cloud provider, or from a company’s on-premises system to a cloud provider’s infrastructure.

      Advantages

      • Reduce hardware costs.
      • Leverage cloud technologies.
      • Improve scalability.
      • Improve disaster recovery.
      • Improve application security.

      Considerations

      • Data extraction, starting from the document databases in NSF format and including security settings about users and groups granted to read and write single documents, which is a powerful feature of Lotus Domino documents.
      • File extraction, starting from the document databases in NSF format, which can contain attachments and RTF documents and embedded files.
      • Design of the final relational database structure; this activity should be carried out without taking into account the original structure of the data in Domino files or the data conversion and loading, from the extracted format to the final model.
      • Design and development of the target-state custom applications based on the new data model and the new selected development platform.

      Application replatform

      Transition an existing Domino application to a new modern platform

      Abstract

      This type of arrangement is typically part of an application migration or transformation. In this model, client can “replatform” the application into an off-premises hosted provider platform. This would yield many benefits of cloud but in a different scaling capacity as experienced with commodity workloads (e.g. Windows, Linux) and the associated application.

      Two challenges are particularly significant when migrating or replatforming Domino applications:

      • The application functionality/value must be reproduced/replaced with not one but many applications, either through custom coding or a commercial-off-the-shelf/SaaS solution.
      • Notes “databases” are not relational databases and will not migrate simply to an SQL database while retaining the same business value. Notes databases are essentially NoSQL repositories and are difficult to normalize.

      Advantages

      • Leverage cloud technologies.
      • Improve scalability.
      • Align to a SharePoint platform.
      • Improve disaster recovery.
      • Improve application security.

      Considerations

      • Application replatform resource effort
      • Network bandwidth
      • New platform terms and conditions
      • Secure connectivity and communication
      • New platform security and compliance
      • Degree of complexity

      Info-Tech Insights

      There is a difference between a migration and a replatform application strategy. Determine which solution aligns to the application requirements.

      Stay with HCL

      Stay with HCL, understanding its future commitment to the platform.

      Abstract

      Following the announced acquisition of IBM Domino and up until around December 2019, HCL had published no future roadmap for the platform. The public-facing information/website at the time stated that HCL acquired “the product family and key lab services to deliver professional services.” Again, there was no mention or emphasis on upcoming new features for the platform. The product offering on their website at the time stated that HCL would leverage its services expertise to advise clients and push applications into four buckets:

      1. Replatform
      2. Retire
      3. Move to cloud
      4. Modernize

      That public-facing messaging changed with release 11.0, which had references to IBM rebranded to HCL for the Notes and Domino product – along with fixes already inflight. More information can be found on HCL’s FAQ page.

      Advantages

      • Known environment
      • Domino is a supported platform
      • Domino is a developed platform
      • No-code/low-code optimization
      • Business developed applications
      • Rapid application framework

      This is the HCL Domino Logo

      Understand your tools

      Many tools are available to help evaluate or migrate your Domino Platform. Here are a few common tools for you to consider.

      Notes Archiving & Notes to SharePoint

      Summary of Vendor

      “SWING Software delivers content transformation and archiving software to over 1,000 organizations worldwide. Our solutions uniquely combine key collaborative platforms and standard document formats, making document production, publishing, and archiving processes more efficient.”*

      Tools

      Lotus Notes Data Migration and Archiving: Preserve historical data outside of Notes and Domino

      Lotus Note Migration: Replacing Lotus Notes. Boost your migration by detaching historical data from Lotus Notes and Domino.

      Headquarters

      Croatia

      Best fit

      • Application archive and retire
      • Migration to SharePoint

      This is an image of the SwingSoftware Logo

      * swingsoftware.com

      Domino Migration to SharePoint

      Summary of Vendor

      “Providing leading solutions, resources, and expertise to help your organization transform its collaborative environment.”*

      Tools

      Notes Domino Migration Solutions: Rivit’s industry-leading solutions and hardened migration practice will help you eliminate Notes Domino once and for all.

      Rivive Me: Migrate Notes Domino applications to an enterprise web application

      Headquarters

      Canada

      Best fit

      • Application Archive & Retire
      • Migration to SharePoint

      This is an image of the RiVit Logo

      * rivit.ca

      Lotus Notes to M365

      Summary of Vendor

      “More than 300 organizations across 40+ countries trust skybow to build no-code/no-compromise business applications & processes, and skybow’s community of customers, partners, and experts grows every day.”*

      Tools

      SkyBow Studio: The low-code platform fully integrated into Microsoft 365

      Headquarters:

      Switzerland

      Best fit

      • Application Archive & Retire
      • Migration to SharePoint

      This is an image of the SkyBow Logo

      * skybow.com | About skybow

      Notes to SharePoint Migration

      Summary of Vendor

      “CIMtrek is a global software company headquartered in the UK. Our mission is to develop user-friendly, cost-effective technology solutions and services to help companies modernize their HCL Domino/Notes® application landscape and support their legacy COBOL applications.”*

      Tools

      CIMtrek SharePoint Migrator: Reduce the time and cost of migrating your IBM® Lotus Notes® applications to Office 365, SharePoint online, and SharePoint on premises.

      Headquarters

      United Kingdom

      Best fit

      • Application replatform
      • Migration to SharePoint

      This is an image of the CIMtrek Logo

      * cimtrek.com | About CIMtrek

      Domino replatform/Rapid application selection framework

      Summary of Vendor

      “4WS.Platform is a rapid application development tool used to quickly create multi-channel applications including web and mobile applications.”*

      Tools

      4WS.Platform is available in two editions: Community and Enterprise.
      The Platform Enterprise Edition, allows access with an optional support pack.

      4WS.Platform’s technical support provides support services to the users through support contracts and agreements.

      The platform is a subscription support services for companies using the product which will allow customers to benefit from the knowledge of 4WS.Platform’s technical experts.

      Headquarters

      Italy

      Best fit

      • Application replatform

      This is an image of the 4WS PLATFORM Logo

      * 4wsplatform.org

      Activity

      Understand your Domino options

      Application Rationalization Exercise

      Info-Tech Insight

      Application rationalization is the perfect exercise to fully understand your business-developed applications, their importance to business process, and the potential underlying financial impact.

      This activity involves the following participants:

      • IT strategic direction decision-makers.
      • IT managers responsible for an existing Domino platform
      • Organizations evaluating platforms for mission-critical applications.

      Outcomes of this step:

      • Completed Application Rationalization Tool

      Application rationalization exercise

      Use this Application Rationalization Tool to input the outcomes of your various application assessments

      In the Application Entry tab:

      • Input your application inventory or subset of apps you intend to rationalize, along with some basic information for your apps.

      In the Business Value & TCO Comparison tab, determine rationalization priorities.

      • Input your business value scores and total cost of ownership (TCO) of applications.
      • Review the results of this analysis to determine which apps should require additional analysis and which dispositions should be prioritized.

      In the Disposition Selection tab:

      • Add to or adapt our list of dispositions as appropriate.

      In the Rationalization Inputs tab:

      • Add or adapt the disposition criteria of your application rationalization framework as appropriate.
      • Input the results of your various assessments for each application.

      In the Disposition Settings tab:

      • Add or adapt settings that generate recommended dispositions based on your rationalization inputs.

      In the Disposition Recommendations tab:

      • Review and compare the rationalization results and confirm if dispositions are appropriate for your strategy.

      In the Timeline Considerations tab:

      • Enter the estimated timeline for when you execute your dispositions.

      In the Portfolio Roadmap tab:

      • Review and present your roadmap and rationalization results.

      Follow the instructions to generate recommended dispositions and populate an application portfolio roadmap.

      This image depicts a scatter plot graph where the X axis is labeled Business Value, and the Y Axis is labeled Cost. On the graph, the following datapoints are displayed: SF; HRIS; ERP; ALM; B; A; C; ODP; SAS

      Info-Tech Insight

      Watch out for misleading scores that result from poorly designed criteria weightings.

      Related Info-Tech Research

      Build an Application Rationalization Framework

      Manage your application portfolio to minimize risk and maximize value.

      Embrace Business-Managed Applications

      Empower the business to implement their own applications with a trusted business-IT relationship.

      Satisfy Digital End Users With Low- and No-Code

      Extend IT, automation, and digital capabilities to the business with the right tools, good governance, and trusted organizational relationships.

      Maximize the Benefits from Enterprise Applications with a Center of Excellence

      Optimize your organization’s enterprise application capabilities with a refined and scalable methodology.

      Drive Successful Sourcing Outcomes With a Robust RFP Process

      Leverage your vendor sourcing process to get better results.

      Research Authors

      Darin Stahl, Principal Research Advisor, Info-Tech Research Group

      Darin Stahl, Principal Research Advisor,
      Info-Tech Research Group

      Darin is a Principal Research Advisor within the Infrastructure practice, leveraging 38+ years of experience. His areas of focus include IT operations management, service desk, infrastructure outsourcing, managed services, cloud infrastructure, DRP/BCP, printer management, managed print services, application performance monitoring, managed FTP, and non-commodity servers (zSeries, mainframe, IBM i, AIX, Power PC).

      Troy Cheeseman, Practice Lead, Info-Tech Research Group

      Troy Cheeseman, Practice Lead,
      Info-Tech Research Group

      Troy has over 24 years of experience and has championed large enterprise-wide technology transformation programs, remote/home office collaboration and remote work strategies, BCP, IT DRP, IT operations and expense management programs, international right placement initiatives, and large technology transformation initiatives (M&A). Additionally, he has deep experience working with IT solution providers and technology (cloud) startups.

      Research Contributors

      Rob Salerno, Founder & CTO, Rivit Technology Partners

      Rob Salerno, Founder & CTO, Rivit Technology Partners

      Rob is the Founder and Chief Technology Strategist for Rivit Technology Partners. Rivit is a system integrator that delivers unique IT solutions. Rivit is known for its REVIVE migration strategy which helps companies leave legacy platforms (such as Domino) or move between versions of software. Rivit is the developer of the DCOM Application Archiving solution.

      Bibliography

      Cheshire, Nigel. “Domino v12 Launch Keeps HCL Product Strategy On Track.” Team Studio, 19 July 2021. Web.

      “Is LowCode/NoCode the best platform for you?” Rivit Technology Partners, 15 July 2021. Web.

      McCracken, Harry. “Lotus: Farewell to a Once-Great Tech Brand.” TIME, 20 Nov. 2012. Web.

      Sharwood, Simon. “Lotus Notes refuses to die, again, as HCL debuts Domino 12.” The Register, 8 June 2021. Web.

      Woodie, Alex. “Domino 12 Comes to IBM i.” IT Jungle, 16 Aug. 2021. Web.

      Establish Effective Data Stewardship

      • Buy Link or Shortcode: {j2store}133|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Data Management
      • Parent Category Link: /data-management
      • Data stewardship is a critical function in modern data governance. Every data-driven firm needs stewards who can tackle data issues and challenges rapidly. Data stewards help to reach agreement on data definition, quality, and usage. They direct efforts aimed at completing metadata, improving data quality, and ensuring regulatory compliance.
      • Stewards must also provide recommendations regarding data access, security, distribution, retention, archiving, and disposal.

      Our Advice

      Critical Insight

      • While the data steward role is crucial to establishing and sustaining effective governance of data, it is the role in the data governance operating structure that is often left ambiguous.
      • It is often perceived as requiring incremental IT skills and one with all new or unfamiliar functions.
      • In the ambition and haste to deliver on data governance, the various data governance role titles are communicated out to the wider organization, with data stewards especially left wondering: “Why am I being asked to be a data steward? What is expected of me? How will succeed in this role?”

      Impact and Result

      To establish effective and impactful data stewardship:

      • Clearly articulate the data stewardship value proposition.
      • Formally design and detail the data steward role, including functions, capabilities, etc.
      • Set up your data stewards for success: having a detailed role definition on paper is certainly not enough. Ensure you go the extra mile to deliver relevant training such as data stewardship onboarding, awareness program, etc.

      Establish Effective Data Stewardship Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Establish Effective Data Stewardship Storyboard – Research that provides a step-by-step approach to aid in the successful establishment of data steward role.

      Use this deck to establish a solid data governance foundation in your organization. Start by defining the value of data stewardship and data governance and demystifying the role.

      • Establish Effective Data Stewardship – Phases 1-3

      2. Data Governance Role Accelerator Kit – A brief deck that defines the clear functions for different roles in data governance.

      This brief guide outlines how to adapt a data governance organizational structure for your organization and defines the roles of data owner, data steward, and data custodian.

      • Data Governance Roles Accelerator Kit
      [infographic]

      Further reading

      Establish Effective Data Stewardship

      Leverage your organization's business subject matter experts to drive impactful data use and handling.

      Analyst perspective

      Leverage your organization's business subject matter experts to drive impactful data use and handling.

      Data stewards bring valuable expertise and knowledge about their business areas: priorities, business capabilities and processes, and challenges and opportunities with respect to data. Because this knowledge cannot be easily replicated, going outside your organization to hire a data steward is not the most effective route.

      While it may seem difficult, organizing internally to harvest the already existing institutional knowledge of your business subject matter experts (SMEs) will give a better – and faster – return when setting up and formalizing data stewardship.

      The role must be well defined and communicated. We cannot expect SMEs to wear a hat without understanding the expectations for their role. They must be set up for success – they must be empowered, recognized, and rewarded.

      Crystal Singh, Director, Research and Advisory, Data and Analytics Practice

      Crystal Singh
      Director, Research and Advisory, Data and Analytics Practice
      Info-Tech Research Group

      Phase breakdown

      Phase 1: Data Stewardship Value Proposition

      • Define the value of data stewardship and data governance, their importance, and the relationship between them.
      • Determine where data stewards fit in the bigger data governance operating structure. The data steward role will not be effective without the other data governance roles.
      • Highlight the gains of effective data stewardship: e.g. data quality management, data definition, data sharing, and the ethical use and handling of data.

      Phase breakdown

      Phase 2: Data Steward Role Design

      • Who makes a good data steward? Important knowledge and skills include subject area expertise, institutional knowledge, collaborative skills, interpersonal, and political skills, an understanding of your organization's culture, and the ability to build good partnerships across business functions and with data management.
      • Seek out SMEs from within your organization. This may require you to mold and shape individuals to step up and into the role. An external hire will give capacity but will be more difficult (and time consuming) to ramp up.
      • Consult internally in your organization. For example, consult and liaise with Human Resources (HR) to determine if job descriptions need to be updated, if there would be any impact to compensation, etc.
      • Determine if this role needs to be a full-time role.
      • Demystify the role. Clarify that this is not an IT role and therefore will not require IT skills.
      • Leverage Info-Tech data governance patterns:
        • Data Stewardship in Action – Sample Data Quality Issue Resolution Process Template and Business Term and Data Definitions
        • Sample Data Steward (and Data Owner) to Data Domain Mapping

      Phase breakdown

      Phase 3: Strategies for Data Stewardship Success

      • Establish a solid data governance foundation in your organization.
      • Develop data stewardship onboarding: e.g. literacy and training, and frequently asked questions (FAQs).
      • Gain support from data owners, the director general (DG) committee, data leadership, and executive leaders/champions.
      • Set up rewards and recognition for the role.
      • Establish a feedback loop/mechanism for data stewards so the stewardship program can be adjusted accordingly.
      • Establish communication and create awareness of the role.

      Establishing effective data stewardship

      Leverage your organization's business SMEs to drive impactful data use and handling.

      Unlock the value of data through people.

      Data Steward Value Proposition
      Clearly articulate the data stewardship value proposition. What's in it for the person, their line of business or mandate, and your organization as a whole.

      Data Steward Role Design
      Formally design and define the role of a data steward, including the functions and capabilities.

      Strategies for Success
      Set up your data stewards for success. Having a detailed role definition on paper is not enough. Ensure that you go the extra mile to deliver the relevant training, such as data stewardship onboarding and an awareness program.

      Executive summary

      Your Challenge Common Obstacles Info-Tech's Approach
      Data stewardship is a critical function in modern data governance. Every data-driven firm needs stewards who can rapidly tackle data issues and challenges. Data stewards help to reach agreement on data definition, quality, and usage. They direct efforts aimed at completing metadata, improving data quality, and ensuring regulatory compliance.
      Stewards must also provide recommendations regarding data access, security, distribution, retention, archiving, and disposal.
      While the data steward role is crucial to establishing and sustaining the effective governance of data, it is the role in the data governance operating structure that is often left unclear, ambiguous, and open to misinterpretation.
      It is often perceived as requiring incremental IT skills and one with all new or unfamiliar functions.
      In the ambition and haste to deliver on data governance, the various data governance role titles are communicated to the wider organization, often leaving data stewards wondering why they are being asked to be a data steward, what is expected of them, and how they will succeed in this role.
      Info-Tech's approach to establish effective and impactful data stewardship:
      • Clearly articulate the data stewardship value proposition.
      • Formally design and define the role of data steward, including the functions and capabilities.
      • Set up your data stewards for success. Having a detailed role definition on paper is not enough. Ensure that you go the extra mile to deliver the relevant training, such as data stewardship onboarding and an awareness program.

      Info-Tech Insight
      Effective data governance requires a solid foundation. Data stewards provide the foundation for data governance. The time and effort to define this role properly will yield sound data governance return.

      Phase 1: Data Stewardship Value Proposition

      What is the VALUE of a DATA STEWARD?

      Value of a Data Steward

      Improved Data Quality Management

      Clear and Consistent Data Definition

      Increased Data Sharing and Collaboration

      Ethical Handling of Data

      Define the strategic value of data in your organization

      Harness the value of data to power intelligent and transformative organizational performance.

      Optimize the way you serve your stakeholders.

      Respond to industry disruption.

      Develop products and services to meet ever-evolving needs.

      Manage operations and mitigate risk.

      Data governance is an enabling framework of decision rights, responsibilities, and accountabilities for data assets across an organization.

      Data governance is:

      • Executed according to agreed-upon models that describe who can take what actions with what information, when, and using what methods (CIO.com, 2021).
      • True business-IT collaboration that leads to increased consistency and confidence in data to support decision making

      If done correctly, data governance is not:

      • An annoying, finger-waving roadblock in the way of getting things done
      • An inhibitor or impediment to using and sharing data

      Data governance is about putting guard rails in place to better support the use and handling of your organization's data.

      Is there a clear definition of data accountability and responsibility in your organization?

      Recruit and Retain People of Color in IT

      • Buy Link or Shortcode: {j2store}546|cart{/j2store}
      • member rating overall impact: 9.7/10 Overall Impact
      • member rating average dollars saved: $19,184 Average $ Saved
      • member rating average days saved: 21 Average Days Saved
      • Parent Category Name: Engage
      • Parent Category Link: /engage
      • Organizations have been trying to promote equality for many years. Diversity and inclusion strategies and a myriad of programs have been implemented in companies across the world. Despite the attempts, many organizations still struggle to ensure that their workforce is representative of the populations they support or want to support.
      • IT brings another twist. Many IT companies and departments are based on the culture of white males, and underrepresented ethnic communities find it more of a challenge to fit in.
      • This sometimes means that talented minorities are less incentivized to join or stay in technology.

      Our Advice

      Critical Insight

      • Diversity and inclusion cannot be a one-time campaign or a one-off initiative.
      • For real change to happen, every leader needs to internalize the value of creating and retaining diverse teams.

      Impact and Result

      • To stay competitive, IT leaders need to be more involved and commit to a plan to recruit and retain people of color in their departments and organizations. A diverse team is an answer to innovation that can differentiate your company.
      • Treat recruiting and retaining a diverse team as a business challenge that requires full engagement. Info-Tech offers a targeted solution that will help IT leaders build a plan to attract, recruit, engage, and retain people of color.

      Recruit and Retain People of Color in IT Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should recruit and retain people of color in your IT department or organization, review Info-Tech’s methodology, and understand the ways we can support you in this endeavor.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Recruit people of color in IT

      Diverse teams are necessary to foster creativity and guide business strategies. Overcome limitations by recruiting people of color and creating a diverse workforce.

      • Recruit and Retain People of Color in IT – Phase 1: Recruit People of Color in IT
      • Support Plan
      • IT Behavioral Interview Question Library

      2. Retain people of color in IT

      Underrepresented employees benefit from an expansive culture. Create an inclusive environment and retain people of color and promote value within your organization.

      • Recruit and Retain People of Color in IT – Phase 2: Retain People of Color in IT

      Infographic

      Workshop: Recruit and Retain People of Color in IT

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Setting the Stage

      The Purpose

      Introduce challenges and concerns around recruiting and retaining people of color.

      Key Benefits Achieved

      Gain a sense of direction.

      Activities

      1.1 Introduction to diversity conversations.

      1.2 Assess areas to focus on and determine what is right, wrong, missing, and confusing.

      1.3 Obtain feedback from your team about the benefits of working at your organization.

      1.4 Establish your employee value proposition (EVP).

      1.5 Discuss and establish your recruitment goals.

      Outputs

      Current State Analysis

      Right, Wrong, Missing, Confusing Quadrant

      Draft EVP

      Recruitment Goals

      2 Refine Your Recruitment Process

      The Purpose

      Identify areas in your current recruitment process that are preventing you from hiring people of color.

      Establish a plan to make improvements.

      Key Benefits Achieved

      Optimized recruitment process

      Activities

      2.1 Brainstorm and research community partners.

      2.2 Review current job descriptions and equity statement.

      2.3 Update job description template and equity statement.

      2.4 Set team structure for interview and assessment.

      2.5 Identify decision-making structure.

      Outputs

      List of community partners

      Updated job description template

      Updated equity statement

      Interview and assessment structure

      Behavioral Question Library

      3 Culture and Management

      The Purpose

      Create a plan for an inclusive culture where your managers are supported.

      Key Benefits Achieved

      Awareness of how to better support employees of color.

      Activities

      3.1 Discuss engagement and belonging.

      3.2 Augment your onboarding materials.

      3.3 Create an inclusive culture plan.

      3.4 Determine how to support your management team.

      Outputs

      List of onboarding content

      Inclusive culture plan

      Management support plan

      4 Close the Loop

      The Purpose

      Establish mechanisms to gain feedback from your employees and act on them.

      Key Benefits Achieved

      Finalize the plan to create your diverse and inclusive workforce.

      Activities

      4.1 Ask and listen: determine what to ask your employees.

      4.2 Create your roadmap.

      4.3 Wrap-up and next steps.

      Outputs

      List of survey questions

      Roadmap

      Completed support plan

      Manage End-User Devices

      • Buy Link or Shortcode: {j2store}307|cart{/j2store}
      • member rating overall impact: 10.0/10 Overall Impact
      • member rating average dollars saved: $45,499 Average $ Saved
      • member rating average days saved: 10 Average Days Saved
      • Parent Category Name: End-User Computing Devices
      • Parent Category Link: /end-user-computing-devices
      • Desktop and mobile device management teams use separate tools and different processes.
      • People at all levels of IT are involved in device management.
      • Vendors are pushing unified endpoint management (UEM) products, and teams struggling with device management are hoping that UEM is their savior.
      • The number and variety of devices will only increase with the continued advance of mobility and emergence of the Internet of Things (IoT).

      Our Advice

      Critical Insight

      • Many problems can be solved by fixing roles, responsibilities, and process. Standardize so you can optimize.
      • UEM is not a silver bullet. Your current solution can image computers in less than 4 hours if you use lean images.
      • Done with, not done to. Getting input from the business will improve adoption, avoid frustration, and save everyone time.

      Impact and Result

      • Define the benefits that you want to achieve and optimize based on those benefits.
      • Take an evolutionary, rather than revolutionary, approach to merging end-user support teams. Process and tool unity comes first.
      • Define the roles and responsibilities involved in end-user device management, and create a training plan to ensure everyone can execute their responsibilities.
      • Stop using device management practices from the era of Windows XP. Create a plan for lean images and app packages.

      Manage End-User Devices Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out why you should optimize end-user device management, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Identify the business and IT benefits of optimizing endpoint management

      Get your desktop and mobile device support teams out of firefighting mode by identifying the real problem.

      • Manage End-User Devices – Phase 1: Identify the Business and IT Benefits
      • End-User Device Management Standard Operating Procedure
      • End-User Device Management Executive Presentation

      2. Improve supporting teams and processes

      Improve the day-to-day operations of your desktop and mobile device support teams through role definition, training, and process standardization.

      • Manage End-User Devices – Phase 2: Improve Supporting Teams and Processes
      • End-User Device Management Workflow Library (Visio)
      • End-User Device Management Workflow Library (PDF)

      3. Improve supporting technologies

      Stop using management tools and techniques from the Windows XP era. Save yourself, and your technicians, from needless pain.

      • Manage End-User Devices – Phase 3: Improve Supporting Technologies
      [infographic]

      Workshop: Manage End-User Devices

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Identify the Business and IT Benefits of Optimizing End-User Device Management

      The Purpose

      Identify how unified endpoint management (UEM) can improve the lives of the end user and of IT.

      Key Benefits Achieved

      Cutting through the vendor hype and aligning with business needs.

      Activities

      1.1 Identify benefits you can provide to stakeholders.

      1.2 Identify business and IT goals in order to prioritize benefits.

      1.3 Identify how to achieve benefits.

      1.4 Define goals based on desired benefits.

      Outputs

      Executive presentation

      2 Improve the Teams and Processes That Support End-User Device Management

      The Purpose

      Ensure that your teams have a consistent approach to end-user device management.

      Key Benefits Achieved

      Developed a standard approach to roles and responsibilities, to training, and to device management processes.

      Activities

      2.1 Align roles to your environment.

      2.2 Assign architect-, engineer-, and administrator-level responsibilities.

      2.3 Rationalize your responsibility matrix.

      2.4 Ensure you have the necessary skills.

      2.5 Define Tier 2 processes, including patch deployment, emergency patch deployment, device deployment, app deployment, and app packaging.

      Outputs

      List of roles involved in end-user device management

      Responsibility matrix for end-user device management

      End-user device management training plan

      End-user device management standard operating procedure

      Workflows and checklists of end-user device management processes

      3 Improve the Technologies That Support End-User Device Management

      The Purpose

      Modernize the toolset used by IT to manage end-user devices.

      Key Benefits Achieved

      Saving time and resources for many standard device management processes.

      Activities

      3.1 Define the core image for each device/OS.

      3.2 Define app packages.

      3.3 Gather action items for improving the support technologies.

      3.4 Create a roadmap for improving end-user device management.

      3.5 Create a communication plan for improving end-user device management.

      Outputs

      Core image outline

      Application package outline

      End-user device management roadmap

      End-user device management communication plan

      Build a Continual Improvement Program

      • Buy Link or Shortcode: {j2store}463|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Operations Management
      • Parent Category Link: /i-and-o-process-management
      • IT managers must work hard to maintain and improve service quality or risk performance deterioration over time.
      • Leadership may feel lost about what to do next and which initiatives have higher priority for improvement.
      • The backlog of improvement initiatives makes the work even harder. Managers should involve the right people in the process and build a team that is responsible to monitor, measure, prioritize, implement, and test improvements.

      Our Advice

      Critical Insight

      • Without continual improvement, sustained service quality will be temporary. Organizations need to put in place an ongoing process to detect potential services, enhance their procedures, and sustain their performance, whatever the process maturity is.

      Impact and Result

      • Set strategic vision for the continual improvement program.
      • Build a team to set regulations, processes, and audits for the program.
      • Set measurable targets for the program.
      • Identify and prioritize improvement initiatives.
      • Measure and monitor progress to ensure initiatives achieve the desired outcome.
      • Apply lessons learned to the next initiatives.

      Build a Continual Improvement Program Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Build a Continual Improvement Program – A step-by-step document to walk you through building a plan for efficient IT continual improvement.

      This storyboard will help you craft a continual improvement register and a workflow to ensure sustained service improvements that fulfill ongoing increases in stakeholder expectations.

      • Build a Continual Improvement Program Storyboard

      2. Continual Improvement Register and Workflow – Structured documents to help you outline improvement initiatives, prioritize them, and build a dashboard to streamline tracking.

      Use the Continual Improvement Register and Continual Improvement Workflow to help you brainstorm improvement items, get a better visibility into the items, and plan to execute improvements.

      • Continual Improvement Register
      • Continual Improvement Workflow (Visio)
      • Continual Improvement Workflow (PDF)
      [infographic]

      Further reading

      Build a Continual Improvement Program

      Don’t stop with process standardization; plan to continually improve and help those improvements stick.

      Analyst Perspective

      Go beyond standardizing basics

      IT managers often learn how to standardize IT services. Where they usually fail is in keeping these improvements sustainable. It’s one thing to build a quality process, but it’s another challenge entirely to keep momentum and know what to do next.

      To fill the gap, build a continual improvement plan to continuously increase value for stakeholders. This plan will help connect services, products, and practices with changing business needs.

      Without a continual improvement plan, managers may find themselves lost and wonder what’s next. This will lead to misalignment between ongoing and increasingly high stakeholder expectations and your ability to fulfill these requirements.

      Build a continual improvement program to engage executives, leaders, and subject matter experts (SMEs) to go beyond break fixes, enable proactive enhancements, and sustain process changes.

      Photo of Mahmoud Ramin, Ph.D., Senior Research Analyst, Infrastructure and Operations, Info-Tech Research Group. Mahmoud Ramin, Ph.D.
      Senior Research Analyst
      Infrastructure and Operations
      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Even high-quality services and products need to be aligned with rising stakeholder expectations to sustain operational excellence.
      • Without the right leadership, commitment, and processes, improvements in service quality can be difficult to sustain.
      • Continual improvement is not only a development plan but also an organizational culture shift, which makes stakeholder buy-in even challenging.

      Common Obstacles

      • IT managers must work hard to maintain and improve service quality or risk performance deterioration over time.
      • Leadership feels lost about what to do next and which initiatives have higher priority for improvement.
      • A backlog of improvement initiatives makes the work even harder. Managers should involve the right people in the process and build a team that is responsible for monitoring, measuring, prioritizing, implementing, and testing improvements.

      Info-Tech’s Approach

      • Set a strategic vision for the continual improvement program.
      • Build a team to set regulations, processes, and audits for the program.
      • Set measurable targets for the program.
      • Identify and prioritize improvement initiatives.
      • Measure and monitor progress to ensure initiatives achieve the desired outcome.
      • Apply lessons learned to the next initiatives.

      Info-Tech Insight

      Without continual improvement, any process maturity achieved around service quality will not be sustained. Organizations need to put in place an ongoing program to maintain their current maturity and continue to grow and improve by identifying new services and enhancing existing processes.

      Purpose of continual improvement

      There should be alignment between ongoing improvements of business products and services and management of these products and services. Continual improvement helps service providers adapt to changing environments. No matter how critical the service is to the business, failure to continually improve reduces the service value.

      Image of a notebook with an illustration titled 'Continuous Improvement'.

      Continual improvement is one of the five elements of ITIL’s Service Value System (SVS).

      Continual improvement should be documented in an improvement register to record and manage improvement initiatives.

      Continual improvement is a proactive approach to service management. It involves measuring the effectiveness and efficiency of people, processes, and technology to:

      • Identify areas for improvement.
      • Adapt to changes in the business environment.
      • Align the IT strategy to organizational goals.

      A continual improvement process helps service management move away from a reactive approach that focuses only on fixing problems as they occur.

      Info-Tech Insight

      Make sure the basics are in place before you embark on a continual improvement initiative.

      Benefits of embedding a cross-organizational continual improvement approach

      Icon of a computer screen. Encourage end users to provide feedback on service quality. Icon of a crossed pencil and wrench.

      Provide an opportunity to stakeholders to define requirements and raise their concerns.

      Icon of a storefront.

      Embed continual improvement in all service delivery procedures.

      Icon of chevrons moving backward.

      Turn failures into improvement opportunities rather than contributing to a blame culture.

      Icon of a telescope.

      Improve practice effectiveness that enhances IT efficiency.

      Icon of a thumbs up in a speech bubble.

      Improve end-user satisfaction that positively impacts brand reputation.

      Icon of shopping bags.

      Improve operational costs while maintaining a high level of satisfaction.

      Icon of a magnifying glass over a map marker.

      Help the business become more proactive by identifying and improving services.

      Info-Tech Insight

      It’s the responsibility of the organization’s leaders to develop and promote a continual improvement culture. Work with the business unit leads and communicate the benefits of continual improvement to get their buy-in for the practice and achieve the long-term impact.

      Build a feedback program to get input into where improvement initiatives are needed

      A well-maintained continual improvement process creates a proper feedback mechanism for the following stakeholder groups:
      • Users
      • Suppliers
      • Service delivery team members
      • Service owners
      • Sponsors
      An efficient feedback mechanism should be constructed around the following initiatives:
      Target with an arrow in the bullseye. The arrow has four flags: 'Perceived value by users', 'Service effectiveness', 'Service governance', and 'Service demand'.
      Stakeholders who participate in feedback activities should feel comfortable providing suggestions for improvement.

      Work closely with the service desk team to build communication channels to conduct surveys. Avoid formal bureaucratic communications and enforce openness in communicating the value of feedback the stakeholders can provide.

      Info-Tech Insight

      When conducting feedback activities with users, keep surveys anonymous and ensure users’ information is kept confidential. Make sure everyone else is comfortable providing feedback in a constructive way so that you can seek clarification and create a feedback loop.

      Implement an iterative continual improvement model and ensure that your services align with your organizational vision

      Build a six-step process for your continual improvement plan. Make it a loop, in which each step becomes an input for the next step. A cycle around a dartboard with numbered steps: '01 Determine your goals', '02 Define the process team', '03 Determine initiatives', '04 Prioritize initiatives', '05 Execute improvement', '06 Establish a learning culture'.

      1. Determine your goals

      A vision statement communicates your desired future state of the IT organization.

      Your IT goals should always support your organizational goals. IT goals are high-level objectives that the IT organization needs to achieve to reach a target state.
      A cycle of the bolded statements on the right surrounding a dartboard with two bullseyes.

      Understand the high-level business objectives to set the vision for continual improvement in a way that will align IT strategies with business strategies.

      Obtaining a clear picture of your organization’s goals and overall corporate strategy is one of the crucial first steps to continual improvement and will set the stage for the metrics you select. Document your continual improvement program goals and objectives.

      Knowing what your business is doing and understanding the impact of IT on the business will help you ensure that any metrics you collect will be business focused.

      Understanding the long-term vision of the business and its appetite for commitment and sponsorship will also inform your IT strategy and continual improvement goals.

      Assess the future state

      At this stage, you need to visualize improvement, considering your critical success factors.

      Critical success factors (CSFs) are higher-level goals or requirements for success, such as improving end-user satisfaction. They’re factors that must be met in order to reach your IT and business strategic vision.

      Select key performance indicators (KPIs) that will identify useful information for the initiative: Define KPIs for each CSF. These will usually involve a trend, as an increase or decrease in something. If KPIs already exist for your IT processes, re-evaluate them to assess their relevance to current strategy and redefine if necessary. Selected KPIs should provide a full picture of the health of targeted practice.

      KPIs should cover these four vectors of practice performance:

      1. Quantity
        How many continual improvement initiatives are in progress
      2. Quality
        How well you implemented improvements
      3. Timeliness
        How long it took to get continual improvement initiatives done
      4. Compliance
        How well processes and controls are being executed, such as system availability
      Cross-section of a head split into sections with icons in the middle sections.

      Examples of key CSFs and KPIs for continual improvement

      CSF

      KPI

      Adopt and maintain an effective approach for continual improvement Improve stakeholder satisfaction due to implementation of improvement initiatives.
      Enhance stakeholder awareness about continual improvement plan and initiatives.
      Increase continual improvement adoption across the organization.
      Commit to effective continual improvement across the business Improve the return on investment.
      Increase the impact of the improvement initiatives on process maturity.
      Increase the rate of successful improvement initiatives.

      Prepare a vision statement to communicate the improvement strategy

      IT Implications + Business Context –› IT Goals
      • IT implications are derived from the business context and inform goals by aligning the IT goals with the business context.
      • Business context encompasses an understanding of the factors impacting the business from various perspectives, how the business makes decisions, and what it is trying to achieve.
      • IT goals are high-level, specific objectives that the IT organization needs to achieve to reach the target state. IT goals begin a process of framing what IT as an organization needs to be able to do in the target state.

      IT goals will help identify the target state, IT capabilities, and the initiatives that will need to be implemented to enable those capabilities.

      The vision statement is expressed in the present tense. It seeks to articulate the desired role of IT and how IT will be perceived.

      Strong IT vision statements have the following characteristics:
      Arrow pointing right. Describe a desired future
      Arrow pointing right. Focus on ends, not means
      Arrow pointing right. Communicate promise
      Arrow pointing right. Work as an elevator pitch:
      • Concise; no unnecessary words
      • Compelling
      • Achievable
      • Inspirational
      • Memorable

      2. Define the process team

      The structure of each continual improvement team depends on resource availability and competency levels.

      Make sure to allocate continual improvement activities to the available resources and assess the requirement to bring in others to fulfill all tasks.

      Brainstorm what steps should be included in a continual improvement program:

      • Who is responsible for identifying, logging, and prioritizing improvement opportunities?
      • Who makes the business case for improvement initiatives?
      • Who is the owner of the register, responsible for documenting initiatives and updating their status?
      • Who executes implementation?
      • Who evaluates implementation success?
      Match stakeholder skill sets with available resources to ensure continual improvement processes are handled properly. Brainstorm skills specific to the program:
      • Knowledge of provided products and services.
      • Good understanding of organization’s goals and objectives.
      • Efficiency in collecting and measuring metrics, understanding company standards and policies, and presenting them to impacted stakeholders.
      • Competency in strategic thinking and aligning the organization’s goals with improvement initiatives.

      Enable the continual improvement program by clarifying responsibilities

      Determine roles and responsibilities to ensure accountability

      The continual improvement activities will only be successful if specific roles and responsibilities are clearly identified.

      Depending on available staff and resources, you may be able to have full-time continual improvement roles, or you may include continual improvement activities in individuals’ job descriptions.

      Each improvement action that you identify should have clear ownership and accountability to ensure that it is completed within the specified timeframe.

      Roles and responsibilities can be reassigned throughout the continual improvement process.

      Info-Tech Insight

      Create cross-functional teams to improve perspective and not focus on only one small group when trying to problem solve. Having other teams hear and reframe the issue or talk about how they can help to solve issues as a team can create bigger solutions that will help the entire IT team, not just one group.

      Consider assigning dedicated continual improvement roles

      Silhouette of a business person.
      CI Coordinator

      Continual improvement coordinators are responsible for moving projects to the implementation phase and monitoring all continual improvement roles.

      Silhouette of a business person.
      Business Owner

      Business owners are accountable for business governance, compliance, and ROI analysis. They are responsible for operational and monetary aspects of the business.

      Silhouette of a business person.
      IT Owner

      IT owners are responsible for developing the action plan and ensuring success of the initiatives. They are usually the subject matter experts, focusing on technical aspects.

      3. Determine improvement initiatives

      Businesses usually make the mistake of focusing too much on making existing processes better while missing gaps in their practices.

      Gather stakeholder feedback to help you evaluate the maturity levels of IT practices Sample of the End User Satisfaction Survey.

      You need to understand the current state of service operations to understand how you can provide value through continual improvement. Give everyone an opportunity to provide feedback on IT services.

      Use Info-Tech’s End User Satisfaction Survey to define the state of your core IT services.

      Info-Tech Insight

      Become proactive to improve satisfaction. Continual improvement is not only about identifying pain points and improving them. It enables you to proactively identify initiatives for further service improvement using both practice functionality and technology enablement.

      Understand the current state of your IT practices

      Determine the maturity level of your IT areas to help you understand which processes need improvement. Involve the practice team in maturity assessment activities to get ideas and input from them. This will also help you get their buy-in and engagement for improvement.

      Leverage performance metrics to analyze performance level. Metrics play a key role in understanding what needs improvement. After you implement metrics, have an impact report regularly generated to monitor them.

      Use problem management to identify root causes for the identified gaps. Potential sources of problems can be:

      • Recurring issues that may be an indicator of an underlying problem.
      • Business processes or service issues that are not IT related, such as inefficient business process or service design issues.

      Establish an improvement roadmap and execute initiatives

      Build a continual improvement register (CIR) for your target initiatives

      A CIR is a document used for recording your action plan from the beginning to the end of the improvement project.

      If you just sit and plan for improvements without acting on them, nothing will improve. CIR helps you create an action plan and allows you to manage, track, and prioritize improvement suggestions.

      Consider tracking the following information in your CIR, adjusted to meet the needs of your organization:

      Information

      Description

      Business value impact Identify approved themes or goals that each initiative should apply to. These can and should change over time based on changing business needs.
      Effort/cost Identify the expected effort or cost the improvement initiative will require.
      Priority How urgent is the improvement? Categorize based on effort, cost, and risk levels.
      Status Ensure each initiative has a status assigned that reflects its current state.
      Timeline List the timeframe to start the improvement initiative based on the priority level.
      CI functional groups Customize the functional groups in your CI program

      Populate your register with ideas that come from your first round of assessments and use this document to continually add and track new ideas as they emerge.

      You can also consider using the register to track the outcomes and benefits of improvement initiatives after they have been completed.

      Activity: Use the Continual Improvement Register template to brainstorm responsibilities, generate improvement initiatives, and action plan

      1-3 hours
      1. Open the Continual Improvement Register template and navigate to tab 2, Setup.
      2. Brainstorm your definitions for the following items to get a clear understanding of these items when completing the CIR. The more quantification you apply to the criteria, the more tangible evaluation you will do:
        • Business value impact categories
        • Effort/cost
        • Priority
        • Status
        • Timeline
      3. Discuss the teams that the upcoming initiatives will belong to and update them under CI Functional Groups.
      1. Analyze the assessment data collected throughout stakeholder feedback and your current-state evaluation.
      2. Use this data to generate a list of initiatives that should be undertaken to improve the performance of the targeted processes.
      3. Use sticky notes to record identified CI initiatives.
      4. Record each initiative in tab 3, CI Register, along with associated information:
        • A unique ID number for the initiative
        • The individual who submitted the idea
        • The team the initiative belongs to
        • A description of the initiative

      Download the Continual Improvement Register template

      Activity: Use the Continual Improvement Register template to brainstorm responsibilities, generate improvement initiatives, and action plan

      Input

      • List of key stakeholders for continual improvement
      • Current state of services and processes

      Output

      • Continual improvement register setup
      • List of initiatives for continual improvement

      Materials

      • Continual improvement register
      • Whiteboard/flip charts
      • Markers
      • Laptops

      Participant

      • CIO
      • IT managers
      • Project managers
      • Continual improvement manager/coordinator

      4. Prioritize initiatives

      Prioritization should be transparent and available to stakeholders.

      Some initiatives are more critical than others to achieve and should be prioritized accordingly. Some improvements require large investments and need an equally large effort, while some are relatively low-cost, low-effort improvements. Focus on low-hanging fruit and prioritize low-cost, low-effort improvements to help the organization with rapid growth. This will also help you get stakeholder buy-in for the rest of your continual improvement program.

      Prioritize improvement initiatives in your CIR to increase visibility and ensure larger improvement initiatives are done the next cycle. As one improvement cycle ends, the next cycle begins, which allows the continual improvement team to keep pace with changing business requirements.

      Stock image of a person on a ladder leaning against a bookshelf.

      Identify “quick wins” that can provide immediate improvement

      Prioritize these quick wins to immediately demonstrate the success of the continual service improvement effort to the business.

      01

      Keep the scope of the continual improvement process manageable at the beginning by focusing on a few key areas that you want to improve.
      • If you have identified pain points, addressing these will demonstrate the value of the project to the business to gain their support.
      • Choose the services or processes that continue to disrupt or threaten service – focus on where pain points are evident and where there is a need for improvement.
      • Critical services to improve should emerge from the current-state assessments.

      02

      From your list of proposed improvements, focus on a few of the top pain points and plan to address those.

      03

      Choose the right services to improve at the first stage of continual improvement to ensure that the continual improvement process delivers value to the business.

      Activity: Prioritize improvement initiatives

      2-3 hours

      Input: List of initiatives for continual improvement

      Output: Prioritized list of initiatives

      Materials: Continual improvement register, Whiteboard/flip charts, Markers, Laptops

      Participants: CIO, IT managers, Project managers, Continual improvement manager

      1. In the CI Register tab of the Continual Improvement Register template, define the status, priority, effort/cost, and timeline according to the definition of each in the data entry tab.
      2. Review improvement initiatives from the previous activity.
      3. Record the CI coordinator, business owner, and IT owner for each initiative.
      4. Fill out submission date to track when the initiative was added to the register.
      5. According to the updated items, you will get a dashboard of items based on their categories, effort, priority, status, and timeline. You will also get a visibility into the total number of improvement initiatives.
      6. Focus on the short-term initiatives that are higher priority and require less effort.
      7. Refer to the Continual Improvement Workflow template and update the steps.

      Download the Continual Improvement Register template

      Download the Continual Improvement Workflow template

      5. Execute improvement

      Develop a plan for improvement

      Determine how you want to reach your improvement objectives. Define how to make processes work better.
      Icons representing steps. Descriptions below.
      Make a business case for your action plan Determine budget for implementing the improvement and move to execution. Find out how long it takes to build the improvement in the practice. Confirm the resources and skill sets you require for the improvement. Communicate the improvement plan across the business for better visibility and for seamless organizational change management, if needed. Lean into incremental improvements to ensure practice quality is sustained, not temporary. Put in place an ongoing process to audit, enhance, and sustain the performance of the target practice.

      Create a specific action plan to guide your improvement activities

      As part of the continual improvement plan, identify specific actions to be completed, along with ownership for each action.

      The continual improvement process must:

      • Define activities to be completed.
      • Create roles and assign ownership to complete activities.
      • Provide training and awareness about the initiative.
      • Define inputs and outputs.
      • Include reporting.

      For each action, identify:

      • The problem.
      • Who will be responsible and accountable.
      • Metric(s) for assessment.
      • Baseline and target metrics.
      • Action to be taken to achieve improvement (training, new templates, etc.).

      Choose timelines:

      • Firm timelines are important to keep the project on track.
      • One to two months for an initiative is an ideal length of time to maintain interest and enthusiasm for the specific project and achieve a result.

      Info-Tech Insight

      Every organization is unique in terms of its services, processes, strengths, weaknesses, and needs, as well as the expectations of its end users. There is no single action plan that will work for everyone. The improvement plan will vary from organization to organization, but the key elements of the plan (i.e. specific priorities, timelines, targets, and responsibilities) should always be in place.

      Build a communication plan to ensure the implementation of continual improvement stakeholder buy-in

      1. Throughout the improvement process, share information about both the status of the project and the impact of the improvement initiatives.
      Icon of a group of people. Encourage a collaborative environment across all members of the practice team.
      Icon of an ascending graph. Motivate every individual to continue moving upward and taking ownership over their roles.
      Icon of overlapping speech bubbles. Communication among team members ensures that everyone is on the same page working together toward a common goal.
      Icon of a handshake. The most important thing is to get the support of your team. Unless you have their support, you won’t be able to deliver any of the solutions you draw up.
      2. The end users should be kept in the loop so they can feel that their contribution is valued.
      Icon of an arrow pointing right. When improvements happen and only a small group of people are involved in the results and action plan, misconceptions will arise.
      Icon of a thumbs up in a speech bubble. If communication is lacking, end users will provide less feedback on the practice improvements.
      Icon of a cone made of stacked layers. For end users to feel their concerns are being considered, you must communicate the findings in a way that conveys the impact of their contribution.

      Info-Tech Insight

      To be effective, continual improvement requires open and honest feedback from IT staff. Debriefings work well for capturing information about lessons learned. Break down the debriefings into smaller, individual activities completed within each phase of the project to better capture the large amount of data and lessons learned within that phase.

      Measure the success of your improvement program

      Continual improvement is everybody’s job within the organization.

      Determine how improvements impacted stakeholders. Build a relationship pyramid to analyze how improvements impacted external users and narrow down to the internal users, implementing team, and leaders.
      1. How did we make improvements with our partners and suppliers? –› Look into your contracts and measure the SLAs and commitments.
      2. How could improvement initiatives impact the organization? –› Involve everybody to provide feedback. Rerun the end-user satisfaction survey and compare with the baseline that you obtained before improvement implementation.
      3. How does the improvement team feel about the whole process? –› What were the lessons learned, and can the team apply the lessons in the next improvement initiatives?
      4. How did the leaders manage and lead improvements? –› Were they able to provide proper vision to guide the improvement team through the process?
      A relationship pyramid with the initial questions on the left starting from '1' at the bottom to '4' at the 2nd highest level.

      Measure changes in selected metrics to evaluate success

      Measuring and reporting are key components in the improvement process.

      Adjust improvement priority based on updated objectives. Justify the reason. Refer to your CIR to document it.

      Did you get there?

      Part of the measurement should include a review of CSFs and KPIs determined in step 1 (assess the future state). Some may need to be replaced.

      • After an improvement has been implemented, it is important to regularly monitor and evaluate the CSFs and KPIs you chose and run reports to evaluate whether the implemented improvement has actually resolved the service/process issues or helped you achieve your objectives.
      • Establish a schedule for regularly reviewing key metrics that were identified in Step 1 and assessing change in those metrics and progress toward reaching objectives.
      • In addition to reviewing CSFs, KPIs, and metrics, check in with the IT organization and end users to measure their perceptions of the change once an appropriate amount of time has passed.
      • Ensure that metrics are telling the whole story and that reporting is honest in order to be informative.
      Outcomes of the continual improvement process should include:
      • Improved efficiency, effectiveness, and quality of processes and services.
      • Processes and services more aligned with the business needs and strategy.
      • Maturity of processes and services.

      For a guideline to determine a list of metrics, refer to Info-Tech’s blueprints:

      Info-Tech Insight

      Make sure you’re measuring the right things and considering all sources of information. Don’t rely on a single or very few metrics. Instead, consider a group of metrics to help you get a better holistic view of improvement initiatives and their impact on IT operations.

      6. Establish a learning culture and apply it to other practices

      Reflect on lessons learned to drive change forward

      What did you learn?
      Icon of a checklist and pencil. Ultimately, continual improvement is an ongoing educational program.
      Icon of a brain with a lighting bolt.
      Icon of a wrench in a speech bubble. By teaching your team how to learn better and identify sources of new knowledge that can be applied going forward, you maximize the efficacy of your team and improvement plan effort.
      What obstacles prevented you from reaching your target condition?
      Icon of a map marker. If you did not reach your target goals, reflect as a team on what obstacles prevented you from reaching that target.
      Icon of a wrench in a gear. Focus on the obstacles that are preventing your team from reaching the target state.
      Icon of a sun behind clouds. As obstacles are removed, new ones will appear, and old ones will disappear.

      Compare expectations versus reality

      Compare the EC (expected change) to the AC (actual change)
      Arrow pointing down.
      Arrow pointing left and down labelled 'Small'. Evaluate the differences: how large is the difference from what you expected? Arrow pointing right and down labelled 'Large'.
      Things are on track and the issue could have simply been an issue with timing of the improvement. More reflection is needed. Perhaps it is a gap in understanding the goal or a poor execution of the action plan.

      Info-Tech Insight

      Regardless of the cause, large differences between the EC and the AC provide great learning opportunities about how to approach change in the future.

      A cycle around a dartboard with numbered steps: '01 Determine your goals', '02 Define the process team', '03 Determine initiatives', '04 Prioritize initiatives', '05 Execute improvement', '06 Establish a learning culture'.

      Think long-term to sustain changes

      The continual improvement process is ongoing. When one improvement cycle ends, the next should begin in order to continually measure and evaluate processes.

      The goal of any framework is steady and continual improvement over time that resets the baseline to the current (and hopefully improved) level at the end of each cycle.

      Have processes in place to ensure that the improvements made will remain in place after the change is implemented. Each completed cycle is just another step toward your target state.
      Icon of a group of people. Ensure that there is a continual commitment from management.
      Icon of a bar chart. Regularly monitor metrics as well as stakeholder feedback after the initial improvement period has ended. Use this information to plan the next improvement.
      Icon of gears. Continual improvement is a combination of attitudes, behavior, and culture.

      Related Info-Tech Research

      Sample of 'Build a Business-Aligned IT Strategy'. Build a Business-Aligned IT Strategy

      Success depends on IT initiatives clearly aligned to business goals, IT excellence, and driving technology innovation.

      Sample of 'Develop Meaningful Service Metrics'. Develop Meaningful Service Metrics

      Reinforce service orientation in your IT organization by ensuring your IT metrics generate value-driven resource behavior.

      Sample of 'Common Challenges to incident management success'. Improve Incident and Problem Management

      Rise above firefighter mode with structured incident management to enable effective problem management.

      Works Cited

      “Continual Improvement ITIL4 Practice Guide.” AXELOS, 2020. Accessed August 2022.

      “5 Tips for Adopting ITIL 4’s Continual Improvement Management Practice.” SysAid, 2021. Accessed August 2022.

      Jacob Gillingham. “ITIL Continual Service Improvement And 7-Step Improvement Process” Invensis Global Learning Services, 2022. Accessed August 2022.

      Define Service Desk Metrics That Matter

      • Buy Link or Shortcode: {j2store}491|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: Service Desk
      • Parent Category Link: /service-desk
      • Consolidate your metrics and assign context and actions to ones currently tracked.
      • Establish tension metrics to see and tell the whole story.
      • Split your metrics for each stakeholder group. Assign proper cadences for measurements as a first step to building an effective dashboard.

      Our Advice

      Critical Insight

      • Identify the metrics that serve a real purpose and eliminate the rest. Establish a formal review process to ensure metrics are still valid, continue to provide the answers needed, and are at a manageable and usable level.

      Impact and Result

      • Tracking goal- and action-based metrics allows you to make meaningful, data-driven decisions for your service desk. You can establish internal benchmarks to set your own baselines.
      • Predefining the audience and cadence of each metric allows you to construct targeted dashboards to aid your metrics analysis.

      Define Service Desk Metrics That Matter Research & Tools

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Define Service Desk Metrics That Matter Storyboard – A deck that shows you how to look beyond benchmarks and rely on internal metrics to drive success.

      Deciding which service desk metrics to track and how to analyze them can be daunting. Use this deck to narrow down your goal-oriented metrics as a starting point and set your own benchmarks.

      • Define Service Desk Metrics That Matter Storyboard

      2. Service Desk Metrics Workbook – A tool to organize your service desk metrics.

      For each metric, consider adding the relevant overall goal, audience, cadence, and action. Use the audience and cadence of the metric to split your tracked metrics into various dashboards. Your final list of metrics and reports can be added to your service desk SOP.

      • Service Desk Metrics Workbook
      [infographic]

      Further reading

      Define Service Desk Metrics That Matter

      Look beyond benchmarks and rely on internal metrics to drive success.

      Analyst Perspective

      Don’t get paralyzed by benchmarks when establishing metrics

      When establishing a suite of metrics to track, it’s tempting to start with the metrics measured by other organizations. Naturally, benchmarking will enter the conversation. While benchmarking is useful, measuring you organization against others with a lack of context will only highlight your failures. Furthermore, benchmarks will highlight the norm or common practice. It does not necessarily highlight best practice.

      Keeping the limitations of benchmarking in mind, establish your own metrics suite with action-based metrics. Define the audience, cadence, and actions for each metric you track and pair them with business goals. Measure only what you need to.

      Slowly improve your metrics process over time and analyze your environment using your own data as your benchmark.

      Benedict Chang

      Research Analyst, Infrastructure & Operations

      Info-Tech Research Group

      Executive Summary

      Your Challenge

      • Measure the business value provided by the service desk.
      • Consolidate your metrics and assign context and actions to ones currently tracked.
      • Establish tension metrics to see and tell the whole story.
      • Split your metrics for each stakeholder group. Assign proper cadences for measurements as a first step to building an effective dashboard or effective dashboards.

      Common Obstacles

      • Becoming too focused on benchmarks or unidimensional metrics (e.g. cost, first-contact resolution, time to resolve) can lead to misinterpretation of the data and poorly informed actions.
      • Sifting through the many sources of data post hoc can lead to stalling in data analysis or slow reaction times to poor metrics.
      • Dashboards can quickly become cluttered with uninformative metrics, thus reducing the signal-to-noise ratio of meaningful data.

      Info-Tech's Approach

      • Use metrics that drive productive change and improvement. Track only what you need to report on.
      • Ensure each metric aligns with the desired business goal, is action-based, and includes the answers to what, why, how, and who.
      • Establish internal benchmarks by analyzing the trends from your own data to set baselines.
      • Act on the results of your metrics by adjusting targets and measuring success.

      Info-Tech Insight

      Identify the metrics that serve a real purpose and eliminate the rest. Establish a formal review process to ensure metrics are still valid, continue to provide the answers needed, and are at a manageable and usable level.

      Improve your metrics to align IT with strategic business goals

      The right metrics can tell the business how hard IT works and how well they perform.

      • Only 19% of CXOs feel that their organization is effective at measuring the success of IT projects with their current metrics.
      • Implementing the proper metrics can facilitate communication between the business division and IT practice.
      • The proper metrics can help IT know what issues the business has and how the CEO and CIO should tackle them.
      • If the goals above resonate with your organization, our blueprint Take Control of Infrastructure and Operations Metrics will take you through the right steps.

      Current Metrics Suite

      19% Effective

      36% Some Improvement Necessary

      45% Significant Improvement Necessary

      Source: Info-Tech Research Group’s CEO/CIO Alignment Diagnostic, 2019; N=622

      CXOs stress that value is the most critical area for IT to improve in reporting

      • You most likely have to improve your metrics suite by addressing business value.
      • Over 80% of organizations say they need improvement to their business value metrics, with 32% of organizations reporting that significant improvement is needed.
      • Of course, measuring metrics for service desk operations is important, but don’t forget business-oriented metrics such as measuring knowledgebase articles written for shift-left enablement, cost (time and money) of service desk tickets, and overall end-user satisfaction.

      The image shows a bar graph with percentages on the Y-Acis, and the following categories on the X-Axis: Business value metrics; Stakeholder satisfaction reporting; Risk metrics; Technology performance & operating metrics; Cost & Salary metrics; and Ad hoc feedback from executives and staff. Each bar is split into two sections, with the blue section marked a Significant Improvement Necessary, and the purple section labelled Some Improvement necessary. Two sections are highlighted with red circles: Business Value metrics--32% blue; 52% purple; and Technology performance & operating metrics--23% blue and 51% purple.

      Source: Info-Tech Research Group’s CEO/CIO Alignment Diagnostic, 2019; N=622

      Benchmarking used in isolation will not tell the whole story

      Benchmarks can be used as a step in the metrics process

      They can be the first step to reach an end goal, but if benchmarks are observed in isolation, it will only highlight your failures.

      Benchmarking relies on standardized models

      This does not account for all the unique variables that make up an IT organization.

      For example, benchmarks that include cost and revenue may include organizations that prioritize first-call resolution (FCR), but the variables that make up this benchmark model will be quite different within your own organization.

      Info-Tech Insight

      Benchmarks reflect the norm and common practice, not best practice.

      Benchmarks are open to interpretation

      Taking the time to establish proper metrics is often more valuable time spent than going down the benchmark rabbit hole.

      Being above or below the norm is neither a good nor a bad thing.

      Determining what the results mean for you depends on what’s being measured and the unique factors, characteristics, and priorities in your organization.

      If benchmark data is a priority within your IT organization, you may look up organizations like MetricNet, but keep the following in mind:

      Review the collected benchmark data

      See where IT organizations in your industry typically stand in relation to the overall benchmark.

      Assess the gaps

      Large gaps between yourself and the overall benchmark could indicate areas for improvement or celebration. Use the data to focus your analysis, develop deeper self-awareness, and prioritize areas for potential concern.

      Benchmarks are only guidelines

      The benchmark source data may not come from true peers in every sense. Each organization is different, so always explore your unique context when interpreting any findings.

      Rely on internal metrics to measure and improve performance

      Measure internal metrics over time to define goals and drive real improvement

      • Internally measured metrics are more reliable because they provide information about your actual performance over time. This allows for targeted improvements and objective measurements of your milestones.
      • Whether a given metric is the right one for your service desk will depend on several different factors, including:
        • The maturity and capability of your service desk processes
        • The volume of service requests and incidents
        • The complexity of your environment when resolving tickets
        • The degree to which your end users are comfortable with self-service

      Take Info-Tech’s approach to metrics management

      Use metrics that drive productive change and improvement. Track only what you need to report on.

      Ensure each metric aligns with the desired business goal, is action-based, and includes the answers to what, why, how, and who.

      Establish internal benchmarks by analyzing the trends from your own data to set baselines.

      Act on the results of your metrics by adjusting targets and measuring success.

      Define action-based metrics to cut down on analysis paralysis

      Every metric needs to be backed with the following criteria:

      • Defining audience, cadence, goal, and action for each metric allows you to keep your tracked metrics to a minimum while maximizing the value.
      • The audience and cadence of each metric may allow you to define targeted dashboards.

      Audience - Who is this metric tracked for?

      Goal - Why are you tracking this metric? This can be defined along with the CSFs and KPIs.

      Cadence - How often are you going to view, analyze, and action this metric?

      Action - What will you do if this metric spikes, dips, trends up, or trends down?

      Activity 1. Define your critical success factors and key performance indicators

      Critical success factors (CSFs) are high-level goals that help you define the direction of your service desk. Key performance indicators (KPIs) can be treated as the trend of metrics that will indicate that you are moving in the direction of your CSFs. These will help narrow the data you have to track and action (metrics).

      CSFs, or your overall goals, typically revolve around three aspects of the service desk: time spent on tickets, resources spent on tickets, and the quality of service provided.

      1. As a group, brainstorm the CSFs and the KPIs that will help narrow your metrics. Use the Service Desk Metrics Workbook to record the results.
      2. Look at the example to the right as a starting point.

      Example metrics:

      Critical success factor Key performance indicator
      High End-User Satisfaction Increasing CSAT score on transactional surveys
      High end-user satisfaction score
      Proper resolution of tickets
      Low time to resolve
      Low Cost per Ticket Decreasing cost per ticket (due to efficient resolution, FCR, automation, self-service, etc.)
      Improve Access to Self-Service (tangential to improve customer service) High utilization of knowledgebase
      High utilization of portal

      Download the Service Desk Metrics Workbook

      Activity 2. Define action-based metrics that align with your KPIs and CSFs

      1. Now that you have defined your goals, continue to fill the workbook by choosing metrics that align with those goals.
      2. Use the chart below as a guide. For every metric, define the cadence of measurement, audience of the metric, and action associated with the metric. There may be multiple metrics for each KPI.
      3. If you find you are unable to define the cadence, audience, or action associated with a metric, you may not need to track the metric in the first place. Alternatively, if you find that you may action a metric in the future, you can decide to start gathering data now.

      Example metrics:

      Critical success factor Key performance indicator Metric Cadence Audience Action
      High End-User Satisfaction Increasing CSAT score on transactional surveys Monthly average of ticket satisfaction scores Monthly Management Action low scores immediately, view long-term trends
      High end-user satisfaction score Average end-user satisfaction score from annual survey Annually IT Leadership View IT satisfaction trends to align IT with business direction
      Proper resolution of tickets Number of tickets reopened Weekly Service Desk Technicians Action reopened tickets, look for training opportunities
      SLA breach rate Daily Service Desk Technicians Action reopened tickets, look for training opportunities
      Low time to resolve Average TTR (incidents) Weekly Management Look for trends to monitor resources
      Average TTR by priority Weekly Management Look for TTR solve rates to align with SLA
      Average TTR by tier Weekly Management Look for improperly escalated tickets or shift-left opportunities

      Download the Service Desk Metrics Workbook

      Activity 3. Define the data ownership, metric viability, and dashboards

      1. For each metric, define where the data is housed. Ideally, the data is directly in the ticketing tool or ITSM tool. This will make it easy to pull and analyze.
      2. Determine how difficult the metric will be to pull or track. If the effort is high, decide if the value of tracking the metric is worth the hassle of gathering it.
      3. Lastly, for each metric, use the cadence and audience to place the metric in a reporting dashboard. This will help divide your metrics and make them easier to report and action.
      4. You may use the output of this exercise to add your tracked metrics to your service desk SOP.
      5. A full suite of metrics can be found in our Infrastructure & Operations Metrics Library in the Take Control of Infrastructure Metrics Storyboard. The metrics have been categorized by low, medium, and advanced capabilities for you.

      Example metrics:

      Metric Who Owns the Data? Efforts to Track? Dashboards
      Monthly average of ticket satisfaction scores Service Desk Low Monthly Management Meeting
      Average end-user satisfaction score Service Desk Low Leadership Meeting
      Number of tickets reopened Service Desk Low Weekly Technician Standup
      SLA breach rate Service Desk Low Daily Technician Standup
      Average TTR (incidents) Service Desk Low Weekly Technician Standup
      Average TTR by priority Service Desk Low Weekly Technician Standup
      Average TTR by tier Service Desk Low Weekly Technician Standup
      Average TTR (SRs) Service Desk Low Weekly Technician Standup
      Number of tickets reopened Service Desk Low Daily Technician Standup

      Download the Service Desk Metrics Workbook

      Keep the following considerations in mind when defining which metrics matter

      Keep the customer in mind

      Metrics are typically focused on transactional efficiency and process effectiveness and not what was achieved against the customers’ need and satisfaction.

      Understand the relationships between performance and metrics management to provide the end-to-end service delivery picture you are aiming to achieve.

      Don’t settle for tool defaults

      ITSM solutions offer an abundance of metrics to choose from. The most common ones are typically built into the reporting modules of the tool suite.

      Do not start tracking everything. Choose metrics that are specifically aligned to your organization’s desired business outcomes.

      Establish tension metrics to achieve balance

      Don’t ignore the correlation and context between the suites of metrics chosen and how one interacts and affects the other.

      Measuring metrics in isolation may lead to an incomplete picture or undesired technician behavior. Tension metrics help complete the picture and lead to proper actions.

      Adjust those targets

      An arbitrary target on a metric that is consistently met month over month is useless. Each metric should inform the overall performance by combining capable service level management and customer experience programs to prove the value IT is providing to the organization.

      Related Info-Tech Research

      Standardize the Service Desk

      This project will help you build and improve essential service desk processes, including incident management, request fulfillment, and knowledge management, to create a sustainable service desk.

      Take Control of Infrastructure and Operations Metrics

      Make faster decisions and improve service delivery by using the right metrics for the job.

      Analyze Your Service Desk Ticket Data

      Take a data-driven approach to service desk optimization.

      IT Diagnostics: Build a Data-Driven IT Strategy

      Our data-driven programs ask business and IT stakeholders the right questions to ensure you have the inputs necessary to build an effective IT strategy.

      Mergers & Acquisitions: The Sell Blueprint

      • Buy Link or Shortcode: {j2store}324|cart{/j2store}
      • member rating overall impact: N/A
      • member rating average dollars saved: N/A
      • member rating average days saved: N/A
      • Parent Category Name: IT Strategy
      • Parent Category Link: /it-strategy

      There are four key scenarios or entry points for IT as the selling/divesting organization in M&As:

      • IT can suggest a divestiture to meet the business objectives of the organization.
      • IT is brought in to strategy plan the sale/divestiture from both the business’ and IT’s perspectives.
      • IT participates in due diligence activities and complies with the purchasing organization’s asks.
      • IT needs to reactively prepare its environment to enable the separation.

      Consider the ideal scenario for your IT organization.

      Our Advice

      Critical Insight

      Divestitures are inevitable in modern business, and IT’s involvement in the process should be too. This progression is inspired by:

      • The growing trend for organizations to increase, decrease, or evolve through these types of transactions.
      • A maturing business perspective of IT, preventing the difficulty that IT is faced with when invited into the transaction process late.
      • Transactions that are driven by digital motivations, requiring IT’s expertise.
      • There never being such a thing as a true merger, making the majority of M&A activity either acquisitions or divestitures.

      Impact and Result

      Prepare for a sale/divestiture transaction by:

      • Recognizing the trend for organizations to engage in M&A activity and the increased likelihood that, as an IT leader, you will be involved in a transaction in your career.
      • Creating a standard strategy that will enable strong program management.
      • Properly considering all the critical components of the transaction and integration by prioritizing tasks that will reduce risk, deliver value, and meet stakeholder expectations.

      Mergers & Acquisitions: The Sell Blueprint Research & Tools

      Start here – read the Executive Brief

      Read our concise Executive Brief to find out how your organization can excel its reduction strategy by engaging in M&A transactions. Review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

      Besides the small introduction, subscribers and consulting clients within this management domain have access to:

      1. Proactive Phase

      Be an innovative IT leader by suggesting how and why the business should engage in an acquisition or divestiture.

      • One-Pager: M&A Proactive
      • Case Study: M&A Proactive
      • Information Asset Audit Tool
      • Data Valuation Tool
      • Enterprise Integration Process Mapping Tool
      • Risk Register Tool
      • Security M&A Due Diligence Tool
      • Service Catalog Internal Service Level Agreement Template

      2. Discovery & Strategy

      Create a standardized approach for how your IT organization should address divestitures or sales.

      • One-Pager: M&A Discovery & Strategy – Sell
      • Case Study: M&A Discovery & Strategy – Sell

      3. Due Diligence & Preparation

      Comply with due diligence, prepare the IT environment for carve-out possibilities, and establish the separation project plan.

      • One-Pager: M&A Due Diligence & Preparation – Sell
      • Case Study: M&A Due Diligence & Preparation – Sell
      • IT Due Diligence Charter
      • IT Culture Diagnostic
      • M&A Separation Project Management Tool (SharePoint)
      • SharePoint Template: Step-by-Step Deployment Guide
      • M&A Separation Project Management Tool (Excel)

      4. Execution & Value Realization

      Deliver on the separation project plan successfully and communicate IT’s transaction value to the business.

      • One-Pager: M&A Execution & Value Realization – Sell
      • Case Study: M&A Execution & Value Realization – Sell

      Infographic

      Workshop: Mergers & Acquisitions: The Sell Blueprint

      Workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

      1 Pre-Transaction Discovery & Strategy

      The Purpose

      Establish the transaction foundation.

      Discover the motivation for divesting or selling.

      Formalize the program plan.

      Create the valuation framework.

      Strategize the transaction and finalize the M&A strategy and approach.

      Key Benefits Achieved

      All major stakeholders are on the same page.

      Set up crucial elements to facilitate the success of the transaction.

      Have a repeatable transaction strategy that can be reused for multiple organizations.

      Activities

      1.1 Conduct the CIO Business Vision and CEO-CIO Alignment diagnostics.

      1.2 Identify key stakeholders and outline their relationship to the M&A process.

      1.3 Understand the rationale for the company's decision to pursue a divestiture or sale.

      1.4 Assess the IT/digital strategy.

      1.5 Identify pain points and opportunities tied to the divestiture/sale.

      1.6 Create the IT vision statement and mission statement and identify IT guiding principles and the transition team.

      1.7 Document the M&A governance.

      1.8 Establish program metrics.

      1.9 Create the valuation framework.

      1.10 Establish the separation strategy.

      1.11 Conduct a RACI.

      1.12 Create the communication plan.

      1.13 Prepare to assess target organizations.

      Outputs

      Business perspectives of IT

      Stakeholder network map for M&A transactions

      Business context implications for IT

      IT’s divestiture/sale strategic direction

      Governance structure

      M&A program metrics

      IT valuation framework

      Separation strategy

      RACI

      Communication plan

      Prepared to assess target organization(s)

      2 Mid-Transaction Due Diligence & Preparation

      The Purpose

      Establish the foundation.

      Discover the motivation for separation.

      Identify expectations and create the carve-out roadmap.

      Prepare and manage employees.

      Plan the separation roadmap.

      Key Benefits Achieved

      All major stakeholders are on the same page.

      Methodology identified to enable compliance during due diligence.

      Employees are set up for a smooth and successful transition.

      Separation activities are planned and assigned.

      Activities

      2.1 Gather and evaluate the stakeholders involved, M&A strategy, future-state operating model, and governance.

      2.2 Review the business rationale for the divestiture/sale.

      2.3 Establish the separation strategy.

      2.4 Create the due diligence charter.

      2.5 Create a list of IT artifacts to be reviewed in the data room.

      2.6 Create a carve-out roadmap.

      2.7 Create a service/technical transaction agreement.

      2.8 Measure staff engagement.

      2.9 Assess the current culture and identify the goal culture.

      2.10 Create employee transition and functional workplans.

      2.11 Establish the separation roadmap.

      2.12 Establish and align project metrics with identified tasks.

      2.13 Estimate integration costs.

      Outputs

      Stakeholder map

      IT strategy assessed

      IT operating model and IT governance structure defined

      Business context implications for IT

      Separation strategy

      Due diligence charter

      Data room artifacts

      Carve-out roadmap

      Service/technical transaction agreement

      Engagement assessment

      Culture assessment

      Employee transition and functional workplans

      Integration roadmap and associated resourcing

      3 Post-Transaction Execution & Value Realization

      The Purpose

      Establish the transaction foundation.

      Discover the motivation for separation.

      Plan the separation roadmap.

      Prepare employees for the transition.

      Engage in separation.

      Assess the transaction outcomes.

      Key Benefits Achieved

      All major stakeholders are on the same page.

      Separation activities are planned and assigned.

      Employees are set up for a smooth and successful transition.

      Separation strategy and roadmap are executed to benefit the organization.

      Review what went well and identify improvements to be made in future transactions.

      Activities

      3.1 Identify key stakeholders and outline their relationship to the M&A process.

      3.2 Gather and evaluate the M&A strategy, future-state operating model, and governance.

      3.3 Review the business rationale for the divestiture/sale.

      3.4 Establish the separation strategy.

      3.5 Prioritize separation tasks.

      3.6 Establish the separation roadmap.

      3.7 Establish and align project metrics with identified tasks.

      3.8 Estimate separation costs.

      3.9 Measure staff engagement.

      3.10 Assess the current culture and identify the goal culture.

      3.11 Create employee transition and functional workplans.

      3.12 Complete the separation by regularly updating the project plan.

      3.13 Assess the service/technical transaction agreement.

      3.14 Confirm separation costs.

      3.15 Review IT’s transaction value.

      3.16 Conduct a transaction and separation SWOT.

      3.17 Review the playbook and prepare for future transactions.

      Outputs

      M&A transaction team

      Stakeholder map

      IT strategy assessed

      IT operating model and IT governance structure defined

      Business context implications for IT

      Separation strategy

      Separation roadmap and associated resourcing

      Engagement assessment

      Culture assessment

      Employee transition and functional workplans

      Updated separation project plan

      Evaluated service/technical transaction agreement

      SWOT of transaction

      M&A Sell Playbook refined for future transactions

      Further reading

      Mergers & Acquisitions: The Sell Blueprint

      For IT leaders who want to have a role in the transaction process when their business is engaging in an M&A sale or divestiture.

      EXECUTIVE BRIEF

      Analyst Perspective

      Don’t wait to be invited to the M&A table, make it.

      Photo of Brittany Lutes, Research Analyst, CIO Practice, Info-Tech Research Group.
      Brittany Lutes
      Research Analyst,
      CIO Practice
      Info-Tech Research Group
      Photo of Ibrahim Abdel-Kader, Research Analyst, CIO Practice, Info-Tech Research Group.
      Ibrahim Abdel-Kader
      Research Analyst,
      CIO Practice
      Info-Tech Research Group

      IT has always been an afterthought in the M&A process, often brought in last minute once the deal is nearly, if not completely, solidified. This is a mistake. When IT is brought into the process late, the business misses opportunities to generate value related to the transaction and has less awareness of critical risks or inaccuracies.

      To prevent this mistake, IT leadership needs to develop strong business relationships and gain respect for their innovative suggestions. In fact, when it comes to modern M&A activity, IT should be the ones suggesting potential transactions to meet business needs, specifically when it comes to modernizing the business or adopting digital capabilities.

      IT needs to stop waiting to be invited to the acquisition or divestiture table. IT needs to suggest that the table be constructed and actively work toward achieving the strategic objectives of the business.

      Executive Summary

      Your Challenge

      There are four key scenarios or entry points for IT as the selling/divesting organization in M&As:

      • IT can suggest a divestiture to meet the business objectives of the organization.
      • IT is brought in to strategy plan the sale/divestiture from both the business’ and IT’s perspectives.
      • IT participates in due diligence activities and complies with the purchasing organization’s asks.
      • IT needs to reactively prepare its environment to enable the separation.

      Consider the ideal scenario for your IT organization.

      Common Obstacles

      Some of the obstacles IT faces include:

      • IT is often told about the transaction once the deal has already been solidified and is now forced to meet unrealistic business demands.
      • The business does not trust IT and therefore does not approach IT to define value or reduce risks to the transaction process.
      • The people and culture element is forgotten or not given adequate priority.

      These obstacles often arise when IT waits to be invited into the transaction process and misses critical opportunities.

      Info-Tech's Approach

      Prepare for a sale/divestiture transaction by:

      • Recognizing the trend for organizations to engage in M&A activity and the increased likelihood that, as an IT leader, you will be involved in a transaction in your career.
      • Creating a standard strategy that will enable strong program management.
      • Properly considering all the critical components of the transaction and integration by prioritizing tasks that will reduce risk, deliver value, and meet stakeholder expectations.

      Info-Tech Insight

      As the number of merger, acquisition, and divestiture transactions continues to increase, so too does IT’s opportunity to leverage the growing digital nature of these transactions and get involved at the onset.

      The changing M&A landscape

      Businesses will embrace more digital M&A transactions in the post-pandemic world

      • When the pandemic occurred, businesses reacted by either pausing (61%) or completely cancelling (46%) deals that were in the mid-transaction state (Deloitte, 2020). The uncertainty made many organizations consider whether the risks would be worth the potential benefits.
      • However, many organizations quickly realized the pandemic is not a hindrance to M&A transactions but an opportunity. Over 16,000 American companies were involved in M&A transactions in the first six months of 2021 (The Economist). For reference, this had been averaging around 10,000 per six months from 2016 to 2020.
      • In addition to this transaction growth, organizations have increasingly been embracing digital. These trends increase the likelihood that, as an IT leader, you will engage in an M&A transaction. However, it is up to you when you get involved in the transactions.

      The total value of transactions in the year after the pandemic started was $1.3 billion – a 93% increase in value compared to before the pandemic. (Nasdaq)

      71% of technology companies anticipate that divestitures will take place as a result of the COVID-19 pandemic. (EY, 2020)

      Your challenge

      IT is often not involved in the M&A transaction process. When it is, it’s often too late.

      • The most important driver of an acquisition is the ability to access new technology (DLA Piper), and yet 50% of the time, IT isn’t involved in the M&A transaction at all (IMAA Institute, 2017).
      • Additionally, IT’s lack of involvement in the process negatively impacts the business:
        • Most organizations (60%) do not have a standardized approach to integration (Steeves and Associates), let alone separation.
        • Two-thirds of the time, the divesting organization and acquiring organization will either fail together or succeed together (McKinsey, 2015).
        • Less than half (47%) of organizations actually experience the positive results sought by the M&A transaction (Steeves and Associates).
      • Organizations pursuing M&A and not involving IT are setting themselves up for failure.

      Only half of M&A deals involve IT (Source: IMAA Institute, 2017)

      Common Obstacles

      These barriers make this challenge difficult to address for many organizations:

      • IT is rarely afforded the opportunity to participate in the transaction deal. When IT is invited, this often happens later in the process where separation will be critical to business continuity.
      • IT has not had the opportunity to demonstrate that it is a valuable business partner in other business initiatives.
      • One of the most critical elements that IT often doesn’t take the time or doesn’t have the time to focus on is the people and leadership component.
      • IT waits to be invited to the process rather then actively involving themselves and suggesting how value can be added to the process.

      In hindsight, it’s clear to see: Involving IT is just good business.

      47% of senior leaders wish they would have spent more time on IT due diligence to prevent value erosion. (Source: IMAA Institute, 2017)

      “Solutions exist that can save well above 50 percent on divestiture costs, while ensuring on-time delivery.” (Source: SNP)

      Info-Tech's approach

      Acquisitions & Divestitures Framework

      Acquisitions and divestitures are inevitable in modern business, and IT’s involvement in the process should be too. This progression is inspired by:

      1. The growing trend for organizations to increase, decrease, or evolve through these types of transactions.
      2. Transactions that are driven by digital motivations, requiring IT’s expertise.
      3. A maturing business perspective of IT, preventing the difficulty that IT is faced with when invited into the transaction process late.
      4. There never being such a thing as a true merger, making the majority of M&A activity either acquisitions or divestitures.
      A diagram highlighting the 'IT Executives' Role in Acquisitions and Divestitures' when they are integrated at different points in the 'Core Business Timeline'. There are four main entry points 'Proactive', 'Discovery and Strategy', 'Due Diligence and Preparation', and 'Execution and Value Realized'. It is highlighted that IT can and should start at 'Proactive', but most organizations start at 'Execution and Value Realized'. 'Proactive': suggest opportunities to evolve the organization; prove IT's value and engage in growth opportunities early. Innovators start here. Steps of the business timeline in 'Proactive' are 'Organization strategies are defined' and 'M and A is considered to enable strategy'. After a buy or sell transaction is initiated is 'Discovery and Strategy': pre-transaction state. If it is a Buy transaction, 'Establish IT's involvement and approach'. If it is a Sell transaction, 'Prepare to engage in negotiations'. Business Partners start here. Steps of the business timeline in 'Discovery and Strategy' are 'Searching criteria is set', 'Potential candidates are considered', and 'LOI is sent/received'. 'Due Diligence and Preparation': mid-transaction state. If it is a Buy transaction, 'Identify potential transaction benefits and risks'. If it is a Sell transaction, 'Comply, communicate, and collaborate in transaction'. Trusted Operators start here. Steps of the business timeline in 'Due Diligence and Preparation' are 'Due diligence engagement occurs', 'Final agreement is reached', and 'Preparation for transaction execution occurs'. 'Execution and Value Realization': post-transaction state. If it is a Buy transaction, 'Integrate the IT environments and achieve business value'. If it is a Sell transaction, 'Separate the IT environment and deliver on transaction terms'. Firefighters start here. Steps of the business timeline in 'Execution and Value Realization' are 'Staff and operations are addressed appropriately', 'Day 1 of implementation and integration activities occurs', '1st 100 days of new entity state occur' and 'Ongoing risk mitigating and value creating activities occur'.

      The business’ view of IT will impact how soon IT can get involved

      There are four key entry points for IT

      A colorful visualization of the four key entry points for IT and a fifth not-so-key entry point. Starting from the top: 'Innovator', Information and Technology as a Competitive Advantage, 90% Satisfaction; 'Business Partner', Effective Delivery of Strategic Business Projects, 80% Satisfaction; 'Trusted Operator', Enablement of Business Through Application and Work Orders, 70% Satisfaction; 'Firefighter', Reliable Infrastructure and IT Service Desk, 60% Satisfaction; and then 'Unstable', Inability to Consistently Deliver Basic Services, <60% Satisfaction.
      1. Innovator: IT suggests a sale or divestiture to meet the business objectives of the organization.
      2. Business Partner: IT is brought in to strategy plan the sale/divestiture from both the business’ and IT’s perspective.
      3. Trusted Operator: IT participates in due diligence activities and complies with the purchasing organization’s asks.
      4. Firefighter: IT needs to reactively prepare its environment in order to enable the separation.

      Merger, acquisition, and divestiture defined

      Merger

      A merger looks at the equal combination of two entities or organizations. Mergers are rare in the M&A space, as the organizations will combine assets and services in a completely equal 50/50 split. Two organizations may also choose to divest business entities and merge as a new company.

      Acquisition

      The most common transaction in the M&A space, where an organization will acquire or purchase another organization or entities of another organization. This type of transaction has a clear owner who will be able to make legal decisions regarding the acquired organization.

      Divestiture

      An organization may decide to sell partial elements of a business to an acquiring organization. They will separate this business entity from the rest of the organization and continue to operate the other components of the business.

      Info-Tech Insight

      A true merger does not exist, as there is always someone initiating the discussion. As a result, most M&A activity falls into acquisition or divestiture categories.

      Selling vs. buying

      The M&A process approach differs depending on whether you are the selling or buying organization

      This blueprint is only focused on the sell side:

      • Examples of sell-related scenarios include:
        • Your organization is selling to another organization with the intent of keeping its regular staff, operations, and location. This could mean minimal separation is required.
        • Your organization is selling to another organization with the intent of separating to be a part of the purchasing organization.
        • Your organization is engaging in a divestiture with the intent of:
          • Separating components to be part of the purchasing organization permanently.
          • Separating components to be part of a spinoff and establish a unit as a standalone new company.
      • As the selling organization, you could proactively seek out suitors to purchase all or components of your organization, or you could be approached by an organization.

      The buy side is focused on:

      • More than two organizations could be involved in a transaction.
      • Examples of buy-related scenarios include:
        • Your organization is buying another organization with the intent of having the purchased organization keep its regular staff, operations, and location. This could mean minimal integration is required.
        • Your organization is buying another organization in its entirety with the intent of integrating it into your original company.
        • Your organization is buying components of another organization with the intent of integrating them into your original company.
      • As the purchasing organization, you will probably be initiating the purchase and thus will be valuating the selling organization during due diligence and leading the execution plan.

      For more information on acquisitions or purchases, check out Info-Tech’s Mergers & Acquisitions: The Buy Blueprint.

      Core business timeline

      For IT to be valuable in M&As, you need to align your deliverables and your support to the key activities the business and investors are working on.

      Info-Tech’s methodology for Selling Organizations in Mergers, Acquisitions, or Divestitures

      1. Proactive

      2. Discovery & Strategy

      3. Due Diligence & Preparation

      4. Execution & Value Realization

      Phase Steps

      1. Identify Stakeholders and Their Perspective of IT
      2. Assess IT’s Current Value and Future State
      3. Drive Innovation and Suggest Growth Opportunities
      1. Establish the M&A Program Plan
      2. Prepare IT to Engage in the Separation or Sale
      1. Engage in Due Diligence and Prepare Staff
      2. Prepare to Separate
      1. Execute the Transaction
      2. Reflection and Value Realization

      Phase Outcomes

      Be an innovative IT leader by suggesting how and why the business should engage in an acquisition or divestiture.

      Create a standardized approach for how your IT organization should address divestitures or sales.

      Comply with due diligence, prepare the IT environment for carve-out possibilities, and establish the separation project plan.

      Deliver on the separation project plan successfully and communicate IT’s transaction value to the business.

      Metrics for each phase

      1. Proactive

      2. Discovery & Strategy

      3. Valuation & Due Diligence

      4. Execution & Value Realization

      • % Share of business innovation spend from overall IT budget
      • % Critical processes with approved performance goals and metrics
      • % IT initiatives that meet or exceed value expectation defined in business case
      • % IT initiatives aligned with organizational strategic direction
      • % Satisfaction with IT's strategic decision-making abilities
      • $ Estimated business value added through IT-enabled innovation
      • % Overall stakeholder satisfaction with IT
      • % Percent of business leaders that view IT as an Innovator
      • % IT budget as a percent of revenue
      • % Assets that are not allocated
      • % Unallocated software licenses
      • # Obsolete assets
      • % IT spend that can be attributed to the business (chargeback or showback)
      • % Share of CapEx of overall IT budget
      • % Prospective organizations that meet the search criteria
      • $ Total IT cost of ownership (before and after M&A, before and after rationalization)
      • % Business leaders that view IT as a Business Partner
      • % Defects discovered in production
      • $ Cost per user for enterprise applications
      • % In-house-built applications vs. enterprise applications
      • % Owners identified for all data domains
      • # IT staff asked to participate in due diligence
      • Change to due diligence
      • IT budget variance
      • Synergy target
      • % Satisfaction with the effectiveness of IT capabilities
      • % Overall end-customer satisfaction
      • $ Impact of vendor SLA breaches
      • $ Savings through cost-optimization efforts
      • $ Savings through application rationalization and technology standardization
      • # Key positions empty
      • % Frequency of staff turnover
      • % Emergency changes
      • # Hours of unplanned downtime
      • % Releases that cause downtime
      • % Incidents with identified problem record
      • % Problems with identified root cause
      • # Days from problem identification to root cause fix
      • % Projects that consider IT risk
      • % Incidents due to issues not addressed in the security plan
      • # Average vulnerability remediation time
      • % Application budget spent on new build/buy vs. maintenance (deferred feature implementation, enhancements, bug fixes)
      • # Time (days) to value realization
      • % Projects that realized planned benefits
      • $ IT operational savings and cost reductions that are related to synergies/divestitures
      • % IT staff–related expenses/redundancies
      • # Days spent on IT separation
      • $ Accurate IT budget estimates
      • % Revenue growth directly tied to IT delivery
      • % Profit margin growth

      IT's role in the selling transaction

      And IT leaders have a greater likelihood than ever of needing to support a merger, acquisition, or divestiture.

      1. Reduced Risk

        IT can identify risks that may go unnoticed when IT is not involved.
      2. Increased Accuracy

        The business can make accurate predictions around the costs, timelines, and needs of IT.
      3. Faster Integration

        Faster integration means faster value realization for the business.
      4. Informed Decision Making

        IT leaders hold critical information that can support the business in moving the transaction forward.
      5. Innovation

        IT can suggest new opportunities to generate revenue, optimize processes, or reduce inefficiencies.

      The IT executive’s critical role is demonstrated by:

      • Reduced Risk

        47% of senior leaders wish they would have spent more time on IT due diligence to prevent value erosion (IMAA Institute, 2017).
      • Increased Accuracy

        Sellers often only provide 15 to 30 days for the acquiring organization to decide (Forbes, 2018), increasing the necessity of accurate pricing.
      • Faster Integration

        36% of CIOs have visibility into only business unit data, making the divestment a challenge (EY, 2021).
      • Informed Decision Making

        Only 38% of corporate and 22% of private equity firms include IT as a significant aspect in their transaction approach (IMAA Institute, 2017).
      • Innovation

        Successful CIOs involved in M&As can spend 70% of their time on aspects outside of IT and 30% of their time on technology and delivery (CIO).

      Playbook benefits

      IT Benefits

      • IT will be seen as an innovative partner to the business, and its suggestions and involvement in the organization will lead to benefits, not hindrances.
      • Develop a streamlined method to prepare the IT environment for potential carve-out and separations, ensuring risk management concerns are brought to the business’ attention immediately.
      • Create a comprehensive list of items that IT needs to do during the separation that can be prioritized and actioned.

      Business Benefits

      • The business will get accurate and relevant information about its IT environment in order to sell or divest the company to the highest bidder for a true price.
      • Fewer business interruptions will happen, because IT can accurately plan for and execute the high-priority separation tasks.
      • The business can obtain a high-value offer for the components of IT being sold and can measure the ongoing value the sale will bring.

      Insight summary

      Overarching Insight

      IT controls if and when it gets invited to support the business through a purchasing growth transaction. Take control of the process, demonstrate the value of IT, and ensure that separation of IT environments does not lead to unnecessary and costly decisions.

      Proactive Insight

      CIOs on the forefront of digital transformation need to actively look for and suggest opportunities to acquire or partner on new digital capabilities to respond to rapidly changing business needs.

      Discovery & Strategy Insight

      IT organizations that have an effective M&A program plan are more prepared for the transaction, enabling a successful outcome. A structured strategy is particularly necessary for organizations expected to deliver M&As rapidly and frequently.

      Due Diligence & Preparation Insight

      IT often faces unnecessary separation challenges because of a lack of preparation. Secure the IT environment and establish how IT will retain employees early in the transaction process.

      Execution & Value Realization Insight

      IT needs to demonstrate value and cost savings within 100 days of the transaction. The most successful transactions are when IT continuously realizes synergies a year after the transaction and beyond.

      Blueprint deliverables

      Key Deliverable: M&A Sell Playbook

      The M&A Sell Playbook should be a reusable document that enables your IT organization to successfully deliver on any divestiture transaction.

      Screenshots of the 'M and A Sell Playbook' deliverable.

      M&A Sell One-Pager

      See a one-page overview of each phase of the transaction.

      Screenshots of the 'M and A Sell One-Pagers' deliverable.

      M&A Sell Case Studies

      Read a one-page case study for each phase of the transaction.

      Screenshots of the 'M and A Sell Case Studies' deliverable.

      M&A Separation Project Management Tool (SharePoint)

      Manage the separation process of the divestiture/sale using this SharePoint template.

      Screenshots of the 'M and A Separation Project Management Tool (SharePoint)' deliverable.

      M&A Separation Project Management Tool (Excel)

      Manage the separation process of the divestiture/sale using this Excel tool if you can’t or don’t want to use SharePoint.

      Screenshots of the 'M and A Separation Project Management Tool (Excel)' deliverable.

      Info-Tech offers various levels of support to best suit your needs

      DIY Toolkit

      Guided Implementation

      Workshop

      Consulting

      "Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful." "Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track." "We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place." "Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

      Diagnostics and consistent frameworks used throughout all four options

      Guided Implementation

      What does a typical GI on this topic look like?

      A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

      A typical GI is between 6 to 10 calls over the course of 2 to 4 months.

        Proactive Phase

      • Call #1: Scope requirements, objectives, and your specific challenges.
      • Discovery & Strategy Phase

      • Call #2: Determine stakeholders and business perspectives on IT.
      • Call #3: Identify how M&A could support business strategy and how to communicate.
      • Due Diligence & Preparation Phase

      • Call #4: Establish a transaction team and divestiture/sale strategic direction.
      • Call #5: Create program metrics and identify a standard separation strategy.
      • Call #6: Prepare to carve out the IT environment.
      • Call #7: Identify the separation program plan.
      • Execution & Value Realization Phase

      • Call #8: Establish employee transitions to retain key staff.
      • Call #9: Assess IT’s ability to deliver on the divestiture/sale transaction.

      The Sell Blueprint

      Phase 1

      Proactive

      Phase 1

      Phase 2 Phase 3 Phase 4
      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Reduction Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Separation or Sale
      • 3.1 Engage in Due Diligence and Prepare Staff
      • 3.2 Prepare to Separate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Conduct the CEO-CIO Alignment diagnostic
      • Conduct the CIO Business Vision diagnostic
      • Visualize relationships among stakeholders to identify key influencers
      • Group stakeholders into categories
      • Prioritize your stakeholders
      • Plan to communicate
      • Valuate IT
      • Assess the IT/digital strategy
      • Determine pain points and opportunities
      • Align goals to opportunities
      • Recommend reduction opportunities

      This phase involves the following participants:

      • IT and business leadership

      What is the Proactive phase?

      Embracing the digital drivers

      As the number of merger, acquisition, or divestiture transactions driven by digital means continues to increase, IT has an opportunity to not just be involved in a transaction but actively seek out potential deals.

      In the Proactive phase, the business is not currently considering a transaction. However, the business could consider one to reach its strategic goals. IT organizations that have developed respected relationships with the business leaders can suggest these potential transactions.

      Understand the business’ perspective of IT, determine who the critical M&A stakeholders are, valuate the IT environment, and examine how it supports the business goals in order to suggest an M&A transaction.

      In doing so, IT isn’t waiting to be invited to the transaction table – it’s creating it.

      Goal: To support the organization in reaching its strategic goals by suggesting M&A activities that will enable the organization to reach its objectives faster and with greater-value outcomes.

      Proactive Prerequisite Checklist

      Before coming into the Proactive phase, you should have addressed the following:

      • Understand what mergers, acquisitions, and divestitures are.
      • Understand what mergers, acquisitions, and divestitures mean for the business.
      • Understand what mergers, acquisitions, and divestitures mean for IT.

      Review the Executive Brief for more information on mergers, acquisitions, and divestitures for selling organizations.

      Proactive

      Step 1.1

      Identify M&A Stakeholders and Their Perspective of IT

      Activities

      • 1.1.1 Conduct the CEO-CIO Alignment diagnostic
      • 1.1.2 Conduct the CIO Business Vision diagnostic
      • 1.1.3 Visualize relationships among stakeholders to identify key influencers
      • 1.1.4 Group stakeholders into categories
      • 1.1.5 Prioritize your stakeholders
      • 1.16 Plan to communicate

      This step involves the following participants:

      • IT executive leader
      • IT leadership
      • Critical M&A stakeholders

      Outcomes of Step

      Understand how the business perceives IT and establish strong relationships with critical M&A stakeholders.

      Business executives' perspectives of IT

      Leverage diagnostics and gain alignment on IT’s role in the organization

      • To suggest or get involved with a merger, acquisition, or divestiture, the IT executive leader needs to be well respected by other members of the executive leadership team and the business.
      • Specifically, the Proactive phase relies on the IT organization being viewed as an Innovator within the business.
      • Identify how the CEO/business executive currently views IT and where they would like IT to move within the Maturity Ladder.
      • Additionally, understand how other critical department leaders view IT and how they view the partnership with IT.
      A colorful visualization titled 'Maturity Ladder' detailing levels of IT function that a business may choose from based on the business executives' perspectives of IT. Starting from the bottom: 'Struggle', Does not embarrass, Does not crash; 'Support', Keeps business happy, Keeps costs low; 'Optimize', Increases efficiency, Decreases costs; 'Expand', Extends into new business, Generates revenue; 'Transform', Creates new industry.

      Misalignment in target state requires further communication between the CIO and CEO to ensure IT is striving toward an agreed-upon direction.

      Info-Tech’s CIO Business Vision (CIO BV) diagnostic measures a variety of high-value metrics to provide a well-rounded understanding of stakeholder satisfaction with IT.

      Sample of Info-Tech's CIO Business Vision diagnostic measuring percentages of high-value metrics like 'IT Satisfaction' and 'IT Value' regarding business leader satisfaction. A note for these two reads 'Evaluate business leader satisfaction with IT this year and last year'. A section titled 'Relationship' has metrics such as 'Understands Needs' and 'Trains Effectively'. A note for this section reads 'Examine relationship indicators between IT and the business'. A section titled 'Security Friction' has metrics such as 'Regulatory Compliance-Driven' and 'Office/Desktop Security'.

      Business Satisfaction and Importance for Core Services

      The core services of IT are important when determining what IT should focus on. The most important services with the lowest satisfaction offer the largest area of improvement for IT to drive business value.

      Sample of Info-Tech's CIO Business Vision diagnostic specifically comparing the business satisfaction of 12 core services with their importance. Services listed include 'Service Desk', 'IT Security', 'Requirements Gathering', 'Business Apps', 'Data Quality', and more. There is a short description of the services, a percentage for the business satisfaction with the service, a percentage comparing it to last year, and a numbered ranking of importance for each service. A note reads 'Assess satisfaction and importance across 12 core IT capabilities'.

      1.1.1 Conduct the CEO-CIO Alignment diagnostic

      2 weeks

      Input: IT organization expertise and the CEO-CIO Alignment diagnostic

      Output: An understanding of an executive business stakeholder’s perception of IT

      Materials: M&A Sell Playbook, CEO-CIO Alignment diagnostic

      Participants: IT executive/CIO, Business executive/CEO

      1. The CEO-CIO Alignment diagnostic can be a powerful input. Speak with your Info-Tech account representative to conduct the diagnostic. Use the results to inform current IT capabilities.
      2. You may choose to debrief the results of your diagnostic with an Info-Tech analyst. We recommend this to help your team understand how to interpret and draw conclusions from the results.
      3. Examine the results of the survey and note where there might be specific capabilities that could be improved.
      4. Determine whether there are any areas of significant disagreement between the you and the CEO. Mark down those areas for further conversations. Additionally, take note of areas that could be leveraged to support transactions or support your rationale in recommending transactions.

      Download the sample report.

      Record the results in the M&A Sell Playbook.

      1.1.2 Conduct the CIO Business Vision diagnostic

      2 weeks

      Input: IT organization expertise, CIO BV diagnostic

      Output: An understanding of business stakeholder perception of certain IT capabilities and services

      Materials: M&A Buy Playbook, CIO Business Vision diagnostic

      Participants: IT executive/CIO, Senior business leaders

      1. The CIO Business Vision (CIO BV) diagnostic can be a powerful tool for identifying IT capability focus areas. Speak with your account representative to conduct the CIO BV diagnostic. Use the results to inform current IT capabilities.
      2. You may choose to debrief the results of your diagnostic with an Info-Tech analyst. We recommend this to help your team understand how to interpret the results and draw conclusions from the diagnostic.
      3. Examine the results of the survey and take note of any IT services that have low scores.
      4. Read through the diagnostic comments and note any common themes. Especially note which stakeholders identified they have a favorable relationship with IT and which stakeholders identified they have an unfavorable relationship. For those who have an unfavorable relationship, identify if they will have a critical role in a growth transaction.

      Download the sample report.

      Record the results in the M&A Sell Playbook.

      Create a stakeholder network map for M&A transactions

      Follow the trail of breadcrumbs from your direct stakeholders to their influencers to uncover hidden stakeholders.

      Example:

      Diagram of stakeholders and their relationships with other stakeholders, such as 'Board Members', 'CFO/Finance', 'Compliance', etc. with 'CIO/IT Leader' highlighted in the middle. There are unidirectional black arrows and bi-directional green arrows indicating each connection.

        Legend
      • Black arrows indicate the direction of professional influence
      • Dashed green arrows indicate bidirectional, informal influence relationships

      Info-Tech Insight

      Your stakeholder map defines the influence landscape that the M&A transaction will occur within. This will identify who holds various levels of accountability and decision-making authority when a transaction does take place.

      Use connectors to determine who may be influencing your direct stakeholders. They may not have any formal authority within the organization, but they may have informal yet substantial relationships with your stakeholders.

      1.1.3 Visualize relationships among stakeholders to identify key influencers

      1-3 hours

      Input: List of M&A stakeholders

      Output: Relationships among M&A stakeholders and influencers

      Materials: Flip charts, Markers, Sticky notes, M&A Sell Playbook

      Participants: IT executive leadership

      1. The purpose of this activity is to list all the stakeholders within your organization that will have a direct or indirect impact on the M&A transaction.
      2. Determine the critical stakeholders, and then determine the stakeholders of your stakeholders and consider adding each of them to the stakeholder list.
      3. Assess who has either formal or informal influence over your stakeholders; add these influencers to your stakeholder list.
      4. Construct a diagram linking stakeholders and their influencers together.
        • Use black arrows to indicate the direction of professional influence.
        • Use dashed green arrows to indicate bidirectional, informal influence relationships.

      Record the results in the M&A Sell Playbook.

      Categorize your stakeholders with a prioritization map

      A stakeholder prioritization map helps IT leaders categorize their stakeholders by their level of influence and ownership in the merger, acquisition, or divestiture process.

      A prioritization map of stakeholder categories split into four quadrants. The vertical axis is 'Influence', from low on the bottom to high on top. The horizontal axis is 'Ownership/Interest', from low on the left to high on the right. 'Spectators' are low influence, low ownership/interest. 'Mediators' are high influence, low ownership/interest. 'Noisemakers' are low influence, high ownership/interest. 'Players' are high influence, high ownership/interest.

      There are four areas in the map, and the stakeholders within each area should be treated differently.

      Players – players have a high interest in the initiative and the influence to effect change over the initiative. Their support is critical, and a lack of support can cause significant impediment to the objectives.

      Mediators – mediators have a low interest but significant influence over the initiative. They can help to provide balance and objective opinions to issues that arise.

      Noisemakers – noisemakers have low influence but high interest. They tend to be very vocal and engaged, either positively or negatively, but have little ability to enact their wishes.

      Spectators – generally, spectators are apathetic and have little influence over or interest in the initiative.

      1.1.4 Group stakeholders into categories

      30 minutes

      Input: Stakeholder map, Stakeholder list

      Output: Categorization of stakeholders and influencers

      Materials: Flip charts, Markers, Sticky notes, M&A Sell Playbook

      Participants: IT executive leadership, Stakeholders

      1. Identify your stakeholders’ interest in and influence on the M&A process as high, medium, or low by rating the attributes below.
      2. Map your results to the model to the right to determine each stakeholder’s category.

      Same prioritization map of stakeholder categories as before. This one has specific stakeholders mapped onto it. 'CFO' is mapped as low interest and middling influence, between 'Mediator' and 'Spectator'. 'CIO' is mapped as higher than average interest and high influence, a 'Player'. 'Board Member' is mapped as high interest and high influence, a 'Player'.

      Level of Influence
      • Power: Ability of a stakeholder to effect change.
      • Urgency: Degree of immediacy demanded.
      • Legitimacy: Perceived validity of stakeholder’s claim.
      • Volume: How loud their “voice” is or could become.
      • Contribution: What they have that is of value to you.
      Level of Interest

      How much are the stakeholder’s individual performance and goals directly tied to the success or failure of the product?

      Record the results in the M&A Sell Playbook.

      Prioritize your stakeholders

      There may be too many stakeholders to be able to manage them all. Focus your attention on the stakeholders that matter most.

      Level of Support

      Supporter

      Evangelist

      Neutral

      Blocker

      Stakeholder Category Player Critical High High Critical
      Mediator Medium Low Low Medium
      Noisemaker High Medium Medium High
      Spectator Low Irrelevant Irrelevant Low

      Consider the three dimensions for stakeholder prioritization: influence, interest, and support. Support can be determined by answering the following question: How significant is that stakeholder to the M&A or divestiture process?

      These parameters are used to prioritize which stakeholders are most important and should receive your focused attention.

      1.1.5 Prioritize your stakeholders

      30 minutes

      Input: Stakeholder matrix

      Output: Stakeholder and influencer prioritization

      Materials: Flip charts, Markers, Sticky notes, M&A Sell Playbook

      Participants: IT executive leadership, M&A/divestiture stakeholders

      1. Identify the level of support of each stakeholder by answering the following question: How significant is that stakeholder to the M&A transaction process?
      2. Prioritize your stakeholders using the prioritization scheme on the previous slide.

      Stakeholder

      Category

      Level of Support

      Prioritization

      CMO Spectator Neutral Irrelevant
      CIO Player Supporter Critical

      Record the results in the M&A Sell Playbook.

      Define strategies for engaging stakeholders by type

      A revisit to the map of stakeholder categories, but with strategies listed for each one, and arrows on the side instead of an axis. The vertical arrow is 'Authority', which increases upward, and the horizontal axis is Ownership/Interest which increases as it moves to the right. The strategy for 'Players' is 'Engage', for 'Mediators' is 'Satisfy', for 'Noisemakers' is 'Inform', and for 'Spectators' is 'Monitor'.

      Type

      Quadrant

      Actions

      Players High influence, high interest – actively engage Keep them updated on the progress of the project. Continuously involve Players in the process and maintain their engagement and interest by demonstrating their value to its success.
      Mediators High influence, low interest – keep satisfied They can be the game changers in groups of stakeholders. Turn them into supporters by gaining their confidence and trust and including them in important decision-making steps. In turn, they can help you influence other stakeholders.
      Noisemakers Low influence, high interest – keep informed Try to increase their influence (or decrease it if they are detractors) by providing them with key information, supporting them in meetings, and using Mediators to help them.
      Spectators Low influence, low interest – monitor They are followers. Keep them in the loop by providing clarity on objectives and status updates.

      Info-Tech Insight

      Each group of stakeholders draws attention and resources away from critical tasks. By properly identifying stakeholder groups, the IT executive leader can develop corresponding actions to manage stakeholders in each group. This can dramatically reduce wasted effort trying to satisfy Spectators and Noisemakers while ensuring the needs of Mediators and Players are met.

      1.1.6 Plan to communicate

      30 minutes

      Input: Stakeholder priority, Stakeholder categorization, Stakeholder influence

      Output: Stakeholder communication plan

      Materials: Flip charts, Markers, Sticky notes, M&A Sell Playbook

      Participants: IT executive leadership, M&A/divestiture stakeholders

      The purpose of this activity is to make a communication plan for each of the stakeholders identified in the previous activities, especially those who will have a critical role in the M&A transaction process.

      1. In the M&A Sell Playbook, input the type of influence each stakeholder has on IT, how they would be categorized in the M&A process, and their level of priority. Use this information to create a communication plan.
      2. Determine the methods and frequency of communication to keep the necessary stakeholder satisfied and maintain or enhance IT’s profile within the organization.

      Record the results in the M&A Sell Playbook.

      Proactive

      Step 1.2

      Assess IT’s Current Value and Method to Achieve a Future State

      Activities

      • 1.2.1 Valuate IT
      • 1.2.2 Assess the IT/digital strategy

      This step involves the following participants:

      • IT executive leader
      • IT leadership
      • Critical stakeholders to M&A

      Outcomes of Step

      Identify critical opportunities to optimize IT and meet strategic business goals through a merger, acquisition, or divestiture.

      How to valuate your IT environment

      And why it matters so much

      • Valuating your current organization’s IT environment is a critical step that all IT organizations should take, whether involved in an M&A or not, to fully understand what it might be worth.
      • The business investments in IT can be directly translated into a value amount. For every $1 invested in IT, the business might be gaining $100 in value back or possibly even loosing $100.
      • Determining, documenting, and communicating this information ensures that the business takes IT’s suggestions seriously and recognizes why investing in IT is so critical.
      • There are three ways a business or asset can be valuated:
        • Cost Approach: Look at the costs associated with building, purchasing, replacing, and maintaining a given aspect of the business.
        • Market Approach: Look at the relative value of a particular aspect of the business. Relative value can fluctuate and depends on what the markets and consequently society believe that particular element is worth.
        • Discounted Cash Flow Approach: Focus on what the potential value of the business could be or the intrinsic value anticipated due to future profitability.
      • (Source: “Valuation Methods,” Corporate Finance Institute)

      Four ways to create value through digital

      1. Reduced costs
      2. Improved customer experience
      3. New revenue sources
      4. Better decision making
      5. (Source: McKinsey & Company)

      1.2.1 Valuate IT

      1 day

      Input: Valuation of data, Valuation of applications, Valuation of infrastructure and operations, Valuation of security and risk

      Output: Valuation of IT

      Materials: Relevant templates/tools listed on the following slides, Capital budget, Operating budget, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership

      The purpose of this activity is to demonstrate that IT is not simply an operational functional area that diminishes business resources. Rather, IT contributes significant value to the business.

      1. Review each of the following slides to valuate IT’s data, applications, infrastructure and operations, and security and risk. These valuations consider several tangible and intangible factors and result in a final dollar amount.
      2. Input the financial amounts identified for each critical area into a summary slide. Use this information to determine where IT is delivering value to the organization.

      Info-Tech Insight

      Consistency is key when valuating your IT organization as well as other IT organizations throughout the transaction process.

      Record the results in the M&A Sell Playbook.

      Data valuation

      Data valuation identifies how you monetize the information that your organization owns.

      Create a data value chain for your organization

      When valuating the information and data that exists in an organization, there are many things to consider.

      Info-Tech has two tools that can support this process:

      1. Information Asset Audit Tool: Use this tool first to take inventory of the different information assets that exist in your organization.
      2. Data Valuation Tool: Once information assets have been accounted for, valuate the data that exists within those information assets.

      Data Collection

      Insight Creation

      Value Creation

      Data Valuation

      01 Data Source
      02 Data Collection Method
      03 Data
      04 Data Analysis
      05 Insight
      06 Insight Delivery
      07 Consumer
      08 Value in Data
      09 Value Dimension
      10 Value Metrics Group
      11 Value Metrics
      Screenshots of Tab 2 of Info-Tech's Data Valuation Tool.

      Instructions

      1. Using the Data Valuation Tool, start gathering information based on the eight steps above to understand your organization’s journey from data to value.
      2. Identify the data value spectrum. (For example: customer sales service, citizen licensing service, etc.)
      3. Fill out the columns for data sources, data collection, and data first.
      4. Capture data analysis and related information.
      5. Then capture the value in data.
      6. Add value dimensions such as usage, quality, and economic dimensions.
        • Remember that economic value is not the only dimension, and usage/quality has a significant impact on economic value.
      7. Collect evidence to justify your data valuation calculator (market research, internal metrics, etc.).
      8. Finally, calculate the value that has a direct correlation with underlying value metrics.

      Application valuation

      Calculate the value of your IT applications

      When valuating the applications and their users in an organization, consider using a business process map. This shows how business is transacted in the company by identifying which IT applications support these processes and which business groups have access to them. Info-Tech has a business process mapping tool that can support this process:

      • Enterprise Integration Process Mapping Tool: Complete this tool first to map the different business processes to the supporting applications in your organization.

      Instructions

      1. Start by calculating user costs. This is the multiplication of: (# of users) × (% of time spent using IT) × (fully burdened salary).
      2. Identify the revenue per employee and divide that by the average cost per employee to calculate the derived productivity ratio (DPR).
      3. Once you have calculated the user costs and DPR, multiply those total values together to get the application value.
      4. User Costs

        Total User Costs

        Derived Productivity Ratio (DPR)

        Total DPR

        Application Value

        # of users % time spent using IT Fully burdened salary Multiply values from the 3 user costs columns Revenue per employee Average cost per employee (Revenue P.E) ÷ (Average cost P.E) (User costs) X (DPR)

      5. Once the total application value is established, calculate the combined IT and business costs of delivering that value. IT and business costs include inflexibility (application maintenance), unavailability (downtime costs, including disaster exposure), IT costs (common costs statistically allocated to applications), and fully loaded cost of active (full-time equivalent [FTE]) users.
      6. Calculate the net value of applications by subtracting the total IT and business costs from the total application value calculated in step 3.
      7. IT and Business Costs

        Total IT and Business Costs

        Net Value of Applications

        Application maintenance Downtime costs (include disaster exposure) Common costs allocated to applications Fully loaded costs of active (FTE) users Sum of values from the four IT and business costs columns (Application value) – (IT and business costs)

      (Source: CSO)

      Infrastructure valuation

      Assess the foundational elements of the business’ information technology

      The purpose of this exercise is to provide a high-level infrastructure valuation that will contribute to valuating your IT environment.

      Calculating the value of the infrastructure will require different methods depending on the environment. For example, a fully cloud-hosted organization will have different costs than a fully on-premises IT environment.

      Instructions:

      1. Start by listing all of the infrastructure-related items that are relevant to your organization.
      2. Once you have finalized your items column, identify the total costs/value of each item.
        • For example, total software costs would include servers and storage.
      3. Calculate the total cost/value of your IT infrastructure by adding all of values in the right column.

      Item

      Costs/Value

      Hardware Assets Total Value +$3.2 million
      Hardware Leased/Service Agreement -$
      Software Purchased +$
      Software Leased/Service Agreement -$
      Operational Tools
      Network
      Disaster Recovery
      Antivirus
      Data Centers
      Service Desk
      Other Licenses
      Total:

      For additional support, download the M&A Runbook for Infrastructure and Operations.

      Risk and security

      Assess risk responses and calculate residual risk

      The purpose of this exercise is to provide a high-level risk assessment that will contribute to valuating your IT environment. For a more in-depth risk assessment, please refer to the Info-Tech tools below:

      1. Risk Register Tool
      2. Security M&A Due Diligence Tool

      Instructions

      1. Review the probability and impact scales below and ensure you have the appropriate criteria that align to your organization before you conduct a risk assessment.
      2. Identify the probability of occurrence and estimated financial impact for each risk category detail and fill out the table on the right. Customize the table as needed so it aligns to your organization.
      3. Probability of Risk Occurrence

        Occurrence Criteria
        (Classification; Probability of Risk Event Within One Year)

        Negligible Very Unlikely; ‹20%
        Very Low Unlikely; 20 to 40%
        Low Possible; 40 to 60%
        Moderately Low Likely; 60 to 80%
        Moderate Almost Certain; ›80%

      Note: If needed, you can customize this scale with the severity designations that you prefer. However, make sure you are always consistent with it when conducting a risk assessment.

      Financial & Reputational Impact

      Budgetary and Reputational Implications
      (Financial Impact; Reputational Impact)

      Negligible (‹$10,000; Internal IT stakeholders aware of risk event occurrence)
      Very Low ($10,000 to $25,000; Business customers aware of risk event occurrence)
      Low ($25,000 to $50,000; Board of directors aware of risk event occurrence)
      Moderately Low ($50,000 to $100,000; External customers aware of risk event occurrence)
      Moderate (›$100,000; Media coverage or regulatory body aware of risk event occurrence)

      Risk Category Details

      Probability of Occurrence

      Estimated Financial Impact

      Estimated Severity (Probability X Impact)

      Capacity Planning
      Enterprise Architecture
      Externally Originated Attack
      Hardware Configuration Errors
      Hardware Performance
      Internally Originated Attack
      IT Staffing
      Project Scoping
      Software Implementation Errors
      Technology Evaluation and Selection
      Physical Threats
      Resource Threats
      Personnel Threats
      Technical Threats
      Total:

      1.2.2 Assess the IT/digital strategy

      4 hours

      Input: IT strategy, Digital strategy, Business strategy

      Output: An understanding of an executive business stakeholder’s perception of IT, Alignment of IT/digital strategy and overall organization strategy

      Materials: Computer, Whiteboard and markers, M&A Sell Playbook

      Participants: IT executive/CIO, Business executive/CEO

      The purpose of this activity is to review the business and IT strategies that exist to determine if there are critical capabilities that are not being supported.

      Ideally, the IT and digital strategies would have been created following development of the business strategy. However, sometimes the business strategy does not directly call out the capabilities it requires IT to support.

      1. On the left half of the corresponding slide in the M&A Sell Playbook, document the business goals, initiatives, and capabilities. Input this information from the business or digital strategies. (If more space for goals, initiatives, or capabilities is needed, duplicate the slide).
      2. On the other half of the slide, document the IT goals, initiatives, and capabilities. Input this information from the IT strategy and digital strategy.

      For additional support, see Build a Business-Aligned IT Strategy.

      Record the results in the M&A Sell Playbook.

      Proactive

      Step 1.3

      Drive Innovation and Suggest Growth Opportunities

      Activities

      • 1.3.1 Determine pain points and opportunities
      • 1.3.2 Align goals with opportunities
      • 1.3.3 Recommend reduction opportunities

      This step involves the following participants:

      • IT executive leader
      • IT leadership
      • Critical M&A stakeholders

      Outcomes of Step

      Establish strong relationships with critical M&A stakeholders and position IT as an innovative business partner that can suggest reduction opportunities.

      1.3.1 Determine pain points and opportunities

      1-2 hours

      Input: CEO-CIO Alignment diagnostic, CIO Business Vision diagnostic, Valuation of IT environment, IT-business goals cascade

      Output: List of pain points or opportunities that IT can address

      Materials: Computer, Whiteboard and markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Business stakeholders

      The purpose of this activity is to determine the pain points and opportunities that exist for the organization. These can be external or internal to the organization.

      1. Identify what opportunities exist for your organization. Opportunities are the potential positives that the organization would want to leverage.
      2. Next, identify pain points, which are the potential negatives that the organization would want to alleviate.
      3. Spend time considering all the options that might exist, and keep in mind what has been identified previously.

      Opportunities and pain points can be trends, other departments’ initiatives, business perspectives of IT, etc.

      Record the results in the M&A Sell Playbook.

      1.3.2 Align goals with opportunities

      1-2 hours

      Input: CEO-CIO Alignment diagnostic, CIO Business Vision diagnostic, Valuation of IT environment, IT-business goals cascade, List of pain points and opportunities

      Output: An understanding of an executive business stakeholder’s perception of IT, Foundations for reduction strategy

      Materials: Computer, Whiteboard and markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Business stakeholders

      The purpose of this activity is to determine whether a growth or separation strategy might be a good suggestion to the business in order to meet its business objectives.

      1. For the top three to five business goals, consider:
        1. Underlying drivers
        2. Digital opportunities
        3. Whether a growth or reduction strategy is the solution
      2. Just because a growth or reduction strategy is a solution for a business goal does not necessarily indicate M&A is the way to go. However, it is important to consider before you pursue suggesting M&A.

      Record the results in the M&A Sell Playbook.

      1.3.3 Recommend reduction opportunities

      1-2 hours

      Input: Growth or separation strategy opportunities to support business goals, Stakeholder communication plan, Rationale for the suggestion

      Output: M&A transaction opportunities suggested

      Materials: M&A Sell Playbook

      Participants: IT executive/CIO, Business executive/CEO

      The purpose of this activity is to recommend a merger, acquisition, or divestiture to the business.

      1. Identify which of the business goals the transaction would help solve and why IT is the one to suggest such a goal.
      2. Leverage the stakeholder communication plan identified previously to give insight into stakeholders who would have a significant level of interest, influence, or support in the process.

      Info-Tech Insight

      With technology and digital driving many transactions, leverage your organizations’ IT environment as an asset and reason why the divestiture or sale should happen, suggesting the opportunity yourself.

      Record the results in the M&A Sell Playbook.

      By the end of this Proactive phase, you should:

      Be prepared to suggest M&A opportunities to support your company’s goals through sale or divestiture transactions

      Key outcome from the Proactive phase

      Develop progressive relationships and strong communication with key stakeholders to suggest or be aware of transformational opportunities that can be achieved through sale or divestiture strategies.

      Key deliverables from the Proactive phase
      • Business perspective of IT examined
      • Key stakeholders identified and relationship to the M&A process outlined
      • Ability to valuate the IT environment and communicate IT’s value to the business
      • Assessment of the business, digital, and IT strategies and how M&As could support those strategies
      • Pain points and opportunities that could be alleviated or supported through an M&A transaction
      • Sale or divestiture recommendations

      The Sell Blueprint

      Phase 2

      Discovery & Strategy

      Phase 1

      Phase 2

      Phase 3Phase 4
      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Reduction Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Separation or Sale
      • 3.1 Engage in Due Diligence and Prepare Staff
      • 3.2 Prepare to Separate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Create the mission and vision
      • Identify the guiding principles
      • Create the future-state operating model
      • Determine the transition team
      • Document the M&A governance
      • Create program metrics
      • Establish the separation strategy
      • Conduct a RACI
      • Create the communication plan
      • Assess the potential organization(s)

      This phase involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Pre-Work

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Establish the Transaction FoundationDiscover the Motivation for Divesting or SellingFormalize the Program PlanCreate the Valuation FrameworkStrategize the TransactionNext Steps and Wrap-Up (offsite)

      Activities

      • 0.1 Conduct the CIO Business Vision and CEO-CIO Alignment diagnostics
      • 0.2 Identify key stakeholders and outline their relationship to the M&A process
      • 0.3 Identify the rationale for the company's decision to pursue a divestiture or sale
      • 1.1 Review the business rationale for the divestiture/sale
      • 1.2 Assess the IT/digital strategy
      • 1.3 Identify pain points and opportunities tied to the divestiture/sale
      • 1.4 Create the IT vision statement, create the IT mission statement, and identify IT guiding principles
      • 2.1 Create the future-state operating model
      • 2.2 Determine the transition team
      • 2.3 Document the M&A governance
      • 2.4 Establish program metrics
      • 3.1 Valuate your data
      • 3.2 Valuate your applications
      • 3.3 Valuate your infrastructure
      • 3.4 Valuate your risk and security
      • 3.5 Combine individual valuations to make a single framework
      • 4.1 Establish the separation strategy
      • 4.2 Conduct a RACI
      • 4.3 Review best practices for assessing target organizations
      • 4.4 Create the communication plan
      • 5.1 Complete in-progress deliverables from previous four days
      • 5.2 Set up review time for workshop deliverables and to discuss next steps

      Deliverables

      1. Business perspectives of IT
      2. Stakeholder network map for M&A transactions
      1. Business context implications for IT
      2. IT’s divestiture/sale strategic direction
      1. Operating model for future state
      2. Transition team
      3. Governance structure
      4. M&A program metrics
      1. IT valuation framework
      1. Separation strategy
      2. RACI
      3. Communication plan
      1. Completed M&A program plan and strategy
      2. Prepared to assess target organization(s)

      What is the Discovery & Strategy phase?

      Pre-transaction state

      The Discovery & Strategy phase during a sale or divestiture is a unique opportunity for many IT organizations. IT organizations that can participate in the transaction at this stage are likely considered a strategic partner of the business.

      For one-off sales/divestitures, IT being invited during this stage of the process is rare. However, for organizations that are preparing to engage in many divestitures over the coming years, this type of strategy will greatly benefit from IT involvement. Again, the likelihood of participating in an M&A transaction is increasing, making it a smart IT leadership decision to, at the very least, loosely prepare a program plan that can act as a strategic pillar throughout the transaction.

      During this phase of the pre-transaction state, IT may be asked to participate in ensuring that the IT environment is able to quickly and easily carve out components/business lines and deliver on service-level agreements (SLAs).

      Goal: To identify a repeatable program plan that IT can leverage when selling or divesting all or parts of the current IT environment, ensuring customer satisfaction and business continuity

      Discovery & Strategy Prerequisite Checklist

      Before coming into the Discovery & Strategy phase, you should have addressed the following:

      • Understand the business perspective of IT.
      • Know the key stakeholders and have outlined their relationship to the M&A process.
      • Be able to valuate the IT environment and communicate IT's value to the business.
      • Understand the rationale for the company's decision to pursue a sale or divestiture and the opportunities or pain points the sale should address.

      Discovery & Strategy

      Step 2.1

      Establish the M&A Program Plan

      Activities

      • 2.1.1 Create the mission and vision
      • 2.1.2 Identify the guiding principles
      • 2.1.3 Create the future-state operating model
      • 2.1.4 Determine the transition team
      • 2.1.5 Document the M&A governance
      • 2.1.6 Create program metrics

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team

      Outcomes of Step

      Establish an M&A program plan that can be repeated across sales/divestitures.

      The vision and mission statements clearly articulate IT’s aspirations and purpose

      The IT vision statement communicates a desired future state of the IT organization, whereas the IT mission statement portrays the organization’s reason for being. While each serves its own purpose, they should both be derived from the business context implications for IT.

      Vision Statements

      Mission Statements

      Characteristics

      • Describe a desired future
      • Focus on ends, not means
      • Concise
      • Aspirational
      • Memorable
      • Articulate a reason for existence
      • Focus on how to achieve the vision
      • Concise
      • Easy to grasp
      • Sharply focused
      • Inspirational

      Samples

      To be a trusted advisor and partner in enabling business innovation and growth through an engaged IT workforce. (Source: Business News Daily) IT is a cohesive, proactive, and disciplined team that delivers innovative technology solutions while demonstrating a strong customer-oriented mindset. (Source: Forbes, 2013)

      2.1.1 Create the mission and vision statements

      2 hours

      Input: Business objectives, IT capabilities, Rationale for the transaction

      Output: IT’s mission and vision statements for reduction strategies tied to mergers, acquisitions, and divestitures

      Materials: Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create mission and vision statements that reflect IT’s intent and method to support the organization as it pursues a reduction strategy.

      1. Review the definitions and characteristics of mission and vision statements.
      2. Brainstorm different versions of the mission and vision statements.
      3. Edit the statements until you get to a single version of each that accurately reflects IT’s role in the reduction process.

      Record the results in the M&A Sell Playbook.

      Guiding principles provide a sense of direction

      IT guiding principles are shared, long-lasting beliefs that guide the use of IT in constructing, transforming, and operating the enterprise by informing and restricting IT investment portfolio management, solution development, and procurement decisions.

      A diagram illustrating the place of 'IT guiding principles' in the process of making 'Decisions on the use of IT'. There are four main items, connecting lines naming the type of process in getting from one step to the next, and a line underneath clarifying the questions asked at each step. On the far left, over the question 'What decisions should be made?', is 'Business context and IT implications'. This flows forward to 'IT guiding principles', and they are connected by 'Influence'. Next, over the question 'How should decisions be made?', is the main highlighted section. 'IT guiding principles' flows forward to 'Decisions on the use of IT', and they are connected by 'Guide and inform'. On the far right, over the question 'Who has the accountability and authority to make decisions?', is 'IT policies'. This flows back to 'Decisions on the use of IT', and they are connected by 'Direct and control'.

      IT principles must be carefully constructed to make sure they are adhered to and relevant

      Info-Tech has identified a set of characteristics that IT principles should possess. These characteristics ensure the IT principles are relevant and followed in the organization.

      Approach focused. IT principles should be focused on the approach – how the organization is built, transformed, and operated – as opposed to what needs to be built, which is defined by both functional and non-functional requirements.

      Business relevant. Create IT principles that are specific to the organization. Tie IT principles to the organization’s priorities and strategic aspirations.

      Long lasting. Build IT principles that will withstand the test of time.

      Prescriptive. Inform and direct decision making with actionable IT principles. Avoid truisms, general statements, and observations.

      Verifiable. If compliance can’t be verified, people are less likely to follow the principle.

      Easily Digestible. IT principles must be clearly understood by everyone in IT and by business stakeholders. IT principles aren’t a secret manuscript of the IT team. IT principles should be succinct; wordy principles are hard to understand and remember.

      Followed. Successful IT principles represent a collection of beliefs shared among enterprise stakeholders. IT principles must be continuously communicated to all stakeholders to achieve and maintain buy-in.

      In organizations where formal policy enforcement works well, IT principles should be enforced through appropriate governance processes.

      Consider the example principles below

      IT Principle Name

      IT Principle Statement

      1. Risk Management We will ensure that the organization’s IT Risk Management Register is properly updated to reflect all potential risks and that a plan of action against those risks has been identified.
      2. Transparent Communication We will ensure employees are spoken to with respect and transparency throughout the transaction process.
      3. Separation for Success We will create a carve-out strategy that enables the organization and clearly communicates the resources required to succeed.
      4. Managed Data We will handle data creation, modification, separation, and use across the enterprise in compliance with our data governance policy.
      5.Deliver Better Customer Service We will reduce the number of products offered by IT, enabling a stronger focus on specific products or elements to increase customer service delivery.
      6. Compliance With Laws and Regulations We will operate in compliance with all applicable laws and regulations for both our organization and the potentially purchasing organization.
      7. Defined Value We will create a plan of action that aligns with the organization’s defined value expectations.
      8. Network Readiness We will ensure that employees and customers have immediate access to the network with minimal or no outages.
      9. Value Generator We will leverage the current IT people, processes, and technology to turn the IT organization into a value generator by developing and selling our services to purchasing organizations.

      2.1.2 Identify the guiding principles

      2 hours

      Input: Business objectives, IT capabilities, Rationale for the transaction, Mission and vision statements

      Output: IT’s guiding principles for reduction strategies tied to mergers, acquisitions, and divestitures

      Materials: Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create the guiding principles that will direct the IT organization throughout the reduction strategy process.

      1. Review the role of guiding principles and the examples of guiding principles that organizations have used.
      2. Brainstorm different versions of the guiding principles. Each guiding principle should start with the phrase “We will…”
      3. Edit and consolidate the statements until you have a list of approximately eight to ten statements that accurately reflect IT’s role in the reduction process.
      4. Review the guiding principles every six months to ensure they continue to support the delivery of the business’ reduction strategy goals.

      Record the results in the M&A Sell Playbook.

      Create two IT teams to support the transaction

      IT M&A Transaction Team

      • The IT M&A Transaction Team should consist of the strongest members of the IT team who can be expected to deliver on unusual or additional tasks not asked of them in normal day-to-day operations.
      • The roles selected for this team will have very specific skills sets or deliver on critical separation capabilities, making their involvement in the combination of two or more IT environments paramount.
      • These individuals need to have a history of proving themselves very trustworthy, as they will likely be required to sign an NDA as well.
      • Expect to have to certain duplicate capabilities or roles across the M&A Team and Operational Team.

      IT Operational Team

      • This group is responsible for ensuring the business operations continue.
      • These employees might be those who are newer to the organization but can be counted on to deliver consistent IT services and products.
      • The roles of this team should ensure that end users or external customers remain satisfied.

      Key capabilities to support M&A

      Consider the following capabilities when looking at who should be a part of the IT Transaction Team.

      Employees who have a significant role in ensuring that these capabilities are being delivered will be a top priority.

      Infrastructure & Operations

      • System Separation
      • Data Management
      • Helpdesk/Desktop Support
      • Cloud/Server Management

      Business Focus

      • Service-Level Management
      • Enterprise Architecture
      • Stakeholder Management
      • Project Management

      Risk & Security

      • Privacy Management
      • Security Management
      • Risk & Compliance Management

      Build a lasting and scalable operating model

      An operating model is an abstract visualization, used like an architect’s blueprint, that depicts how structures and resources are aligned and integrated to deliver on the organization’s strategy.

      It ensures consistency of all elements in the organizational structure through a clear and coherent blueprint before embarking on detailed organizational design.

      The visual should highlight which capabilities are critical to attaining strategic goals and clearly show the flow of work so that key stakeholders can understand where inputs flow in and outputs flow out of the IT organization.

      As you assess the current operating model, consider the following:

      • Does the operating model contain all the necessary capabilities your IT organization requires to be successful?
      • What capabilities should be duplicated?
      • Are there individuals with the skill set to support those roles? If not, is there a plan to acquire or develop those skills?
      • A dedicated project team strictly focused on M&A is great. However, is it feasible for your organization? If not, what blockers exist?
      A diagram with 'Initiatives' and 'Solutions' on the left and right of an area chart, 'Customer' at the top, the area between them labelled 'Functional Area n', and six horizontal bars labelled 'IT Capability' stacked on top of each other. The 'IT Capability' bars are slightly skewed to the 'Solutions' side of the chart.

      Info-Tech Insight

      Investing time up-front getting the operating model right is critical. This will give you a framework to rationalize future organizational changes, allowing you to be more iterative and allowing your model to change as the business changes.

      2.1.3 Create the future-state operating model

      4 hours

      Input: Current operating model, IT strategy, IT capabilities, M&A-specific IT capabilities, Business objectives, Rationale for the transaction, Mission and vision statements

      Output: Future-state operating model for divesting organizations

      Materials: Operating model, Capability overlay, Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to establish what the future-state operating model will be if your organization needs to adjust to support a divestiture transaction. If your organization plans to sell in its entirety, you may choose to skip this activity.

      1. Ensuring that all the IT capabilities are identified by the business and IT strategy, document your organization’s current operating model.
      2. Identify what core capabilities would be critical to the divesting transaction process and separation. Highlight and make copies of those capabilities in the M&A Sell Playbook. As a result of divesting, there may also be capabilities that will become irrelevant in your future state.
      3. Ensure the capabilities that will be decentralized are clearly identified. Decentralized capabilities do not exist within the central IT organization but rather in specific lines of businesses, products, or locations to better understand needs and deliver on the capability.

      An example operating model is included in the M&A Sell Playbook. This process benefits from strong reference architecture and capability mapping ahead of time.

      Record the results in the M&A Sell Playbook.

      2.1.4 Determine the transition team

      3 hours

      Input: IT capabilities, Future-state operating model, M&A-specific IT capabilities, Business objectives, Rationale for the transaction, Mission and vision statements

      Output: Transition team

      Materials: Reference architecture, Organizational structure, Flip charts/whiteboard, Markers

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create a team that will support your IT organization throughout the transaction. Determining which capabilities and therefore which roles will be required ensures that the business will continue to get the operational support it needs.

      1. Based on the outcome of activity 2.1.3, review the capabilities that your organization will require on the transition team. Group capabilities into functional groups containing capabilities that are aligned well with one another because they have similar responsibilities and functionalities.
      2. Replace the capabilities with roles. For example, stakeholder management, requirements gathering, and project management might be one functional group. Project management and stakeholder management might combine to create a project manager role.
      3. Review the examples in the M&A Sell Playbook and identify which roles will be a part of the transition team.

      For more information, see Redesign Your Organizational Structure

      What is governance?

      And why does it matter so much to IT and the M&A process?

      • Governance is the method in which decisions get made, specifically as they impact various resources (time, money, and people).
      • Because M&A is such a highly governed transaction, it is important to document the governance bodies that exist in your organization.
      • This will give insight into what types of governing bodies there are, what decisions they make, and how that will impact IT.
      • For example, funds to support separation need to be discussed, approved, and supplied to IT from a governing body overseeing the acquisition.
      • A highly mature IT organization will have automated governance, while a seemingly non-existent governance process will be considered ad hoc.
      A pyramid with four levels representing the types of governing bodies that are available with differing levels of IT maturity. An arrow beside the pyramid points upward. The bottom of the arrow is labelled 'Traditional (People and document centric)' and the top is labelled 'Adaptive (Data centric)'. Starting at the bottom of the pyramid is level 1 'Ad Hoc Governance', 'Governance that is not well defined or understood within the organization. It occurs out of necessity but often not by the right people'. Level 2 is 'Controlled Governance', 'Governance focused on compliance and decisions driven by hierarchical authority. Levels of authority are defined and often driven by regulatory'. Level 3 is 'Agile Governance', 'Governance that is flexible to support different needs and quick response in the organization. Driven by principles and delegated throughout the company'. At the top of the pyramid is level 4 'Automated Governance', 'Governance that is entrenched and automated into organizational processes and product/service design. Empowered and fully delegated governance to maintain fit and drive organizational success and survival'.

      2.1.5 Document M&A governance

      1-2 hours

      Input: List of governing bodies, Governing body committee profiles, Governance structure

      Output: Documented method on how decisions are made as it relates to the M&A transaction

      Materials: Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to determine the method in which decisions are made throughout the M&A transaction as it relates to IT. This will require understanding both governing bodies internal to IT and those external to IT.

      1. First, determine the other governance structures within the organization that will impact the decisions made about M&A. List out these bodies or committees.
      2. Create a profile for each committee that looks at the membership, purpose of the committee, decision areas (authority), and the process of inputs and outputs. Ensure IT committees that will have a role in this process are also documented. Consider the benefits realized, risks, and resources required for each.
      3. Organize the committees into a structure, identifying the committees that have a role in defining the strategy, designing and building, and running.

      Record the results in the M&A Sell Playbook.

      Current-state structure map – definitions of tiers

      Strategy: These groups will focus on decisions that directly connect to the strategic direction of the organization.

      Design & Build: The second tier of groups will oversee prioritization of a certain area of governance as well as design and build decisions that feed into strategic decisions.

      Run: The lowest level of governance will be oversight of more-specific initiatives and capabilities within IT.

      Expect tier overlap. Some committees will operate in areas that cover two or three of these governance tiers.

      Measure the IT program’s success in terms of its ability to support the business’ M&A goals

      Upper management will measure IT’s success based on your ability to support the underlying reasons for the M&A. Using business metrics will help assure business stakeholders that IT understands their needs and is working with the business to achieve them.

      Business-Specific Metrics

      • Revenue Growth: Increase in the top line as seen by market expansion, product expansion, etc. by percentage/time.
      • Synergy Extraction: Reduction in costs as determined by the ability to identify and eliminate redundancies over time.
      • Profit Margin Growth: Increase in the bottom line as a result of increased revenue growth and/or decreased costs over time.

      IT-Specific Metrics

      • IT operational savings and cost reductions due to synergies: Operating expenses, capital expenditures, licenses, contracts, applications, infrastructure over time.
      • Reduction in IT staff expense and headcount: Decreased budget allocated to IT staff, and ability to identify and remove redundancies in staff.
      • Meeting or improving on IT budget estimates: Delivering successful IT separation on a budget that is the same or lower than the budget estimated during due diligence.
      • Meeting or improving on IT time-to-separation estimates: Delivering successful IT carve-out on a timeline that is the same or shorter than the timeline estimated during due diligence.
      • Business capability support: Delivering the end state of IT that supports the expected business capabilities and growth.

      Establish your own metrics to gauge the success of IT

      Establish SMART M&A Success Metrics

      S pecific Make sure the objective is clear and detailed.
      M easurable Objectives are measurable if there are specific metrics assigned to measure success. Metrics should be objective.
      A ctionable Objectives become actionable when specific initiatives designed to achieve the objective are identified.
      R ealistic Objectives must be achievable given your current resources or known available resources.
      T ime-Bound An objective without a timeline can be put off indefinitely. Furthermore, measuring success is challenging without a timeline.
      • What should IT consider when looking to identify potential additions, deletions, or modifications that will either add value to the organization or reduce costs/risks?
      • Provide a definition of synergies.
      • IT operational savings and cost reductions due to synergies: Operating expenses, capital expenditures, licenses, contracts, applications, infrastructure.
      • Reduction in IT staff expense and headcount: Decreased budget allocated to IT staff, and ability to identify and remove redundancies in staff.
      • Meeting or improving on IT budget estimates: Delivering successful IT separation on a budget that is the same or lower than the budget estimated during due diligence.
      • Meeting or improving on IT time-to-separation estimates: Delivering successful IT carve-out on a timeline that is the same or shorter than the timeline estimated during due diligence.
      • Revenue growth: Increase in the top line as a result, as seen by market expansion, product expansion, etc., as a result of divesting lines of the business and selling service-level agreements to the purchasing organization.
      • Synergy extraction: Reduction in costs, as determined by the ability to identify and eliminate redundancies.
      • Profit margin growth: Increase in the bottom line as a result of increased revenue growth and/or decreased costs.

      Metrics for each phase

      1. Proactive

      2. Discovery & Strategy

      3. Valuation & Due Diligence

      4. Execution & Value Realization

      • % Share of business innovation spend from overall IT budget
      • % Critical processes with approved performance goals and metrics
      • % IT initiatives that meet or exceed value expectation defined in business case
      • % IT initiatives aligned with organizational strategic direction
      • % Satisfaction with IT's strategic decision-making abilities
      • $ Estimated business value added through IT-enabled innovation
      • % Overall stakeholder satisfaction with IT
      • % Percent of business leaders that view IT as an Innovator
      • % IT budget as a percent of revenue
      • % Assets that are not allocated
      • % Unallocated software licenses
      • # Obsolete assets
      • % IT spend that can be attributed to the business (chargeback or showback)
      • % Share of CapEx of overall IT budget
      • % Prospective organizations that meet the search criteria
      • $ Total IT cost of ownership (before and after M&A, before and after rationalization)
      • % Business leaders that view IT as a Business Partner
      • % Defects discovered in production
      • $ Cost per user for enterprise applications
      • % In-house-built applications vs. enterprise applications
      • % Owners identified for all data domains
      • # IT staff asked to participate in due diligence
      • Change to due diligence
      • IT budget variance
      • Synergy target
      • % Satisfaction with the effectiveness of IT capabilities
      • % Overall end-customer satisfaction
      • $ Impact of vendor SLA breaches
      • $ Savings through cost-optimization efforts
      • $ Savings through application rationalization and technology standardization
      • # Key positions empty
      • % Frequency of staff turnover
      • % Emergency changes
      • # Hours of unplanned downtime
      • % Releases that cause downtime
      • % Incidents with identified problem record
      • % Problems with identified root cause
      • # Days from problem identification to root cause fix
      • % Projects that consider IT risk
      • % Incidents due to issues not addressed in the security plan
      • # Average vulnerability remediation time
      • % Application budget spent on new build/buy vs. maintenance (deferred feature implementation, enhancements, bug fixes)
      • # Time (days) to value realization
      • % Projects that realized planned benefits
      • $ IT operational savings and cost reductions that are related to synergies/divestitures
      • % IT staff–related expenses/redundancies
      • # Days spent on IT separation
      • $ Accurate IT budget estimates
      • % Revenue growth directly tied to IT delivery
      • % Profit margin growth

      2.1.6 Create program metrics

      1-2 hours

      Input: IT capabilities, Mission, vision, and guiding principles, Rationale for the acquisition

      Output: Program metrics to support IT throughout the M&A process

      Materials: Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to determine how IT’s success throughout a growth transaction will be measured and determined.

      1. Document a list of appropriate metrics on the whiteboard. Remember to include metrics that demonstrate the business impact. You can use the sample metrics listed on the previous slide as a starting point.
      2. Set a target and deadline for each metric. This will help the group determine when it is time to evaluate progression.
      3. Establish a baseline for each metric based on information collected within your organization.
      4. Assign an owner for tracking each metric as well as someone to be accountable for performance.

      Record the results in the M&A Sell Playbook.

      Discovery & Strategy

      Step 2.2

      Prepare IT to Engage in the Separation or Sale

      Activities

      • 2.2.1 Establish the separation strategy
      • 2.2.2 Conduct a RACI
      • 2.2.3 Create the communication plan
      • 2.2.4 Assess the potential organization(s)

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team

      Outcomes of Step

      Identify IT’s plan of action when it comes to the separation/sale and align IT’s separation/sale strategy with the business’ M&A strategy.

      Separation strategies

      There are several IT separation strategies that will let you achieve your target technology environment.

      IT Separation Strategies
      • Divest. Carve out elements of the IT organization and sell them to a purchasing organization with or without a service-level agreement.
      • Sell. Sell the entire IT environment to a purchasing organization. The purchasing organization takes full responsibility in delivering and running the IT environment.
      • Spin-Off Joint Venture. Carve out elements of the IT organization and combine them with elements of a new or purchasing organization to create a new entity.

      The approach IT takes will depend on the business objectives for the M&A.

      • Generally speaking, the separation strategy is well understood and influenced by the frequency of and rationale for selling.
      • Based on the initiatives generated by each business process owner, you need to determine the IT separation strategy that will best support the desired target technology environment, especially if you are still operating or servicing elements of that IT environment.

      Key considerations when choosing an IT separation strategy include:

      • What are the main business objectives of the M&A?
      • What are the key synergies expected from the transaction?
      • What IT separation strategy best helps obtain these benefits?
      • What opportunities exist to position the business for sustainable and long-term growth?

      Separation strategies in detail

      Review highlights and drawbacks of different separation strategies

      Divest
        Highlights
      • Recommended for businesses striving to reduce costs and potentially even generate revenue for the business through the delivery of SLAs.
      • Opportunity to reduce or scale back on lines of business or products that are not driving profits.
        Drawbacks
      • May be forced to give up critical staff that have been known to deliver high value.
      • The IT department is left to deliver services to the purchasing organization with little support or consideration from the business.
      • There can be increased risk and security concerns that need to be addressed.
      Sell
        Highlights
      • Recommended for businesses looking to gain capital to exit the market profitably or to enter a new market with a large sum of capital.
      • The business will no longer exist, and as a result all operational costs, including IT, will become redundant.
        Drawbacks
      • IT is no longer needed as an operating or capital service for the organization.
      • Lost resources, including highly trained and critical staff.
      • May require packaging employees off and using the profit or capital generated to cover any closing costs.
      Spin-Off or Joint Venture
        Highlights
      • Recommended for businesses looking to expand their market presence or acquire new products. Essentially aligning the two organizations in the same market.
      • Each side has a unique offering but complementing capabilities.
        Drawbacks
      • As much as the organization is going through a separation from the original company, it will be going through an integration with the new company.
      • There could be differences in culture.
      • This could require a large amount of investment without a guarantee of profit or success.

      2.2.1 Establish the separation strategy

      1-2 hours

      Input: Business separation strategy, Guiding principles, M&A governance

      Output: IT’s separation strategy

      Materials: Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to determine IT’s approach to separating or selling. This approach might differ slightly from transaction to transaction. However, the businesses approach to transactions should give insight into the general separation strategy IT should adopt.

      1. Make sure you have clearly articulated the business objectives for the M&A, the technology end state for IT, and the magnitude of the overall separation.
      2. Review and discuss the highlights and drawbacks of each type of separation.
      3. Use Info-Tech’s Separation Posture Selection Framework on the next slide to select the separation posture that will appropriately enable the business. Consider these questions during your discussion:
        1. What are the main business objectives of the M&A? What key IT capabilities will need to support business objectives?
        2. What key synergies are expected from the transaction? What opportunities exist to position the business for sustainable growth?
        3. What IT separation best helps obtain these benefits?

      Record the results in the M&A Sell Playbook.

      Separation Posture Selection Framework

      Business M&A Strategy

      Resultant Technology Strategy

      M&A Magnitude (% of Seller Assets, Income, or Market Value)

      IT Separation Posture

      A. Horizontal Adopt One Model ‹100% Divest
      ›99% Sell
      B. Vertical Create Links Between Critical Systems Any Divest
      C. Conglomerate Independent Model Any Joint Venture
      Divest
      D. Hybrid: Horizontal & Conglomerate Create Links Between Critical Systems Any Divest
      Joint Venture

      M&A separation strategy

      Business M&A Strategy Resultant Technology Strategy M&A Magnitude (% of Seller Assets, Income, or Market Value) IT Separation Posture

      You may need a hybrid separation posture to achieve the technology end state.

      M&A objectives may not affect all IT domains and business functions in the same way. Therefore, the separation requirements for each business function may differ. Organizations will often choose to select and implement a hybrid separation posture to realize the technology end state.

      Each business division may have specific IT domain and capability needs that require an alternative separation strategy.

      • Example: Even when conducting a joint venture by forming a new organization, some partners might view themselves as the dominant partner and want to influence the IT environment to a greater degree.
      • Example: Some purchasing organizations will expect service-level agreements to be available for a significant period of time following the divestiture, while others will be immediately independent.

      2.2.2 Conduct a RACI

      1-2 hours

      Input: IT capabilities, Transition team, Separation strategy

      Output: Completed RACI for Transition team

      Materials: Reference architecture, Organizational structure, Flip charts/whiteboard, Markers, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to identify the core accountabilities and responsibilities for the roles identified as critical to your transition team. While there might be slight variation from transaction to transaction, ideally each role should be performing certain tasks.

      1. First, identify a list of critical tasks that need to be completed to support the sale or separation. For example:
        • Communicate with the company M&A team.
        • Identify the key IT solutions that can and cannot be carved out.
        • Gather data room artifacts and provide them to acquiring organization.
      2. Next, identify at the activity level which role is accountable or responsible for each activity. Enter an A for accountable, R for responsible, or A/R for both.

      Record the results in the M&A Sell Playbook.

      Communication and change

      Prepare key stakeholders for the potential changes

      • Anytime you are starting a project or program that will depend on users and stakeholders to give up their old way of doing things, change will force people to become novices again, leading to lost productivity and added stress.
      • Change management can improve outcomes for any project where you need people to adopt new tools and procedures, comply with new policies, learn new skills and behaviors, or understand and support new processes.
      • M&As move very quickly, and it can be very difficult to keep track of which stakeholders you need to be communicating with and what you should be communicating.
      • Not all organizations embrace or resist change in the same ways. Base your change communications on your organization’s cultural appetite for change in general.
        • Organizations with a low appetite for change will require more direct, assertive communications.
        • Organizations with a high appetite for change are more suited to more open, participatory approaches.

      Three key dimensions determine the appetite for cultural change:

      • Power Distance. Refers to the acceptance that power is distributed unequally throughout the organization.
        In organizations with a high power distance, the unequal power distribution is accepted by the less powerful employees.
      • Individualism. Organizations that score high in individualism have employees who are more independent. Those who score low in individualism fall into the collectivism side, where employees are strongly tied to one another or their groups.
      • Uncertainty Avoidance. Describes the level of acceptance that an organization has toward uncertainty. Those who score high in this area find that their employees do not favor uncertain situations, while those that score low in this area find that their employees are comfortable with change and uncertainty.

      2.2.3 Create the communication plan

      1-2 hours

      Input: IT’s M&A mission, vision, and guiding principles, M&A transition team, IT separation strategy, RACI

      Output: IT’s M&A communication plan

      Materials: Flip charts/whiteboard, Markers, RACI, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create a communication plan that IT can leverage throughout the initiative.

      1. Create a structured communication plan that allows for continuous communication with the integration management office, senior management, and the business functional heads.
      2. Outline key topics of communication, with stakeholders, inputs, and outputs for each topic.
      3. Review Info-Tech’s example communication plan in the M&A Sell Playbook and update it with relevant information.
      4. Does this communication plan make sense for your organization? What doesn’t make sense? Adjust the communication guide to suit your organization.

      Record the results in the M&A Sell Playbook.

      Assessing potential organizations

      As soon as you have identified organizations to consider, it’s imperative to assess critical risks. Most IT leaders can attest that they will receive little to no notice when the business is pursuing a sale and IT has to assess the IT organization. As a result, having a standardized template to quickly assess the potential acquiring organization is important.

      Ways to Assess

      1. News: Assess what sort of news has been announced in relation to the organization. Have they had any risk incidents? Has a critical vendor announced working with them?
      2. LinkedIn: Scan through the LinkedIn profiles of employees. This will give you a sense of what platforms they have based on employees. It will also give insight into positive or negative employee experiences that could impact retention.
      3. Trends: Some industries will have specific solutions that are relevant and popular. Assess what the key players are (if you don’t already know) to determine the solution.
      4. Business Architecture: While this assessment won’t perfect, try to understand the business’ value streams and the critical business and IT capabilities that would be needed to support them. Will your organization or employee skills be required to support these long term?

      Info-Tech Insight

      Assessing potential organizations is not just for the purchaser. The seller should also know what the purchasing organization’s history with M&As is and what potential risks could occur if remaining connected through ongoing SLAs.

      2.2.4 Assess the potential organization(s)

      1-2 hours

      Input: Publicized historical risk events, Solutions and vendor contracts likely in the works, Trends

      Output: IT’s valuation of the potential organization(s) for selling or divesting

      Materials: M&A Sell Playbook

      Participants: IT executive/CIO

      The purpose of this activity is to assess the organization(s) that your organization is considering selling or divesting to.

      1. Complete the Historical Valuation Worksheet in the M&A Sell Playbook to understand the type of IT organization that your company may support.
        • The business likely isn’t looking for in-depth details at this time. However, as the IT leader, it is your responsibility to ensure critical risks are identified and communicated to the business.
      2. Use the information identified to help the business narrow down which organizations could be the right organizations to sell or divest to.

      Record the results in the M&A Sell Playbook.

      By the end of this pre-transaction phase you should:

      Have a program plan for M&As and a repeatable M&A strategy for IT when engaging in reduction transactions

      Key outcomes from the Discovery & Strategy phase
      • Prepare the IT environment to support the potential sale or divestiture by identifying critical program plan elements and establishing a separation or carve-out strategy that will enable the business to reach its goals.
      • Create a M&A strategy that accounts for all the necessary elements of a transaction and ensures sufficient governance, capabilities, and metrics exist.
      Key deliverables from the Discovery & Strategy phase
      • Create vision and mission statements
      • Establish guiding principles
      • Create a future-state operating model
      • Identify the key roles for the transaction team
      • Identify and communicate the M&A governance
      • Determine target metrics
      • Identify the M&A operating model
      • Select the separation strategy framework
      • Conduct a RACI for key transaction tasks for the transaction team
      • Document the communication plan

      M&A Sell Blueprint

      Phase 3

      Due Diligence & Preparation

      Phase 1Phase 2

      Phase 3

      Phase 4
      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Reduction Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Separation or Sale
      • 3.1 Engage in Due Diligence and Prepare Staff
      • 3.2 Prepare to Separate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Drive value with a due diligence charter
      • Gather data room artifacts
      • Measure staff engagement
      • Assess culture
      • Create a carve-out roadmap
      • Prioritize separation tasks
      • Establish the separation roadmap
      • Identify the buyer’s IT expectations
      • Create a service/transaction agreement
      • Estimate separation costs
      • Create an employee transition plan
      • Create functional workplans for employees
      • Align project metrics with identified tasks

      This phase involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team
      • Business leaders
      • Purchasing organization
      • Transition team

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Pre-Work

      Day 1

      Day 2

      Day 3

      Day 4

      Day 5

      Establish the Transaction FoundationDiscover the Motivation for SeparationIdentify Expectations and Create the Carve-Out RoadmapPrepare and Manage EmployeesPlan the Separation RoadmapNext Steps and Wrap-Up (offsite)

      Activities

      • 0.1 Identify the rationale for the company's decision to pursue a divestiture/sale.
      • 0.2 Identify key stakeholders and determine the IT transaction team.
      • 0.3 Gather and evaluate the M&A strategy, future-state operating model, and governance.
      • 1.1 Review the business rationale for the divestiture/sale.
      • 1.2 Identify pain points and opportunities tied to the divestiture/sale.
      • 1.3 Establish the separation strategy.
      • 1.4 Create the due diligence charter.
      • 2.1 Identify the buyer’s IT expectations.
      • 2.2 Create a list of IT artifacts to be reviewed in the data room.
      • 2.3 Create a carve-out roadmap.
      • 2.4 Create a service/technical transaction agreement.
      • 3.1 Measure staff engagement.
      • 3.2 Assess the current culture and identify the goal culture.
      • 3.3 Create an employee transition plan.
      • 3.4 Create functional workplans for employees.
      • 4.1 Prioritize separation tasks.
      • 4.2 Establish the separation roadmap.
      • 4.3 Establish and align project metrics with identified tasks.
      • 4.4 Estimate separation costs.
      • 5.1 Complete in-progress deliverables from previous four days.
      • 5.2 Set up review time for workshop deliverables and to discuss next steps.

      Deliverables

      1. IT strategy
      2. IT operating model
      3. IT governance structure
      4. M&A transaction team
      1. Business context implications for IT
      2. Separation strategy
      3. Due diligence charter
      1. Data room artifacts identified
      2. Carve-out roadmap
      3. Service/technical transaction agreement
      1. Engagement assessment
      2. Culture assessment
      3. Employee transition plans and workplans
      1. Separation roadmap and associated resourcing
      1. Divestiture separation strategy for IT

      What is the Due Diligence & Preparation phase?

      Mid-transaction state

      The Due Diligence & Preparation phase during a sale or divestiture is a critical time for IT. If IT fails to proactively participate in this phase, IT will have to merely react to separation expectations set by the business.

      If your organization is being sold in its entirety, staff will have major concerns about their future in the new organization. Making this transition as smooth as possible and being transparent could go a long way in ensuring their success in the new organization.

      In a divestiture, this is the time to determine where it’s possible for the organization to divide or separate from itself. A lack of IT involvement in these conversations could lead to an overcommitment by the business and under-delivery by IT.

      Goal: To ensure that, as the selling or divesting organization, you comply with regulations, prepare staff for potential changes, and identify a separation strategy if necessary

      Due Diligence Prerequisite Checklist

      Before coming into the Due Diligence & Preparation phase, you must have addressed the following:

      • Understand the rationale for the company's decision to pursue a sale or divestiture and what opportunities or pain points the sale should alleviate.
      • Identify the key roles for the transaction team.
      • Identify the M&A governance.
      • Determine target metrics.
      • Select a separation strategy framework.
      • Conduct a RACI for key transaction tasks for the transaction team.

      Before coming into the Due Diligence & Preparation phase, we recommend addressing the following:

      • Create vision and mission statements.
      • Establish guiding principles.
      • Create a future-state operating model.
      • Identify the M&A operating model.
      • Document the communication plan.
      • Examine the business perspective of IT.
      • Identify key stakeholders and outline their relationship to the M&A process.
      • Be able to valuate the IT environment and communicate IT’s value to the business.

      The Technology Value Trinity

      Delivery of Business Value & Strategic Needs

      • Digital & Technology Strategy
        The identification of objectives and initiatives necessary to achieve business goals.
      • IT Operating Model
        The model for how IT is organized to deliver on business needs and strategies.
      • Information & Technology Governance
        The governance to ensure the organization and its customers get maximum value from the use of information and technology.

      All three elements of the Technology Value Trinity work in harmony to deliver business value and achieve strategic needs. As one changes, the others need to change as well.

      • Digital and IT Strategy tells you what you need to achieve to be successful.
      • IT Operating Model and Organizational Design is the alignment of resources to deliver on your strategy and priorities.
      • Information & Technology Governance is the confirmation of IT’s goals and strategy, which ensures the alignment of IT and business strategy. It’s the mechanism by which you continuously prioritize work to ensure that what is delivered is in line with the strategy. This oversight evaluates, directs, and monitors the delivery of outcomes to ensure that the use of resources results in the achieving the organization’s goals.

      Too often strategy, operating model and organizational design, and governance are considered separate practices. As a result, “strategic documents” end up being wish lists, and projects continue to be prioritized based on who shouts the loudest – not based on what is in the best interest of the organization.

      Due Diligence & Preparation

      Step 3.1

      Engage in Due Diligence and Prepare Staff

      Activities

      • 3.1.1 Drive value with a due diligence charter
      • 3.1.2 Gather data room artifacts
      • 3.1.3 Measure staff engagement
      • 3.1.4 Assess culture

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Company M&A team
      • Business leaders
      • Prospective IT organization
      • Transition team

      Outcomes of Step

      This step of the process is when IT should prepare and support the business in due diligence and gather the necessary information about staff changes.

      3.1.1 Drive value with a due diligence charter

      1-2 hours

      Input: Key roles for the transaction team, M&A governance, Target metrics, Selected separation strategy framework, RACI of key transaction tasks for the transaction team

      Output: IT Due Diligence Charter

      Materials: M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to create a charter leveraging the items completed in the previous phase, as listed on the Due Diligence Prerequisite Checklist slide, to gain executive sign-off.

      1. In the IT Due Diligence Charter in the M&A Sell Playbook, complete the aspects of the charter that are relevant for you and your organization.
      2. We recommend including these items in the charter:
        • Communication plan
        • Transition team roles
        • Goals and metrics for the transaction
        • Separation strategy
        • Sale/divestiture RACI
      3. Once the charter has been completed, ensure that business executives agree to the charter and sign off on the plan of action.

      Record the results in the M&A Sell Playbook.

      3.1.2 Gather data room artifacts

      4 hours

      Input: Future-state operating model, M&A governance, Target metrics, Selected separation strategy framework, RACI of key transaction tasks for the transaction team

      Output: List of items to acquire and verify can be provided to the purchasing organization while in the data room

      Materials: Critical domain lists on following slides, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Transition team, Legal team, Compliance/privacy officers

      The purpose of this activity is to create a list of the key artifacts that you could be asked for during the due diligence process.

      1. Review the lists on the following pages as a starting point. Identify which domains, stakeholders, artifacts, and information should be requested for the data room.
      2. IT leadership may or may not be asked to enter the data room directly. The short notice for having to find these artifacts for the purchasing organization can leave your IT organization scrambling. Identify the critical items worth obtaining ahead of time.
      3. Once you have identified the artifacts, provide the list to the legal team or compliance/privacy officers and ensure they also agree those items can be provided. If changes to the documents need to be made, take the time to do so.
      4. Store all items in a safe and secure file or provide to the M&A team ahead of due diligence.

      **Note that if your organization is not leading/initiating the data room, then you can ignore this activity.

      Record the results in the M&A Sell Playbook.

      Critical domains

      Understand the key stakeholders and outputs for each domain

      Domain

      Stakeholders

      Key Artifacts

      Key Information to request

      Business
      • Enterprise Architecture
      • Business Relationship Manager
      • Business Process Owners
      • Business capability map
      • Capability map (the M&A team should be taking care of this, but make sure it exists)
      • Business satisfaction with various IT systems and services
      Leadership/IT Executive
      • CIO
      • CTO
      • CISO
      • IT budgets
      • IT capital and operating budgets (from current year and previous year)
      Data & Analytics
      • Chief Data Officer
      • Data Architect
      • Enterprise Architect
      • Master data domains, system of record for each
      • Unstructured data retention requirements
      • Data architecture
      • Master data domains, sources, and storage
      • Data retention requirements
      Applications
      • Applications Manager
      • Application Portfolio Manager
      • Application Architect
      • Applications map
      • Applications inventory
      • Applications architecture
      • Copy of all software license agreements
      • Copy of all software maintenance agreements
      Infrastructure
      • Head of Infrastructure
      • Enterprise Architect
      • Infrastructure Architect
      • Infrastructure Manager
      • Infrastructure map
      • Infrastructure inventory
      • Network architecture (including which data centers host which infrastructure and applications)
      • Inventory (including separation capabilities of vendors, versions, switches, and routers)
      • Copy of all hardware lease or purchase agreements
      • Copy of all hardware maintenance agreements
      • Copy of all outsourcing/external service provider agreements
      • Copy of all service-level agreements for centrally provided, shared services and systems
      Products and Services
      • Product Manager
      • Head of Customer Interactions
      • Product lifecycle
      • Product inventory
      • Customer market strategy

      Critical domains (continued)

      Understand the key stakeholders and outputs for each domain

      Domain

      Stakeholders

      Key Artifacts

      Key Information to request

      Operations
      • Head of Operations
      • Service catalog
      • Service overview
      • Service owners
      • Access policies and procedures
      • Availability and service levels
      • Support policies and procedures
      • Costs and approvals (internal and customer costs)
      IT Processes
      • CIO
      • IT Management
      • VP of IT Governance
      • VP of IT Strategy
      • IT process flow diagram
      • Processes in place and productivity levels (capacity)
      • Critical processes/processes the organization feels they do particularly well
      IT People
      • CIO
      • VP of Human Resources
      • IT organizational chart
      • Competency & capacity assessment
      • IT organizational structure (including resources from external service providers such as contractors) with appropriate job descriptions or roles and responsibilities
      • IT headcount and location
      Security
      • CISO
      • Security Architect
      • Security posture
      • Information security staff
      • Information security service providers
      • Information security tools
      • In-flight information security projects
      Projects
      • Head of Projects
      • Project portfolio
      • List of all future, ongoing, and recently completed projects
      Vendors
      • Head of Vendor Management
      • License inventory
      • Inventory (including what will and will not be transitioning, vendors, versions, number of licenses)

      Retain top talent throughout the transition

      Focus on retention and engagement

      • People are such a critical component of this process, especially in the selling organization.
      • Retaining employees, especially the critical employees who hold specific skills or knowledge, will ensure the success and longevity of the divesting organization, purchasing organization, or the new company.
      • Giving employees a role in the organization and ensuring they do not see their capabilities as redundant will be critical to the process.
      • It is okay if employees need to change what they were doing temporarily or even long-term. However, being transparent about these changes and highlighting their value to the process and organization(s) will help.
      • The first step to moving forward with retention is to look at the baseline engagement and culture of employees and the organization. This will help determine where to focus and allow you to identify changes in engagement that resulted from the transaction.
      • Job engagement drivers are levers that influence the engagement of employees in their day-to-day roles.
      • Organizational engagement drivers are levers that influence an employee’s engagement with the broader organization.
      • Retention drivers are employment needs. They don’t necessarily drive engagement, but they must be met for engagement to be possible.

      3.1.3 Measure staff engagement

      3-4 hours

      Input: Engagement survey

      Output: Baseline engagement scores

      Materials: Build an IT Employee Engagement Program

      Participants: IT executive/CIO, IT senior leadership, IT employees of current organization

      The purpose of this activity is to measure current staff engagement to have a baseline to measure against in the future state. This is a good activity to complete if you will be divesting or selling in entirety.

      The results from the survey should act as a baseline to determine what the organization is doing well in terms of employee engagement and what drivers could be improved upon.

      1. Review Info-Tech’s Build an IT Employee Engagement Program research and select a survey that will best meet your needs.
      2. Conduct the survey and note which drivers employees are currently satisfied with. Likewise, note where there are opportunities.
      3. Document actions that should be taken to mitigate the negative engagement drivers throughout the transaction and enhance or maintain the positive engagement drivers.

      Record the results in the M&A Sell Playbook.

      Assess culture as a part of engagement

      Culture should not be overlooked, especially as it relates to the separation of IT environments

      • There are three types of culture that need to be considered.
      • Most importantly, this transition is an opportunity to change the culture that might exist in your organization’s IT environment.
      • Make a decision on which type of culture you’d like IT to have post transition.

      Target Organization's Culture. The culture that the target organization is currently embracing. Their established and undefined governance practices will lend insight into this.

      Your Organization’s Culture. The culture that your organization is currently embracing. Examine people’s attitudes and behaviors within IT toward their jobs and the organization.

      Ideal Culture. What will the future culture of the IT organization be once separation is complete? Are there aspects that your current organization and the target organization embrace that are worth considering?

      Culture categories

      Map the results of the IT Culture Diagnostic to an existing framework

      Competitive
      • Autonomy
      • Confront conflict directly
      • Decisive
      • Competitive
      • Achievement oriented
      • Results oriented
      • High performance expectations
      • Aggressive
      • High pay for good performance
      • Working long hours
      • Having a good reputation
      • Being distinctive/different
      Innovative
      • Adaptable
      • Innovative
      • Quick to take advantage of opportunities
      • Risk taking
      • Opportunities for professional growth
      • Not constrained by rules
      • Tolerant
      • Informal
      • Enthusiastic
      Traditional
      • Stability
      • Reflective
      • Rule oriented
      • Analytical
      • High attention to detail
      • Organized
      • Clear guiding philosophy
      • Security of employment
      • Emphasis on quality
      • Focus on safety
      Cooperative
      • Team oriented
      • Fair
      • Praise for good performance
      • Supportive
      • Calm
      • Developing friends at work
      • Socially responsible

      Culture Considerations

      • What culture category was dominant for each IT organization?
      • Do you share the same dominant category?
      • Is your current dominant culture category the most ideal to have post-separation?

      3.1.4 Assess Culture

      3-4 hours

      Input: Cultural assessments for current IT organization, Cultural assessment for target IT organization

      Output: Goal for IT culture

      Materials: IT Culture Diagnostic

      Participants: IT executive/CIO, IT senior leadership, IT employees of current organization, IT employees of target organization, Company M&A team

      The purpose of this activity is to assess the different cultures that might exist within the IT environments of the organizations involved. By understanding the culture that exists in the purchasing organization, you can identify the fit and prepare impacted staff for potential changes.

      1. Complete this activity by leveraging the blueprint Fix Your IT Culture, specifically the IT Culture Diagnostic.
      2. Fill out the diagnostic for the IT department in your organization:
        1. Answer the 16 questions in tab 2, Diagnostic.
        2. Find out your dominant culture and review recommendations in tab 3, Results.
      3. Document the results from tab 3, Results, in the M&A Sell Playbook if you are trying to record all artifacts related to the transaction in one place.
      4. Repeat the activity for the purchasing organization.
      5. Leverage the information to determine what the goal for the culture of IT will be post-separation if it will differ from the current culture.

      Record the results in the M&A Sell Playbook.

      Due Diligence & Preparation

      Step 3.2

      Prepare to Separate

      Activities

      • 3.2.1 Create a carve-out roadmap
      • 3.2.2 Prioritize separation tasks
      • 3.2.3 Establish the separation roadmap
      • 3.2.4 Identify the buyer’s IT expectations
      • 3.2.5 Create a service/transaction agreement
      • 3.2.6 Estimate separation costs
      • 3.2.7 Create an employee transition plan
      • 3.2.8 Create functional workplans for employees
      • 3.2.9 Align project metrics with identified tasks

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Transition team
      • Company M&A team
      • Purchasing organization

      Outcomes of Step

      Have an established plan of action toward separation across all domains and a strategy toward resources.

      Don’t underestimate the importance of separation preparation

      Separation involves taking the IT organization and dividing it into two or more separate entities.

      Testing the carve capabilities of the IT organization often takes 3 months. (Source: Cognizant, 2014)

      Daimler-Benz lost nearly $19 billion following its purchase of Chrysler by failing to recognize the cultural differences that existed between the two car companies. (Source: Deal Room)

      Info-Tech Insight

      Separating the IT organization requires more time and effort than business leaders will know. Frequently communicate challenges and lost opportunities when carving the IT environment out.

      Separation needs

      Identify the business objectives of the sale to determine the IT strategy

      Set up a meeting with your IT due diligence team to:

      • Ensure there will be no gaps in the delivery of products and services in the future state.
      • Discuss the people and processes necessary to achieve the target technology environment and support M&A business objectives.

      Use this opportunity to:

      • Identify data and application complexities between the involved organizations.
      • Identify the IT people and process gaps, initiatives, and levels of support expected.
      • Determine your infrastructure needs to ensure effectiveness and delivery of services:
        • Does IT have the infrastructure to support the applications and business capabilities?
        • Identify any gaps between the current infrastructure in both organizations and the infrastructure required.
        • Identify any redundancies/gaps.
        • Determine the appropriate IT separation strategies.
      • Document your gaps, redundancies, initiatives, and assumptions to help you track and justify the initiatives that must be undertaken and help estimate the cost of separation.

      Separation strategies

      There are several IT separation strategies that will let you achieve your target technology environment.

      IT Separation Strategies
      • Divest. Carve out elements of the IT organization and sell them to a purchasing organization with or without a service-level agreement.
      • Sell. Sell the entire IT environment to a purchasing organization. The purchasing organization takes full responsibility in delivering and running the IT environment.
      • Spin-Off Joint Venture. Carve out elements of the IT organization and combine them with elements of a new or purchasing organization to create a new entity.

      The approach IT takes will depend on the business objectives for the M&A.

      • Generally speaking, the separation strategy is well understood and influenced by the frequency of and rationale for selling.
      • Based on the initiatives generated by each business process owner, you need to determine the IT separation strategy that will best support the desired target technology environment, especially if you are still operating or servicing elements of that IT environment.

      Key considerations when choosing an IT separation strategy include:

      • What are the main business objectives of the M&A?
      • What are the key synergies expected from the transaction?
      • What IT separation strategy best helps obtain these benefits?
      • What opportunities exist to position the business for sustainable and long-term growth?

      Separation strategies in detail

      Review highlights and drawbacks of different separation strategies

      Divest
        Highlights
      • Recommended for businesses striving to reduce costs and potentially even generate revenue for the business through the delivery of SLAs.
      • Opportunity to reduce or scale back on lines of business or products that are not driving profits.
        Drawbacks
      • May be forced to give up critical staff that have been known to deliver high value.
      • The IT department is left to deliver services to the purchasing organization with little support or consideration from the business.
      • There can be increased risk and security concerns that need to be addressed.
      Sell
        Highlights
      • Recommended for businesses looking to gain capital to exit the market profitably or to enter a new market with a large sum of capital.
      • The business will no longer exist, and as a result all operational costs, including IT, will become redundant.
        Drawbacks
      • IT is no longer needed as an operating or capital service for the organization.
      • Lost resources, including highly trained and critical staff.
      • May require packaging employees off and using the profit or capital generated to cover any closing costs.
      Spin-Off or Joint Venture
        Highlights
      • Recommended for businesses looking to expand their market presence or acquire new products. Essentially aligning the two organizations in the same market.
      • Each side has a unique offering but complementing capabilities.
        Drawbacks
      • As much as the organization is going through a separation from the original company, it will be going through an integration with the new company.
      • There could be differences in culture.
      • This could require a large amount of investment without a guarantee of profit or success.

      Preparing the carve-out roadmap

      And why it matters so much

      • When carving out the IT environment in preparation for a divestiture, it’s important to understand the infrastructure, application, and data connections that might exist.
      • Much to the business’ surprise, carving out the IT environment is not easy, especially when considering the services and products that might depend on access to certain applications or data sets.
      • Once the business has indicated which elements they anticipate divesting, be prepared for testing the functionality and ability of this carve-out, either through automation or manually. There are benefits and drawbacks to both methods:
        • Automated requires a solution and a developer to code the tests.
        • Manual requires time to find the errors, possibly more time than automated testing.
      • Identify if there are dependencies that will make the carve-out difficult.
        • For example, the business is trying to divest Product X, but that product is integrated with Product Y, which is not being sold.
        • Consider all the processes and products that specific data might support as well.
        • Moreover, the data migration tool will need to enter the ERP system and identify not just the data but all supporting and historical elements that underlie the data.

      Critical components to consider:

      • Selecting manual or automated testing
      • Determining data dependencies
      • Data migration capabilities
      • Auditing approval
      • People and skills that support specific elements being carved out

      3.2.1 Create a carve-out roadmap

      6 hours

      Input: Items included in the carve-out, Dependencies, Whether testing is completed, If the carve-out will pass audit, If the carve-out item is prepared to be separated

      Output: Carve-out roadmap

      Materials: Business’ divestiture plan, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Business leaders, Transition team

      The purpose of this activity is to prepare the IT environment by identifying a carve-out roadmap, specifically looking at data, infrastructure, and applications. Feel free to expand the roadmap to include other categories as your organization sees fit.

      1. In the Carve-Out Roadmap in the M&A Sell Playbook, identify the key elements of the carve-out in the first column.
      2. Note any dependencies the items might have. For example:
        • The business is selling Product X, which is linked to Data X and Data Y. The organization does not want to sell Data Y. Data X would be considered dependent on Data Y.
      3. Once the dependencies have been confirmed, begin automated or manual testing to examine the possibility of separating the data sets (or other dependencies) from one another.
      4. After identifying an acceptable method of separation, inform the auditing individual or body and confirm that there would be no repercussions for the planned process.

      Record the results in the M&A Sell Playbook.

      3.2.2 Prioritize separation tasks

      2 hours

      Input: Separation tasks, Transition team, M&A RACI

      Output: Prioritized separation list

      Materials: Separation task checklist, Separation roadmap

      Participants: IT executive/CIO, IT senior leadership, Company M&A team

      The purpose of this activity is to prioritize the different separation tasks that your organization has identified as necessary to this transaction. Some tasks might not be relevant for this particular transaction, and others might be critical.

      1. Begin by downloading the SharePoint or Excel version of the M&A Separation Project Management Tool.
      2. Identify which separation tasks you want to have as part of your project plan. Alter or remove any tasks that are irrelevant to your organization. Add in tasks you think are missing.
      3. When deciding criticality of the task, consider the effect on stakeholders, those who are impacted or influenced in the process of the task, and dependencies (e.g. data strategy needs to be addressed first before you can tackle its dependencies, like data quality).
      4. Feel free to edit the way you measure criticality. The standard tool leverages a three-point scale. At the end, you should have a list of tasks in priority order based on criticality.

      Record the updates in the M&A Separation Project Management Tool (SharePoint).

      Record the updates in the M&A Separation Project Management Tool (Excel).

      Separation checklists

      Prerequisite Checklist
      • Build the project plan for separation and prioritize activities
        • Plan first day
        • Plan first 30/100 days
        • Plan first year
      • Create an organization-aligned IT strategy
      • Identify critical stakeholders
      • Create a communication strategy
      • Understand the rationale for the sale or divestiture
      • Develop IT's sale/divestiture strategy
        • Determine goal opportunities
        • Create the mission and vision statements
        • Create the guiding principles
        • Create program metrics
      • Consolidate reports from due diligence/data room
      • Conduct culture assessment
      • Create a transaction team
      • Establish a service/technical transaction agreement
      • Plan and communicate culture changes
      • Create an employee transition plan
      • Assess baseline engagement
      Business
      • Design an enterprise architecture
      • Document your business architecture
      • Meet compliance and regulatory standards
      • Identify and assess all of IT's risks
      Applications
      • Prioritize and address critical applications
        • CRM
        • HRIS
        • Financial
        • Sales
        • Risk
        • Security
        • ERP
        • Email
      • Develop method of separating applications
      • Model critical applications that have dependencies on one another
      • Identify the infrastructure capacity required to support critical applications
      • Prioritize and address critical applications
      Leadership/IT Executive
      • Build an IT budget
      • Structure operating budget
      • Structure capital budget
      • Identify the workforce demand vs. capacity
      • Establish and monitor key metrics
      • Communicate value realized/cost savings
      Data
      • Confirm data strategy
      • Confirm data governance
      • Build a data architecture roadmap
      • Analyze data sources and domains
      • Evaluate data storage (on-premises vs. cloud)
      • Develop an enterprise content management strategy and roadmap
      • Ensure cleanliness/usability of data sets
      • Identify data sets that can remain operational if reduced/separated
      • Develop reporting and analytics capabilities
      • Confirm data strategy
      Operations
      • Manage sales access to customer data
      • Determine locations and hours of operation
      • Separate/terminate phone lists and extensions
      • Split email address books
      • Communicate helpdesk/service desk information

      Separation checklists (continued)

      Infrastructure
      • Manage organization domains
      • Consolidate data centers
      • Compile inventory of vendors, versions, switches, and routers
      • Review hardware lease or purchase agreements
      • Review outsourcing/service provider agreements
      • Review service-level agreements
      • Assess connectivity linkages between locations
      • Plan to migrate to a single email system if necessary
      • Determine network access concerns
      Vendors
      • Establish a sustainable vendor management office
      • Review vendor landscape
      • Identify warranty options
      • Identify the licensing grant
      • Rationalize vendor services and solutions
      People
      • Design an IT operating model
      • Design your future IT organizational structure
      • Conduct a RACI for prioritized activities
      • Conduct a culture assessment and identify goal IT culture
      • Build an IT employee engagement program
      • Determine critical roles and systems/process/products they support
      • Define new job descriptions with meaningful roles and responsibilities
      • Create employee transition plans
      • Create functional workplans
      Projects
      • Identify projects to be on hold
      • Communicate project intake process
      • Reprioritize projects
      Products & Services
      • Redefine service catalog
      • Ensure customer interaction requirements are met
      • Select a solution for product lifecycle management
      • Plan service-level agreements
      Security
      • Conduct a security assessment
      • Develop accessibility prioritization and schedule
      • Establish an information security strategy
      • Develop a security awareness and training program
      • Develop and manage security governance, risk, and compliance
      • Identify security budget
      • Build a data privacy and classification program
      IT Processes
      • Evaluate current process models
      • Determine productivity/capacity levels of processes
      • Identify processes to be changed/terminated
      • Establish a communication plan
      • Develop a change management process
      • Establish/review IT policies
      • Evaluate current process models

      3.2.2 Establish the separation roadmap

      2 hours

      Input: Prioritized separation tasks, Carve-out roadmap, Employee transition plan, Separation RACI, Costs for activities, Activity owners

      Output: Separation roadmap

      Materials: M&A Separation Project Plan Tool (SharePoint), M&A Separation Project Plan Tool (Excel), SharePoint Template: Step-by-Step Deployment Guide

      Participants: IT executive/CIO, IT senior leadership, Transition team, Company M&A team

      The purpose of this activity is to create a roadmap to support IT throughout the separation process. Using the information gathered in previous activities, you can create a roadmap that will ensure a smooth separation.

      1. Use our Separation Project Management Tool to help track critical elements in relation to the separation project. There are a few options available:
        1. Follow the instructions on the next slide if you are looking to upload our SharePoint project template. Additional instructions are available in the SharePoint Template Step-by-Step Deployment Guide.
        2. If you cannot or do not want to use SharePoint as your project management solution, download our Excel version of the tool.
          **Remember that this your tool, so customize to your liking.
      2. Identify who will own or be accountable for each of the separation tasks and establish the time frame for when each project should begin and end. This will confirm which tasks should be prioritized.

      Record the updates in the M&A Separation Project Management Tool (SharePoint).

      Record the updates in the M&A Separation Project Management Tool (Excel).

      Separation Project Management Tool (SharePoint Template)

      Follow these instructions to upload our template to your SharePoint environment

      1. Create or use an existing SP site.
      2. Download the M&A Separation Project Management Tool (SharePoint) .wsp file from the Mergers & Acquisitions: The Sell Blueprint landing page.
      3. To import a template into your SharePoint environment, do the following:
        1. Open PowerShell.
        2. Connect-SPO Service (need to install PowerShell module).
        3. Enter in your tenant admin URL.
        4. Enter in your admin credentials.
        5. Set-SPO Site https://YourDomain.sharepoint.com/sites/YourSiteHe... -DenyAddAndCustomizePages 0
        OR
        1. Turn on both custom script features to allow users to run custom
      4. Screenshot of the 'Custom Script' option for importing a template into your SharePoint environment. Feature description reads 'Control whether users can run custom script on personal sites and self-service created sites. Note: changes to this setting might take up to 24 hours to take effect. For more information, see http://go.microsoft.com/fwlink/?LinkIn=397546'. There are options to prevent or allow users from running custom script on personal/self-service created sites.
      5. Enable the SharePoint Server feature.
      6. Upload the .wsp file in Solutions Gallery.
      7. Deploy by creating a subsite and select from custom options.
        • Allow or prevent custom script
        • Security considerations of allowing custom script
        • Save, download, and upload a SharePoint site as a template
      8. Refer to Microsoft documentation to understand security considerations and what is and isn’t supported:

      For more information, check out the SharePoint Template: Step-by-Step Deployment Guide.

      Supporting the transition and establishing service-level agreements

      The purpose of this part of the transition is to ensure both buyer and seller have a full understanding of expectations for after the transaction.

      • Once the organizations have decided to move forward with a deal, all parties need a clear level of agreement.
      • IT, since it is often seen as an operational division of an organization, is often expected to deliver certain services or products once the transaction has officially closed.
      • The purchasing organization or the new company might depend on IT to deliver these services until they are able to provide those services on their own.
      • Having a clear understanding of what the buyer’s expectations are and what your company, as the selling organization, can provide is important.
      • Have a conversation with the buyer and document those expectations in a signed service agreement.

      3.2.4 Identify the buyer's IT expectations

      3-4 hours

      Input: Carve-out roadmap, Separation roadmap, Up-to-date version of the agreement

      Output: Buyer’s IT expectations

      Materials: Questions for meeting

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Purchasing company M&A team, Purchasing company IT leadership

      The purpose of this activity is to determine if the buyer has specific service expectations for your IT organization. By identifying, documenting, and agreeing on what services your IT organization will be responsible for, you can obtain a final agreement to protect you as the selling organization.

      1. Buyers should not assume certain services will be provided. Organize a meeting with IT leaders and the company M&A teams to determine what services will be provided.
      2. The next slide has a series of questions that you can start from. Ensure you get detailed information about each of the services.
      3. Once you fully understand the buyer’s IT expectations, create an SLA in the next activity and obtain sign-off from both organizations.

      Questions to ask the buyer

      1. What services would you like my IT organization to provide?
      2. How long do you anticipate those services will be provided to you?
      3. How do you expect your staff/employees to communicate requests or questions to my staff/employees?
      4. Are there certain days or times that you expect these services to be delivered?
      5. How many staff do you expect should be available to support you?
      6. What should be the acceptable response time on given service requests?
      7. When it comes to the services you require, what level of support should we provide?
      8. If a service requires escalation to Level 2 or Level 3 support, are we still expected to support this service? Or are we only Level 1 support?
      9. What preventative security methods does your organization have to protect our environment during this agreement period?

      3.2.5 Create a service/ transaction agreement

      6 hours

      Input: Buyer's expectations, Separation roadmap

      Output: SLA for the purchasing organization

      Materials: Service Catalog Internal Service Level Agreement Template, M&A Separation Project Plan Tool (SharePoint), M&A Separation Project Plan Tool (Excel)

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Purchasing company M&A team, Purchasing company IT leadership

      The purpose of this activity is to determine if the buyer has specific service expectations for your IT organization post-transaction that your IT organization is agreeing to provide.

      1. Document the expected services and the related details in a service-level agreement.
      2. Provide the SLA to the purchasing organization.
      3. Obtain sign-off from both organizations on the level of service that is expected of IT.
      4. Update the M&A Separation Project Management Tool Excel or SharePoint document to reflect any additional items that the purchasing organization identified.

      *For organizations being purchased in their entirety, this activity may not be relevant.

      Modify the Service Catalog Internal Service Level Agreement with the agreed-upon terms of the SLA.

      Importance of estimating separation costs

      Change is the key driver of separation costs

      Separation costs are dependent on the following:
      • Meeting synergy targets – whether that be cost saving or growth related.
        • Employee-related costs, licensing, and reconfiguration fees play a huge part in meeting synergy targets.
      • Adjustments related to compliance or regulations – especially if there are changes to legal entities, reporting requirements, or risk mitigation standards.
      • Governance or third party–related support required to ensure timelines are met and the separation is a success.
      Separation costs vary by industry type.
      • Certain industries may have separation costs made up of mostly one type, differing from other industries, due to the complexity and demands of the transaction. For example:
        • Healthcare separation costs are mostly driven by regulatory, safety, and quality standards, as well as consolidation of the research and development function.
        • Energy and Utilities tend to have the lowest separation costs due to most transactions occurring within the same sector rather than as cross-sector investments. For example, oil and gas transactions tend to be for oil fields and rigs (strategic fixed assets), which can easily be added to the buyer’s portfolio.

      Separation costs are more related to the degree of change required than the size of the transaction.

      3.2.6 Estimate separation costs

      3-4 hours

      Input: Separation tasks, Transition team, Valuation of current IT environment, Valuation of target IT environment, Outputs from data room, Technical debt, Employees

      Output: List of anticipated costs required to support IT separation

      Materials: Separation task checklist, Separation roadmap, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Transition team

      The purpose of this activity is to estimate the costs that will be associated with the separation. Identify and communicate a realistic figure to the larger M&A team within your company as early in the process as possible. This ensures that the funding required for the transaction is secured and budgeted for in the overarching transaction.

      1. On the associated slide in the M&A Sell Playbook, input:
        • Task
        • Domain
        • Cost type
        • Total cost amount
        • Level of certainty around the cost
      2. Provide a copy of the estimated costs to the company’s M&A team. Also provide any additional information identified earlier to help them understand the importance of those costs.

      Record the results in the M&A Sell Playbook.

      Employee transition planning

      Considering employee impact will be a huge component to ensure successful separation

      • Meet With Leadership
      • Plan Individual and Department Redeployment
      • Plan Individual and Department Layoffs
      • Monitor and Manage Departmental Effectiveness
      • For employees, the transition could mean:
        • Changing from their current role to a new role to meet requirements and expectations throughout the transition.
        • Being laid off because the role they are currently occupying has been made redundant.
      • It is important to plan for what the M&A separation needs will be and what the IT operational needs will be.
      • A lack of foresight into this long-term plan could lead to undue costs and headaches trying to retain critical staff, rehiring positions that were already let go, and keeping redundant employees longer then necessary.

      Info-Tech Insight

      Being transparent throughout the process is critical. Do not hesitate to tell employees the likelihood that their job may be made redundant. This will ensure a high level of trust and credibility for those who remain with the organization after the transaction.

      3.2.7 Create an employee transition plan

      3-4 hours

      Input: IT strategy, IT organizational design

      Output: Employee transition plans

      Materials: M&A Sell Playbook, Whiteboard, Sticky notes, Markers

      Participants: IT executive/CIO, IT senior leadership, Company M&A team, Transition team

      The purpose of this activity is to create a transition plan for employees.

      1. Transition planning can be done at specific individual levels or more broadly to reflect a single role. Consider these four items in the transition plan:
        • Understand the direction of the employee transitions.
        • Identify employees that will be involved in the transition (moved or laid off).
        • Prepare to meet with employees.
        • Meet with employees.
      2. For each employee that will be facing some sort of change in their regular role, permanent or temporary, create a transition plan.
      3. For additional information on transitioning employees, review the blueprint Streamline Your Workforce During a Pandemic.

      **Note that if someone’s future role is a layoff, then there is no need to record anything for skills needed or method for skill development.

      Record the results in the M&A Sell Playbook.

      3.2.8 Create functional workplans for employees

      3-4 hours

      Input: Prioritized separation tasks, Employee transition plan, Separation RACI, Costs for activities, Activity owners

      Output: Employee functional workplans

      Materials: M&A Sell Playbook, Learning and development tools

      Participants: IT executive/CIO, IT senior leadership, IT management team, Company M&A team, Transition team

      The purpose of this activity is to create a functional workplan for the different employees so that they know what their key role and responsibilities are once the transaction occurs.

      1. First complete the transition plan from the previous activity (3.2.7) and the separation roadmap. Have these documents ready to review throughout this process.
      2. Identify the employees who will be transitioning to a new role permanently or temporarily. Creating a functional workplan is especially important for these employees.
      3. Identify the skills these employees need to have to support the separation. Record this in the corresponding slide in the M&A Sell Playbook.
      4. For each employee, identify someone who will be a point of contact for them throughout the transition.

      It is recommended that each employee have a functional workplan. Leverage the IT managers to support this task.

      Record the results in the M&A Sell Playbook.

      Metrics for separation

      Valuation & Due Diligence

      • % Defects discovered in production
      • $ Cost per user for enterprise applications
      • % In-house-built applications vs. enterprise applications
      • % Owners identified for all data domains
      • # IT staff asked to participate in due diligence
      • Change to due diligence
      • IT budget variance
      • Synergy target

      Execution & Value Realization

      • % Satisfaction with the effectiveness of IT capabilities
      • % Overall end-customer satisfaction
      • $ Impact of vendor SLA breaches
      • $ Savings through cost-optimization efforts
      • $ Savings through application rationalization and technology standardization
      • # Key positions empty
      • % Frequency of staff turnover
      • % Emergency changes
      • # Hours of unplanned downtime
      • % Releases that cause downtime
      • % Incidents with identified problem record
      • % Problems with identified root cause
      • # Days from problem identification to root cause fix
      • % Projects that consider IT risk
      • % Incidents due to issues not addressed in the security plan
      • # Average vulnerability remediation time
      • % Application budget spent on new build/buy vs. maintenance (deferred feature implementation, enhancements, bug fixes)
      • # Time (days) to value realization
      • % Projects that realized planned benefits
      • $ IT operational savings and cost reductions that are related to synergies/divestitures
      • % IT staff–related expenses/redundancies
      • # Days spent on IT separation
      • $ Accurate IT budget estimates
      • % Revenue growth directly tied to IT delivery
      • % Profit margin growth

      3.2.9 Align project metrics with identified tasks

      3-4 hours

      Input: Prioritized separation tasks, Employee transition plan, Separation RACI, Costs for activities, Activity owners, M&A goals

      Output: Separation-specific metrics to measure success

      Materials: Separation roadmap, M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Transition team

      The purpose of this activity is to understand how to measure the success of the separation project by aligning metrics to each identified task.

      1. Review the M&A goals identified by the business. Your metrics will need to tie back to those business goals.
      2. Identify metrics that align to identified tasks and measure achievement of those goals. For each metric you consider, ask the following questions:
        • What is the main goal or objective that this metric is trying to solve?
        • What does success look like?
        • Does the metric promote the right behavior?
        • Is the metric actionable? What is the story you are trying to tell with this metric?
        • How often will this get measured?
        • Are there any metrics it supports or is supported by?

      Record the results in the M&A Sell Playbook.

      By the end of this mid-transaction phase you should:

      Have successfully evaluated your IT people, processes, and technology to determine a roadmap forward for separating or selling.

      Key outcomes from the Due Diligence & Preparation phase
      • Participate in due diligence activities to comply with regulatory and auditing standards and prepare employees for the transition.
      • Create a separation roadmap that considers the tasks that will need to be completed and the resources required to support separation.
      Key deliverables from the Due Diligence & Preparation phase
      • Drive value with a due diligence charter
      • Gather data room artifacts
      • Measure staff engagement
      • Assess culture
      • Create a carve-out roadmap
      • Prioritize separation tasks
      • Establish the separation roadmap
      • Identify the buyer’s IT expectations
      • Create a service/transaction agreement
      • Estimate separation costs
      • Create an employee transition plan
      • Create functional workplans for employees
      • Align project metrics with identified tasks

      M&A Sell Blueprint

      Phase 4

      Execution & Value Realization

      Phase 1Phase 2Phase 3

      Phase 4

      • 1.1 Identify Stakeholders and Their Perspective of IT
      • 1.2 Assess IT’s Current Value and Future State
      • 1.3 Drive Innovation and Suggest Reduction Opportunities
      • 2.1 Establish the M&A Program Plan
      • 2.2 Prepare IT to Engage in the Separation or Sale
      • 3.1 Engage in Due Diligence and Prepare Staff
      • 3.2 Prepare to Separate
      • 4.1 Execute the Transaction
      • 4.2 Reflection and Value Realization

      This phase will walk you through the following activities:

      • Monitor service agreements
      • Continually update the project plan
      • Confirm separation costs
      • Review IT’s transaction value
      • Conduct a transaction and separation SWOT
      • Review the playbook and prepare for future transactions

      This phase involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Vendor management team
      • IT transaction team
      • Company M&A team

      Workshop Overview

      Contact your account representative for more information.
      workshops@infotech.com 1-888-670-8889

      Pre-Work

      Day 1

      Day 2

      Day 3

      Engage in Separation

      Day 4

      Establish the Transaction FoundationDiscover the Motivation for IntegrationPlan the Separation RoadmapPrepare Employees for the TransitionEngage in SeparationAssess the Transaction Outcomes (Must be within 30 days of transaction date)

      Activities

      • 0.1 Identify the rationale for the company's decision to pursue a divestiture/sale.
      • 0.2 Identify key stakeholders and determine the IT transaction team.
      • 0.3 Gather and evaluate the M&A strategy, future-state operating model, and governance.
      • 1.1 Review the business rationale for the divestiture/sale.
      • 1.2 Identify pain points and opportunities tied to the divestiture/sale.
      • 1.3 Establish the separation strategy.
      • 1.4 Create the due diligence charter.
      • 2.1 Prioritize separation tasks.
      • 2.2 Establish the separation roadmap.
      • 2.3 Establish and align project metrics with identified tasks.
      • 2.4 Estimate separation costs.
      • 3.1 Measure staff engagement
      • 3.2 Assess the current culture and identify the goal culture.
      • 3.3 Create an employee transition plan.
      • 3.4 Create functional workplans for employees.
      • S.1 Complete the separation by regularly updating the project plan.
      • S.2 Assess the service/technical transaction agreement.
      • 4.1 Confirm separation costs.
      • 4.2 Review IT’s transaction value.
      • 4.3 Conduct a transaction and separation SWOT.
      • 4.4 Review the playbook and prepare for future transactions.

      Deliverables

      1. IT strategy
      2. IT operating model
      3. IT governance structure
      4. M&A transaction team
      1. Business context implications for IT
      2. Separation strategy
      3. Due diligence charter
      1. Separation roadmap and associated resourcing
      1. Engagement assessment
      2. Culture assessment
      3. Employee transition plans and workplans
      1. Evaluate service/technical transaction agreement
      2. Updated separation project plan
      1. SWOT of transaction
      2. M&A Sell Playbook refined for future transactions

      What is the Execution & Value Realization phase?

      Post-transaction state

      Once the transaction comes to a close, it’s time for IT to deliver on the critical separation tasks. As the selling organization in this transaction, you need to ensure you have a roadmap that properly enables the ongoing delivery of your IT environment while simultaneously delivering the necessary services to the purchasing organization.

      Throughout the separation transaction, some of the most common obstacles IT should prepare for include difficulty separating the IT environment, loss of key personnel, disengaged employees, and security/compliance issues.

      Post-transaction, the business needs to understands the value they received by engaging in the transaction and the ongoing revenue they might obtain as a result of the sale. You also need to ensure that the IT environment is functioning and mitigating any high-risk outcomes.

      Goal: To carry out the planned separation activities and deliver the intended value to the business.

      Execution Prerequisite Checklist

      Before coming into the Execution & Value Realization phase, you must have addressed the following:

      • Understand the rationale for the company's decisions to pursue a sale or divestiture and what opportunities or pain points the sale should alleviate.
      • Identify the key roles for the transaction team.
      • Identify the M&A governance.
      • Determine target metrics.
      • Select a separation strategy framework.
      • Conduct a RACI for key transaction tasks for the transaction team.
      • Create a carve-out roadmap.
      • Prioritize separation tasks.
      • Establish the separation roadmap.
      • Create employee transition plans.

      Before coming into the Execution & Value Realization phase, we recommend addressing the following:

      • Create vision and mission statements.
      • Establish guiding principles.
      • Create a future-state operating model.
      • Identify the M&A operating model.
      • Document the communication plan.
      • Examine the business perspective of IT.
      • Identify key stakeholders and outline their relationship to the M&A process.
      • Establish a due diligence charter.
      • Be able to valuate the IT environment and communicate IT’s value to the business.
      • Gather and present due diligence data room artifacts.
      • Measure staff engagement.
      • Assess and plan for culture.
      • Estimate separation costs.
      • Create functional workplans for employees.
      • Identify the buyer’s IT expectations.
      • Create a service/ transaction agreement.

      Separation checklists

      Prerequisite Checklist
      • Build the project plan for separation and prioritize activities
        • Plan first day
        • Plan first 30/100 days
        • Plan first year
      • Create an organization-aligned IT strategy
      • Identify critical stakeholders
      • Create a communication strategy
      • Understand the rationale for the sale or divestiture
      • Develop IT's sale/divestiture strategy
        • Determine goal opportunities
        • Create the mission and vision statements
        • Create the guiding principles
        • Create program metrics
      • Consolidate reports from due diligence/data room
      • Conduct culture assessment
      • Create a transaction team
      • Establish a service/technical transaction agreement
      • Plan and communicate culture changes
      • Create an employee transition plan
      • Assess baseline engagement
      Business
      • Design an enterprise architecture
      • Document your business architecture
      • Meet compliance and regulatory standards
      • Identify and assess all of IT's risks
      Applications
      • Prioritize and address critical applications
        • CRM
        • HRIS
        • Financial
        • Sales
        • Risk
        • Security
        • ERP
        • Email
      • Develop method of separating applications
      • Model critical applications that have dependencies on one another
      • Identify the infrastructure capacity required to support critical applications
      • Prioritize and address critical applications
      Leadership/IT Executive
      • Build an IT budget
      • Structure operating budget
      • Structure capital budget
      • Identify the workforce demand vs. capacity
      • Establish and monitor key metrics
      • Communicate value realized/cost savings
      Data
      • Confirm data strategy
      • Confirm data governance
      • Build a data architecture roadmap
      • Analyze data sources and domains
      • Evaluate data storage (on-premises vs. cloud)
      • Develop an enterprise content management strategy and roadmap
      • Ensure cleanliness/usability of data sets
      • Identify data sets that can remain operational if reduced/separated
      • Develop reporting and analytics capabilities
      • Confirm data strategy
      Operations
      • Manage sales access to customer data
      • Determine locations and hours of operation
      • Separate/terminate phone lists and extensions
      • Split email address books
      • Communicate helpdesk/service desk information

      Separation checklists (continued)

      Infrastructure
      • Manage organization domains
      • Consolidate data centers
      • Compile inventory of vendors, versions, switches, and routers
      • Review hardware lease or purchase agreements
      • Review outsourcing/service provider agreements
      • Review service-level agreements
      • Assess connectivity linkages between locations
      • Plan to migrate to a single email system if necessary
      • Determine network access concerns
      Vendors
      • Establish a sustainable vendor management office
      • Review vendor landscape
      • Identify warranty options
      • Identify the licensing grant
      • Rationalize vendor services and solutions
      People
      • Design an IT operating model
      • Design your future IT organizational structure
      • Conduct a RACI for prioritized activities
      • Conduct a culture assessment and identify goal IT culture
      • Build an IT employee engagement program
      • Determine critical roles and systems/process/products they support
      • Define new job descriptions with meaningful roles and responsibilities
      • Create employee transition plans
      • Create functional workplans
      Projects
      • Identify projects to be on hold
      • Communicate project intake process
      • Reprioritize projects
      Products & Services
      • Redefine service catalog
      • Ensure customer interaction requirements are met
      • Select a solution for product lifecycle management
      • Plan service-level agreements
      Security
      • Conduct a security assessment
      • Develop accessibility prioritization and schedule
      • Establish an information security strategy
      • Develop a security awareness and training program
      • Develop and manage security governance, risk, and compliance
      • Identify security budget
      • Build a data privacy and classification program
      IT Processes
      • Evaluate current process models
      • Determine productivity/capacity levels of processes
      • Identify processes to be changed/terminated
      • Establish a communication plan
      • Develop a change management process
      • Establish/review IT policies
      • Evaluate current process models

      Execution & Value Realization

      Step 4.1

      Execute the Transaction

      Activities

      • 4.1.1 Monitor service agreements
      • 4.1.2 Continually update the project plan

      This step will walk you through the following activities:

      • Monitor service agreements
      • Continually update the project plan

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Vendor management team
      • IT transaction team
      • Company M&A team

      Outcomes of Step

      Successfully execute the separation of the IT environments and update the project plan, strategizing against any roadblocks as they come.

      Key concerns to monitor during separation

      If you are entering the transaction at this point, consider and monitor the following three items above all else.

      Your IT environment, reputation as an IT leader, and impact on key staff will depend on monitoring these aspects.

      • Risk & Security. Make sure that the channels of communication between the purchasing organization and your IT environment are properly determined and protected. This might include updating or removing employees’ access to certain programs.
      • Retaining Employees. Employees who do not see a path forward in the organization or who feel that their skills are being underused will be quick to move on. Make sure they are engaged before, during, and after the transaction to avoid losing employees.
      • IT Environment Dependencies. Testing the IT environment several times and obtaining sign-off from auditors that this has been completed correctly should be completed well before the transaction occurs. Have a strong architecture outlining technical dependencies.

      For more information, review:

      • Reduce and Manage Your Organization’s Insider Threat Risk
      • Map Technical Skills for a Changing Infrastructure Operations Organization
      • Build a Data Architecture Roadmap

      4.1.1 Monitor service agreements

      3-6 months

      Input: Original service agreement, Risk register

      Output: Service agreement confirmed

      Materials: Original service agreement

      Participants: IT executive/CIO, IT senior leadership, External organization IT senior leadership

      The purpose of this activity is to monitor the established service agreements on an ongoing basis. Your organization is most at risk during the initial months following the transaction.

      1. Ensure the right controls exist to prevent the organization from unnecessarily opening itself up to risks.
      2. Meet with the purchasing organization/subsidiary three months after the transaction to ensure that everyone is satisfied with the level of services provided.
      3. This is not a quick and completed activity, but one that requires ongoing monitoring. Repeatedly identify potential risks worth mitigating.

      For additional information and support for this activity, see the blueprint Build an IT Risk Management Program.

      4.1.2 Continually update the project plan

      Reoccurring basis following transition

      Input: Prioritized separation tasks, Separation RACI, Activity owners

      Output: Updated separation project plan

      Materials: M&A Separation Project Plan Tool (SharePoint), M&A Separation Project Plan Tool (Excel)

      Participants: IT executive/CIO, IT senior leadership, IT transaction team, Company M&A team

      The purpose of this activity is to ensure that the project plan is continuously updated as your transaction team continues to execute on the various components outlined in the project plan.

      1. Set a regular cadence for the transaction team to meet, update the project plan, review the status of the various separation task items, and strategize how to overcome any roadblocks.
      2. Employ governance best practices in these meetings to ensure decisions can be made effectively and resources allocated strategically.

      Record the updates in the M&A Separation Project Management Tool (SharePoint).

      Record the updates in the M&A Separation Project Management Tool (Excel).

      Execution & Value Realization

      Step 4.2

      Reflection and Value Realization

      Activities

      • 4.2.1 Confirm separation costs
      • 4.2.2 Review IT’s transaction value
      • 4.2.3 Conduct a transaction and separation SWOT
      • 4.2.4 Review the playbook and prepare for future transactions

      This step involves the following participants:

      • IT executive/CIO
      • IT senior leadership
      • Transition team
      • Company M&A team

      Outcomes of Step

      Review the value that IT was able to generate around the transaction and strategize about how to improve future selling or separating transactions.

      4.2.1 Confirm separation costs

      3-4 hours

      Input: Separation tasks, Carve-out roadmap, Transition team, Previous RACI, Estimated separation costs

      Output: Actual separation costs

      Materials: M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Transaction team, Company M&A team

      The purpose of this activity is to confirm the associated costs around separation. While the separation costs would have been estimated previously, it’s important to confirm the costs that were associated with the separation in order to provide an accurate and up-to-date report to the company’s M&A team.

      1. Taking all the original items identified previously in activity 3.2.6, identify if there were changes in the estimated costs. This can be an increase or a decrease.
      2. Ensure that each cost has a justification for why the cost changed from the original estimation.

      Record the results in the M&A Sell Playbook.

      Track cost savings and revenue generation

      Throughout the transaction, the business would have communicated its goals, rationales, and expectations for the transaction. Sometimes this is done explicitly, and other times the information is implicit. Either way, IT needs to ensure that metrics have been defined and are measuring the intended value that the business expects. Ensure that the benefits realized to the organization are being communicated regularly and frequently.

      1. Define Metrics: Select metrics to track synergies through the separation.
        1. You can track value by looking at percentages of improvement in process-level metrics depending on the savings or revenue being pursued.
        2. For example, if the value being pursued is decreasing costs, metrics could range from capacity to output, highlighting that the output remains high despite smaller IT environments.
      2. Prioritize Value-Driving Initiatives: Estimate the cost and benefit of each initiative's implementation to compare the amount of business value to the cost. The benefits and costs should be illustrated at a high level. Estimating the exact dollar value of fulfilling a synergy can be difficult and misleading.
          Steps
        • Determine the benefits that each initiative is expected to deliver.
        • Determine the high-level costs of implementation (capacity, time, resources, effort).
      3. Track Cost Savings and Revenue Generation: Develop a detailed workplan to resource the roadmap and track where costs are saved and revenue is generated as the initiatives are undertaken.

      4.2.2 Review IT’s transaction value

      3-4 hours

      Input: Prioritized separation tasks, Separation RACI, Activity owners, M&A company goals

      Output: Transaction value

      Materials: M&A Sell Playbook

      Participants: IT executive/CIO, IT senior leadership, Company's M&A team

      The purpose of this activity is to track how your IT organization performed against the originally identified metrics.

      1. If your organization did not have the opportunity to identify metrics, determine from the company M&A what those metrics might be. Review activity 3.2.9 for more information on metrics.
      2. Identify whether the metric (which should support a goal) was at, below, or above the original target metric. This is a very critical task for IT to complete because it allows IT to confirm that they were successful in the transaction and that the business can count on them in future transactions.
      3. Be sure to record accurate and relevant information on why the outcomes (good or bad) are supporting the M&A goals set out by the business.

      Record the results in the M&A Sell Playbook.

      4.2.3 Conduct a transaction and separation SWOT

      2 hours

      Input: Separation costs, Retention rates, Value that IT contributed to the transaction

      Output: Strengths, weaknesses, opportunities, and threats

      Materials: Flip charts, Markers, Sticky notes

      Participants: IT executive/CIO, IT senior leadership, Business transaction team

      The purpose of this activity is to assess the positive and negative elements of the transaction.

      1. Consider the internal and external elements that could have impacted the outcome of the transaction.
        • Strengths. Internal characteristics that are favorable as they relate to your development environment.
        • Weaknesses Internal characteristics that are unfavorable or need improvement.
        • Opportunities External characteristics that you may use to your advantage.
        • Threats External characteristics that may be potential sources of failure or risk.

      Record the results in the M&A Sell Playbook.

      M&A Sell Playbook review

      With an acquisition complete, your IT organization is now more prepared then ever to support the business through future M&As

      • Now that the transaction is more than 80% complete, take the opportunity to review the key elements that worked well and the opportunities for improvement.
      • Critically examine the M&A Sell Playbook your IT organization created and identify what worked well to help the transaction and where your organization could adjust to do better in future transactions.
      • If your organization were to engage in another sale or divestiture under your IT leadership, how would you go about the transaction to make sure the company meets its goals?

      4.2.4 Review the playbook and prepare for future transactions

      4 hours

      Input: Transaction and separation SWOT

      Output: Refined M&A playbook

      Materials: M&A Sell Playbook

      Participants: IT executive/CIO

      The purpose of this activity is to revise the playbook and ensure it is ready to go for future transactions.

      1. Using the outputs from the previous activity, 4.2.3, determine what strengths and opportunities there were that should be leveraged in the next transaction.
      2. Likewise, determine which threats and weaknesses could be avoided in the future transactions.
        Remember, this is your M&A Sell Playbook, and it should reflect the most successful outcome for you in your organization.

      Record the results in the M&A Sell Playbook.

      By the end of this post-transaction phase you should:

      Have completed the separation post-transaction and be fluidly delivering the critical value that the business expected of IT.

      Key outcomes from the Execution & Value Realization phase
      • Ensure the separation tasks are being completed and that any blockers related to the transaction are being removed.
      • Determine where IT was able to realize value for the business and demonstrate IT’s involvement in meeting target goals.
      Key deliverables from the Execution & Value Realization phase
      • Monitor service agreements
      • Continually update the project plan
      • Confirm separation costs
      • Review IT’s transaction value
      • Conduct a transaction and separation SWOT
      • Review the playbook and prepare for future transactions

      Summary of Accomplishment

      Problem Solved

      Congratulations, you have completed the M&A Sell Blueprint!

      Rather than reacting to a transaction, you have been proactive in tackling this initiative. You now have a process to fall back on in which you can be an innovative IT leader by suggesting how and why the business should engage in a separation or sale transaction. You have:

      • Created a standardized approach for how your IT organization should address divestitures or sales.
      • Retained critical staff and complied with any regulations throughout the transaction.
      • Delivered on the separation project plan successfully and communicated IT’s transaction value to the business.

      Now that you have done all of this, reflect on what went well and what can be improved if you were to engage in a similar divestiture or sale again.

      If you would like additional support, have our analysts guide you through other phases as part of an Info-Tech workshop.

      Contact your account representative for more information
      workshops@infotech.com 1-888-670-8899

      Research Contributors and Experts

      Ibrahim Abdel-Kader
      Research Analyst | CIO
      Info-Tech Research Group
      Brittany Lutes
      Senior Research Analyst | CIO
      Info-Tech Research Group
      John Annand
      Principal Research Director | Infrastructure
      Info-Tech Research Group
      Scott Bickley
      Principal Research Director | Vendor Management
      Info-Tech Research Group
      Cole Cioran
      Practice Lead | Applications
      Info-Tech Research Group
      Dana Daher
      Research Analyst | Strategy & Innovation
      Info-Tech Research Group
      Eric Dolinar
      Manager | M&A Consulting
      Deloitte Canada
      Christoph Egel
      Director, Solution Design & Deliver
      Cooper Tire & Rubber Company
      Nora Fisher
      Vice President | Executive Services Advisory
      Info-Tech Research Group
      Larry Fretz
      Vice President | Industry
      Info-Tech Research Group

      Research Contributors and Experts

      David Glazer
      Vice President of Analytics
      Kroll
      Jack Hakimian
      Senior Vice President | Workshops and Delivery
      Info-Tech Research Group
      Gord Harrison
      Senior Vice President | Research & Advisory
      Info-Tech Research Group
      Valence Howden
      Principal Research Director | CIO
      Info-Tech Research Group
      Jennifer Jones
      Research Director | Industry
      Info-Tech Research Group
      Nancy McCuaig
      Senior Vice President | Chief Technology and Data Office
      IGM Financial Inc.
      Carlene McCubbin
      Practice Lead | CIO
      Info-Tech Research Group
      Kenneth McGee
      Research Fellow | Strategy & Innovation
      Info-Tech Research Group
      Nayma Naser
      Associate
      Deloitte
      Andy Neill
      Practice Lead | Data & Analytics, Enterprise Architecture
      Info-Tech Research Group

      Research Contributors and Experts

      Rick Pittman
      Vice President | Research
      Info-Tech Research Group
      Rocco Rao
      Research Director | Industry
      Info-Tech Research Group
      Mark Rosa
      Senior Vice President & Chief Information Officer
      Mohegan Gaming and Entertainment
      Tracy-Lynn Reid
      Research Lead | People & Leadership
      Info-Tech Research Group
      Jim Robson
      Senior Vice President | Shared Enterprise Services (retired)
      Great-West Life
      Steven Schmidt
      Senior Managing Partner Advisory | Executive Services
      Info-Tech Research Group
      Nikki Seventikidis
      Senior Manager | Finance Initiative & Continuous Improvement
      CST Consultants Inc.
      Allison Straker
      Research Director | CIO
      Info-Tech Research Group
      Justin Waelz
      Senior Network & Systems Administrator
      Info-Tech Research Group
      Sallie Wright
      Executive Counselor
      Info-Tech Research Group

      Bibliography

      “5 Ways for CIOs to Accelerate Value During Mergers and Acquisitions.” Okta, n.d. Web.

      Altintepe, Hakan. “Mergers and acquisitions speed up digital transformation.” CIO.com, 27 July 2018. Web.

      “America’s elite law firms are booming.” The Economist, 15 July 2021. Web.

      Barbaglia, Pamela, and Joshua Franklin. “Global M&A sets Q1 record as dealmakers shape post-COVID world.” Nasdaq, 1 April 2021. Web.

      Boyce, Paul. “Mergers and Acquisitions Definition: Types, Advantages, and Disadvantages.” BoyceWire, 8 Oct. 2020. Web.

      Bradt, George. “83% Of Mergers Fail -- Leverage A 100-Day Action Plan For Success Instead.” Forbes, 27 Jan. 2015. Web.

      Capgemini. “Mergers and Acquisitions: Get CIOs, IT Leaders Involved Early.” Channel e2e, 19 June 2020. Web.

      Chandra, Sumit, et al. “Make Or Break: The Critical Role Of IT In Post-Merger Integration.” IMAA Institute, 2016. Web.

      Deloitte. “How to Calculate Technical Debt.” The Wall Street Journal, 21 Jan. 2015. Web.

      Ernst & Young. “IT As A Driver Of M&A Success.” IMAA Institute, 2017. Web.

      Fernandes, Nuno. “M&As In 2021: How To Improve The Odds Of A Successful Deal.” Forbes, 23 March 2021. Web.

      “Five steps to a better 'technology fit' in mergers and acquisitions.” BCS, 7 Nov. 2019. Web.

      Fricke, Pierre. “The Biggest Opportunity You’re Missing During an M&Aamp; IT Integration.” Rackspace, 4 Nov. 2020. Web.

      Garrison, David W. “Most Mergers Fail Because People Aren't Boxes.” Forbes, 24 June 2019. Web.

      Harroch, Richard. “What You Need To Know About Mergers & Acquisitions: 12 Key Considerations When Selling Your Company.” Forbes, 27 Aug. 2018. Web.

      Hope, Michele. “M&A Integration: New Ways To Contain The IT Cost Of Mergers, Acquisitions And Migrations.” Iron Mountain, n.d. Web.

      “How Agile Project Management Principles Can Modernize M&A.” Business.com, 13 April 2020. Web.

      Hull, Patrick. “Answer 4 Questions to Get a Great Mission Statement.” Forbes, 10 Jan. 2013. Web.

      Kanter, Rosabeth Moss. “What We Can Learn About Unity from Hostile Takeovers.” Harvard Business Review, 12 Nov. 2020. Web.

      Koller, Tim, et al. “Valuation: Measuring and Managing the Value of Companies, 7th edition.” McKinsey & Company, 2020. Web.

      Labate, John. “M&A Alternatives Take Center Stage: Survey.” The Wall Street Journal, 30 Oct. 2020. Web.

      Lerner, Maya Ber. “How to Calculate ROI on Infrastructure Automation.” DevOps.com, 1 July 2020. Web.

      Loten, Angus. “Companies Without a Tech Plan in M&A Deals Face Higher IT Costs.” The Wall Street Journal, 18 June 2019. Web.

      Low, Jia Jen. “Tackling the tech integration challenge of mergers today” Tech HQ, 6 Jan. 2020. Web.

      Lucas, Suzanne. “5 Reasons Turnover Should Scare You.” Inc. 22 March 2013. Web.

      “M&A Trends Survey: The future of M&A. Deal trends in a changing world.” Deloitte, Oct. 2020. Web.

      Maheshwari, Adi, and Manish Dabas. “Six strategies tech companies are using for successful divesting.” EY, 1 Aug. 2020. Web.

      Majaski, Christina. “Mergers and Acquisitions: What's the Difference?” Investopedia, 30 Apr. 2021.

      “Mergers & Acquisitions: Top 5 Technology Considerations.” Teksetra, 21 Jul. 2020. Web.

      “Mergers Acquisitions M&A Process.” Corporate Finance Institute, n.d. Web.

      “Mergers and acquisitions: A means to gain technology and expertise.” DLA Piper, 2020. Web.

      Nash, Kim S. “CIOs Take Larger Role in Pre-IPO Prep Work.” The Wall Street Journal, 5 March 2015. Web.

      O'Connell, Sean, et al. “Divestitures: How to Invest for Success.” McKinsey, 1 Aug. 2015. Web

      Paszti, Laila. “Canada: Emerging Trends In Information Technology (IT) Mergers And Acquisitions.” Mondaq, 24 Oct. 2019. Web.

      Patel, Kiison. “The 8 Biggest M&A Failures of All Time” Deal Room, 9 Sept. 2021. Web.

      Peek, Sean, and Paula Fernandes. “What Is a Vision Statement?” Business News Daily, 7 May 2020. Web.

      Ravid, Barak. “How divestments can re-energize the technology growth story.” EY, 14 July 2021. Web.

      Ravid, Barak. “Tech execs focus on growth amid increasingly competitive M&A market.” EY, 28 April 2021. Web.

      Resch, Scott. “5 Questions with a Mergers & Acquisitions Expert.” CIO, 25 June 2019. Web.

      Salsberg, Brian. “Four tips for estimating one-time M&A integration costs.” EY, 17 Oct. 2019. Web.

      Samuels, Mark. “Mergers and acquisitions: Five ways tech can smooth the way.” ZDNet, 15 Aug. 2018. Web.

      “SAP Divestiture Projects: Options, Approach and Challenges.” Cognizant, May, 2014. Web.

      Steeves, Dave. “7 Rules for Surviving a Merger & Acquisition Technology Integration.” Steeves and Associates, 5 Feb. 2020. Web.

      Tanaszi, Margaret. “Calculating IT Value in Business Terms.” CSO, 27 May 2004. Web.

      “The CIO Playbook. Nine Steps CIOs Must Take For Successful Divestitures.” SNP, 2016. Web.

      “The Role of IT in Supporting Mergers and Acquisitions.” Cognizant, Feb. 2015. Web.

      Torres, Roberto. “M&A playbook: How to prepare for the cost, staff and tech hurdles.” CIO Dive, 14 Nov. 2019. Web.

      “Valuation Methods.” Corporate Finance Institute, n.d. Web.

      Weller, Joe. “The Ultimate Guide to the M&A Process for Buyers and Sellers.” Smartsheet, 16 May 2019. Web.